orizu 0.5.20 → 0.5.21

package/dist/repository-backup-core.d.ts

@@ -0,0 +1,225 @@
+import { type ReadStream } from 'node:fs';
+import { type RecoveryCredentialHelperInvocation } from './git-recovery-environment.js';
+import { type FrozenRepositoryDatabasePin, type RepositoryBackupAdmissionEnvelopeVersion, type RepositoryRecoveryManifest, type RepositoryRecoveryRef, type RepositoryRefBindingMode } from './repository-recovery-manifest.js';
+export interface RepositoryBackupLimits {
+    maxRefs: number;
+    maxObjects: number;
+    maxObjectBytes: number;
+    maxSingleObjectBytes: number;
+    maxCommits: number;
+    maxTreeEntries: number;
+    maxDatabasePins: number;
+    maxQuarantineBytes: number;
+    maxManifestBytes: number;
+    maxBundleBytes: number;
+    maxGitOutputBytes: number;
+    maxGitInputBytes: number;
+    /**
+     * Hard memory ceiling requested for the complete isolated job, not merely
+     * the Node.js heap or one Git child.
+     */
+    maxMemoryBytes: number;
+    /**
+     * Hard task ceiling requested for the complete job process tree. Production
+     * boundaries count threads as tasks so Git cannot bypass it with workers.
+     */
+    maxProcessCount: number;
+    commandTimeoutMs: number;
+    overallTimeoutMs: number;
+}
+export declare const MAX_REPOSITORY_BACKUP_MEMORY_BYTES: number;
+export declare const MAX_REPOSITORY_BACKUP_PROCESS_COUNT = 64;
+export declare const DEFAULT_REPOSITORY_BACKUP_LIMITS: Readonly<RepositoryBackupLimits>;
+export interface RepositoryRefAdvertisement {
+    headTarget: string | null;
+    headObjectId: string | null;
+    refs: RepositoryRecoveryRef[];
+    peeledRefs: RepositoryRecoveryRef[];
+}
+export interface CloudflareArtifactsRepositoryTarget {
+    accountId: string;
+    namespace: string;
+    repository: string;
+}
+export interface RepositoryBackupExecutionBoundaryRequest {
+    /**
+     * The hard quota that must apply to the complete job filesystem, including
+     * source quarantine, bundle, manifest, and independent restore quarantine.
+     */
+    quotaBytes: number;
+    /**
+     * Hard total-memory ceiling for the job and all descendants. This must be
+     * independently enforced by the execution platform, not by a heap flag.
+     */
+    maxMemoryBytes: number;
+    /**
+     * Hard process/thread-task ceiling for the job and all descendants.
+     */
+    maxProcessCount: number;
+    purpose: 'create-and-verify' | 'verify-existing';
+    /**
+     * Hard wall for the complete filesystem-scoped operation. Production
+     * boundaries must terminate the job process and all descendants when this
+     * expires; an in-process AbortSignal alone is not an isolation boundary.
+     */
+    timeoutMs: number;
+}
+export interface RepositoryBackupExecutionFilesystem {
+    /** Empty, absolute filesystem root dedicated to exactly this job. */
+    rootPath: string;
+    quotaBytes: number;
+    maxMemoryBytes: number;
+    maxProcessCount: number;
+    isolation: 'per-job';
+    /**
+     * `hard` means the execution platform enforces quota independently of this
+     * process (for example, a sandbox volume/filesystem quota). The test-only
+     * mode is accepted only for explicit local fixtures.
+     */
+    quotaEnforcement: 'hard' | 'test-only-unenforced';
+    /**
+     * These attest that the boundary applied the requested limits to the whole
+     * job process tree before invoking the operation.
+     */
+    memoryEnforcement: 'hard' | 'test-only-unenforced';
+    processCountEnforcement: 'hard' | 'test-only-unenforced';
+}
+/**
+ * Production execution boundary. Implementations must provision a new,
+ * isolated filesystem with the exact requested hard quota, invoke `operation`
+ * exactly once, wait for it to settle, then destroy the filesystem. Merely
+ * pointing at a shared host temp directory does not satisfy this contract.
+ */
+export interface RepositoryBackupExecutionBoundary {
+    withJobFilesystem<T>(request: RepositoryBackupExecutionBoundaryRequest, operation: (filesystem: RepositoryBackupExecutionFilesystem) => Promise<T>): Promise<T>;
+}
+export interface PathBackedRepositoryBackupArtifact {
+    /**
+     * Valid only for the duration of consumeVerifiedArtifacts. Callers should
+     * stream it and must not retain the path after the callback resolves.
+     */
+    path: string;
+    byteCount: number;
+    sha256: string;
+    openStream(): ReadStream;
+}
+export interface VerifiedRepositoryBackupArtifacts {
+    manifest: PathBackedRepositoryBackupArtifact;
+    bundle: PathBackedRepositoryBackupArtifact;
+}
+export interface RepositoryBackupDeadline {
+    /**
+     * Aborts at the same absolute deadline as the complete backup operation.
+     * Streaming implementations must pass this signal to every provider read,
+     * upload, and checksum/readback request.
+     */
+    signal: AbortSignal;
+    deadlineMs: number;
+}
+/**
+ * Deterministic scheduler seam for local recovery fixtures. Production
+ * callers always use the platform timer and cannot override the overall wall.
+ */
