self-bench 0.3.6 → 0.3.8

package/dist/auth/session-expired.js

@@ -0,0 +1,17 @@
+import { sendJson } from "../api/http.js";
+import { clearCookie } from "./cookies.js";
+import { GitHubOAuthError } from "./github.js";
+import { SESSION_COOKIE } from "./session.js";
+/** Only an authentication failure logs out the browser; permission/rate-limit errors do not. */
+export function sendExpiredSession(response, error, publicUrl) {
+    if (!(error instanceof GitHubOAuthError) || error.status !== 401)
+        return false;
+    clearCookie(response, SESSION_COOKIE, { secure: publicUrl.startsWith("https://") });
+    response.setHeader("cache-control", "no-store");
+    sendJson(response, 401, {
+        error: "GitHub authorization expired. Sign in again.",
+        code: "session_expired",
+    });
+    return true;
+}
+//# sourceMappingURL=session-expired.js.map

package/dist/auth/session-expired.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-expired.js","sourceRoot":"","sources":["../../src/auth/session-expired.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAChC,QAAwB,EACxB,KAAc,EACd,SAAiB;IAEjB,IAAI,CAAC,CAAC,KAAK,YAAY,gBAAgB,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/E,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACpF,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,KAAK,EAAE,8CAA8C;QACrD,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/session.d.ts

@@ -0,0 +1,23 @@
+export declare const SESSION_COOKIE = "selfbench_session";
+export declare const SESSION_TTL_SECONDS: number;
+/** What the cookie carries: enough to find the user, nothing a browser could use elsewhere. */
+export interface SessionClaims {
+    readonly githubId: number;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+}
+export interface SessionSigner {
+    /** Returns the cookie value for a fresh 30-day session. */
+    issue(githubId: number): string;
+    /** Returns the claims when the value is well formed, signed by us, and unexpired. */
+    verify(value: string | undefined): SessionClaims | undefined;
+}
+/**
+ * Stateless signed cookie: `base64url(json) . base64url(hmac-sha256)`. Rotating the secret
+ * signs everyone out; there is no server-side session row to revoke.
+ */
+export declare function createSessionSigner(secret: string, options?: {
+    now?: () => Date;
+    ttlSeconds?: number;
+}): SessionSigner;
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAClD,eAAO,MAAM,mBAAmB,QAAoB,CAAC;AAErD,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,qFAAqF;IACrF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;CAC9D;AASD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACtD,aAAa,CAwBf"}

package/dist/auth/session.js

@@ -0,0 +1,56 @@
+import { constantTimeEqual, deriveKey, hmacSign } from "./crypto.js";
+export const SESSION_COOKIE = "selfbench_session";
+export const SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
+/**
+ * Stateless signed cookie: `base64url(json) . base64url(hmac-sha256)`. Rotating the secret
+ * signs everyone out; there is no server-side session row to revoke.
+ */
+export function createSessionSigner(secret, options = {}) {
+    const key = deriveKey(secret, "session-signing");
+    const now = options.now ?? (() => new Date());
+    const ttl = options.ttlSeconds ?? SESSION_TTL_SECONDS;
+    return {
+        issue(githubId) {
+            const issuedAt = Math.floor(now().getTime() / 1000);
+            const wire = { v: 1, uid: githubId, iat: issuedAt, exp: issuedAt + ttl };
+            const payload = Buffer.from(JSON.stringify(wire)).toString("base64url");
+            return `${payload}.${hmacSign(key, payload)}`;
+        },
+        verify(value) {
+            if (!value)
+                return undefined;
+            const separator = value.indexOf(".");
+            if (separator <= 0)
+                return undefined;
+            const payload = value.slice(0, separator);
+            const signature = value.slice(separator + 1);
+            if (!constantTimeEqual(signature, hmacSign(key, payload)))
+                return undefined;
+            const wire = decode(payload);
+            if (!wire)
+                return undefined;
+            if (wire.exp <= Math.floor(now().getTime() / 1000))
+                return undefined;
+            return { githubId: wire.uid, issuedAt: wire.iat, expiresAt: wire.exp };
+        },
+    };
+}
+function decode(payload) {
+    try {
+        const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        if (typeof parsed !== "object" || parsed === null)
+            return undefined;
+        const wire = parsed;
+        if (wire.v !== 1 ||
+            !Number.isSafeInteger(wire.uid) ||
+            !Number.isSafeInteger(wire.iat) ||
+            !Number.isSafeInteger(wire.exp)) {
+            return undefined;
+        }
+        return { v: 1, uid: wire.uid, iat: wire.iat, exp: wire.exp };
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAErE,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAuBrD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,UAAqD,EAAE;IAEvD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACtD,OAAO;QACL,KAAK,CAAC,QAAQ;YACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YACpD,MAAM,IAAI,GAAS,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC;YAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxE,OAAO,GAAG,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,CAAC,KAAK;YACV,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,SAAS,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,OAAe;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QACzF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,IAAI,GAAG,MAAuB,CAAC;QACrC,IACE,IAAI,CAAC,CAAC,KAAK,CAAC;YACZ,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAC/B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAa,EAAE,GAAG,EAAE,IAAI,CAAC,GAAa,EAAE,GAAG,EAAE,IAAI,CAAC,GAAa,EAAE,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/auth/users.d.ts

