open-local-audit 0.62.0 → 0.63.0

package/dist/shortlist-runner.js

@@ -1,6 +1,7 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { buildLeadShortlist, readShortlistReviewCsv, renderShortlistCsv, renderShortlistJson, renderShortlistMarkdown, renderShortlistSummaryJson } from "./shortlist.js";
+import { writeWorkflowOutputFile } from "./workflow-output.js";
 export async function runShortlistReport(options) {
     const input = await readFile(options.input, "utf8");
     const reviewRows = options.reviewCsv ? readShortlistReviewCsv(await readFile(options.reviewCsv, "utf8")) : [];
@@ -14,10 +15,10 @@ export async function runShortlistReport(options) {
             ? renderShortlistCsv(result)
             : renderShortlistMarkdown(result);
     await mkdir(dirname(options.out), { recursive: true });
-    await writeFile(options.out, output, "utf8");
+    await writeWorkflowOutputFile(options.out, output);
     if (options.summaryJson) {
         await mkdir(dirname(options.summaryJson), { recursive: true });
-        await writeFile(options.summaryJson, renderShortlistSummaryJson(result), "utf8");
+        await writeWorkflowOutputFile(options.summaryJson, renderShortlistSummaryJson(result));
     }
     return result;
 }

package/dist/shortlist-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"shortlist-runner.js","sourceRoot":"","sources":["../src/shortlist-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAI3B,MAAM,gBAAgB,CAAC;AAWxB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA4B;IACnE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE;QACvC,GAAG,OAAO,CAAC,SAAS;QACpB,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,MAAM;QACvB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK;YACxB,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC5B,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAExC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACnF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"shortlist-runner.js","sourceRoot":"","sources":["../src/shortlist-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAI3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAW/D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA4B;IACnE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE;QACvC,GAAG,OAAO,CAAC,SAAS;QACpB,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,MAAM;QACvB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK;YACxB,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC5B,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAExC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/workflow-output.d.ts

@@ -0,0 +1,5 @@
+interface WorkflowOutputWriteOptions {
+    managedOutputRoot?: string;
+}
+export declare function writeWorkflowOutputFile(path: string, content: string | Uint8Array, options?: WorkflowOutputWriteOptions): Promise<void>;
+export {};

package/dist/workflow-output.js

@@ -0,0 +1,70 @@
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+function isMissingPath(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+function isContainedPath(root, path) {
+    const relativePath = relative(root, path);
+    return relativePath === "" || (!relativePath.startsWith(`..${sep}`) && relativePath !== ".." && !isAbsolute(relativePath));
+}
+async function ensureManagedOutputDirectory(directory, managedOutputRoot) {
+    const resolvedRoot = resolve(managedOutputRoot);
+    const resolvedDirectory = resolve(directory);
+    if (!isContainedPath(resolvedRoot, resolvedDirectory)) {
+        throw new Error("Managed output directory escapes managed output root");
+    }
+    async function inspectDirectory() {
+        const rootInfo = await lstat(resolvedRoot);
+        if (rootInfo.isSymbolicLink()) {
+            throw new Error("Managed output directory must not be linked");
+        }
+        if (!rootInfo.isDirectory()) {
+            throw new Error("Managed output directory must be a directory");
+        }
+        let directoryInfo;
+        try {
+            directoryInfo = await lstat(resolvedDirectory);
+        }
+        catch (error) {
+            if (isMissingPath(error)) {
+                return false;
+            }
+            throw error;
+        }
+        if (directoryInfo.isSymbolicLink()) {
+            throw new Error("Managed output directory must not be linked");
+        }
+        if (!directoryInfo.isDirectory()) {
+            throw new Error("Managed output directory must be a directory");
+        }
+        const [realRoot, realDirectory] = await Promise.all([realpath(resolvedRoot), realpath(resolvedDirectory)]);
+        if (!isContainedPath(realRoot, realDirectory)) {
+            throw new Error("Managed output directory escapes managed output root");
+        }
+        return true;
+    }
+    if (!(await inspectDirectory())) {
+        await mkdir(resolvedDirectory, { recursive: true });
+        await inspectDirectory();
+    }
+}
+export async function writeWorkflowOutputFile(path, content, options = {}) {
+    if (options.managedOutputRoot) {
+        await ensureManagedOutputDirectory(dirname(path), options.managedOutputRoot);
+    }
+    const temporaryPath = join(dirname(path), `.${basename(path)}-${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporaryPath, content, "utf8");
+        await rename(temporaryPath, path);
+    }
+    finally {
+        try {
+            await rm(temporaryPath, { force: true });
+        }
+        catch {
+            // Preserve the write or replacement failure when its temporary cleanup also fails.
+        }
+    }
+}
+//# sourceMappingURL=workflow-output.js.map

