handoffprobe 0.1.0

package/dist/core/runner.js

@@ -0,0 +1,181 @@
+import { HandoffProbeCoreError } from './errors.js';
+import { cloneSecurityContext } from './security-context.js';
+const DEFAULT_TIMEOUT_MS = 5_000;
+function validateTimeout(timeoutMs) {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+        throw new HandoffProbeCoreError('INVALID_TIMEOUT', 'Timeout must be a positive finite number.', 'runner', {
+            timeoutMs,
+        });
+    }
+}
+function normalizeEvidence(evidence, input) {
+    return evidence.map((event) => ({
+        ...event,
+        runId: input.runId,
+        correlationId: input.correlationId,
+        testId: input.testId,
+        context: cloneSecurityContext(event.context),
+        details: {
+            ...event.details,
+        },
+        provenance: [...event.provenance, ...input.provenance],
+    }));
+}
+function errorFinding(input) {
+    return {
+        testId: input.definition.id,
+        runId: input.runId,
+        correlationId: input.correlationId,
+        title: input.definition.name,
+        severity: 'info',
+        status: 'error',
+        propertyClass: input.definition.propertyClass,
+        applicability: input.definition.applicability,
+        expectedInvariant: input.definition.expectedInvariant,
+        observedBehavior: 'HandoffProbe could not execute or observe this test correctly.',
+        evidenceSequences: [],
+        sources: input.definition.sourceReferences,
+    };
+}
+function structuredError(error) {
+    return {
+        name: 'HandoffProbeCoreError',
+        code: error.code,
+        message: error.message,
+        stage: error.stage,
+        details: error.details,
+    };
+}
+async function executeWithTimeout(target, input) {
+    const controller = new AbortController();
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new HandoffProbeCoreError('TIMEOUT', `Target execution exceeded ${input.timeoutMs} ms.`, 'target-execution', {
+                targetId: target.id,
+                timeoutMs: input.timeoutMs,
+            }));
+        }, input.timeoutMs);
+    });
+    try {
+        return await Promise.race([
+            target.execute({
+                runId: input.runId,
+                correlationId: input.correlationId,
+                context: cloneSecurityContext(input.context),
+                signal: controller.signal,
+            }),
+            timeout,
+        ]);
+    }
+    finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+    }
+}
+export class CoreRunner {
+    async run(input) {
+        const correlationId = input.correlationId ?? `${input.runId}:${input.attack.definition.id}`;
+        const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        try {
+            validateTimeout(timeoutMs);
+        }
+        catch (error) {
+            if (error instanceof HandoffProbeCoreError) {
+                return {
+                    finding: errorFinding({
+                        definition: input.attack.definition,
+                        runId: input.runId,
+                        correlationId,
+                        error,
+                    }),
+                    evidence: [],
+                    error: structuredError(error),
+                };
+            }
+            throw error;
+        }
+        let execution;
+        try {
+            execution = await executeWithTimeout(input.target, {
+                runId: input.runId,
+                correlationId,
+                context: input.context,
+                timeoutMs,
+            });
+        }
+        catch (error) {
+            const coreError = error instanceof HandoffProbeCoreError
+                ? error
+                : new HandoffProbeCoreError('ADAPTER_ERROR', 'Target adapter execution failed.', 'target-execution', {
+                    targetId: input.target.id,
+                    causeName: error instanceof Error ? error.name : typeof error,
+                });
+            return {
+                finding: errorFinding({
+                    definition: input.attack.definition,
+                    runId: input.runId,
+                    correlationId,
+                    error: coreError,
+                }),
+                evidence: [],
+                error: structuredError(coreError),
+            };
+        }
+        const evidence = normalizeEvidence(execution.evidence, {
+            testId: input.attack.definition.id,
+            runId: input.runId,
+            correlationId,
+            provenance: input.attack.definition.sourceReferences,
+        });
+        let evaluation;
+        try {
+            evaluation = await input.attack.evaluate({
+                ...execution,
+                evidence,
+            });
+        }
+        catch (error) {
+            const coreError = new HandoffProbeCoreError('EVALUATION_ERROR', 'Attack evaluation failed.', 'attack-evaluation', {
+                attackId: input.attack.definition.id,
+                causeName: error instanceof Error ? error.name : typeof error,
+            });
+            return {
+                finding: errorFinding({
+                    definition: input.attack.definition,
+                    runId: input.runId,
+                    correlationId,
+                    error: coreError,
+                }),
+                evidence,
+                error: structuredError(coreError),
+            };
+        }
+        const finding = {
+            testId: input.attack.definition.id,
+            runId: input.runId,
+            correlationId,
+            title: input.attack.definition.name,
+            severity: evaluation.severity ?? input.attack.definition.defaultSeverity,
+            status: evaluation.status,
+            propertyClass: input.attack.definition.propertyClass,
+            applicability: input.attack.definition.applicability,
+            expectedInvariant: input.attack.definition.expectedInvariant,
+            observedBehavior: evaluation.observedBehavior,
+            evidenceSequences: evaluation.evidenceSequences ?? evidence.map((event) => event.sequence),
+            sources: input.attack.definition.sourceReferences,
+            ...(evaluation.remediation === undefined
+                ? {}
+                : {
+                    remediation: evaluation.remediation,
+                }),
+        };
+        return {
+            finding,
+            evidence,
+        };
+    }
+}
+//# sourceMappingURL=runner.js.map