@@ -0,0 +1,49 @@
+import type { Database } from "../db/client.js";
+import type { GitHubProfile, OrgMembership } from "./github.js";
+/** How an API-key request identifies itself; absent on cookie sessions. */
+export interface ApiKeyRef {
+    readonly id: number;
+    readonly name: string;
+    readonly scope: "read" | "write";
+}
+/** The user as routes see it. The GitHub token is deliberately not here. */
+export interface User {
+    readonly id: number;
+    readonly githubId: number;
+    readonly login: string;
+    readonly name?: string;
+    readonly avatarUrl?: string;
+    /** Set when the request authenticated with an API key rather than a browser session. */
+    readonly apiKey?: ApiKeyRef;
+}
+/** A tenant the user can work in: a GitHub org, or their personal account (`kind: "user"`). */
+export interface Org {
+    readonly id: number;
+    readonly githubId: number;
+    readonly login: string;
+    readonly kind: "org" | "user";
+    readonly name?: string;
+    readonly avatarUrl?: string;
+    readonly role: "admin" | "member";
+}
+export interface SignedInProfile extends GitHubProfile {
+    readonly token: string;
+    readonly scopes: string;
+    /** Active org memberships at sign-in; the personal account is added by the store. */
+    readonly orgs: readonly OrgMembership[];
+}
+export interface UserStore {
+    /** Creates or refreshes the user, re-seals the token, and replaces their org memberships. */
+    upsert(profile: SignedInProfile): Promise<User>;
+    /** Looks a session's subject up; touches `last_seen_at`. Undefined when the row is gone. */
+    findByGitHubId(githubId: number): Promise<User | undefined>;
+    /** The user's tenants: personal account first, then orgs by login. */
+    orgsFor(userId: number): Promise<Org[]>;
+    /** Decrypts the stored GitHub token for server-side use (discovery); never for a browser. */
+    gitHubToken(githubId: number): Promise<string | undefined>;
+}
+export declare function createUserStore(db: Database, options: {
+    secret: string;
+    now?: () => Date;
+}): UserStore;
+//# sourceMappingURL=users.d.ts.map

package/dist/auth/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/auth/users.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGhD,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAClC;AAED,4EAA4E;AAC5E,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAED,+FAA+F;AAC/F,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;CACnC;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,SAAS;IACxB,6FAA6F;IAC7F,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,4FAA4F;IAC5F,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC5D,sEAAsE;IACtE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,6FAA6F;IAC7F,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC5D;AAiBD,wBAAgB,eAAe,CAC7B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GAC5C,SAAS,CA+FX"}