package/dist/workflow-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-output.js","sourceRoot":"","sources":["../src/workflow-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAMxF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO,YAAY,KAAK,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,SAAiB,EAAE,iBAAyB;IACtF,MAAM,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,UAAU,gBAAgB;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,aAAa,CAAC;QAClB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,gBAAgB,EAAE,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,gBAAgB,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAY,EACZ,OAA4B,EAC5B,UAAsC,EAAE;IAExC,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,MAAM,4BAA4B,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IAEpF,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/workflow-paths.d.ts

@@ -0,0 +1,19 @@
+import { lstat } from "node:fs/promises";
+import type { ResolvedWorkflowConfig } from "./workflow-config.js";
+export type WorkflowPathIssueId = "output-linked" | "reports-linked" | "packages-linked" | "managed-file-linked" | "reports-escape" | "packages-escape";
+export interface WorkflowPathIssue {
+    id: WorkflowPathIssueId;
+    message: string;
+    path: string;
+}
+export interface WorkflowPathInspection {
+    status: "safe" | "unsafe";
+    issues: WorkflowPathIssue[];
+}
+interface WorkflowPathDependencies {
+    lstat(path: string): ReturnType<typeof lstat>;
+    realpath(path: string): Promise<string>;
+}
+export declare function inspectWorkflowManagedPaths(config: ResolvedWorkflowConfig, dependencies?: Partial<WorkflowPathDependencies>): Promise<WorkflowPathInspection>;
+export declare function prepareWorkflowManagedDirectories(config: ResolvedWorkflowConfig): Promise<void>;
+export {};

