open-local-audit 0.62.0 → 0.64.0

package/dist/output.js

@@ -2,6 +2,7 @@ import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { renderPdfReport } from "./pdf.js";
 import { renderHtmlReport, renderJsonReport, renderMarkdownReport } from "./reporters.js";
+import { writeWorkflowOutputFile } from "./workflow-output.js";
 async function outputFor(report, format, options) {
     const pretty = options.pretty ?? false;
     return {
@@ -32,10 +33,19 @@ export async function writeReportOutputs(report, options) {
         throw new Error("--out or --out-dir is required when --format pdf is used");
     }
     if (options.outDir) {
-        await mkdir(options.outDir, { recursive: true });
+        if (!options.managedOutputRoot) {
+            await mkdir(options.outDir, { recursive: true });
+        }
         for (const output of outputs) {
             output.path = join(options.outDir, defaultReportName(output.format));
-            await writeFile(output.path, output.content);
+            if (options.managedOutputRoot) {
+                await writeWorkflowOutputFile(output.path, output.content, {
+                    managedOutputRoot: options.managedOutputRoot
+                });
+            }
+            else {
+                await writeFile(output.path, output.content);
+            }
         }
         return outputs;
     }
@@ -44,7 +54,14 @@ export async function writeReportOutputs(report, options) {
     }
     if (options.out) {
         outputs[0].path = options.out;
-        await writeFile(options.out, outputs[0].content);
+        if (options.managedOutputRoot) {
+            await writeWorkflowOutputFile(options.out, outputs[0].content, {
+                managedOutputRoot: options.managedOutputRoot
+            });
+        }
+        else {
+            await writeFile(options.out, outputs[0].content);
+        }
     }
     return outputs;
 }

package/dist/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAmB1F,KAAK,UAAU,SAAS,CACtB,MAAmB,EACnB,MAAoC,EACpC,OAAsD;IAEtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,OAAO;QACL,MAAM;QACN,OAAO,EACL,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;YAClC,CAAC,CAAC,MAAM,KAAK,UAAU;gBACrB,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBACxD,CAAC,CAAC,MAAM,KAAK,MAAM;oBACjB,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;oBACpD,CAAC,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAoC;IAC7D,MAAM,SAAS,GAAG;QAChB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,KAAK;KACX,CAAC,MAAM,CAAC,CAAC;IAEV,OAAO,2BAA2B,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAmB,EAAE,OAA4B;IACxF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAExH,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACrE,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;QAC9B,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAmB/D,KAAK,UAAU,SAAS,CACtB,MAAmB,EACnB,MAAoC,EACpC,OAAsD;IAEtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,OAAO;QACL,MAAM;QACN,OAAO,EACL,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;YAClC,CAAC,CAAC,MAAM,KAAK,UAAU;gBACrB,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBACxD,CAAC,CAAC,MAAM,KAAK,MAAM;oBACjB,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;oBACpD,CAAC,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAoC;IAC7D,MAAM,SAAS,GAAG;QAChB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,KAAK;KACX,CAAC,MAAM,CAAC,CAAC;IAEV,OAAO,2BAA2B,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAmB,EAAE,OAA4B;IACxF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAExH,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACrE,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBAC9B,MAAM,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE;oBACzD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;iBAC7C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;QAC9B,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;gBAC7D,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;aAC7C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/shortlist-runner.js

@@ -1,6 +1,7 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { buildLeadShortlist, readShortlistReviewCsv, renderShortlistCsv, renderShortlistJson, renderShortlistMarkdown, renderShortlistSummaryJson } from "./shortlist.js";
+import { writeWorkflowOutputFile } from "./workflow-output.js";
 export async function runShortlistReport(options) {
     const input = await readFile(options.input, "utf8");
     const reviewRows = options.reviewCsv ? readShortlistReviewCsv(await readFile(options.reviewCsv, "utf8")) : [];
@@ -14,10 +15,10 @@ export async function runShortlistReport(options) {
             ? renderShortlistCsv(result)
             : renderShortlistMarkdown(result);
     await mkdir(dirname(options.out), { recursive: true });
-    await writeFile(options.out, output, "utf8");
+    await writeWorkflowOutputFile(options.out, output);
     if (options.summaryJson) {
         await mkdir(dirname(options.summaryJson), { recursive: true });
-        await writeFile(options.summaryJson, renderShortlistSummaryJson(result), "utf8");
+        await writeWorkflowOutputFile(options.summaryJson, renderShortlistSummaryJson(result));
     }
     return result;
 }

