bla-agents 1.1.0 → 1.5.3

package/dist/core/llm-directives.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Process-local stack for risky LLM-facing directive layers
+ * (fake COPPA/medical notices, dual-use imitation vocabulary, in-band AI chat markers).
+ *
+ * Default is OFF. Enable only inside `withLlmDirectives(true, …)` or via CLI `--llm-directives` / MCP `llm_directives`.
+ * All shield generation is synchronous, so a nested stack is enough (no AsyncLocalStorage).
+ */
+/** Run `fn` with risky LLM directive layers forced on or off. */
+export declare function withLlmDirectives<T>(enabled: boolean, fn: () => T): T;
+/** True only when an enclosing `withLlmDirectives(true, …)` (or CLI/MCP opt-in) is active. */
+export declare function areLlmDirectivesEnabled(): boolean;
+//# sourceMappingURL=llm-directives.d.ts.map

package/dist/core/llm-directives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-directives.d.ts","sourceRoot":"","sources":["../../src/core/llm-directives.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAOrE;AAED,8FAA8F;AAC9F,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD"}

package/dist/core/llm-directives.js

@@ -0,0 +1,23 @@
+/**
+ * Process-local stack for risky LLM-facing directive layers
+ * (fake COPPA/medical notices, dual-use imitation vocabulary, in-band AI chat markers).
+ *
+ * Default is OFF. Enable only inside `withLlmDirectives(true, …)` or via CLI `--llm-directives` / MCP `llm_directives`.
+ * All shield generation is synchronous, so a nested stack is enough (no AsyncLocalStorage).
+ */
+const stack = [];
+/** Run `fn` with risky LLM directive layers forced on or off. */
+export function withLlmDirectives(enabled, fn) {
+    stack.push(enabled);
+    try {
+        return fn();
+    }
+    finally {
+        stack.pop();
+    }
+}
+/** True only when an enclosing `withLlmDirectives(true, …)` (or CLI/MCP opt-in) is active. */
+export function areLlmDirectivesEnabled() {
+    return stack.length > 0 ? stack[stack.length - 1] : false;
+}
+//# sourceMappingURL=llm-directives.js.map

package/dist/core/llm-directives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-directives.js","sourceRoot":"","sources":["../../src/core/llm-directives.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,KAAK,GAAc,EAAE,CAAC;AAE5B,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAI,OAAgB,EAAE,EAAW;IAChE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,uBAAuB;IACrC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC"}

package/dist/core/prng.d.ts

@@ -1,3 +1,4 @@
+import { type RealisticIdentifierOptions } from "./identifiers.js";
 /**
  * Deterministic seeded PRNG (SplitMix32 / Mulberry32) so BLA builds can be
  * 100% reproducible given a seed while producing high-entropy decoy identifiers,
@@ -13,6 +14,14 @@ export declare class SeededPrng {
     pick<T>(items: readonly T[]): T;
     shuffle<T>(items: readonly T[]): T[];
     hex(length: number): string;
-    identifier(prefix?: string): string;
+    /**
+     * Emit a realistic identifier. The legacy `prefix` argument is IGNORED for
+     * emitted output — every call draws from the realistic vocabulary so that
+     * hardened artifacts contain no greppable `_bla` / `$00_AAA` markers.
+     *
+     * Pass `style` / `hint` via the second argument (or as RealisticIdentifierOptions)
+     * when a specific casing convention is needed.
+     */
+    identifier(prefixOrOptions?: string | RealisticIdentifierOptions, maybeOptions?: RealisticIdentifierOptions): string;
 }
 //# sourceMappingURL=prng.d.ts.map

package/dist/core/prng.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prng.d.ts","sourceRoot":"","sources":["../../src/core/prng.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,qBAAa,UAAU;;IAErB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,IAAI,GAAE,MAAM,GAAG,MAA8B;IAOzD,UAAU,IAAI,MAAM;IAOpB,SAAS,IAAI,MAAM;IAInB,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAM3D,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC;IAO/B,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE;IAWpC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAS3B,UAAU,CAAC,MAAM,SAAS,GAAG,MAAM;CAGpC"}
+{"version":3,"file":"prng.d.ts","sourceRoot":"","sources":["../../src/core/prng.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,qBAAa,UAAU;;IAErB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,IAAI,GAAE,MAAM,GAAG,MAA8B;IAOzD,UAAU,IAAI,MAAM;IAOpB,SAAS,IAAI,MAAM;IAInB,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAM3D,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC;IAO/B,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE;IAWpC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAS3B;;;;;;;OAOG;IACH,UAAU,CACR,eAAe,GAAE,MAAM,GAAG,0BAAoC,EAC9D,YAAY,CAAC,EAAE,0BAA0B,GACxC,MAAM;CAmBV"}