package/dist/core/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/core/runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AA0C7D,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,qBAAqB,CAC7B,iBAAiB,EACjB,2CAA2C,EAC3C,QAAQ,EACR;YACE,SAAS;SACV,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAkC,EAClC,KAKC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9B,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5C,OAAO,EAAE;YACP,GAAG,KAAK,CAAC,OAAO;SACjB;QACD,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC;KACvD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,YAAY,CAAC,KAKrB;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;QAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC5B,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa;QAC7C,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa;QAC7C,iBAAiB,EAAE,KAAK,CAAC,UAAU,CAAC,iBAAiB;QACrD,gBAAgB,EAAE,gEAAgE;QAClF,iBAAiB,EAAE,EAAE;QACrB,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAA4B;IACnD,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAqB,EACrB,KAKC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,IAAI,KAAgD,CAAC;IAErD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,UAAU,CAAC,KAAK,EAAE,CAAC;YAEnB,MAAM,CACJ,IAAI,qBAAqB,CACvB,SAAS,EACT,6BAA6B,KAAK,CAAC,SAAS,MAAM,EAClD,kBAAkB,EAClB;gBACE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CACF,CACF,CAAC;QACJ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,MAAM,CAAC,OAAO,CAAC;gBACb,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC5C,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;YACF,OAAO;SACR,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,UAAU;IACrB,KAAK,CAAC,GAAG,CAAC,KAAmB;QAC3B,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QAE5F,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;QAExD,IAAI,CAAC;YACH,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO;oBACL,OAAO,EAAE,YAAY,CAAC;wBACpB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;wBACnC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,aAAa;wBACb,KAAK;qBACN,CAAC;oBACF,QAAQ,EAAE,EAAE;oBACZ,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;iBAC9B,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,SAAgC,CAAC;QAErC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE;gBACjD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa;gBACb,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GACb,KAAK,YAAY,qBAAqB;gBACpC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,qBAAqB,CACvB,eAAe,EACf,kCAAkC,EAClC,kBAAkB,EAClB;oBACE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;oBACzB,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;iBAC9D,CACF,CAAC;YAER,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC;oBACpB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;oBACnC,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,aAAa;oBACb,KAAK,EAAE,SAAS;iBACjB,CAAC;gBACF,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,eAAe,CAAC,SAAS,CAAC;aAClC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE;YACrD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,aAAa;YACb,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB;SACrD,CAAC,CAAC;QAEH,IAAI,UAA4B,CAAC;QAEjC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACvC,GAAG,SAAS;gBACZ,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAI,qBAAqB,CACzC,kBAAkB,EAClB,2BAA2B,EAC3B,mBAAmB,EACnB;gBACE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;gBACpC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;aAC9D,CACF,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC;oBACpB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;oBACnC,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,aAAa;oBACb,KAAK,EAAE,SAAS;iBACjB,CAAC;gBACF,QAAQ;gBACR,KAAK,EAAE,eAAe,CAAC,SAAS,CAAC;aAClC,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAY;YACvB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI;YACnC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe;YACxE,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa;YACpD,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa;YACpD,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,iBAAiB;YAC5D,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,iBAAiB,EAAE,UAAU,CAAC,iBAAiB,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC1F,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB;YACjD,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,WAAW,EAAE,UAAU,CAAC,WAAW;iBACpC,CAAC;SACP,CAAC;QAEF,OAAO;YACL,OAAO;YACP,QAAQ;SACT,CAAC;IACJ,CAAC;CACF"}