+export interface RepositoryBackupTestDeadlineScheduler {
+    schedule(callback: () => void, delayMs: number): unknown;
+    cancel(handle: unknown): void;
+}
+export interface RepositoryBackupArtifactDestinations {
+    /**
+     * Create both files without following links and finish all writes before
+     * returning. Production implementations stream downloads into these paths.
+     */
+    manifestPath: string;
+    bundlePath: string;
+}
+export interface CreateVerifiedRepositoryBackupInput<TArtifactResult = unknown> {
+    /**
+     * Immutable admission policy frozen by the backup job. A new limit set
+     * receives a new version; an existing version is never reinterpreted.
+     */
+    admissionEnvelopeVersion: RepositoryBackupAdmissionEnvelopeVersion;
+    /**
+     * Secret-free remote locator. Production authentication is supplied only by
+     * the trusted backup worker's command-scoped exact-path helper below.
+     */
+    remoteUrl: string;
+    /**
+     * Exact provider identity frozen by the backup job. Every production remote
+     * is reconstructed from this tuple and compared byte-for-byte before Git is
+     * spawned, so an attacker-controlled locator cannot redirect the
+     * operation-scoped credential helper to another origin or repository.
+     */
+    cloudflareArtifactsTarget?: CloudflareArtifactsRepositoryTarget;
+    /**
+     * Test-only/local-rehearsal escape hatch. Production callers accept HTTPS
+     * only. `file://` is never inferred from an ambient Git config.
+     */
+    allowLocalRemote?: boolean;
+    /**
+     * Optional trusted executable invocation; arguments may identify an opaque
+     * operation but must never contain a token/password. The helper obtains a
+     * one-use credential when Git asks and store/erase remain no-ops.
+     */
+    credentialHelper?: RecoveryCredentialHelperInvocation;
+    requiredRef: string;
+    /**
+     * Exact is required for immutable publication/bootstrap/recovery refs.
+     * Reachability keeps a frozen historical merge/scheduled commit executable
+     * after its provenance branch advances.
+     */
+    requiredRefBindingMode?: RepositoryRefBindingMode;
+    requiredCommitSha: string;
+    databasePins: readonly FrozenRepositoryDatabasePin[];
+    limits?: Partial<RepositoryBackupLimits>;
+    executionBoundary: RepositoryBackupExecutionBoundary;
+    /**
+     * Test-only scheduler for deterministic deadline tests. It is rejected
+     * unless the remote is an explicit local fixture and the execution boundary
+     * attests that every resource limit is test-only and unenforced.
+     */
+    testDeadlineScheduler?: RepositoryBackupTestDeadlineScheduler;
+    /**
+     * Runs only after source-side and independent restore verification. Stream
+     * both path-backed artifacts to durable storage before returning; the
+     * execution boundary destroys every path after this callback settles.
+     */
+    consumeVerifiedArtifacts: (artifacts: VerifiedRepositoryBackupArtifacts, deadline: RepositoryBackupDeadline) => Promise<TArtifactResult>;
+}
+export interface VerifiedRepositoryBackup<TArtifactResult = unknown> {
+    manifest: RepositoryRecoveryManifest;
+    /**
+     * Plaintext artifact hashes. Storage code must verify the uploaded
+     * FULL_OBJECT checksum and separately record exact object version, KMS key,
+     * and retention evidence. Neither value is a ciphertext hash.
+     */
+    manifestSha256: string;
+    bundleSha256: string;
+    manifestByteCount: number;
+    bundleByteCount: number;
+    artifactResult: TArtifactResult;
+    advertisementBefore: RepositoryRefAdvertisement;
+    advertisementAfter: RepositoryRefAdvertisement;
+}
+export interface VerifyRepositoryBackupBundleInput {
+    /**
+     * Exact version frozen by the backup attempt. It must match the persisted
+     * manifest before any restored evidence is accepted.
+     */
+    admissionEnvelopeVersion: RepositoryBackupAdmissionEnvelopeVersion;
+    limits?: Partial<RepositoryBackupLimits> | RepositoryBackupLimits;
+    executionBoundary: RepositoryBackupExecutionBoundary;
+    /**
+     * Stream existing artifacts into the exact fresh paths supplied by the
+     * verifier. This avoids accepting or copying a multi-gigabyte Buffer.
+     */
+    stageArtifacts: (destinations: RepositoryBackupArtifactDestinations, deadline: RepositoryBackupDeadline) => Promise<void>;
+}
+export interface RepositoryBackupVerificationReceipt {
+    refsVerified: number;
+    objectsVerified: number;
+    databasePinsVerified: number;
+}
+export declare function assertStableRepositoryRefAdvertisement(before: RepositoryRefAdvertisement, after: RepositoryRefAdvertisement): void;
+export declare function verifyRepositoryBackupBundle(input: VerifyRepositoryBackupBundleInput): Promise<RepositoryBackupVerificationReceipt>;
+export declare function createVerifiedRepositoryBackup<TArtifactResult>(input: CreateVerifiedRepositoryBackupInput<TArtifactResult>): Promise<VerifiedRepositoryBackup<TArtifactResult>>;
+//# sourceMappingURL=repository-backup-core.d.ts.map