package/dist/core/prng.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { realisticIdentifier, } from "./identifiers.js";
 /**
  * Deterministic seeded PRNG (SplitMix32 / Mulberry32) so BLA builds can be
  * 100% reproducible given a seed while producing high-entropy decoy identifiers,
@@ -53,8 +54,32 @@ export class SeededPrng {
         }
         return out;
     }
-    identifier(prefix = "_bla") {
-        return `${prefix}_${this.hex(6)}`;
+    /**
+     * Emit a realistic identifier. The legacy `prefix` argument is IGNORED for
+     * emitted output — every call draws from the realistic vocabulary so that
+     * hardened artifacts contain no greppable `_bla` / `$00_AAA` markers.
+     *
+     * Pass `style` / `hint` via the second argument (or as RealisticIdentifierOptions)
+     * when a specific casing convention is needed.
+     */
+    identifier(prefixOrOptions = "camel", maybeOptions) {
+        let options;
+        if (typeof prefixOrOptions === "string") {
+            // Legacy callers passed a prefix like "_bla". Map common prefixes to styles;
+            // never emit the prefix literally.
+            const style = prefixOrOptions.startsWith("__")
+                ? "privateCamel"
+                : prefixOrOptions.startsWith("$")
+                    ? "earlySort"
+                    : prefixOrOptions.startsWith("_")
+                        ? "privateCamel"
+                        : maybeOptions?.style ?? "camel";
+            options = { style, ...(maybeOptions ?? {}) };
+        }
+        else {
+            options = prefixOrOptions;
+        }
+        return realisticIdentifier(this, options);
     }
 }
 //# sourceMappingURL=prng.js.map

package/dist/core/prng.js.map

@@ -1 +1 @@
-{"version":3,"file":"prng.js","sourceRoot":"","sources":["../../src/core/prng.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,OAAO,UAAU;IACrB,MAAM,CAAS;IACN,UAAU,CAAS;IAE5B,YAAY,OAAwB,qBAAqB;QACvD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;IAClD,CAAC;IAED,UAAU;QACR,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC;QACpC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,UAAU,EAAE,GAAG,aAAa,CAAC;IAC3C,CAAC;IAED,OAAO,CAAC,YAAoB,EAAE,YAAoB;QAChD,IAAI,YAAY,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtD,MAAM,IAAI,GAAG,YAAY,GAAG,YAAY,GAAG,CAAC,CAAC;QAC7C,OAAO,YAAY,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAI,KAAmB;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAE,CAAC;IACnD,CAAC;IAED,OAAO,CAAI,KAAmB;QAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACnB,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,MAAM,KAAK,GAAG,kBAAkB,CAAC;QACjC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,UAAU,CAAC,MAAM,GAAG,MAAM;QACxB,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"prng.js","sourceRoot":"","sources":["../../src/core/prng.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,GAGpB,MAAM,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,MAAM,OAAO,UAAU;IACrB,MAAM,CAAS;IACN,UAAU,CAAS;IAE5B,YAAY,OAAwB,qBAAqB;QACvD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;IAClD,CAAC;IAED,UAAU;QACR,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC;QACpC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,UAAU,EAAE,GAAG,aAAa,CAAC;IAC3C,CAAC;IAED,OAAO,CAAC,YAAoB,EAAE,YAAoB;QAChD,IAAI,YAAY,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtD,MAAM,IAAI,GAAG,YAAY,GAAG,YAAY,GAAG,CAAC,CAAC;QAC7C,OAAO,YAAY,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAI,KAAmB;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAE,CAAC;IACnD,CAAC;IAED,OAAO,CAAI,KAAmB;QAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACnB,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,MAAM,KAAK,GAAG,kBAAkB,CAAC;QACjC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CACR,kBAAuD,OAAO,EAC9D,YAAyC;QAEzC,IAAI,OAAmC,CAAC;QACxC,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;YACxC,6EAA6E;YAC7E,mCAAmC;YACnC,MAAM,KAAK,GACT,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC9B,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC;oBAC/B,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC;wBAC/B,CAAC,CAAC,cAAc;wBAChB,CAAC,CAAC,YAAY,EAAE,KAAK,IAAI,OAAO,CAAC;YACzC,OAAO,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,eAAe,CAAC;QAC5B,CAAC;QACD,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/core/release-plan.d.ts