package/dist/workflow-paths.js

@@ -0,0 +1,111 @@
+import { lstat, mkdir, realpath } from "node:fs/promises";
+import { isAbsolute, relative, sep } from "node:path";
+const defaultDependencies = { lstat, realpath };
+function isMissingPath(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+async function pathInfo(path, dependencies) {
+    try {
+        return await dependencies.lstat(path);
+    }
+    catch (error) {
+        if (isMissingPath(error)) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+export async function inspectWorkflowManagedPaths(config, dependencies = {}) {
+    const resolvedDependencies = { ...defaultDependencies, ...dependencies };
+    const outputInfo = await pathInfo(config.outDir, resolvedDependencies);
+    if (!outputInfo) {
+        return { status: "safe", issues: [] };
+    }
+    if (outputInfo.isSymbolicLink()) {
+        return {
+            status: "unsafe",
+            issues: [
+                {
+                    id: "output-linked",
+                    message: "Managed output directory must not be linked",
+                    path: config.outDir
+                }
+            ]
+        };
+    }
+    const realOutDir = await resolvedDependencies.realpath(config.outDir);
+    const directories = [
+        {
+            id: "reports",
+            path: config.paths.reportsDir
+        },
+        ...(config.packageReports
+            ? [
+                {
+                    id: "packages",
+                    path: config.paths.packagesDir
+                }
+            ]
+            : [])
+    ];
+    const issues = [];
+    for (const path of [
+        config.paths.leadsCsv,
+        config.paths.discoverySummaryJson,
+        config.paths.shortlistCsv,
+        config.paths.shortlistSummaryJson,
+        config.paths.reviewSummaryJson,
+        config.paths.workflowSummaryJson
+    ]) {
+        const fileInfo = await pathInfo(path, resolvedDependencies);
+        if (fileInfo?.isSymbolicLink()) {
+            issues.push({
+                id: "managed-file-linked",
+                message: "Managed output file must not be linked",
+                path
+            });
+        }
+    }
+    for (const directory of directories) {
+        const directoryInfo = await pathInfo(directory.path, resolvedDependencies);
+        if (!directoryInfo) {
+            continue;
+        }
+        if (directoryInfo.isSymbolicLink()) {
+            issues.push({
+                id: `${directory.id}-linked`,
+                message: `Managed ${directory.id} directory must not be linked`,
+                path: directory.path
+            });
+            continue;
+        }
+        const realDirectory = await resolvedDependencies.realpath(directory.path);
+        const relativeDirectory = relative(realOutDir, realDirectory);
+        if (relativeDirectory === ".." ||
+            relativeDirectory.startsWith(`..${sep}`) ||
+            isAbsolute(relativeDirectory)) {
+            issues.push({
+                id: `${directory.id}-escape`,
+                message: `Managed ${directory.id} directory escapes output directory`,
+                path: directory.path
+            });
+        }
+    }
+    return issues.length === 0 ? { status: "safe", issues } : { status: "unsafe", issues };
+}
+export async function prepareWorkflowManagedDirectories(config) {
+    await mkdir(config.outDir, { recursive: true });
+    const initialInspection = await inspectWorkflowManagedPaths(config);
+    if (initialInspection.status === "unsafe") {
+        throw new Error(initialInspection.issues[0].message);
+    }
+    await mkdir(config.paths.reportsDir, { recursive: true });
+    if (config.packageReports) {
+        await mkdir(config.paths.packagesDir, { recursive: true });
+    }
+    const inspection = await inspectWorkflowManagedPaths(config);
+    if (inspection.status === "unsafe") {
+        throw new Error(inspection.issues[0].message);
+    }
+}
+//# sourceMappingURL=workflow-paths.js.map

package/dist/workflow-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-paths.js","sourceRoot":"","sources":["../src/workflow-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AA2BtD,MAAM,mBAAmB,GAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAE1E,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnG,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,YAAsC;IAEtC,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAA8B,EAC9B,eAAkD,EAAE;IAEpD,MAAM,oBAAoB,GAA6B,EAAE,GAAG,mBAAmB,EAAE,GAAG,YAAY,EAAE,CAAC;IACnG,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;QAChC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN;oBACE,EAAE,EAAE,eAAe;oBACnB,OAAO,EAAE,6CAA6C;oBACtD,IAAI,EAAE,MAAM,CAAC,MAAM;iBACpB;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG;QAClB;YACE,EAAE,EAAE,SAAkB;YACtB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;SAC9B;QACD,GAAG,CAAC,MAAM,CAAC,cAAc;YACvB,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,UAAmB;oBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;iBAC/B;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI;QACjB,MAAM,CAAC,KAAK,CAAC,QAAQ;QACrB,MAAM,CAAC,KAAK,CAAC,oBAAoB;QACjC,MAAM,CAAC,KAAK,CAAC,YAAY;QACzB,MAAM,CAAC,KAAK,CAAC,oBAAoB;QACjC,MAAM,CAAC,KAAK,CAAC,iBAAiB;QAC9B,MAAM,CAAC,KAAK,CAAC,mBAAmB;KACjC,EAAE,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC5D,IAAI,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,qBAAqB;gBACzB,OAAO,EAAE,wCAAwC;gBACjD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QAED,IAAI,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,GAAG,SAAS,CAAC,EAAE,SAAS;gBAC5B,OAAO,EAAE,WAAW,SAAS,CAAC,EAAE,+BAA+B;gBAC/D,IAAI,EAAE,SAAS,CAAC,IAAI;aACrB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,iBAAiB,GAAG,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC9D,IACE,iBAAiB,KAAK,IAAI;YAC1B,iBAAiB,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,UAAU,CAAC,iBAAiB,CAAC,EAC7B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,GAAG,SAAS,CAAC,EAAE,SAAS;gBAC5B,OAAO,EAAE,WAAW,SAAS,CAAC,EAAE,qCAAqC;gBACrE,IAAI,EAAE,SAAS,CAAC,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,MAA8B;IACpF,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,iBAAiB,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,iBAAiB,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/workflow-preflight.d.ts