package/dist/repository-backup-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-backup-core.d.ts","sourceRoot":"","sources":["../src/repository-backup-core.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAA;AAY3D,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAML,KAAK,2BAA2B,EAEhC,KAAK,wCAAwC,EAC7C,KAAK,0BAA0B,EAE/B,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAI9B,MAAM,mCAAmC,CAAA;AAE1C,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;IACzB,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,eAAO,MAAM,kCAAkC,QACvB,CAAA;AACxB,eAAO,MAAM,mCAAmC,KAAK,CAAA;AAErD,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,sBAAsB,CAoB1E,CAAA;AAEJ,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC7B,UAAU,EAAE,qBAAqB,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,mCAAmC;IAClD,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,wCAAwC;IACvD;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,mBAAmB,GAAG,iBAAiB,CAAA;IAChD;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mCAAmC;IAClD,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,SAAS,CAAA;IACpB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,sBAAsB,CAAA;IACjD;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,sBAAsB,CAAA;IAClD,uBAAuB,EAAE,MAAM,GAAG,sBAAsB,CAAA;CACzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IAChD,iBAAiB,CAAC,CAAC,EACjB,OAAO,EAAE,wCAAwC,EACjD,SAAS,EAAE,CACT,UAAU,EAAE,mCAAmC,KAC5C,OAAO,CAAC,CAAC,CAAC,GACd,OAAO,CAAC,CAAC,CAAC,CAAA;CACd;AAED,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,IAAI,UAAU,CAAA;CACzB;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,EAAE,kCAAkC,CAAA;IAC5C,MAAM,EAAE,kCAAkC,CAAA;CAC3C;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;IACxD,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAA;CAC9B;AAED,MAAM,WAAW,oCAAoC;IACnD;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,mCAAmC,CAClD,eAAe,GAAG,OAAO;IAEzB;;;OAGG;IACH,wBAAwB,EAAE,wCAAwC,CAAA;IAClE;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,mCAAmC,CAAA;IAC/D;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,kCAAkC,CAAA;IACrD,WAAW,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,wBAAwB,CAAA;IACjD,iBAAiB,EAAE,MAAM,CAAA;IACzB,YAAY,EAAE,SAAS,2BAA2B,EAAE,CAAA;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACxC,iBAAiB,EAAE,iCAAiC,CAAA;IACpD;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qCAAqC,CAAA;IAC7D;;;;OAIG;IACH,wBAAwB,EAAE,CACxB,SAAS,EAAE,iCAAiC,EAC5C,QAAQ,EAAE,wBAAwB,KAC/B,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9B;AAED,MAAM,WAAW,wBAAwB,CAAC,eAAe,GAAG,OAAO;IACjE,QAAQ,EAAE,0BAA0B,CAAA;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,iBAAiB,EAAE,MAAM,CAAA;IACzB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,eAAe,CAAA;IAC/B,mBAAmB,EAAE,0BAA0B,CAAA;IAC/C,kBAAkB,EAAE,0BAA0B,CAAA;CAC/C;AAED,MAAM,WAAW,iCAAiC;IAChD;;;OAGG;IACH,wBAAwB,EAAE,wCAAwC,CAAA;IAClE,MAAM,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAA;IACjE,iBAAiB,EAAE,iCAAiC,CAAA;IACpD;;;OAGG;IACH,cAAc,EAAE,CACd,YAAY,EAAE,oCAAoC,EAClD,QAAQ,EAAE,wBAAwB,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAA;CACnB;AAED,MAAM,WAAW,mCAAmC;IAClD,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;IACvB,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAw1BD,wBAAgB,sCAAsC,CACpD,MAAM,EAAE,0BAA0B,EAClC,KAAK,EAAE,0BAA0B,GAChC,IAAI,CAIN;AAu8BD,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,mCAAmC,CAAC,CA8C9C;AAED,wBAAsB,8BAA8B,CAAC,eAAe,EAClE,KAAK,EAAE,mCAAmC,CAAC,eAAe,CAAC,GAC1D,OAAO,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC,CA+VpD"}