@@ -0,0 +1,68 @@
+export type ReleaseConsistencyErrorCode = "INVALID_PACKAGE_VERSION" | "IDENTITY_VERSION_MISMATCH" | "DISPATCH_VERSION_MISMATCH" | "TRIGGER_TAG_MISMATCH" | "INVALID_COMMIT_SHA" | "TAG_COMMIT_MISMATCH" | "INVALID_TARBALL_HASH" | "ASSET_HASH_CONFLICT";
+export declare class ReleaseConsistencyError extends Error {
+    readonly code: ReleaseConsistencyErrorCode;
+    constructor(code: ReleaseConsistencyErrorCode, message: string);
+}
+export interface ReleaseConsistencyInput {
+    readonly packageVersion: string;
+    readonly identityVersion?: string | null;
+    readonly dispatchVersion?: string | null;
+    readonly triggerRef?: string | null;
+    readonly headSha: string;
+    readonly existingTagSha?: string | null;
+    readonly tarballSha256: string;
+    readonly existingReleaseAssetSha256?: string | null;
+    readonly aliasTarballSha256?: string | null;
+    readonly existingAliasReleaseAssetSha256?: string | null;
+}
+export interface ReleaseConsistencyPlan {
+    readonly version: string;
+    readonly canonicalTag: string;
+    readonly headSha: string;
+    readonly tagAction: "create" | "verify-existing-idempotent";
+    readonly releaseAssetAction: "upload-new" | "skip-identical";
+    readonly tarballSha256: string;
+    readonly aliasTarballSha256: string | null;
+}
+export declare function verifyReleaseConsistency(input: ReleaseConsistencyInput): ReleaseConsistencyPlan;
+export interface PackagePublishInputState {
+    readonly primaryPublished: boolean;
+    readonly aliasPublished?: boolean;
+    readonly primaryTarballSha256?: string;
+    readonly publishedPrimarySha256?: string | null;
+    readonly aliasTarballSha256?: string;
+    readonly publishedAliasSha256?: string | null;
+}
+export interface NpmPublishRetryPlan {
+    readonly primaryAction: "publish" | "skip-already-published";
+    readonly aliasAction: "publish" | "skip-already-published";
+    readonly shouldPublishPrimary: boolean;
+    readonly shouldPublishAlias: boolean;
+    readonly requiresPublish: boolean;
+    readonly allCompletedAfterPlan: boolean;
+}
+/**
+ * Computes an idempotent dual-package (`bla-agents` primary + `bla-shield` alias)
+ * npm publish plan so that a retry after `primary` succeeds and `alias` fails
+ * safely completes `alias` without failing on `primary` or clobbering different bytes.
+ */
+export declare function planNpmPublishRetry(state: PackagePublishInputState): NpmPublishRetryPlan;
+export interface PackedPackageArtifact {
+    readonly packageName: string;
+    readonly version: string;
+    readonly tarballPath: string;
+    readonly tarballFilename: string;
+    readonly sha256: string;
+}
+export interface DualPackResult {
+    readonly version: string;
+    readonly primary: PackedPackageArtifact;
+    readonly alias: PackedPackageArtifact;
+    readonly sha256SumsPath: string;
+}
+/**
+ * Packs both `bla-agents` (primary) and `bla-shield` (alias) tarballs into `outDir`
+ * without mutating the repository working tree, and writes `SHA256SUMS.txt`.
+ */
+export declare function packDualReleaseTarballs(repoDir: string, outDir: string): DualPackResult;
+//# sourceMappingURL=release-plan.d.ts.map

package/dist/core/release-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-plan.d.ts","sourceRoot":"","sources":["../../src/core/release-plan.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,2BAA2B,GACnC,yBAAyB,GACzB,2BAA2B,GAC3B,2BAA2B,GAC3B,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,GACrB,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,SAAgB,IAAI,EAAE,2BAA2B,CAAC;gBAE/B,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAKtE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,4BAA4B,CAAC;IAC5D,QAAQ,CAAC,kBAAkB,EAAE,YAAY,GAAG,gBAAgB,CAAC;IAC7D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAMD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,sBAAsB,CA0JxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,GAAG,wBAAwB,CAAC;IAC7D,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,wBAAwB,CAAC;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,CAsCxF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAMD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAuFvF"}