package/dist/shortlist-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"shortlist-runner.js","sourceRoot":"","sources":["../src/shortlist-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAI3B,MAAM,gBAAgB,CAAC;AAWxB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA4B;IACnE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE;QACvC,GAAG,OAAO,CAAC,SAAS;QACpB,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,MAAM;QACvB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK;YACxB,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC5B,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAExC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACnF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"shortlist-runner.js","sourceRoot":"","sources":["../src/shortlist-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAI3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAW/D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA4B;IACnE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE;QACvC,GAAG,OAAO,CAAC,SAAS;QACpB,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,MAAM;QACvB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK;YACxB,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC5B,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAExC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/workflow-output.d.ts

@@ -0,0 +1,5 @@
+interface WorkflowOutputWriteOptions {
+    managedOutputRoot?: string;
+}
+export declare function writeWorkflowOutputFile(path: string, content: string | Uint8Array, options?: WorkflowOutputWriteOptions): Promise<void>;
+export {};

package/dist/workflow-output.js

@@ -0,0 +1,70 @@
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+function isMissingPath(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+function isContainedPath(root, path) {
+    const relativePath = relative(root, path);
+    return relativePath === "" || (!relativePath.startsWith(`..${sep}`) && relativePath !== ".." && !isAbsolute(relativePath));
+}
+async function ensureManagedOutputDirectory(directory, managedOutputRoot) {
+    const resolvedRoot = resolve(managedOutputRoot);
+    const resolvedDirectory = resolve(directory);
+    if (!isContainedPath(resolvedRoot, resolvedDirectory)) {
+        throw new Error("Managed output directory escapes managed output root");
+    }
+    async function inspectDirectory() {
+        const rootInfo = await lstat(resolvedRoot);
+        if (rootInfo.isSymbolicLink()) {
+            throw new Error("Managed output directory must not be linked");
+        }
+        if (!rootInfo.isDirectory()) {
+            throw new Error("Managed output directory must be a directory");
+        }
+        let directoryInfo;
+        try {
+            directoryInfo = await lstat(resolvedDirectory);
+        }
+        catch (error) {
+            if (isMissingPath(error)) {
+                return false;
+            }
+            throw error;
+        }
+        if (directoryInfo.isSymbolicLink()) {
+            throw new Error("Managed output directory must not be linked");
+        }
+        if (!directoryInfo.isDirectory()) {
+            throw new Error("Managed output directory must be a directory");
+        }
+        const [realRoot, realDirectory] = await Promise.all([realpath(resolvedRoot), realpath(resolvedDirectory)]);
+        if (!isContainedPath(realRoot, realDirectory)) {
+            throw new Error("Managed output directory escapes managed output root");
+        }
+        return true;
+    }
+    if (!(await inspectDirectory())) {
+        await mkdir(resolvedDirectory, { recursive: true });
+        await inspectDirectory();
+    }
+}
+export async function writeWorkflowOutputFile(path, content, options = {}) {
+    if (options.managedOutputRoot) {
+        await ensureManagedOutputDirectory(dirname(path), options.managedOutputRoot);
+    }
+    const temporaryPath = join(dirname(path), `.${basename(path)}-${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporaryPath, content, "utf8");
+        await rename(temporaryPath, path);
+    }
+    finally {
+        try {
+            await rm(temporaryPath, { force: true });
+        }
+        catch {
+            // Preserve the write or replacement failure when its temporary cleanup also fails.
+        }
+    }
+}
+//# sourceMappingURL=workflow-output.js.map

package/dist/workflow-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-output.js","sourceRoot":"","sources":["../src/workflow-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAMxF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO,YAAY,KAAK,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,SAAiB,EAAE,iBAAyB;IACtF,MAAM,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,UAAU,gBAAgB;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,aAAa,CAAC;QAClB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,gBAAgB,EAAE,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,gBAAgB,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAY,EACZ,OAA4B,EAC5B,UAAsC,EAAE;IAExC,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,MAAM,4BAA4B,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IAEpF,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/workflow-paths.d.ts