package/dist/core/security-context.d.ts

@@ -0,0 +1,64 @@
+export interface AuthorityGrant {
+    principal: string;
+    delegate: string;
+    tenant: string;
+    resources: string[];
+    capabilities: string[];
+}
+export interface ApprovalBinding {
+    approvalId: string;
+    tool: string;
+    payloadHash: string;
+}
+export type CredentialClass = 'bearer' | 'delegated';
+export interface CredentialBinding {
+    fingerprint: string;
+    credentialClass: CredentialClass;
+    audience: string;
+}
+export type LifecycleState = 'active' | 'cancelled' | 'completed';
+export interface LifecycleContext {
+    taskId: string;
+    state: LifecycleState;
+}
+export interface SecurityContext {
+    principal: string;
+    caller: string;
+    downstream: string;
+    tenant: string;
+    resource: string;
+    /**
+     * Legacy/effective capability view retained for the
+     * Phase 1 protocol laboratory.
+     */
+    capabilities: string[];
+    /**
+     * Authority established before the handoff.
+     */
+    upstreamAuthority?: AuthorityGrant;
+    /**
+     * Authority presented to the downstream side after
+     * handoff translation.
+     */
+    effectiveAuthority?: AuthorityGrant;
+    /**
+     * Optional security-sensitive approval binding.
+     */
+    approval?: ApprovalBinding;
+    /**
+     * Sanitized upstream credential metadata.
+     * Raw credentials are never stored here.
+     */
+    upstreamCredential?: CredentialBinding;
+    /**
+     * Sanitized credential metadata observed downstream.
+     * Raw credentials are never stored here.
+     */
+    forwardedCredential?: CredentialBinding;
+    /**
+     * Governing task lifecycle state.
+     */
+    lifecycle?: LifecycleContext;
+}
+export declare function cloneSecurityContext(context: SecurityContext): SecurityContext;
+//# sourceMappingURL=security-context.d.ts.map

package/dist/core/security-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-context.d.ts","sourceRoot":"","sources":["../../src/core/security-context.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,WAAW,CAAC;AAErD,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,eAAe,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC;AAElE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IAEvB;;OAEG;IACH,iBAAiB,CAAC,EAAE,cAAc,CAAC;IAEnC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,cAAc,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAE3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,iBAAiB,CAAC;IAEvC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,iBAAiB,CAAC;IAExC;;OAEG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAUD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAqD9E"}

package/dist/core/security-context.js

@@ -0,0 +1,56 @@
+function cloneAuthorityGrant(grant) {
+    return {
+        ...grant,
+        resources: [...grant.resources],
+        capabilities: [...grant.capabilities],
+    };
+}
+export function cloneSecurityContext(context) {
+    return {
+        principal: context.principal,
+        caller: context.caller,
+        downstream: context.downstream,
+        tenant: context.tenant,
+        resource: context.resource,
+        capabilities: [...context.capabilities],
+        ...(context.upstreamAuthority === undefined
+            ? {}
+            : {
+                upstreamAuthority: cloneAuthorityGrant(context.upstreamAuthority),
+            }),
+        ...(context.effectiveAuthority === undefined
+            ? {}
+            : {
+                effectiveAuthority: cloneAuthorityGrant(context.effectiveAuthority),
+            }),
+        ...(context.approval === undefined
+            ? {}
+            : {
+                approval: {
+                    ...context.approval,
+                },
+            }),
+        ...(context.upstreamCredential === undefined
+            ? {}
+            : {
+                upstreamCredential: {
+                    ...context.upstreamCredential,
+                },
+            }),
+        ...(context.forwardedCredential === undefined
+            ? {}
+            : {
+                forwardedCredential: {
+                    ...context.forwardedCredential,
+                },
+            }),
+        ...(context.lifecycle === undefined
+            ? {}
+            : {
+                lifecycle: {
+                    ...context.lifecycle,
+                },
+            }),
+    };
+}
+//# sourceMappingURL=security-context.js.map