package/dist/repository-recovery-manifest.d.ts

@@ -0,0 +1,83 @@
+export declare const REPOSITORY_RECOVERY_MANIFEST_KIND: "orizu.repository-recovery-manifest";
+export declare const REPOSITORY_RECOVERY_MANIFEST_VERSION: 1;
+export declare const REPOSITORY_BACKUP_ADMISSION_ENVELOPE_VERSION: 1;
+export type RepositoryBackupAdmissionEnvelopeVersion = typeof REPOSITORY_BACKUP_ADMISSION_ENVELOPE_VERSION;
+export type GitObjectType = 'blob' | 'commit' | 'tag' | 'tree';
+export interface RepositoryRecoveryRef {
+    name: string;
+    objectId: string;
+}
+export interface RepositoryRecoveryObject {
+    objectId: string;
+    type: GitObjectType;
+    size: number;
+}
+export type RepositoryRefBindingMode = 'exact' | 'reachability';
+export type RepositoryDatabasePinRefBindingMode = RepositoryRefBindingMode;
+export type RepositoryDatabasePinPathObjectType = 'blob' | 'tree';
+export interface FrozenRepositoryDatabasePin {
+    pinId: string;
+    kind: string;
+    commitSha: string;
+    /** Frozen provenance ref. Reachability mode does not imply it is still at commitSha. */
+    ref: string;
+    /** Whether the provenance ref tip itself is frozen or only commit reachability is. */
+    refBindingMode: RepositoryDatabasePinRefBindingMode;
+    path?: string;
+    pathObjectType?: RepositoryDatabasePinPathObjectType;
+    pathObjectId?: string;
+    /** Optional byte-level proof for blob pins; tree identity is the Git object ID. */
+    contentSha256?: string;
+}
+export interface RepositoryRecoveryManifestInput {
+    admissionEnvelopeVersion: RepositoryBackupAdmissionEnvelopeVersion;
+    objectFormat: 'sha1';
+    headTarget: string | null;
+    headObjectId: string | null;
+    requiredRef: string;
+    requiredRefBindingMode: RepositoryRefBindingMode;
+    requiredCommitSha: string;
+    refs: readonly RepositoryRecoveryRef[];
+    objects: readonly RepositoryRecoveryObject[];
+    databasePins: readonly FrozenRepositoryDatabasePin[];
+}
+export interface RepositoryRecoveryManifest {
+    kind: typeof REPOSITORY_RECOVERY_MANIFEST_KIND;
+    version: typeof REPOSITORY_RECOVERY_MANIFEST_VERSION;
+    admissionEnvelopeVersion: RepositoryBackupAdmissionEnvelopeVersion;
+    objectFormat: 'sha1';
+    headTarget: string | null;
+    headObjectId: string | null;
+    requiredRef: string;
+    requiredRefBindingMode: RepositoryRefBindingMode;
+    requiredCommitSha: string;
+    refs: RepositoryRecoveryRef[];
+    objects: RepositoryRecoveryObject[];
+    databasePins: FrozenRepositoryDatabasePin[];
+    totals: {
+        refCount: number;
+        objectCount: number;
+        objectBytes: number;
+        databasePinCount: number;
+    };
+}
+export declare function assertSha1ObjectId(value: string, label?: string): void;
+export declare function assertSha256(value: string, label?: string): void;
+/**
+ * A deliberately explicit subset of `git check-ref-format`. Recovery accepts
+ * every ordinary `refs/*` namespace, but never pseudo refs or replace refs:
+ * importing `refs/replace/*` would change object resolution during verification.
+ */
+export declare function assertRecoveryRefName(value: string, label?: string): void;
+export declare function assertSafeRecoveryPath(value: string, label?: string): void;
+export declare function canonicalizeRepositoryRecoveryManifest(input: RepositoryRecoveryManifestInput): RepositoryRecoveryManifest;
+export declare function serializeRepositoryRecoveryManifest(manifest: RepositoryRecoveryManifest): Buffer;
+/**
+ * Parse persisted evidence without silently upgrading, normalizing, or
+ * discarding fields. The byte comparison rejects duplicate JSON keys,
+ * unexpected fields, changed totals, non-canonical ordering/whitespace, and
+ * any future manifest version this runtime does not explicitly understand.
+ */
+export declare function parseRepositoryRecoveryManifestBytes(bytes: Uint8Array): RepositoryRecoveryManifest;
+export declare function sha256Hex(bytes: Uint8Array): string;
+//# sourceMappingURL=repository-recovery-manifest.d.ts.map