@@ -0,0 +1,19 @@
+import { lstat } from "node:fs/promises";
+import type { ResolvedWorkflowConfig } from "./workflow-config.js";
+export type WorkflowPathIssueId = "output-linked" | "reports-linked" | "packages-linked" | "managed-file-linked" | "reports-escape" | "packages-escape";
+export interface WorkflowPathIssue {
+    id: WorkflowPathIssueId;
+    message: string;
+    path: string;
+}
+export interface WorkflowPathInspection {
+    status: "safe" | "unsafe";
+    issues: WorkflowPathIssue[];
+}
+interface WorkflowPathDependencies {
+    lstat(path: string): ReturnType<typeof lstat>;
+    realpath(path: string): Promise<string>;
+}
+export declare function inspectWorkflowManagedPaths(config: ResolvedWorkflowConfig, dependencies?: Partial<WorkflowPathDependencies>): Promise<WorkflowPathInspection>;
+export declare function prepareWorkflowManagedDirectories(config: ResolvedWorkflowConfig): Promise<void>;
+export {};

package/dist/workflow-paths.js

@@ -0,0 +1,111 @@
+import { lstat, mkdir, realpath } from "node:fs/promises";
+import { isAbsolute, relative, sep } from "node:path";
+const defaultDependencies = { lstat, realpath };
+function isMissingPath(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+async function pathInfo(path, dependencies) {
+    try {
+        return await dependencies.lstat(path);
+    }
+    catch (error) {
+        if (isMissingPath(error)) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+export async function inspectWorkflowManagedPaths(config, dependencies = {}) {
+    const resolvedDependencies = { ...defaultDependencies, ...dependencies };
+    const outputInfo = await pathInfo(config.outDir, resolvedDependencies);
+    if (!outputInfo) {
+        return { status: "safe", issues: [] };
+    }
+    if (outputInfo.isSymbolicLink()) {
+        return {
+            status: "unsafe",
+            issues: [
+                {
+                    id: "output-linked",
+                    message: "Managed output directory must not be linked",
+                    path: config.outDir
+                }
+            ]
+        };
+    }
+    const realOutDir = await resolvedDependencies.realpath(config.outDir);
+    const directories = [
+        {
+            id: "reports",
+            path: config.paths.reportsDir
+        },
+        ...(config.packageReports
+            ? [
+                {
+                    id: "packages",
+                    path: config.paths.packagesDir
+                }
+            ]
+            : [])
+    ];
+    const issues = [];
+    for (const path of [
+        config.paths.leadsCsv,
+        config.paths.discoverySummaryJson,
+        config.paths.shortlistCsv,
+        config.paths.shortlistSummaryJson,
+        config.paths.reviewSummaryJson,
+        config.paths.workflowSummaryJson
+    ]) {
+        const fileInfo = await pathInfo(path, resolvedDependencies);
+        if (fileInfo?.isSymbolicLink()) {
+            issues.push({
+                id: "managed-file-linked",
+                message: "Managed output file must not be linked",
+                path
+            });
+        }
+    }
+    for (const directory of directories) {
+        const directoryInfo = await pathInfo(directory.path, resolvedDependencies);
+        if (!directoryInfo) {
+            continue;
+        }
+        if (directoryInfo.isSymbolicLink()) {
+            issues.push({
+                id: `${directory.id}-linked`,
+                message: `Managed ${directory.id} directory must not be linked`,
+                path: directory.path
+            });
+            continue;
+        }
+        const realDirectory = await resolvedDependencies.realpath(directory.path);
+        const relativeDirectory = relative(realOutDir, realDirectory);
+        if (relativeDirectory === ".." ||
+            relativeDirectory.startsWith(`..${sep}`) ||
+            isAbsolute(relativeDirectory)) {
+            issues.push({
+                id: `${directory.id}-escape`,
+                message: `Managed ${directory.id} directory escapes output directory`,
+                path: directory.path
+            });
+        }
+    }
+    return issues.length === 0 ? { status: "safe", issues } : { status: "unsafe", issues };
+}
+export async function prepareWorkflowManagedDirectories(config) {
+    await mkdir(config.outDir, { recursive: true });
+    const initialInspection = await inspectWorkflowManagedPaths(config);
+    if (initialInspection.status === "unsafe") {
+        throw new Error(initialInspection.issues[0].message);
+    }
+    await mkdir(config.paths.reportsDir, { recursive: true });
+    if (config.packageReports) {
+        await mkdir(config.paths.packagesDir, { recursive: true });
+    }
+    const inspection = await inspectWorkflowManagedPaths(config);
+    if (inspection.status === "unsafe") {
+        throw new Error(inspection.issues[0].message);
+    }
+}
+//# sourceMappingURL=workflow-paths.js.map