package/dist/core/security-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-context.js","sourceRoot":"","sources":["../../src/core/security-context.ts"],"names":[],"mappings":"AA4EA,SAAS,mBAAmB,CAAC,KAAqB;IAChD,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;QAC/B,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAwB;IAC3D,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;QAEvC,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,iBAAiB,EAAE,mBAAmB,CAAC,OAAO,CAAC,iBAAiB,CAAC;aAClE,CAAC;QAEN,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,kBAAkB,EAAE,mBAAmB,CAAC,OAAO,CAAC,kBAAkB,CAAC;aACpE,CAAC;QAEN,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,QAAQ,EAAE;oBACR,GAAG,OAAO,CAAC,QAAQ;iBACpB;aACF,CAAC;QAEN,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,kBAAkB,EAAE;oBAClB,GAAG,OAAO,CAAC,kBAAkB;iBAC9B;aACF,CAAC;QAEN,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,mBAAmB,EAAE;oBACnB,GAAG,OAAO,CAAC,mBAAmB;iBAC/B;aACF,CAAC;QAEN,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,GAAG,OAAO,CAAC,SAAS;iBACrB;aACF,CAAC;KACP,CAAC;AACJ,CAAC"}

package/dist/github-action/core.d.ts

@@ -0,0 +1,34 @@
+import type { CliFailOn } from '../cli/config.js';
+import type { CliExecutionBinding, CliTargetFixture } from '../cli/execution-catalog.js';
+import type { CliTestRun } from '../cli/test-command.js';
+export type GitHubActionResult = 'pass' | 'fail' | 'error';
+export interface GitHubActionRequest {
+    readonly target: string | undefined;
+    readonly tests: string | undefined;
+    readonly failOn: string | undefined;
+    readonly artifactName: string | undefined;
+}
+export interface ValidatedGitHubActionRequest {
+    readonly target: CliTargetFixture;
+    readonly failOn: CliFailOn;
+    readonly artifactName: string;
+    readonly bindings: readonly CliExecutionBinding[];
+}
+export interface GitHubActionExecution {
+    readonly exitCode: 0 | 1 | 3;
+    readonly result: GitHubActionResult;
+    readonly jsonReport: string;
+    readonly summary: string;
+    readonly artifactName: string;
+}
+export type GitHubActionRunner = (input: {
+    target: CliTargetFixture;
+    bindings: readonly CliExecutionBinding[];
+}) => Promise<CliTestRun>;
+export declare class GitHubActionUsageError extends Error {
+    readonly name = "GitHubActionUsageError";
+}
+export declare function validateGitHubActionRequest(request: GitHubActionRequest): ValidatedGitHubActionRequest;
+export declare function renderGitHubActionSummary(jsonReport: string, artifactName: string, exitCode: 0 | 1 | 3): string;
+export declare function executeValidatedGitHubAction(request: ValidatedGitHubActionRequest, runner?: GitHubActionRunner): Promise<GitHubActionExecution>;
+//# sourceMappingURL=core.d.ts.map

package/dist/github-action/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/github-action/core.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAQzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACvC,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1C,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AA+B1B,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,SAAyB,IAAI,4BAA4B;CAC1D;AA4DD,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,mBAAmB,GAC3B,4BAA4B,CAmB9B;AAcD,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAClB,MAAM,CAgDR;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,4BAA4B,EACrC,MAAM,GAAE,kBAAgC,GACvC,OAAO,CAAC,qBAAqB,CAAC,CAgBhC"}