package/dist/repository-recovery-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-recovery-manifest.d.ts","sourceRoot":"","sources":["../src/repository-recovery-manifest.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iCAAiC,EAC5C,oCAA6C,CAAA;AAC/C,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAA;AAC9D,eAAO,MAAM,4CAA4C,EAAG,CAAU,CAAA;AAEtE,MAAM,MAAM,wCAAwC,GAClD,OAAO,4CAA4C,CAAA;AAErD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;AAE9D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,aAAa,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,wBAAwB,GAChC,OAAO,GACP,cAAc,CAAA;AAClB,MAAM,MAAM,mCAAmC,GAC7C,wBAAwB,CAAA;AAC1B,MAAM,MAAM,mCAAmC,GAAG,MAAM,GAAG,MAAM,CAAA;AAEjE,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAA;IACX,sFAAsF;IACtF,cAAc,EAAE,mCAAmC,CAAA;IACnD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,mCAAmC,CAAA;IACpD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,wBAAwB,EAAE,wCAAwC,CAAA;IAClE,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,sBAAsB,EAAE,wBAAwB,CAAA;IAChD,iBAAiB,EAAE,MAAM,CAAA;IACzB,IAAI,EAAE,SAAS,qBAAqB,EAAE,CAAA;IACtC,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAA;IAC5C,YAAY,EAAE,SAAS,2BAA2B,EAAE,CAAA;CACrD;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,OAAO,iCAAiC,CAAA;IAC9C,OAAO,EAAE,OAAO,oCAAoC,CAAA;IACpD,wBAAwB,EAAE,wCAAwC,CAAA;IAClE,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,sBAAsB,EAAE,wBAAwB,CAAA;IAChD,iBAAiB,EAAE,MAAM,CAAA;IACzB,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC7B,OAAO,EAAE,wBAAwB,EAAE,CAAA;IACnC,YAAY,EAAE,2BAA2B,EAAE,CAAA;IAC3C,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,WAAW,EAAE,MAAM,CAAA;QACnB,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;CACF;AA0BD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAkB,GAAG,IAAI,CAI/E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAmB,GAAG,IAAI,CAI1E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAY,GAAG,IAAI,CA+B5E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAoB,GAAG,IAAI,CAwBrF;AAqGD,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,+BAA+B,GACrC,0BAA0B,CA4J5B;AAgBD,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,0BAA0B,GACnC,MAAM,CAGR;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,UAAU,GAChB,0BAA0B,CAiD5B;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEnD"}