@@ -0,0 +1,38 @@
+import type { Stats } from "node:fs";
+import type { ResolvedWorkflowConfig, WorkflowManagedPaths } from "./workflow-config.js";
+import type { WorkflowPathInspection } from "./workflow-paths.js";
+export type WorkflowPreflightStatus = "ready" | "blocked";
+export type WorkflowPreflightCheckStatus = "pass" | "warn" | "fail";
+export type WorkflowPreflightStage = "discovery" | "shortlist" | "review" | "packaging";
+export type WorkflowPreflightCheckId = "configuration" | "discovery-input" | "google-api-key" | "review-csv" | "output-access" | "managed-paths";
+export interface WorkflowPreflightCheck {
+    id: WorkflowPreflightCheckId;
+    status: WorkflowPreflightCheckStatus;
+    message: string;
+    path?: string;
+}
+export interface WorkflowPreflightReport {
+    version: 1;
+    status: WorkflowPreflightStatus;
+    checks: WorkflowPreflightCheck[];
+    provider?: "manual-csv" | "google-places";
+    stages?: WorkflowPreflightStage[];
+    outputs?: {
+        outDir: string;
+    } & WorkflowManagedPaths;
+    limits?: {
+        maxCandidates: number | null;
+        maxAudits: number | null;
+    };
+}
+export interface WorkflowPreflightDependencies {
+    readWorkflowConfig(configPath: string): Promise<ResolvedWorkflowConfig>;
+    resolveGoogleMapsApiKey(): string | undefined;
+    lstat(path: string): Promise<Stats>;
+    access(path: string, mode?: number): Promise<void>;
+    inspectWorkflowManagedPaths(config: ResolvedWorkflowConfig): Promise<WorkflowPathInspection>;
+}
+export declare function renderWorkflowPreflightTerminal(report: WorkflowPreflightReport, configPath: string): string;
+export declare function renderWorkflowPreflightJson(report: WorkflowPreflightReport): string;
+export declare function runWorkflowPreflight(configPath: string): Promise<WorkflowPreflightReport>;
+export declare function runWorkflowPreflightWithDependencies(configPath: string, overrides?: Partial<WorkflowPreflightDependencies>): Promise<WorkflowPreflightReport>;