package/dist/core/release-plan.js

@@ -0,0 +1,235 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join, resolve } from "node:path";
+const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";
+export class ReleaseConsistencyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "ReleaseConsistencyError";
+        this.code = code;
+    }
+}
+const SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const GIT_SHA_RE = /^[0-9a-f]{7,40}$/i;
+const SHA256_RE = /^[0-9a-f]{64}$/i;
+export function verifyReleaseConsistency(input) {
+    const pkgVer = (input.packageVersion ?? "").trim();
+    if (!SEMVER_RE.test(pkgVer)) {
+        throw new ReleaseConsistencyError("INVALID_PACKAGE_VERSION", `Invalid package.json version '${input.packageVersion}': expected strict semver (X.Y.Z)`);
+    }
+    if (input.identityVersion !== undefined && input.identityVersion !== null) {
+        const idVer = input.identityVersion.trim();
+        if (idVer !== pkgVer) {
+            throw new ReleaseConsistencyError("IDENTITY_VERSION_MISMATCH", `BLA_IDENTITY.version '${idVer}' does not match package.json version '${pkgVer}'`);
+        }
+    }
+    const headSha = (input.headSha ?? "").trim().toLowerCase();
+    if (!GIT_SHA_RE.test(headSha)) {
+        throw new ReleaseConsistencyError("INVALID_COMMIT_SHA", `Invalid checkout commit SHA '${input.headSha}'`);
+    }
+    const tarballSha256 = (input.tarballSha256 ?? "").trim().toLowerCase();
+    if (!SHA256_RE.test(tarballSha256)) {
+        throw new ReleaseConsistencyError("INVALID_TARBALL_HASH", `Invalid tarball SHA-256 digest '${input.tarballSha256}'`);
+    }
+    let aliasTarballSha256 = null;
+    if (input.aliasTarballSha256 !== undefined && input.aliasTarballSha256 !== null) {
+        aliasTarballSha256 = input.aliasTarballSha256.trim().toLowerCase();
+        if (!SHA256_RE.test(aliasTarballSha256)) {
+            throw new ReleaseConsistencyError("INVALID_TARBALL_HASH", `Invalid alias tarball SHA-256 digest '${input.aliasTarballSha256}'`);
+        }
+    }
+    // 1. Validate workflow_dispatch version input if provided
+    if (input.dispatchVersion !== undefined && input.dispatchVersion !== null) {
+        const rawDispatch = input.dispatchVersion.trim();
+        if (rawDispatch.length > 0 && rawDispatch !== "none") {
+            const normalizedDispatch = rawDispatch.startsWith("v")
+                ? rawDispatch.slice(1)
+                : rawDispatch.startsWith("bla-agents-")
+                    ? rawDispatch.slice("bla-agents-".length)
+                    : rawDispatch;
+            if (normalizedDispatch !== pkgVer) {
+                throw new ReleaseConsistencyError("DISPATCH_VERSION_MISMATCH", `workflow_dispatch version input '${rawDispatch}' does not match package.json version '${pkgVer}'`);
+            }
+        }
+    }
+    // 2. Validate trigger tag ref if triggered by a tag push
+    if (input.triggerRef !== undefined && input.triggerRef !== null) {
+        const ref = input.triggerRef.trim();
+        if (ref.startsWith("refs/tags/") ||
+            ref.startsWith("bla-agents-") ||
+            /^v\d+\./.test(ref)) {
+            const tagName = ref.startsWith("refs/tags/") ? ref.slice("refs/tags/".length) : ref;
+            let extractedVersion = null;
+            if (tagName.startsWith("bla-agents-")) {
+                extractedVersion = tagName.slice("bla-agents-".length);
+            }
+            else if (tagName.startsWith("v")) {
+                extractedVersion = tagName.slice(1);
+            }
+            if (!extractedVersion || extractedVersion !== pkgVer) {
+                throw new ReleaseConsistencyError("TRIGGER_TAG_MISMATCH", `Trigger tag '${tagName}' does not match package.json version '${pkgVer}'`);
+            }
+        }
+    }
+    const canonicalTag = `bla-agents-${pkgVer}`;
+    // 3. Verify existing tag commit matches checkout commit
+    let tagAction = "create";
+    if (input.existingTagSha !== undefined &&
+        input.existingTagSha !== null &&
+        input.existingTagSha.trim().length > 0) {
+        const existingSha = input.existingTagSha.trim().toLowerCase();
+        if (!GIT_SHA_RE.test(existingSha)) {
+            throw new ReleaseConsistencyError("INVALID_COMMIT_SHA", `Invalid existing tag commit SHA '${input.existingTagSha}'`);
+        }
+        if (existingSha !== headSha) {
+            throw new ReleaseConsistencyError("TAG_COMMIT_MISMATCH", `Existing tag '${canonicalTag}' points to commit ${existingSha}, which differs from checkout commit ${headSha}; refusing cross-commit release overwrite`);
+        }
+        tagAction = "verify-existing-idempotent";
+    }
+    // 4. Verify existing release asset SHA-256 matches packed tarball SHA-256
+    let releaseAssetAction = "upload-new";
+    if (input.existingReleaseAssetSha256 !== undefined &&
+        input.existingReleaseAssetSha256 !== null &&
+        input.existingReleaseAssetSha256.trim().length > 0) {
+        const existingAssetHash = input.existingReleaseAssetSha256.trim().toLowerCase();
+        if (existingAssetHash !== tarballSha256) {
+            throw new ReleaseConsistencyError("ASSET_HASH_CONFLICT", `Existing release asset SHA-256 (${existingAssetHash}) differs from packed tarball SHA-256 (${tarballSha256}); refusing to clobber`);
+        }
+        releaseAssetAction = "skip-identical";
+    }
+    if (aliasTarballSha256 !== null &&
+        input.existingAliasReleaseAssetSha256 !== undefined &&
+        input.existingAliasReleaseAssetSha256 !== null &&
+        input.existingAliasReleaseAssetSha256.trim().length > 0) {