package/dist/workflow-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-paths.js","sourceRoot":"","sources":["../src/workflow-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AA2BtD,MAAM,mBAAmB,GAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAE1E,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnG,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,YAAsC;IAEtC,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAA8B,EAC9B,eAAkD,EAAE;IAEpD,MAAM,oBAAoB,GAA6B,EAAE,GAAG,mBAAmB,EAAE,GAAG,YAAY,EAAE,CAAC;IACnG,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;QAChC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN;oBACE,EAAE,EAAE,eAAe;oBACnB,OAAO,EAAE,6CAA6C;oBACtD,IAAI,EAAE,MAAM,CAAC,MAAM;iBACpB;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG;QAClB;YACE,EAAE,EAAE,SAAkB;YACtB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;SAC9B;QACD,GAAG,CAAC,MAAM,CAAC,cAAc;YACvB,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,UAAmB;oBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;iBAC/B;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI;QACjB,MAAM,CAAC,KAAK,CAAC,QAAQ;QACrB,MAAM,CAAC,KAAK,CAAC,oBAAoB;QACjC,MAAM,CAAC,KAAK,CAAC,YAAY;QACzB,MAAM,CAAC,KAAK,CAAC,oBAAoB;QACjC,MAAM,CAAC,KAAK,CAAC,iBAAiB;QAC9B,MAAM,CAAC,KAAK,CAAC,mBAAmB;KACjC,EAAE,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC5D,IAAI,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,qBAAqB;gBACzB,OAAO,EAAE,wCAAwC;gBACjD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QAED,IAAI,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,GAAG,SAAS,CAAC,EAAE,SAAS;gBAC5B,OAAO,EAAE,WAAW,SAAS,CAAC,EAAE,+BAA+B;gBAC/D,IAAI,EAAE,SAAS,CAAC,IAAI;aACrB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,iBAAiB,GAAG,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC9D,IACE,iBAAiB,KAAK,IAAI;YAC1B,iBAAiB,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,UAAU,CAAC,iBAAiB,CAAC,EAC7B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,GAAG,SAAS,CAAC,EAAE,SAAS;gBAC5B,OAAO,EAAE,WAAW,SAAS,CAAC,EAAE,qCAAqC;gBACrE,IAAI,EAAE,SAAS,CAAC,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,MAA8B;IACpF,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,iBAAiB,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,iBAAiB,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/workflow-plan.d.ts