package/dist/workflow-preflight.js

@@ -0,0 +1,206 @@
+import { constants } from "node:fs";
+import { access, lstat } from "node:fs/promises";
+import { dirname } from "node:path";
+import { ZodError } from "zod";
+import { readWorkflowConfig } from "./workflow-config.js";
+import { inspectWorkflowManagedPaths } from "./workflow-paths.js";
+import { resolveGoogleMapsApiKey } from "./secrets.js";
+const defaultDependencies = {
+    readWorkflowConfig,
+    resolveGoogleMapsApiKey,
+    lstat,
+    access,
+    inspectWorkflowManagedPaths
+};
+function hasErrorCode(error, code) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+function isFilesystemReadinessError(error) {
+    return ["ENOENT", "EACCES", "EPERM", "EISDIR", "ENOTDIR", "ELOOP", "ENAMETOOLONG", "EIO", "ESTALE"].some((code) => hasErrorCode(error, code));
+}
+function isInvalidWorkflowConfigJsonError(error) {
+    return Boolean(error &&
+        typeof error === "object" &&
+        "cause" in error &&
+        error.cause instanceof SyntaxError &&
+        error instanceof Error &&
+        error.message.startsWith("Workflow config ") &&
+        error.message.endsWith(" contains invalid JSON"));
+}
+function isExpectedWorkflowConfigError(error) {
+    return isFilesystemReadinessError(error) || error instanceof ZodError || isInvalidWorkflowConfigJsonError(error);
+}
+async function isReadableRegularFile(path, dependencies) {
+    try {
+        const info = await dependencies.lstat(path);
+        if (!info.isFile()) {
+            return "invalid";
+        }
+        await dependencies.access(path, constants.R_OK);
+        return "readable";
+    }
+    catch (error) {
+        if (!isFilesystemReadinessError(error)) {
+            throw error;
+        }
+        return hasErrorCode(error, "ENOENT") ? "missing" : "invalid";
+    }
+}
+async function findWritableOutputAncestor(outDir, dependencies) {
+    let ancestor = outDir;
+    while (true) {
+        let info;
+        try {
+            info = await dependencies.lstat(ancestor);
+        }
+        catch (error) {
+            if (!hasErrorCode(error, "ENOENT")) {
+                if (isFilesystemReadinessError(error)) {
+                    return false;
+                }
+                throw error;
+            }
+            const parent = dirname(ancestor);
+            if (parent === ancestor) {
+                return false;
+            }
+            ancestor = parent;
+            continue;
+        }
+        if (!info.isDirectory()) {
+            return false;
+        }
+        try {
+            await dependencies.access(ancestor, constants.W_OK);
+            return true;
+        }
+        catch (error) {
+            if (isFilesystemReadinessError(error)) {
+                return false;
+            }
+            throw error;
+        }
+    }
+}
+function reportStatus(checks) {
+    return checks.some((check) => check.status === "fail") ? "blocked" : "ready";
+}
+export function renderWorkflowPreflightTerminal(report, configPath) {
+    const details = [
+        ...(report.stages ? [`Stages: ${report.stages.join(" -> ")}`] : []),
+        ...(report.outputs ? [`Managed output: ${report.outputs.outDir}`] : [])
+    ];
+    const lines = [
+        `Workflow preflight: ${report.status.toUpperCase()}`,
+        `Config: ${configPath}`,
+        ...(report.provider ? [`Provider: ${report.provider}`] : []),
+        "",
+        ...report.checks.map((check) => `${check.status.toUpperCase().padEnd(5)} ${check.message}`),
+        ...(details.length > 0 ? ["", ...details] : [])
+    ];
+    return `${lines.join("\n")}\n`;
+}
+export function renderWorkflowPreflightJson(report) {
+    return `${JSON.stringify(report, null, 2)}\n`;
+}
+export async function runWorkflowPreflight(configPath) {
+    return runWorkflowPreflightWithDependencies(configPath);
+}
+export async function runWorkflowPreflightWithDependencies(configPath, overrides = {}) {
+    const dependencies = { ...defaultDependencies, ...overrides };
+    let config;
+    try {
+        config = await dependencies.readWorkflowConfig(configPath);
+    }
+    catch (error) {
+        if (!isExpectedWorkflowConfigError(error)) {
+            throw error;
+        }
+        return {
+            version: 1,
+            status: "blocked",
+            checks: [
+                {
+                    id: "configuration",
+                    status: "fail",
+                    message: "Workflow configuration could not be read or validated"
+                }
+            ]
+        };
+    }
+    const checks = [
+        { id: "configuration", status: "pass", message: "Workflow configuration is valid" }
+    ];
+    if (config.discovery.provider === "manual-csv") {
+        const inputStatus = await isReadableRegularFile(config.discovery.input, dependencies);
+        checks.push({
+            id: "discovery-input",
+            status: inputStatus === "readable" ? "pass" : "fail",
+            message: inputStatus === "readable" ? "Discovery input is readable" : "Discovery input must be a readable regular file",
+            path: config.discovery.input
+        });
+    }
+    else {
+        const hasApiKey = Boolean(dependencies.resolveGoogleMapsApiKey()?.trim());
+        checks.push({
+            id: "google-api-key",
+            status: hasApiKey ? "pass" : "fail",
+            message: hasApiKey ? "Google Maps API key is available" : "Google Maps API key is required"
+        });
+    }
+    if (config.review) {
+        const reviewStatus = await isReadableRegularFile(config.review.csv, dependencies);
+        checks.push({
+            id: "review-csv",
+            status: reviewStatus === "readable" ? "pass" : reviewStatus === "missing" ? "warn" : "fail",
+            message: reviewStatus === "readable"
+                ? "Review CSV is readable"
+                : reviewStatus === "missing"
+                    ? "Review CSV does not exist and will be created"
+                    : "Review CSV must be a readable regular file",
+            path: config.review.csv
+        });
+    }
+    const outputWritable = await findWritableOutputAncestor(config.outDir, dependencies);
+    checks.push({
+        id: "output-access",
+        status: outputWritable ? "pass" : "fail",
+        message: outputWritable ? "Output location is writable" : "Output location is not writable",
+        path: config.outDir
+    });
+    try {
+        const inspection = await dependencies.inspectWorkflowManagedPaths(config);
+        for (const issue of inspection.issues) {
+            checks.push({ id: "managed-paths", status: "fail", message: issue.message, path: issue.path });
+        }
+    }
+    catch (error) {
+        if (!isFilesystemReadinessError(error)) {
+            throw error;
+        }
+        checks.push({
+            id: "managed-paths",
+            status: "fail",
+            message: "Managed output paths could not be inspected safely"
+        });
+    }
+    const stages = [
+        "discovery",
+        "shortlist",
+        ...(config.review ? ["review"] : []),
+        ...(config.packageReports ? ["packaging"] : [])
+    ];
+    return {
+        version: 1,
+        status: reportStatus(checks),
+        checks,
+        provider: config.discovery.provider,
+        stages,
+        outputs: { outDir: config.outDir, ...config.paths },
+        limits: {
+            maxCandidates: config.discovery.provider === "google-places" ? config.discovery.limit : null,
+            maxAudits: config.discovery.maxAudits ?? null
+        }
+    };
+}
+//# sourceMappingURL=workflow-preflight.js.map