package/dist/auth/users.js

@@ -0,0 +1,125 @@
+import { and, asc, eq, sql } from "drizzle-orm";
+import { orgMembers, orgs, users } from "../db/schema.js";
+import { createSecretBox, deriveKey } from "./crypto.js";
+/** The tenants a profile implies: the personal account (as admin) plus every org membership. */
+function tenantsOf(profile) {
+    return [
+        {
+            githubId: profile.githubId,
+            login: profile.login,
+            kind: "user",
+            ...(profile.name ? { name: profile.name } : {}),
+            ...(profile.avatarUrl ? { avatarUrl: profile.avatarUrl } : {}),
+            role: "admin",
+        },
+        ...profile.orgs.map((org) => ({ ...org, kind: "org" })),
+    ];
+}
+export function createUserStore(db, options) {
+    const box = createSecretBox(deriveKey(options.secret, "token-sealing"));
+    const now = options.now ?? (() => new Date());
+    return {
+        async upsert(profile) {
+            return db.transaction(async (tx) => {
+                const [row] = await tx
+                    .insert(users)
+                    .values({
+                    githubId: profile.githubId,
+                    login: profile.login,
+                    name: profile.name ?? null,
+                    avatarUrl: profile.avatarUrl ?? null,
+                    githubToken: Buffer.from(box.seal(profile.token)).toString("base64"),
+                    githubScopes: profile.scopes,
+                    createdAt: now(),
+                    lastSeenAt: now(),
+                })
+                    .onConflictDoUpdate({
+                    target: users.githubId,
+                    set: {
+                        login: profile.login,
+                        name: profile.name ?? null,
+                        avatarUrl: profile.avatarUrl ?? null,
+                        githubToken: Buffer.from(box.seal(profile.token)).toString("base64"),
+                        githubScopes: profile.scopes,
+                        lastSeenAt: now(),
+                    },
+                })
+                    .returning();
+                if (!row)
+                    throw new Error("user upsert returned no row");
+                await tx.delete(orgMembers).where(eq(orgMembers.userId, row.id));
+                for (const tenant of tenantsOf(profile)) {
+                    const [org] = await tx
+                        .insert(orgs)
+                        .values({
+                        githubId: tenant.githubId,
+                        login: tenant.login,
+                        kind: tenant.kind,
+                        name: tenant.name ?? null,
+                        avatarUrl: tenant.avatarUrl ?? null,
+                        updatedAt: now(),
+                    })
+                        .onConflictDoUpdate({
+                        target: orgs.githubId,
+                        set: {
+                            login: tenant.login,
+                            kind: tenant.kind,
+                            name: tenant.name ?? null,
+                            avatarUrl: tenant.avatarUrl ?? null,
+                            updatedAt: now(),
+                        },
+                    })
+                        .returning({ id: orgs.id });
+                    if (!org)
+                        throw new Error("org upsert returned no row");
+                    await tx
+                        .insert(orgMembers)
+                        .values({ orgId: org.id, userId: row.id, role: tenant.role, syncedAt: now() });
+                }
+                return userFrom(row);
+            });
+        },
+        async findByGitHubId(githubId) {
+            const [row] = await db
+                .update(users)
+                .set({ lastSeenAt: now() })
+                .where(eq(users.githubId, githubId))
+                .returning();
+            return row ? userFrom(row) : undefined;
+        },
+        async orgsFor(userId) {
+            const rows = await db
+                .select({ org: orgs, role: orgMembers.role })
+                .from(orgMembers)
+                .innerJoin(orgs, eq(orgs.id, orgMembers.orgId))
+                .where(eq(orgMembers.userId, userId))
+                .orderBy(sql `(${orgs.kind} = 'user') desc`, asc(sql `lower(${orgs.login})`));
+            return rows.map(({ org, role }) => ({
+                id: org.id,
+                githubId: org.githubId,
+                login: org.login,
+                kind: org.kind,
+                ...(org.name ? { name: org.name } : {}),
+                ...(org.avatarUrl ? { avatarUrl: org.avatarUrl } : {}),
+                role,
+            }));
+        },
+        async gitHubToken(githubId) {
+            const [row] = await db
+                .select({ token: users.githubToken })
+                .from(users)
+                .where(and(eq(users.githubId, githubId)));
+            return row ? box.open(Buffer.from(row.token, "base64")) : undefined;
+        },
+    };
+}
+function userFrom(row) {
+    return {
+        id: row.id,
+        githubId: row.githubId,
+        login: row.login,
+        ...(row.name ? { name: row.name } : {}),
+        ...(row.avatarUrl ? { avatarUrl: row.avatarUrl } : {}),
+    };
+}
+//# sourceMappingURL=users.js.map