package/dist/github-action/core.js

@@ -0,0 +1,118 @@
+import { renderJsonReport } from '../cli/reporters.js';
+import { evaluateCliTestExitCode, resolveCliTestSelection, runCliTests, } from '../cli/test-command.js';
+export class GitHubActionUsageError extends Error {
+    name = 'GitHubActionUsageError';
+}
+function parseTarget(value) {
+    const trimmed = value?.trim();
+    const normalized = trimmed === undefined || trimmed.length === 0 ? 'secure' : trimmed;
+    if (normalized === 'secure' || normalized === 'vulnerable') {
+        return normalized;
+    }
+    throw new GitHubActionUsageError('Invalid target; expected secure or vulnerable.');
+}
+function parseFailOn(value) {
+    const trimmed = value?.trim();
+    const normalized = trimmed === undefined || trimmed.length === 0 ? 'high' : trimmed;
+    if (normalized === 'info' ||
+        normalized === 'low' ||
+        normalized === 'medium' ||
+        normalized === 'high' ||
+        normalized === 'critical') {
+        return normalized;
+    }
+    throw new GitHubActionUsageError('Invalid fail-on severity; expected info, low, medium, high, or critical.');
+}
+function parseTests(value) {
+    if (value === undefined || value.trim().length === 0) {
+        return undefined;
+    }
+    const ids = value.split(',').map((id) => id.trim());
+    if (ids.some((id) => id.length === 0)) {
+        throw new GitHubActionUsageError('Invalid tests input; expected comma-separated stable HP- IDs.');
+    }
+    return ids;
+}
+function parseArtifactName(value) {
+    const trimmed = value?.trim();
+    const normalized = trimmed === undefined || trimmed.length === 0 ? 'handoffprobe-report' : trimmed;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(normalized) || normalized.includes('..')) {
+        throw new GitHubActionUsageError('Invalid artifact-name; use a simple safe artifact name.');
+    }
+    return normalized;
+}
+export function validateGitHubActionRequest(request) {
+    const target = parseTarget(request.target);
+    const failOn = parseFailOn(request.failOn);
+    const artifactName = parseArtifactName(request.artifactName);
+    const requestedIds = parseTests(request.tests);
+    const selection = resolveCliTestSelection(requestedIds);
+    if (selection.unknownIds.length > 0) {
+        throw new GitHubActionUsageError('Invalid tests input; one or more attack IDs are not stable HandoffProbe IDs.');
+    }
+    return {
+        target,
+        failOn,
+        artifactName,
+        bindings: selection.bindings,
+    };
+}
+function resultFromExitCode(exitCode) {
+    if (exitCode === 0) {
+        return 'pass';
+    }
+    if (exitCode === 1) {
+        return 'fail';
+    }
+    return 'error';
+}
+export function renderGitHubActionSummary(jsonReport, artifactName, exitCode) {
+    const report = JSON.parse(jsonReport);
+    const result = resultFromExitCode(exitCode).toUpperCase();
+    const lines = [
+        '# HandoffProbe',
+        '',
+        `- Version: ${report.handoffProbeVersion}`,
+        `- Protocols: A2A ${report.protocols.a2a} → MCP ${report.protocols.mcp}`,
+        `- Target: ${report.target}`,
+        `- Selected attacks: ${report.selection.count}`,
+        `- Fail on: ${report.threshold.toUpperCase()}`,
+        `- Gate: ${result}`,
+        `- Report artifact: \`${artifactName}\``,
+        '',
+        '## Summary',
+        '',
+        '| Status | Count |',
+        '| --- | ---: |',
+        `| PASS | ${report.summary.pass} |`,
+        `| FAIL | ${report.summary.fail} |`,
+        `| NOT_APPLICABLE | ${report.summary.notApplicable} |`,
+        `| INCONCLUSIVE | ${report.summary.inconclusive} |`,
+        `| ERROR | ${report.summary.error} |`,
+        `| TOTAL | ${report.summary.total} |`,
+    ];
+    const failedFindings = report.findings.filter((finding) => finding.status === 'fail' || finding.status === 'error');
+    if (failedFindings.length > 0) {
+        lines.push('', '## FAIL / ERROR findings', '', '| Status | ID | Severity | Title |', '| --- | --- | --- | --- |');
+        for (const finding of failedFindings) {
+            lines.push(`| ${finding.status.toUpperCase()} | ${finding.id} | ${finding.severity.toUpperCase()} | ${finding.title.replace(/\|/gu, '\\|')} |`);
+        }
+    }
+    return lines.join('\n');
+}
+export async function executeValidatedGitHubAction(request, runner = runCliTests) {
+    const run = await runner({
+        target: request.target,
+        bindings: request.bindings,
+    });
+    const jsonReport = renderJsonReport(run, request.failOn);
+    const exitCode = evaluateCliTestExitCode(run, request.failOn);
+    return {
+        exitCode,
+        result: resultFromExitCode(exitCode),
+        jsonReport,
+        summary: renderGitHubActionSummary(jsonReport, request.artifactName, exitCode),
+        artifactName: request.artifactName,
+    };
+}
+//# sourceMappingURL=core.js.map