package/dist/workflow-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-preflight.js","sourceRoot":"","sources":["../src/workflow-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAsCvD,MAAM,mBAAmB,GAAkC;IACzD,kBAAkB;IAClB,uBAAuB;IACvB,KAAK;IACL,MAAM;IACN,2BAA2B;CAC5B,CAAC;AAEF,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAChH,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CAAC,KAAc;IACtD,OAAO,OAAO,CACZ,KAAK;QACH,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,IAAI,KAAK;QAChB,KAAK,CAAC,KAAK,YAAY,WAAW;QAClC,KAAK,YAAY,KAAK;QACtB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAc;IACnD,OAAO,0BAA0B,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,QAAQ,IAAI,gCAAgC,CAAC,KAAK,CAAC,CAAC;AACnH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,YAA2C;IAE3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,MAAc,EACd,YAA2C;IAE3C,IAAI,QAAQ,GAAG,MAAM,CAAC;IAEtB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,IAAW,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACnC,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtC,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC;YAClB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAgC;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAA+B,EAAE,UAAkB;IACjG,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,uBAAuB,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;QACpD,WAAW,UAAU,EAAE;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,EAAE;QACF,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IAEF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAA+B;IACzE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IAC3D,OAAO,oCAAoC,CAAC,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,UAAkB,EAClB,YAAoD,EAAE;IAEtD,MAAM,YAAY,GAAkC,EAAE,GAAG,mBAAmB,EAAE,GAAG,SAAS,EAAE,CAAC;IAC7F,IAAI,MAA8B,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE;gBACN;oBACE,EAAE,EAAE,eAAe;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,uDAAuD;iBACjE;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iCAAiC,EAAE;KACpF,CAAC;IAEF,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,iBAAiB;YACrB,MAAM,EAAE,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACpD,OAAO,EAAE,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,iDAAiD;YACvH,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK;SAC7B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,gBAAgB;YACpB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACnC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,iCAAiC;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,YAAY;YAChB,MAAM,EAAE,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC3F,OAAO,EACL,YAAY,KAAK,UAAU;gBACzB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,YAAY,KAAK,SAAS;oBAC1B,CAAC,CAAC,+CAA+C;oBACjD,CAAC,CAAC,4CAA4C;YACpD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrF,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,eAAe;QACnB,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACxC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,iCAAiC;QAC3F,IAAI,EAAE,MAAM,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC1E,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,eAAe;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,WAAW;QACX,WAAW;QACX,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;QAC5B,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;QACnC,MAAM;QACN,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE;QACnD,MAAM,EAAE;YACN,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YAC5F,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,IAAI,IAAI;SAC9C;KACF,CAAC;AACJ,CAAC"}