package/dist/run-event-digest.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Shared compact per-event digest renderer for workbench-run tails (ALI-1045).
+ *
+ * Used by BOTH `orizu run tail` (human mode) and the `--tail` attached to
+ * `orizu session start --hosted`, so the operator watching a live hosted run
+ * can see at a glance what the agent said, which tool it called with what
+ * args, and what came back — enough to spot a stall, an unanswerable question,
+ * or a misdirection within seconds, without a second terminal.
+ *
+ * THREAT MODEL: the sandboxed agent AUTHORS these payloads and this renderer
+ * writes to the OPERATOR'S terminal — treat every field as hostile.
+ *
+ * Contract:
+ *   - ONE line per event, prefixed `#<sequence> <eventType>`.
+ *   - Every field that reaches the output is capped (FIELD_MAX for tool /
+ *     status / eventType, TOKEN_TEXT_MAX for prose/output, SUMMARY_MAX for
+ *     args/JSON) and the WHOLE assembled line is bounded by LINE_MAX.
+ *   - The final line is sanitized as the LAST step: all C0/C1 control bytes
+ *     (ESC, BEL, backspace, CR/LF, DEL, 0x80-0x9F, …) are stripped, so a
+ *     hostile payload can never emit terminal escape sequences (OSC-52
+ *     clipboard writes, CSI clear/spoof) or extra lines at the operator; the
+ *     same pass strips Unicode bidi controls, U+2028/U+2029 separators, and
+ *     zero-width characters, so a payload cannot visually reorder, split, or
+ *     spoof the line either (see CONTROL_CHARS).
+ *   - Bounded work per event: raw strings are sliced to a working window of
+ *     WORK_FACTOR x the display cap BEFORE any regex normalization; JSON
+ *     summaries first take a BOUNDED PROJECTION of the payload (max
+ *     PROJECTION_MAX_ITEMS entries per level, PROJECTION_MAX_DEPTH deep,
+ *     PROJECTION_MAX_NODES containers) so JSON.stringify never traverses a
+ *     payload-sized structure, then slice oversized string fields via the
+ *     replacer — a megabyte payload costs O(display size), not O(payload).
+ *   - NEVER throws: malformed payloads degrade to the bare `#<seq> <type>`
+ *     line; hostile objects (throwing getters) degrade to `#? unknown`. Full
+ *     fidelity stays in the JSON streams (`--json` on either command).
+ *
+ * Event payload shapes come from the hosted harness seam
+ * (hosted-harness-{claude,opencode}.ts → hosted-run-event-sink.ts):
+ *   agent_token        { messageId, text }                  (coalesced snapshot)
+ *   agent_tool_call    { tool, args, callId, status }
+ *   agent_tool_result  { callId, status, output[, tool] }
+ *   agent_step_finish  { cost, tokens, reason }             (tokens shape varies)
+ */
+/** Max chars of streamed agent text / tool output shown per digest line. */
+export declare const TOKEN_TEXT_MAX = 120;
+/** Max chars of arg/JSON summaries shown per digest line. */
+export declare const SUMMARY_MAX = 160;
+/** Max chars for short identifier-ish fields: tool names, statuses, eventType. */
+export declare const FIELD_MAX = 60;
+/** Hard backstop for a whole assembled digest line (prefix + segments + slack). */
+export declare const LINE_MAX = 360;
+interface ProjectionState {
+    nodes: number;
+    seen: WeakSet<object>;
+}
+/**
+ * Build a bounded clone of a hostile payload BEFORE serialization, so
+ * JSON.stringify never traverses payload-sized structures (huge arrays, many
+ * properties, deep nesting): at most PROJECTION_MAX_ITEMS entries per level,
+ * PROJECTION_MAX_DEPTH levels, PROJECTION_MAX_NODES containers total. Cut
+ * points and repeated/cyclic references become the '…' marker. Exported for
+ * tests only.
+ */
+export declare function boundedJsonProjection(value: unknown, depth?: number, state?: ProjectionState): unknown;
+/** The old (pre-ALI-1045) types-only line — kept for `--quiet`. */
+export declare function formatRunEventTypeLine(event: unknown): string;
+/**
+ * One compact human line for a workbench-run event: `#<seq> <type>  <digest>`.
+ * Never throws; degrades to the bare `#<seq> <type>` line on any malformed or
+ * missing payload field, and to `#? unknown` when the envelope itself is
+ * hostile (throwing getters, revoked proxies).
+ */
+export declare function formatRunEventDigest(event: unknown): string;
+export {};
+//# sourceMappingURL=run-event-digest.d.ts.map

package/dist/run-event-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-event-digest.d.ts","sourceRoot":"","sources":["../src/run-event-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,cAAc,MAAM,CAAA;AACjC,6DAA6D;AAC7D,eAAO,MAAM,WAAW,MAAM,CAAA;AAC9B,kFAAkF;AAClF,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,mFAAmF;AACnF,eAAO,MAAM,QAAQ,MAAM,CAAA;AAyD3B,UAAU,eAAe;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,SAAI,EACT,KAAK,GAAE,eAAmD,GACzD,OAAO,CA+BT;AA+ID,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAO7D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAkB3D"}