package/dist/github-action/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/github-action/core.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,WAAW,GACZ,MAAM,wBAAwB,CAAC;AA8DhC,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtB,IAAI,GAAG,wBAAwB,CAAC;CAC1D;AAED,SAAS,WAAW,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAEtF,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAC3D,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,IAAI,sBAAsB,CAAC,gDAAgD,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAEpF,IACE,UAAU,KAAK,MAAM;QACrB,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,QAAQ;QACvB,UAAU,KAAK,MAAM;QACrB,UAAU,KAAK,UAAU,EACzB,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,IAAI,sBAAsB,CAC9B,0EAA0E,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpD,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,sBAAsB,CAC9B,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,MAAM,UAAU,GACd,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC;IAElF,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,sBAAsB,CAAC,yDAAyD,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,OAA4B;IAE5B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAExD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,sBAAsB,CAC9B,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM;QACN,MAAM;QACN,YAAY;QACZ,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAmB;IAC7C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAkB,EAClB,YAAoB,EACpB,QAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAqB,CAAC;IAC1D,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAE1D,MAAM,KAAK,GAAG;QACZ,gBAAgB;QAChB,EAAE;QACF,cAAc,MAAM,CAAC,mBAAmB,EAAE;QAC1C,oBAAoB,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;QACxE,aAAa,MAAM,CAAC,MAAM,EAAE;QAC5B,uBAAuB,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE;QAC/C,cAAc,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE;QAC9C,WAAW,MAAM,EAAE;QACnB,wBAAwB,YAAY,IAAI;QACxC,EAAE;QACF,YAAY;QACZ,EAAE;QACF,oBAAoB;QACpB,gBAAgB;QAChB,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI;QACnC,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI;QACnC,sBAAsB,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI;QACtD,oBAAoB,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI;QACnD,aAAa,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI;QACrC,aAAa,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI;KACtC,CAAC;IAEF,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAC3C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CACrE,CAAC;IAEF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,EAAE,EACF,0BAA0B,EAC1B,EAAE,EACF,oCAAoC,EACpC,2BAA2B,CAC5B,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CACR,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CACpI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAqC,EACrC,SAA6B,WAAW;IAExC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QACpC,UAAU;QACV,OAAO,EAAE,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC9E,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;AACJ,CAAC"}

package/dist/github-action/run-action.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=run-action.d.ts.map

package/dist/github-action/run-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-action.d.ts","sourceRoot":"","sources":["../../src/github-action/run-action.ts"],"names":[],"mappings":""}

package/dist/github-action/run-action.js

@@ -0,0 +1,112 @@
+import { appendFile, mkdtemp, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { executeValidatedGitHubAction, GitHubActionUsageError, validateGitHubActionRequest, } from './core.js';
+function requestFromEnvironment() {
+    return {
+        target: process.env.HANDOFFPROBE_ACTION_TARGET,
+        tests: process.env.HANDOFFPROBE_ACTION_TESTS,
+        failOn: process.env.HANDOFFPROBE_ACTION_FAIL_ON,
+        artifactName: process.env.HANDOFFPROBE_ACTION_ARTIFACT_NAME,
+    };
+}
+async function createOutputDirectory() {
+    const configuredRoot = process.env.RUNNER_TEMP?.trim();
+    const root = configuredRoot === undefined || configuredRoot.length === 0
+        ? tmpdir()
+        : resolve(configuredRoot);
+    return mkdtemp(join(root, 'handoffprobe-action-'));
+}
+function renderFailureSummary(reason) {
+    const detail = reason === 'input'
+        ? 'The HandoffProbe action received invalid configuration.'
+        : 'HandoffProbe could not complete the scanner/runtime operation.';
+    return [
+        '# HandoffProbe',
+        '',
+        '- Gate: ERROR',
+        `- Result: ${detail}`,
+        '',
+        'No raw runtime exception or secret-bearing input is included in this summary.',
+    ].join('\n');
+}
+async function appendStepSummary(summary) {
+    const path = process.env.GITHUB_STEP_SUMMARY;
+    if (path === undefined || path.trim().length === 0) {
+        return;
+    }
+    await appendFile(path, `${summary}\n`, 'utf8');
+}
+async function writeActionOutputs(outputs) {
+    const path = process.env.GITHUB_OUTPUT;
+    if (path === undefined || path.trim().length === 0) {
+        throw new Error('GITHUB_OUTPUT is unavailable.');
+    }
+    const outputNames = [
+        'exit-code',
+        'result',
+        'report-path',
+        'summary-path',
+        'artifact-path',
+        'artifact-name',
+    ];
+    for (const name of outputNames) {
+        const value = outputs[name];
+        if (value.includes('\n') || value.includes('\r')) {
+            throw new Error('Action output contains an invalid newline.');
+        }
+        await appendFile(path, `${name}=${value}\n`, 'utf8');
+    }
+}
+async function main() {
+    const outputDirectory = await createOutputDirectory();
+    const summaryPath = join(outputDirectory, 'handoffprobe-summary.md');
+    let exitCode = 3;
+    let result = 'error';
+    let reportPath = '';
+    let artifactName = '';
+    let summary = renderFailureSummary('runtime');
+    try {
+        const validated = validateGitHubActionRequest(requestFromEnvironment());
+        artifactName = validated.artifactName;
+        try {
+            const execution = await executeValidatedGitHubAction(validated);
+            exitCode = execution.exitCode;
+            result = execution.result;
+            summary = execution.summary;
+            reportPath = join(outputDirectory, 'handoffprobe-report.json');
+            await writeFile(reportPath, `${execution.jsonReport}\n`, 'utf8');
+        }
+        catch {
+            exitCode = 3;
+            result = 'error';
+            summary = renderFailureSummary('runtime');
+        }
+    }
+    catch (error) {
+        if (error instanceof GitHubActionUsageError) {
+            exitCode = 2;
+            result = 'error';
+            summary = renderFailureSummary('input');
+        }
+        else {
+            exitCode = 3;
+            result = 'error';
+            summary = renderFailureSummary('runtime');
+        }
+    }
+    await writeFile(summaryPath, `${summary}\n`, 'utf8');
+    await appendStepSummary(summary);
+    const artifactPath = artifactName.length === 0 ? '' : outputDirectory;
+    await writeActionOutputs({
+        'exit-code': String(exitCode),
+        result,
+        'report-path': reportPath,
+        'summary-path': summaryPath,
+        'artifact-path': artifactPath,
+        'artifact-name': artifactName,
+    });
+    console.log(`HandoffProbe action result: ${result}; exit code: ${String(exitCode)}.`);
+}
+await main();
+//# sourceMappingURL=run-action.js.map