+        const existingAliasHash = input.existingAliasReleaseAssetSha256.trim().toLowerCase();
+        if (existingAliasHash !== aliasTarballSha256) {
+            throw new ReleaseConsistencyError("ASSET_HASH_CONFLICT", `Existing alias release asset SHA-256 (${existingAliasHash}) differs from packed alias tarball SHA-256 (${aliasTarballSha256}); refusing to clobber`);
+        }
+    }
+    return {
+        version: pkgVer,
+        canonicalTag,
+        headSha,
+        tagAction,
+        releaseAssetAction,
+        tarballSha256,
+        aliasTarballSha256,
+    };
+}
+/**
+ * Computes an idempotent dual-package (`bla-agents` primary + `bla-shield` alias)
+ * npm publish plan so that a retry after `primary` succeeds and `alias` fails
+ * safely completes `alias` without failing on `primary` or clobbering different bytes.
+ */
+export function planNpmPublishRetry(state) {
+    if (state.primaryPublished &&
+        state.primaryTarballSha256 &&
+        state.publishedPrimarySha256 &&
+        state.primaryTarballSha256.trim().toLowerCase() !==
+            state.publishedPrimarySha256.trim().toLowerCase()) {
+        throw new ReleaseConsistencyError("ASSET_HASH_CONFLICT", `Published primary package SHA-256 (${state.publishedPrimarySha256}) differs from local tarball SHA-256 (${state.primaryTarballSha256})`);
+    }
+    if (state.aliasPublished &&
+        state.aliasTarballSha256 &&
+        state.publishedAliasSha256 &&
+        state.aliasTarballSha256.trim().toLowerCase() !==
+            state.publishedAliasSha256.trim().toLowerCase()) {
+        throw new ReleaseConsistencyError("ASSET_HASH_CONFLICT", `Published alias package SHA-256 (${state.publishedAliasSha256}) differs from local alias tarball SHA-256 (${state.aliasTarballSha256})`);
+    }
+    const shouldPublishPrimary = !state.primaryPublished;
+    const shouldPublishAlias = !(state.aliasPublished ?? false);
+    return {
+        primaryAction: shouldPublishPrimary ? "publish" : "skip-already-published",
+        aliasAction: shouldPublishAlias ? "publish" : "skip-already-published",
+        shouldPublishPrimary,
+        shouldPublishAlias,
+        requiresPublish: shouldPublishPrimary || shouldPublishAlias,
+        allCompletedAfterPlan: true,
+    };
+}
+function sha256File(filePath) {
+    return createHash("sha256").update(readFileSync(filePath)).digest("hex");
+}
+/**
+ * Packs both `bla-agents` (primary) and `bla-shield` (alias) tarballs into `outDir`
+ * without mutating the repository working tree, and writes `SHA256SUMS.txt`.
+ */
+export function packDualReleaseTarballs(repoDir, outDir) {
+    const absRepo = resolve(repoDir);
+    const absOut = resolve(outDir);
+    mkdirSync(absOut, { recursive: true });
+    const pkgJsonPath = join(absRepo, "package.json");
+    if (!existsSync(pkgJsonPath)) {
+        throw new Error(`package.json not found in '${absRepo}'`);
+    }
+    const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+    const version = pkgJson.version;
+    // 1. Pack primary (`bla-agents-<version>.tgz`) directly into `absOut`
+    execFileSync(npmCmd, ["pack", "--pack-destination", absOut], {
+        cwd: absRepo,
+        stdio: "pipe",
+        // .cmd shims on Windows require a shell; bare execFile EINVAL otherwise.
+        shell: process.platform === "win32",
+    });
+    const primaryFilename = `bla-agents-${version}.tgz`;
+    const primaryPath = join(absOut, primaryFilename);
+    if (!existsSync(primaryPath)) {
+        throw new Error(`Expected packed tarball at '${primaryPath}'`);
+    }
+    const primarySha256 = sha256File(primaryPath);
+    // 2. Build alias (`bla-shield-<version>.tgz`) in an isolated temp staging directory
+    const stageDir = mkdtempSync(join(tmpdir(), "bla-alias-pack-"));
+    try {
+        execFileSync("tar", ["-xzf", primaryPath, "-C", stageDir], {
+            stdio: "pipe",
+        });
+        const unpackedPkgDir = join(stageDir, "package");
+        const unpackedPkgJsonPath = join(unpackedPkgDir, "package.json");
+        const unpackedPkg = JSON.parse(readFileSync(unpackedPkgJsonPath, "utf8"));
+        unpackedPkg.name = "bla-shield";
+        writeFileSync(unpackedPkgJsonPath, JSON.stringify(unpackedPkg, null, 2) + "\n", "utf8");
+        execFileSync(npmCmd, ["pack", "--pack-destination", absOut, "--ignore-scripts"], {
+            cwd: unpackedPkgDir,
+            stdio: "pipe",
+            shell: process.platform === "win32",
+        });
+    }
+    finally {
+        rmSync(stageDir, { recursive: true, force: true });
+    }
+    const aliasFilename = `bla-shield-${version}.tgz`;
+    const aliasPath = join(absOut, aliasFilename);
+    if (!existsSync(aliasPath)) {
+        throw new Error(`Expected packed alias tarball at '${aliasPath}'`);
+    }
+    const aliasSha256 = sha256File(aliasPath);
+    const sha256SumsPath = join(absOut, "SHA256SUMS.txt");
+    const sumsContent = [
+        `${primarySha256}  ${basename(primaryPath)}`,
+        `${aliasSha256}  ${basename(aliasPath)}`,
+        "",
+    ].join("\n");
+    writeFileSync(sha256SumsPath, sumsContent, "utf8");
+    return {
+        version,
+        primary: {
+            packageName: "bla-agents",
+            version,
+            tarballPath: primaryPath,
+            tarballFilename: primaryFilename,
+            sha256: primarySha256,
+        },
+        alias: {
+            packageName: "bla-shield",
+            version,
+            tarballPath: aliasPath,
+            tarballFilename: aliasFilename,
+            sha256: aliasSha256,
+        },
+        sha256SumsPath,
+    };
+}
+//# sourceMappingURL=release-plan.js.map