package/dist/workflow.js

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { lstat, mkdir, mkdtemp, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, mkdtemp, realpath, rename, rm } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { runDiscovery } from "./discovery-runner.js";
 import { packageReport } from "./report-pack.js";
@@ -7,6 +7,8 @@ import { summarizeReviewCsvFile } from "./review.js";
 import { runShortlistReport } from "./shortlist-runner.js";
 import { resolveGoogleMapsApiKey } from "./secrets.js";
 import { readWorkflowConfig } from "./workflow-config.js";
+import { prepareWorkflowManagedDirectories } from "./workflow-paths.js";
+import { writeWorkflowOutputFile } from "./workflow-output.js";
 export class WorkflowRunError extends Error {
     summary;
     constructor(summary) {
@@ -94,7 +96,7 @@ function createInitialSummary(config) {
 }
 async function writePrettyJson(path, value) {
     await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+    await writeWorkflowOutputFile(path, `${JSON.stringify(value, null, 2)}\n`);
 }
 async function writeWorkflowSummary(summary) {
     await writePrettyJson(summary.outputs.workflowSummaryJson, summary);
@@ -120,30 +122,6 @@ function markStageFailure(summary, stage, message) {
         message
     };
 }
-async function prepareManagedDirectories(config) {
-    await mkdir(config.outDir, { recursive: true });
-    const outputInfo = await lstat(config.outDir);
-    if (outputInfo.isSymbolicLink()) {
-        throw new Error("Managed output directory must not be linked");
-    }
-    const realOutDir = await realpath(config.outDir);
-    const directories = [
-        { label: "reports", path: config.paths.reportsDir },
-        ...(config.packageReports ? [{ label: "packages", path: config.paths.packagesDir }] : [])
-    ];
-    for (const directory of directories) {
-        await mkdir(directory.path, { recursive: true });
-        const directoryInfo = await lstat(directory.path);
-        if (directoryInfo.isSymbolicLink()) {
-            throw new Error(`Managed ${directory.label} directory must not be linked`);
-        }
-        const realDirectory = await realpath(directory.path);
-        const relativeDirectory = relative(realOutDir, realDirectory);
-        if (relativeDirectory.startsWith("..") || isAbsolute(relativeDirectory)) {
-            throw new Error(`Managed ${directory.label} directory escapes output directory`);
-        }
-    }
-}
 async function resolvePackageInputDir(reportsDir, reportPath) {
     const resolvedReportPath = resolve(reportsDir, reportPath);
     const relativePath = relative(reportsDir, resolvedReportPath);
@@ -271,7 +249,7 @@ export async function runResolvedWorkflow(config, dependencies = {}) {
         ...defaultDependencies,
         ...dependencies
     };
-    await prepareManagedDirectories(config);
+    await prepareWorkflowManagedDirectories(config);
     const summary = createInitialSummary(config);
     const knownSecrets = [];
     try {
@@ -285,6 +263,7 @@ export async function runResolvedWorkflow(config, dependencies = {}) {
             ...(config.discovery.provider === "google-places" ? { query: config.discovery.query } : {}),
             profile: config.discovery.profile,
             outDir: config.paths.reportsDir,
+            managedOutputRoot: config.paths.reportsDir,
             exportCsv: config.paths.leadsCsv,
             summaryJson: config.paths.discoverySummaryJson,
             reviewCsv: config.review?.csv,