package/dist/auth/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/auth/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAkDzD,gGAAgG;AAChG,SAAS,SAAS,CAAC,OAAwB;IACzC,OAAO;QACL;YACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,MAAM;YACZ,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI,EAAE,OAAO;SACd;QACD,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,KAAc,EAAE,CAAC,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,EAAY,EACZ,OAA6C;IAE7C,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACjC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;qBACnB,MAAM,CAAC,KAAK,CAAC;qBACb,MAAM,CAAC;oBACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;oBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;oBACpC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACpE,YAAY,EAAE,OAAO,CAAC,MAAM;oBAC5B,SAAS,EAAE,GAAG,EAAE;oBAChB,UAAU,EAAE,GAAG,EAAE;iBAClB,CAAC;qBACD,kBAAkB,CAAC;oBAClB,MAAM,EAAE,KAAK,CAAC,QAAQ;oBACtB,GAAG,EAAE;wBACH,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;wBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;wBACpC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBACpE,YAAY,EAAE,OAAO,CAAC,MAAM;wBAC5B,UAAU,EAAE,GAAG,EAAE;qBAClB;iBACF,CAAC;qBACD,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBACzD,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjE,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;yBACnB,MAAM,CAAC,IAAI,CAAC;yBACZ,MAAM,CAAC;wBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;wBACzB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;wBACnC,SAAS,EAAE,GAAG,EAAE;qBACjB,CAAC;yBACD,kBAAkB,CAAC;wBAClB,MAAM,EAAE,IAAI,CAAC,QAAQ;wBACrB,GAAG,EAAE;4BACH,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;4BACzB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;4BACnC,SAAS,EAAE,GAAG,EAAE;yBACjB;qBACF,CAAC;yBACD,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC9B,IAAI,CAAC,GAAG;wBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBACxD,MAAM,EAAE;yBACL,MAAM,CAAC,UAAU,CAAC;yBAClB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBACnF,CAAC;gBACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC1B,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;iBACnC,SAAS,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;iBAC5C,IAAI,CAAC,UAAU,CAAC;iBAChB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;iBAC9C,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBACpC,OAAO,CAAC,GAAG,CAAA,IAAI,IAAI,CAAC,IAAI,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAA,SAAS,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBAClC,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,IAAI;aACL,CAAC,CAAC,CAAC;QACN,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,QAAQ;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;iBACpC,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAA8B;IAC9C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/build-metadata.js

@@ -1,2 +1,2 @@
 // Generated during the build.
-export const buildCommit = "2df529c120713bd7251dea545af3fe383b64b9b6";
+export const buildCommit = "7671bc3df0451efd548e6af8e85b4a82f437f24b";

package/dist/cli/api-client.d.ts

@@ -0,0 +1,8 @@
+export declare function passthrough(method: "GET" | "POST", path: string): Promise<void>;
+export declare function download(runId: string, outputPath: string): Promise<void>;
+export declare function requestJson(path: string, options: {
+    method: "GET" | "POST";
+    body?: Uint8Array;
+    contentType?: string;
+}): Promise<Record<string, unknown>>;
+//# sourceMappingURL=api-client.d.ts.map

package/dist/cli/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/cli/api-client.ts"],"names":[],"mappings":"AAOA,wBAAsB,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF;AAED,wBAAsB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4C/E;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmBlC"}