package/dist/core/release-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-plan.js","sourceRoot":"","sources":["../../src/core/release-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAYhE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChC,IAAI,CAA8B;IAElD,YAAmB,IAAiC,EAAE,OAAe;QACnE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAyBD,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,UAAU,GAAG,mBAAmB,CAAC;AACvC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC,MAAM,UAAU,wBAAwB,CACtC,KAA8B;IAE9B,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAC/B,yBAAyB,EACzB,iCAAiC,KAAK,CAAC,cAAc,mCAAmC,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,EAC3B,yBAAyB,KAAK,0CAA0C,MAAM,GAAG,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gCAAgC,KAAK,CAAC,OAAO,GAAG,CACjD,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,EACtB,mCAAmC,KAAK,CAAC,aAAa,GAAG,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAChF,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,EACtB,yCAAyC,KAAK,CAAC,kBAAkB,GAAG,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YACrD,MAAM,kBAAkB,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;gBACpD,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtB,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,aAAa,CAAC;oBACrC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC;oBACzC,CAAC,CAAC,WAAW,CAAC;YAClB,IAAI,kBAAkB,KAAK,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,EAC3B,oCAAoC,WAAW,0CAA0C,MAAM,GAAG,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACpC,IACE,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAC5B,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EACnB,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACpF,IAAI,gBAAgB,GAAkB,IAAI,CAAC;YAC3C,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtC,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;gBACrD,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,EACtB,gBAAgB,OAAO,0CAA0C,MAAM,GAAG,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,MAAM,EAAE,CAAC;IAE5C,wDAAwD;IACxD,IAAI,SAAS,GAAwC,QAAQ,CAAC;IAC9D,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;QAClC,KAAK,CAAC,cAAc,KAAK,IAAI;QAC7B,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EACtC,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oCAAoC,KAAK,CAAC,cAAc,GAAG,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,iBAAiB,YAAY,sBAAsB,WAAW,wCAAwC,OAAO,2CAA2C,CACzJ,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,4BAA4B,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,IAAI,kBAAkB,GAAiD,YAAY,CAAC;IACpF,IACE,KAAK,CAAC,0BAA0B,KAAK,SAAS;QAC9C,KAAK,CAAC,0BAA0B,KAAK,IAAI;QACzC,KAAK,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAClD,CAAC;QACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChF,IAAI,iBAAiB,KAAK,aAAa,EAAE,CAAC;YACxC,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,mCAAmC,iBAAiB,0CAA0C,aAAa,wBAAwB,CACpI,CAAC;QACJ,CAAC;QACD,kBAAkB,GAAG,gBAAgB,CAAC;IACxC,CAAC;IAED,IACE,kBAAkB,KAAK,IAAI;QAC3B,KAAK,CAAC,+BAA+B,KAAK,SAAS;QACnD,KAAK,CAAC,+BAA+B,KAAK,IAAI;QAC9C,KAAK,CAAC,+BAA+B,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EACvD,CAAC;QACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,+BAA+B,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrF,IAAI,iBAAiB,KAAK,kBAAkB,EAAE,CAAC;YAC7C,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,yCAAyC,iBAAiB,gDAAgD,kBAAkB,wBAAwB,CACrJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM;QACf,YAAY;QACZ,OAAO;QACP,SAAS;QACT,kBAAkB;QAClB,aAAa;QACb,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,IACE,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,oBAAoB;QAC1B,KAAK,CAAC,sBAAsB;QAC5B,KAAK,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YAC7C,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,sCAAsC,KAAK,CAAC,sBAAsB,yCAAyC,KAAK,CAAC,oBAAoB,GAAG,CACzI,CAAC;IACJ,CAAC;IAED,IACE,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,kBAAkB;QACxB,KAAK,CAAC,oBAAoB;QAC1B,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YAC3C,KAAK,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EACjD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,oCAAoC,KAAK,CAAC,oBAAoB,+CAA+C,KAAK,CAAC,kBAAkB,GAAG,CACzI,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACrD,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,aAAa,EAAE,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB;QAC1E,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB;QACtE,oBAAoB;QACpB,kBAAkB;QAClB,eAAe,EAAE,oBAAoB,IAAI,kBAAkB;QAC3D,qBAAqB,EAAE,IAAI;KAC5B,CAAC;AACJ,CAAC;AAiBD,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,MAAc;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAG3D,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,sEAAsE;IACtE,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE;QAC3D,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,MAAM;QACb,yEAAyE;QACzE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;KACpC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,cAAc,OAAO,MAAM,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAE9C,oFAAoF;IACpF,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE;YACzD,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjD,MAAM,mBAAmB,GAAG,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAGvE,CAAC;QACF,WAAW,CAAC,IAAI,GAAG,YAAY,CAAC;QAChC,aAAa,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAExF,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE;YAC/E,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACpC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,aAAa,GAAG,cAAc,OAAO,MAAM,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAE1C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG;QAClB,GAAG,aAAa,KAAK,QAAQ,CAAC,WAAW,CAAC,EAAE;QAC5C,GAAG,WAAW,KAAK,QAAQ,CAAC,SAAS,CAAC,EAAE;QACxC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,aAAa,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAEnD,OAAO;QACL,OAAO;QACP,OAAO,EAAE;YACP,WAAW,EAAE,YAAY;YACzB,OAAO;YACP,WAAW,EAAE,WAAW;YACxB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,aAAa;SACtB;QACD,KAAK,EAAE;YACL,WAAW,EAAE,YAAY;YACzB,OAAO;YACP,WAAW,EAAE,SAAS;YACtB,eAAe,EAAE,aAAa;YAC9B,MAAM,EAAE,WAAW;SACpB;QACD,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/core/sarif.d.ts