@@ -0,0 +1,47 @@
+import type { WorkflowPreflightEvaluation, WorkflowPreflightReport, WorkflowPreflightStatus } from "./workflow-preflight.js";
+import type { ResolvedWorkflowConfig } from "./workflow-config.js";
+export type WorkflowPlanStatus = WorkflowPreflightStatus;
+export type WorkflowPlanStepId = "discovery" | "shortlist" | "review" | "packaging" | "summary";
+export type WorkflowPlanStepState = "will-run" | "conditional" | "disabled";
+export type WorkflowPlanNetworkAccess = "google-places" | "website-audits";
+export type WorkflowPlanArtifactId = "manual-input-csv" | "review-csv" | "leads-csv" | "discovery-summary-json" | "reports-dir" | "shortlist-csv" | "shortlist-summary-json" | "review-summary-json" | "packages-dir" | "workflow-summary-json";
+interface WorkflowPlanStepBase<Id extends WorkflowPlanStepId, State extends WorkflowPlanStepState, Settings> {
+    id: Id;
+    state: State;
+    dependsOn: WorkflowPlanStepId[];
+    inputs: WorkflowPlanArtifactId[];
+    outputs: WorkflowPlanArtifactId[];
+    networkAccess: WorkflowPlanNetworkAccess[];
+    reason?: string;
+    settings: Settings;
+}
+export type WorkflowPlanStep = WorkflowPlanStepBase<"discovery", "will-run", {
+    provider: ResolvedWorkflowConfig["discovery"]["provider"];
+    profile: ResolvedWorkflowConfig["discovery"]["profile"];
+    concurrency: number;
+    maxCandidates: number | null;
+    maxAudits: number | null;
+}> | WorkflowPlanStepBase<"shortlist", "will-run", {
+    top: number;
+    minOpportunityScore: number | null;
+    sort: ResolvedWorkflowConfig["shortlist"]["sort"];
+}> | WorkflowPlanStepBase<"review", "will-run" | "disabled", {
+    staleBefore: string | null;
+}> | WorkflowPlanStepBase<"packaging", "conditional" | "disabled", {
+    enabled: boolean;
+}> | WorkflowPlanStepBase<"summary", "will-run", Record<string, never>>;
+export interface WorkflowPlanReport {
+    version: 1;
+    status: WorkflowPlanStatus;
+    preflight: WorkflowPreflightReport;
+    artifacts: Partial<Record<WorkflowPlanArtifactId, string>>;
+    steps: WorkflowPlanStep[];
+}
+interface WorkflowPlanDependencies {
+    evaluatePreflight(configPath: string): Promise<WorkflowPreflightEvaluation>;
+}
+export declare function renderWorkflowPlanTerminal(report: WorkflowPlanReport, configPath: string): string;
+export declare function renderWorkflowPlanJson(report: WorkflowPlanReport): string;
+export declare function runWorkflowPlan(configPath: string): Promise<WorkflowPlanReport>;
+export declare function runWorkflowPlanWithDependencies(configPath: string, overrides?: Partial<WorkflowPlanDependencies>): Promise<WorkflowPlanReport>;
+export {};