package/dist/runner-dir-verify.d.ts

@@ -0,0 +1,66 @@
+/**
+ * ALI-1159 (ADR-007): ad-hoc `--runner-dir` bytes may only execute when they
+ * ARE a registered runner version. Runs that execute local runner bytes stamp
+ * a registered `runner_version_id` into every result record; before this
+ * guard, nothing tied those bytes to that version — a run could produce live
+ * Orizu records from runner bytes that were never registered or committed
+ * anywhere (the GEPA-adapter loss on orizu-workbench-demo). The check is the
+ * same deterministic-zip content sha the push paths record: identical
+ * directory bytes hash to the registered version's `content_sha256`.
+ *
+ * Lives outside index.ts per the CLI line ratchet (ALI-976).
+ */
+/** Test seam; defaults to the authenticated CLI fetcher. */
+export interface VerifyRunnerDirInput {
+    runnerVersionId: string;
+    dir: string;
+    /** The CLI flag the dir arrived on (for the error message). */
+    flag: string;
+    fetcher?: (path: string, init?: RequestInit) => Promise<Response>;
+}
+export interface VerifiedRunnerSnapshot {
+    /**
+     * Temp directory holding EXACTLY the verified file set, materialized from
+     * the same in-memory bytes the hash covered (codex round 4 on #1447):
+     * execution from here is immune to post-hash mutation of the original dir,
+     * and hash-excluded entries (.env, .git, .orizu, caches, symlinks) simply
+     * do not exist at runtime.
+     */
+    snapshotDir: string;
+    cleanup: () => void;
+}
+export declare function verifyRunnerDirRegistered(input: VerifyRunnerDirInput): Promise<VerifiedRunnerSnapshot>;
+/**
+ * The runner contract executes `manifest.json`'s `command` with cwd at the
+ * artifact root. Every command entry must stay INSIDE the snapshot: absolute
+ * entries and `..` escapes are refused (a bare program name like `node` is
+ * PATH-resolved — interpreters are environment, not artifact bytes). Missing
+ * or malformed manifests are refused here too, so no snapshot can outlive a
+ * runner that could never execute.
+ */
+export declare function assertSnapshotManifestConfined(snapshotDir: string, flag: string): void;
+/** Extract a flag value accepting BOTH argparse forms: `--flag value` and
+ * `--flag=value` (codex P1 on #1447 — the equals form bypassed `getArg`). */
+export declare function extractFlagValue(args: string[], flag: string): string | null;
+export interface GepaVerifiedArgs {
+    /** The forwarded argv with each runner-dir flag REWRITTEN to its verified
+     * snapshot path — Python executes the hashed bytes, not the mutable dir. */
+    args: string[];
+    /** The snapshot dirs, for the ORIZU_VERIFIED_RUNNER_DIRS handshake. */
+    verifiedDirs: string[];
+    cleanup: () => void;
+}
+/**
+ * Verify the run-gepa wrapper's two ad-hoc runner dirs (candidate + scorer)
+ * against the FORWARDED argv before the Python optimizer is spawned —
+ * scanning the same tokens Python will parse, in both argparse forms, so no
+ * spelling of the flags can slip past verification. FAIL-CLOSED: if either
+ * half of a pair is present but the pair is incomplete, the wrapper refuses
+ * here rather than forwarding an unverified pair to argparse. A pair that is
+ * entirely absent is left to the Python CLI's required-argument validation —
+ * it cannot execute without both. On success each dir flag is REWRITTEN to
+ * the verified snapshot (codex round 4): the optimizer runs the exact hashed
+ * bytes, immune to post-hash mutation of the original dirs.
+ */
+export declare function verifyGepaRunnerDirsFromArgs(args: string[], fetcher?: (path: string, init?: RequestInit) => Promise<Response>): Promise<GepaVerifiedArgs>;
+//# sourceMappingURL=runner-dir-verify.d.ts.map

package/dist/runner-dir-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-dir-verify.d.ts","sourceRoot":"","sources":["../src/runner-dir-verify.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;GAWG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AA6DD,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA4F5G;AAonBD;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CA0EtF;AAYD;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY5E;AAoBD,MAAM,WAAW,gBAAgB;IAC/B;gFAC4E;IAC5E,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,uEAAuE;IACvE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAChE,OAAO,CAAC,gBAAgB,CAAC,CAmD3B"}

package/dist/runner-instruction-set-contract.d.ts

@@ -0,0 +1,24 @@
+import { type SyncSet } from './instruction-sets-cli.js';
+export interface RunnerInstructionSet {
+    name: string;
+    modelConfig: Record<string, unknown>;
+    shape: string[];
+    profileVersionId: string;
+    modelConfigSettingsVersionId?: string;
+    versionNumber: number;
+    promptComponentKey?: string;
+    components: Record<string, string>;
+    pinnedComponents?: Record<string, {
+        repoPath: string;
+        contentSha: string;
+        commitSha: string;
+    }>;
+}
+export declare function runnerInstructionSetSyncSet(instructionSet: RunnerInstructionSet): SyncSet;
+export declare function runnerInputPrompt(promptContext: {
+    body?: string | null;
+    bodyKind: string;
+    providerSettings: Record<string, unknown>;
+}): Record<string, unknown>;
+export declare function runnerInputInstructionSet(instructionSet: RunnerInstructionSet): Record<string, unknown>;
+//# sourceMappingURL=runner-instruction-set-contract.d.ts.map

package/dist/runner-instruction-set-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-instruction-set-contract.d.ts","sourceRoot":"","sources":["../src/runner-instruction-set-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAE5E,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,gBAAgB,EAAE,MAAM,CAAA;IACxB,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC,aAAa,EAAE,MAAM,CAAA;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC/F;AAED,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAwBzF;AAED,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACnG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUvG"}