@@ -0,0 +1,53 @@
+import type { AuditReport } from "./types.js";
+import type { ReleaseExposureReport } from "./release-exposure.js";
+export interface SarifLog {
+    readonly $schema: string;
+    readonly version: "2.1.0";
+    readonly runs: readonly [
+        {
+            readonly tool: {
+                readonly driver: {
+                    readonly name: string;
+                    readonly fullName: string;
+                    readonly version: string;
+                    readonly informationUri: string;
+                    readonly rules: readonly {
+                        readonly id: string;
+                        readonly name: string;
+                        readonly shortDescription: {
+                            readonly text: string;
+                        };
+                        readonly defaultConfiguration: {
+                            readonly level: "error" | "warning" | "note";
+                        };
+                    }[];
+                };
+            };
+            readonly results: readonly {
+                readonly ruleId: string;
+                readonly level: "error" | "warning" | "note";
+                readonly message: {
+                    readonly text: string;
+                };
+                readonly locations: readonly [
+                    {
+                        readonly physicalLocation: {
+                            readonly artifactLocation: {
+                                readonly uri: string;
+                            };
+                            readonly region?: {
+                                readonly startLine: number;
+                            };
+                        };
+                    }
+                ];
+            }[];
+        }
+    ];
+}
+/**
+ * Formats an `AuditReport` (and optional `ReleaseExposureReport`) as a SARIF 2.1.0 JSON document
+ * compatible with GitHub Code Scanning (`github/codeql-action/upload-sarif`).
+ */
+export declare function buildSarifReport(audit: AuditReport, releaseExposure?: ReleaseExposureReport | null): SarifLog;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/core/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../src/core/sarif.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS;QACtB;YACE,QAAQ,CAAC,IAAI,EAAE;gBACb,QAAQ,CAAC,MAAM,EAAE;oBACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;oBACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;oBAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;oBACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;oBAChC,QAAQ,CAAC,KAAK,EAAE,SAAS;wBACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;wBACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;wBACtB,QAAQ,CAAC,gBAAgB,EAAE;4BAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;yBAAE,CAAC;wBACrD,QAAQ,CAAC,oBAAoB,EAAE;4BAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;yBAC9C,CAAC;qBACH,EAAE,CAAC;iBACL,CAAC;aACH,CAAC;YACF,QAAQ,CAAC,OAAO,EAAE,SAAS;gBACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;gBAC7C,QAAQ,CAAC,OAAO,EAAE;oBAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;iBAAE,CAAC;gBAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS;oBAC3B;wBACE,QAAQ,CAAC,gBAAgB,EAAE;4BACzB,QAAQ,CAAC,gBAAgB,EAAE;gCAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;6BAAE,CAAC;4BACpD,QAAQ,CAAC,MAAM,CAAC,EAAE;gCAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;6BAAE,CAAC;yBAClD,CAAC;qBACH;iBACF,CAAC;aACH,EAAE,CAAC;SACL;KACF,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,WAAW,EAClB,eAAe,CAAC,EAAE,qBAAqB,GAAG,IAAI,GAC7C,QAAQ,CAqGV"}