package/dist/workflow-plan.js

@@ -0,0 +1,186 @@
+import { runWorkflowPreflightEvaluationWithDependencies } from "./workflow-preflight.js";
+const workflowPlanArtifactIds = [
+    "manual-input-csv",
+    "review-csv",
+    "leads-csv",
+    "discovery-summary-json",
+    "reports-dir",
+    "shortlist-csv",
+    "shortlist-summary-json",
+    "review-summary-json",
+    "packages-dir",
+    "workflow-summary-json"
+];
+const defaultDependencies = {
+    evaluatePreflight: runWorkflowPreflightEvaluationWithDependencies
+};
+function buildPlan(evaluation) {
+    const { config, report: preflight } = evaluation;
+    if (!config) {
+        return { version: 1, status: preflight.status, preflight, artifacts: {}, steps: [] };
+    }
+    const artifacts = {
+        ...(config.discovery.provider === "manual-csv" ? { "manual-input-csv": config.discovery.input } : {}),
+        ...(config.review ? { "review-csv": config.review.csv } : {}),
+        "leads-csv": config.paths.leadsCsv,
+        "discovery-summary-json": config.paths.discoverySummaryJson,
+        "reports-dir": config.paths.reportsDir,
+        "shortlist-csv": config.paths.shortlistCsv,
+        "shortlist-summary-json": config.paths.shortlistSummaryJson,
+        ...(config.review ? { "review-summary-json": config.paths.reviewSummaryJson } : {}),
+        ...(config.packageReports ? { "packages-dir": config.paths.packagesDir } : {}),
+        "workflow-summary-json": config.paths.workflowSummaryJson
+    };
+    const reviewEnabled = Boolean(config.review);
+    const packagingEnabled = config.packageReports;
+    const discoveryNetworkAccess = [
+        ...(config.discovery.provider === "google-places" ? ["google-places"] : []),
+        ...(config.discovery.maxAudits === 0 ? [] : ["website-audits"])
+    ];
+    const summaryDependency = packagingEnabled ? "packaging" : reviewEnabled ? "review" : "shortlist";
+    const steps = [
+        {
+            id: "discovery",
+            state: "will-run",
+            dependsOn: [],
+            inputs: [
+                ...(config.discovery.provider === "manual-csv" ? ["manual-input-csv"] : []),
+                ...(config.review ? ["review-csv"] : [])
+            ],
+            outputs: [
+                "leads-csv",
+                "discovery-summary-json",
+                "reports-dir",
+                ...(config.review ? ["review-csv"] : [])
+            ],
+            networkAccess: discoveryNetworkAccess,
+            settings: {
+                provider: config.discovery.provider,
+                profile: config.discovery.profile,
+                concurrency: config.discovery.concurrency,
+                maxCandidates: config.discovery.provider === "google-places" ? config.discovery.limit : null,
+                maxAudits: config.discovery.maxAudits ?? null
+            }
+        },
+        {
+            id: "shortlist",
+            state: "will-run",
+            dependsOn: ["discovery"],
+            inputs: ["leads-csv", ...(config.review ? ["review-csv"] : [])],
+            outputs: ["shortlist-csv", "shortlist-summary-json"],
+            networkAccess: [],
+            settings: {
+                top: config.shortlist.top,
+                minOpportunityScore: config.shortlist.minOpportunityScore ?? null,
+                sort: config.shortlist.sort
+            }
+        },
+        config.review
+            ? {
+                id: "review",
+                state: "will-run",
+                dependsOn: ["shortlist"],
+                inputs: ["review-csv"],
+                outputs: ["review-summary-json"],
+                networkAccess: [],
+                settings: { staleBefore: config.review.staleBefore ?? null }
+            }
+            : {
+                id: "review",
+                state: "disabled",
+                dependsOn: [],
+                inputs: [],
+                outputs: [],
+                networkAccess: [],
+                reason: "Review is not configured",
+                settings: { staleBefore: null }
+            },
+        packagingEnabled
+            ? {
+                id: "packaging",
+                state: "conditional",
+                dependsOn: [reviewEnabled ? "review" : "shortlist"],
+                inputs: ["reports-dir"],
+                outputs: ["packages-dir"],
+                networkAccess: [],
+                reason: "Runs for selected leads with successful report artifacts",
+                settings: { enabled: true }
+            }
+            : {
+                id: "packaging",
+                state: "disabled",
+                dependsOn: [],
+                inputs: [],
+                outputs: [],
+                networkAccess: [],
+                reason: "Report packaging is not enabled",
+                settings: { enabled: false }
+            },
+        {
+            id: "summary",
+            state: "will-run",
+            dependsOn: [summaryDependency],
+            inputs: [],
+            outputs: ["workflow-summary-json"],
+            networkAccess: [],
+            settings: {}
+        }
+    ];
+    return { version: 1, status: preflight.status, preflight, artifacts, steps };
+}
+function renderNetworkCapabilities(step) {
+    return step.networkAccess.flatMap((access) => {
+        if (access === "google-places") {
+            return "Google Places";
+        }
+        return step.id !== "discovery" || step.settings.maxAudits === null
+            ? "website audits (no configured cap)"
+            : `website audits (up to ${step.settings.maxAudits})`;
+    });
+}
+function renderWorkflowPlanStep(step, index) {
+    const networkCapabilities = renderNetworkCapabilities(step);
+    return [
+        `${index + 1}. ${step.id} [${step.state.toUpperCase().replace("-", " ")}]`,
+        ...(step.reason !== undefined ? [`   Reason: ${step.reason}`] : []),
+        ...(networkCapabilities.length > 0 ? [`   Network: ${networkCapabilities.join(", ")}`] : []),
+        ...(step.inputs.length > 0 ? [`   Inputs: ${step.inputs.join(", ")}`] : []),
+        ...(step.outputs.length > 0 ? [`   Outputs: ${step.outputs.join(", ")}`] : [])
+    ];
+}
+export function renderWorkflowPlanTerminal(report, configPath) {
+    const discovery = report.steps.find((step) => step.id === "discovery");
+    const artifactLines = workflowPlanArtifactIds.flatMap((id) => {
+        const path = report.artifacts[id];
+        return path !== undefined ? [`- ${id}: ${path}`] : [];
+    });
+    const lines = [
+        `Workflow plan: ${report.status.toUpperCase()}`,
+        `Config: ${configPath}`,
+        ...(discovery ? [`Provider: ${discovery.settings.provider}`] : []),
+        "",
+        "Readiness:",
+        ...report.preflight.checks.map((check) => `${check.status.toUpperCase().padEnd(5)} ${check.message}`),
+        "",
+        "Execution plan:",
+        ...(report.steps.length > 0
+            ? report.steps.flatMap((step, index) => [
+                ...renderWorkflowPlanStep(step, index),
+                ...(index < report.steps.length - 1 ? [""] : [])
+            ])
+            : ["No execution plan is available"]),
+        ...(artifactLines.length > 0 ? ["", "Artifacts:", ...artifactLines] : [])
+    ];
+    return `${lines.join("\n")}\n`;
+}
+export function renderWorkflowPlanJson(report) {
+    return `${JSON.stringify(report, null, 2)}\n`;
+}
+export async function runWorkflowPlan(configPath) {
+    return runWorkflowPlanWithDependencies(configPath);
+}
+export async function runWorkflowPlanWithDependencies(configPath, overrides = {}) {
+    const dependencies = { ...defaultDependencies, ...overrides };
+    return buildPlan(await dependencies.evaluatePreflight(configPath));
+}
+//# sourceMappingURL=workflow-plan.js.map