package/dist/runner-instruction-set-contract.js

@@ -0,0 +1,50 @@
+export function runnerInstructionSetSyncSet(instructionSet) {
+    const modelConfigIdentity = typeof instructionSet.modelConfig.identity === 'string'
+        ? instructionSet.modelConfig.identity
+        : '';
+    if (!modelConfigIdentity)
+        throw new Error('Runner exec context instruction set has no model config identity');
+    const missingKey = instructionSet.shape.find(key => !(key in instructionSet.components) && !(key in (instructionSet.pinnedComponents || {})));
+    if (missingKey)
+        throw new Error('instruction_set_tuple_incomplete');
+    const components = Object.fromEntries(Object.entries(instructionSet.components).map(([key, body]) => [key, { body }]));
+    for (const [key, pin] of Object.entries(instructionSet.pinnedComponents || {}))
+        components[key] = pin;
+    const material = {
+        profileVersionId: instructionSet.profileVersionId,
+        versionNumber: instructionSet.versionNumber,
+        modelConfigIdentity,
+        // syncToDisk's long-lived manifest requires provenance; this execution
+        // path has no resolver decision to expose, only an exact profile version.
+        resolvedFrom: 'exact_profile_version',
+        components,
+    };
+    return {
+        name: instructionSet.name,
+        shape: instructionSet.shape,
+        default: material,
+        profiles: [{ modelConfigIdentity, resolvedFrom: 'exact_profile_version', production: material }],
+    };
+}
+export function runnerInputPrompt(promptContext) {
+    const prompt = {
+        body_kind: promptContext.bodyKind,
+        provider_settings: promptContext.providerSettings,
+    };
+    // The route owns this decision. Preserve its response shape exactly so an
+    // implicit wrapped prompt remains compatible with existing runners.
+    if ('body' in promptContext)
+        prompt.body = promptContext.body;
+    return prompt;
+}
+export function runnerInputInstructionSet(instructionSet) {
+    return {
+        name: instructionSet.name,
+        model_config: instructionSet.modelConfig,
+        shape: instructionSet.shape,
+        ...(instructionSet.modelConfigSettingsVersionId ? { model_config_settings_version_id: instructionSet.modelConfigSettingsVersionId } : {}),
+        ...(instructionSet.promptComponentKey ? { prompt_component_key: instructionSet.promptComponentKey } : {}),
+        components: instructionSet.components,
+        ...(Object.keys(instructionSet.pinnedComponents || {}).length > 0 ? { pinned_components: instructionSet.pinnedComponents } : {}),
+    };
+}

package/dist/sandbox-hygiene.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Provider-neutral sandbox token-hygiene sweep (ALI-973 / ALI-1050).
+ *
+ * Extracted out of `daytona-slice.ts` so the hygiene helper carries NO Daytona
+ * coupling: it works against any `SandboxProvider`/`SandboxSession` (ADR-003
+ * seam) and is imported by the shipped hosted-bootstrap path (`hosted-bootstrap
+ * .ts`) as well as the founder-only Daytona slice. Keeping it here means the
+ * shipped code never transitively reaches the optional `@daytonaio/sdk`.
+ */
+import type { SandboxSession } from './sandbox-provider.js';
+export interface HygieneFinding {
+    location: string;
+    marker: string;
+}
+export interface HygieneProbe {
+    location: string;
+    /** Shell command whose stdout is scanned for tokens + markers. */
+    command: string;
+}
+/**
+ * The list of places a short-lived git token can leak inside a sandbox after a
+ * transient clone+push. List-driven so it is trivial to extend. `${repo}` is
+ * substituted with the repo path. Ordered from the repo-local stores outward to
+ * global config, the credential cache, the reflog, shell history, and the live
+ * process listing / argv — the exact surfaces the Daytona-support question names.
+ */
+export declare function tokenLeakProbes(repoPath: string): HygieneProbe[];
+/**
+ * Grep the sandbox filesystem + process table for token values and the
+ * `x-access-token` marker across every known leak surface (see `tokenLeakProbes`).
+ * Returns every finding; an empty array means the transient operations left no
+ * residue. This is the load-bearing check the whole slice exists to make.
+ *
+ * NOTE (local-sim): the reflog/config/credential-store/history probes run
+ * meaningfully in local-sim, but `ps`/argv coverage is only decisive on the live
+ * Daytona run (local-sim runs the git clone via a child process on the host, not
+ * inside an isolated PID namespace). The WS-F memo marks that probe live-only.
+ */
+export declare function sweepForTokenResidue(session: SandboxSession, opts: {
+    tokens: string[];
+    repoPath: string;
+    markers?: string[];
+    probes?: HygieneProbe[];
+}): Promise<HygieneFinding[]>;
+//# sourceMappingURL=sandbox-hygiene.d.ts.map

package/dist/sandbox-hygiene.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-hygiene.d.ts","sourceRoot":"","sources":["../src/sandbox-hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAYhE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAA;CAAE,GACxF,OAAO,CAAC,cAAc,EAAE,CAAC,CAoB3B"}