package/dist/core/sarif.js

@@ -0,0 +1,91 @@
+import { BLA_IDENTITY } from "../identity.js";
+/**
+ * Formats an `AuditReport` (and optional `ReleaseExposureReport`) as a SARIF 2.1.0 JSON document
+ * compatible with GitHub Code Scanning (`github/codeql-action/upload-sarif`).
+ */
+export function buildSarifReport(audit, releaseExposure) {
+    const rulesMap = new Map();
+    const results = [];
+    for (const item of audit.exposedItems) {
+        const ruleId = `BLA-AUDIT-${item.kind.toUpperCase()}`;
+        const level = item.riskLevel === "critical"
+            ? "error"
+            : item.riskLevel === "high"
+                ? "warning"
+                : "note";
+        if (!rulesMap.has(ruleId)) {
+            rulesMap.set(ruleId, {
+                id: ruleId,
+                name: `ExposedArtifact_${item.kind}`,
+                shortDescription: {
+                    text: `Artifact surface (${item.kind}) exposed to automated reverse-engineering tool (${item.reaToolUsed})`,
+                },
+                defaultConfiguration: { level },
+            });
+        }
+        const [uriPart, linePart] = item.location.split(":");
+        const startLine = linePart ? Number.parseInt(linePart, 10) : undefined;
+        results.push({
+            ruleId,
+            level,
+            message: {
+                text: `${item.name}: ${item.reason} (Est. reconstruction: ${item.estimatedTokensToReconstruct} tokens / $${item.estimatedCostUsd.toFixed(2)})`,
+            },
+            locations: [
+                {
+                    physicalLocation: {
+                        artifactLocation: { uri: uriPart || audit.targetPath },
+                        ...(startLine && Number.isFinite(startLine) ? { region: { startLine } } : {}),
+                    },
+                },
+            ],
+        });
+    }
+    if (releaseExposure) {
+        for (const f of releaseExposure.findings) {
+            const ruleId = `BLA-RELEASE-${f.kind.toUpperCase()}`;
+            const level = f.kind === "embedded-source-text" ? "error" : "warning";
+            if (!rulesMap.has(ruleId)) {
+                rulesMap.set(ruleId, {
+                    id: ruleId,
+                    name: `ReleaseExposure_${f.kind}`,
+                    shortDescription: { text: `Release source-map exposure (${f.kind}, ${f.representation})` },
+                    defaultConfiguration: { level },
+                });
+            }
+            results.push({
+                ruleId,
+                level,
+                message: {
+                    text: `${f.kind} (${f.representation}) in ${f.file} — Run "npx bla-agents defend" to replace with decoy source maps.`,
+                },
+                locations: [
+                    {
+                        physicalLocation: {
+                            artifactLocation: { uri: f.file },
+                        },
+                    },
+                ],
+            });
+        }
+    }
+    return {
+        $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: BLA_IDENTITY.packageName,
+                        fullName: BLA_IDENTITY.fullName,
+                        version: BLA_IDENTITY.version,
+                        informationUri: "https://bla.tools",
+                        rules: [...rulesMap.values()],
+                    },
+                },
+                results,
+            },
+        ],
+    };
+}
+//# sourceMappingURL=sarif.js.map

package/dist/core/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/core/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA0C9C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAkB,EAClB,eAA8C;IAE9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAQrB,CAAC;IAEJ,MAAM,OAAO,GAA6C,EAAE,CAAC;IAE7D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,aAAa,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACtD,MAAM,KAAK,GACT,IAAI,CAAC,SAAS,KAAK,UAAU;YAC3B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM;gBACzB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,CAAC;QAEf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE;gBACnB,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,mBAAmB,IAAI,CAAC,IAAI,EAAE;gBACpC,gBAAgB,EAAE;oBAChB,IAAI,EAAE,qBAAqB,IAAI,CAAC,IAAI,oDAAoD,IAAI,CAAC,WAAW,GAAG;iBAC5G;gBACD,oBAAoB,EAAE,EAAE,KAAK,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvE,OAAO,CAAC,IAAI,CAAC;YACX,MAAM;YACN,KAAK;YACL,OAAO,EAAE;gBACP,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,0BAA0B,IAAI,CAAC,4BAA4B,cAAc,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;aAC/I;YACD,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE;wBACtD,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9E;iBACF;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACrD,MAAM,KAAK,GACT,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE;oBACnB,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,mBAAmB,CAAC,CAAC,IAAI,EAAE;oBACjC,gBAAgB,EAAE,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,cAAc,GAAG,EAAE;oBAC1F,oBAAoB,EAAE,EAAE,KAAK,EAAE;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM;gBACN,KAAK;gBACL,OAAO,EAAE;oBACP,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAC,IAAI,mEAAmE;iBACtH;gBACD,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE;yBAClC;qBACF;iBACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,YAAY,CAAC,WAAW;wBAC9B,QAAQ,EAAE,YAAY,CAAC,QAAQ;wBAC/B,OAAO,EAAE,YAAY,CAAC,OAAO;wBAC7B,cAAc,EAAE,mBAAmB;wBACnC,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;qBAC9B;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/core/sqlite-runtime.d.ts

@@ -1,4 +1,17 @@
 import type { DatabaseSync } from "node:sqlite";
+/**
+ * Probe whether the current Node runtime exposes a usable `node:sqlite`
+ * `DatabaseSync` with custom scalar `function()` support (Node ^22.13 || >=24).
+ * Result is memoized for the process lifetime.
+ */
+export declare function isNodeSqliteAvailable(): boolean;
+/**
+ * Load `DatabaseSync` when available; return `null` on unsupported runtimes
+ * (Node < 22.13, `--no-experimental-sqlite`, or missing `function` API).
+ * Prefer this for optional/degraded paths; use `getDatabaseSyncClass()` when
+ * SQLite is required and a clear hard-error is appropriate.
+ */
+export declare function tryGetDatabaseSyncClass(): typeof DatabaseSync | null;
 /** Load lazily so non-SQLite commands can still explain an unsupported setup. */
 export declare function getDatabaseSyncClass(): typeof DatabaseSync;
 //# sourceMappingURL=sqlite-runtime.d.ts.map

package/dist/core/sqlite-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-runtime.d.ts","sourceRoot":"","sources":["../../src/core/sqlite-runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIhD,iFAAiF;AACjF,wBAAgB,oBAAoB,IAAI,OAAO,YAAY,CAkB1D"}
+{"version":3,"file":"sqlite-runtime.d.ts","sourceRoot":"","sources":["../../src/core/sqlite-runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAOhD;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAI/C;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,YAAY,GAAG,IAAI,CAiBpE;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,IAAI,OAAO,YAAY,CAQ1D"}