package/dist/workflow-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-plan.js","sourceRoot":"","sources":["../src/workflow-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8CAA8C,EAAE,MAAM,yBAAyB,CAAC;AAwEzF,MAAM,uBAAuB,GAAG;IAC9B,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,wBAAwB;IACxB,aAAa;IACb,eAAe;IACf,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;CAC6B,CAAC;AAMvD,MAAM,mBAAmB,GAA6B;IACpD,iBAAiB,EAAE,8CAA8C;CAClE,CAAC;AAEF,SAAS,SAAS,CAAC,UAAuC;IACxD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,SAAS,GAAoD;QACjE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;QAClC,wBAAwB,EAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB;QAC3D,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;QACtC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;QAC1C,wBAAwB,EAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB;QAC3D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,uBAAuB,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB;KAC1D,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,cAAc,CAAC;IAC/C,MAAM,sBAAsB,GAAgC;QAC1D,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,eAAwB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAyB,CAAC,CAAC;KACzE,CAAC;IACF,MAAM,iBAAiB,GAAuB,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;IAEtH,MAAM,KAAK,GAAuB;QAChC;YACE,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,EAAE;YACb,MAAM,EAAE;gBACN,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,kBAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD;YACD,OAAO,EAAE;gBACP,WAAW;gBACX,wBAAwB;gBACxB,aAAa;gBACb,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD;YACD,aAAa,EAAE,sBAAsB;YACrC,QAAQ,EAAE;gBACR,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;gBACnC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;gBACjC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;gBACzC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBAC5F,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,IAAI,IAAI;aAC9C;SACF;QACD;YACE,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,CAAC,WAAW,CAAC;YACxB,MAAM,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC,eAAe,EAAE,wBAAwB,CAAC;YACpD,aAAa,EAAE,EAAE;YACjB,QAAQ,EAAE;gBACR,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG;gBACzB,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,mBAAmB,IAAI,IAAI;gBACjE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI;aAC5B;SACF;QACD,MAAM,CAAC,MAAM;YACX,CAAC,CAAC;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,CAAC,WAAW,CAAC;gBACxB,MAAM,EAAE,CAAC,YAAY,CAAC;gBACtB,OAAO,EAAE,CAAC,qBAAqB,CAAC;gBAChC,aAAa,EAAE,EAAE;gBACjB,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,EAAE;aAC7D;YACH,CAAC,CAAC;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,EAAE;gBACX,aAAa,EAAE,EAAE;gBACjB,MAAM,EAAE,0BAA0B;gBAClC,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;aAChC;QACL,gBAAgB;YACd,CAAC,CAAC;gBACE,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;gBACnD,MAAM,EAAE,CAAC,aAAa,CAAC;gBACvB,OAAO,EAAE,CAAC,cAAc,CAAC;gBACzB,aAAa,EAAE,EAAE;gBACjB,MAAM,EAAE,0DAA0D;gBAClE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;aAC5B;YACH,CAAC,CAAC;gBACE,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,EAAE;gBACX,aAAa,EAAE,EAAE;gBACjB,MAAM,EAAE,iCAAiC;gBACzC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;aAC7B;QACL;YACE,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,CAAC,iBAAiB,CAAC;YAC9B,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,uBAAuB,CAAC;YAClC,aAAa,EAAE,EAAE;YACjB,QAAQ,EAAE,EAAE;SACb;KACF,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAsB;IACvD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAC3C,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/B,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI;YAChE,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,yBAAyB,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAsB,EAAE,KAAa;IACnE,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO;QACL,GAAG,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG;QAC1E,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAA0B,EAAE,UAAkB;IACvF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,kBAAkB,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;QAC/C,WAAW,UAAU,EAAE;QACvB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,EAAE;QACF,YAAY;QACZ,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACrG,EAAE;QACF,iBAAiB;QACjB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACpC,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC;gBACtC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC;YACJ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;QACvC,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;IAEF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB;IACtD,OAAO,+BAA+B,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAkB,EAClB,YAA+C,EAAE;IAEjD,MAAM,YAAY,GAA6B,EAAE,GAAG,mBAAmB,EAAE,GAAG,SAAS,EAAE,CAAC;IACxF,OAAO,SAAS,CAAC,MAAM,YAAY,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/workflow-preflight.d.ts