package/dist/github-action/run-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-action.js","sourceRoot":"","sources":["../../src/github-action/run-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AAenB,SAAS,sBAAsB;IAC7B,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;QAC9C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;QAC/C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;KAC5D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB;IAClC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,IAAI,GACR,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QACzD,CAAC,CAAC,MAAM,EAAE;QACV,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE9B,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA2B;IACvD,MAAM,MAAM,GACV,MAAM,KAAK,OAAO;QAChB,CAAC,CAAC,yDAAyD;QAC3D,CAAC,CAAC,gEAAgE,CAAC;IAEvE,OAAO;QACL,gBAAgB;QAChB,EAAE;QACF,eAAe;QACf,aAAa,MAAM,EAAE;QACrB,EAAE;QACF,+EAA+E;KAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAe;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAE7C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO;IACT,CAAC;IAED,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAsB;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAEvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,WAAW,GAAqC;QACpD,WAAW;QACX,QAAQ;QACR,aAAa;QACb,cAAc;QACd,eAAe;QACf,eAAe;KAChB,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,eAAe,GAAG,MAAM,qBAAqB,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAErE,IAAI,QAAQ,GAAmB,CAAC,CAAC;IACjC,IAAI,MAAM,GAAuB,OAAO,CAAC;IACzC,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,2BAA2B,CAAC,sBAAsB,EAAE,CAAC,CAAC;QAExE,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,SAAS,CAAC,CAAC;YAEhE,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;YAC9B,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAC1B,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5B,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;YAE/D,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,SAAS,CAAC,UAAU,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,CAAC,CAAC;YACb,MAAM,GAAG,OAAO,CAAC;YACjB,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;YAC5C,QAAQ,GAAG,CAAC,CAAC;YACb,MAAM,GAAG,OAAO,CAAC;YACjB,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,CAAC,CAAC;YACb,MAAM,GAAG,OAAO,CAAC;YACjB,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEtE,MAAM,kBAAkB,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC7B,MAAM;QACN,aAAa,EAAE,UAAU;QACzB,cAAc,EAAE,WAAW;QAC3B,eAAe,EAAE,YAAY;QAC7B,eAAe,EAAE,YAAY;KAC9B,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,gBAAgB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,IAAI,EAAE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export declare const PRODUCT_NAME = "HandoffProbe";
+export declare const PACKAGE_NAME = "handoffprobe";
+export declare const VERSION = "0.1.0";
+export * from './core/index.js';
+export * from './attacks/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export const PRODUCT_NAME = 'HandoffProbe';
+export const PACKAGE_NAME = 'handoffprobe';
+export const VERSION = '0.1.0';
+export * from './core/index.js';
+export * from './attacks/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}