@@ -0,0 +1,43 @@
+import type { Stats } from "node:fs";
+import type { ResolvedWorkflowConfig, WorkflowManagedPaths } from "./workflow-config.js";
+import type { WorkflowPathInspection } from "./workflow-paths.js";
+export type WorkflowPreflightStatus = "ready" | "blocked";
+export type WorkflowPreflightCheckStatus = "pass" | "warn" | "fail";
+export type WorkflowPreflightStage = "discovery" | "shortlist" | "review" | "packaging";
+export type WorkflowPreflightCheckId = "configuration" | "discovery-input" | "google-api-key" | "review-csv" | "output-access" | "managed-paths";
+export interface WorkflowPreflightCheck {
+    id: WorkflowPreflightCheckId;
+    status: WorkflowPreflightCheckStatus;
+    message: string;
+    path?: string;
+}
+export interface WorkflowPreflightReport {
+    version: 1;
+    status: WorkflowPreflightStatus;
+    checks: WorkflowPreflightCheck[];
+    provider?: "manual-csv" | "google-places";
+    stages?: WorkflowPreflightStage[];
+    outputs?: {
+        outDir: string;
+    } & WorkflowManagedPaths;
+    limits?: {
+        maxCandidates: number | null;
+        maxAudits: number | null;
+    };
+}
+export interface WorkflowPreflightEvaluation {
+    config?: ResolvedWorkflowConfig;
+    report: WorkflowPreflightReport;
+}
+export interface WorkflowPreflightDependencies {
+    readWorkflowConfig(configPath: string): Promise<ResolvedWorkflowConfig>;
+    resolveGoogleMapsApiKey(): string | undefined;
+    lstat(path: string): Promise<Stats>;
+    access(path: string, mode?: number): Promise<void>;
+    inspectWorkflowManagedPaths(config: ResolvedWorkflowConfig): Promise<WorkflowPathInspection>;
+}
+export declare function renderWorkflowPreflightTerminal(report: WorkflowPreflightReport, configPath: string): string;
+export declare function renderWorkflowPreflightJson(report: WorkflowPreflightReport): string;
+export declare function runWorkflowPreflight(configPath: string): Promise<WorkflowPreflightReport>;
+export declare function runWorkflowPreflightWithDependencies(configPath: string, overrides?: Partial<WorkflowPreflightDependencies>): Promise<WorkflowPreflightReport>;
+export declare function runWorkflowPreflightEvaluationWithDependencies(configPath: string, overrides?: Partial<WorkflowPreflightDependencies>): Promise<WorkflowPreflightEvaluation>;