package/dist/cli/api-client.js

@@ -0,0 +1,71 @@
+import { createHash } from "node:crypto";
+import { open, rm } from "node:fs/promises";
+import { resolve } from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+export async function passthrough(method, path) {
+    console.log(JSON.stringify(await requestJson(path, { method }), null, 2));
+}
+export async function download(runId, outputPath) {
+    const base = process.env.SELFBENCH_API_URL ?? "http://127.0.0.1:8080";
+    const headers = new Headers();
+    if (process.env.SELFBENCH_API_TOKEN) {
+        headers.set("authorization", `Bearer ${process.env.SELFBENCH_API_TOKEN}`);
+    }
+    const response = await fetch(new URL(`/v1/runs/${encodeURIComponent(runId)}/export`, base), {
+        headers,
+    });
+    if (!response.ok) {
+        const value = (await response.json());
+        throw new Error(String(value.error ?? `SelfBench API returned ${response.status}`));
+    }
+    const expectedSha256 = response.headers.get("x-content-sha256");
+    if (!expectedSha256 || !response.body) {
+        throw new Error("SelfBench API returned an export without integrity metadata");
+    }
+    const destination = resolve(outputPath);
+    const file = await open(destination, "wx");
+    let verified = false;
+    try {
+        const hash = createHash("sha256");
+        const hasher = new Transform({
+            transform(chunk, _encoding, callback) {
+                hash.update(chunk);
+                callback(undefined, chunk);
+            },
+        });
+        await pipeline(Readable.fromWeb(response.body), hasher, file.createWriteStream());
+        if (hash.digest("hex") !== expectedSha256) {
+            throw new Error("downloaded export failed its SHA-256 integrity check");
+        }
+        verified = true;
+    }
+    finally {
+        await file.close().catch(() => undefined);
+        if (!verified) {
+            await rm(destination, { force: true });
+        }
+    }
+    console.log(JSON.stringify({ runId, output: destination }, null, 2));
+}
+export async function requestJson(path, options) {
+    const base = process.env.SELFBENCH_API_URL ?? "http://127.0.0.1:8080";
+    const headers = new Headers();
+    if (options.contentType) {
+        headers.set("content-type", options.contentType);
+    }
+    if (process.env.SELFBENCH_API_TOKEN) {
+        headers.set("authorization", `Bearer ${process.env.SELFBENCH_API_TOKEN}`);
+    }
+    const response = await fetch(new URL(path, base), {
+        method: options.method,
+        headers,
+        ...(options.body ? { body: Buffer.from(options.body) } : {}),
+    });
+    const value = (await response.json());
+    if (!response.ok) {
+        throw new Error(String(value.error ?? `SelfBench API returned ${response.status}`));
+    }
+    return value;
+}
+//# sourceMappingURL=api-client.js.map

package/dist/cli/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/cli/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAsB,EAAE,IAAY;IACpE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa,EAAE,UAAkB;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE;QAC1F,OAAO;KACR,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC3B,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;gBAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,CACZ,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAqC,CAAC,EAChE,MAAM,EACN,IAAI,CAAC,iBAAiB,EAAE,CACzB,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,cAAc,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,OAA4E;IAE5E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;QAChD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/associate.d.ts

@@ -0,0 +1,2 @@
+export declare function associate(args: string[]): Promise<void>;
+//# sourceMappingURL=associate.d.ts.map

package/dist/cli/associate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"associate.d.ts","sourceRoot":"","sources":["../../src/cli/associate.ts"],"names":[],"mappings":"AAaA,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiD7D"}

package/dist/cli/associate.js

@@ -0,0 +1,51 @@
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { collectRepositoryProvenanceWithMetadata } from "../provenance.js";
+import { associationSessionSummaries, createProvenanceAssociationManifest, resolveMergedPullRequest, writeProvenanceAssociationManifest, } from "../provenance-associations.js";
+import { resolveRepository } from "./repository.js";
+import { fail, positiveInteger } from "./values.js";
+export async function associate(args) {
+    const parsed = parseArgs({
+        args,
+        options: {
+            repo: { type: "string", short: "r" },
+            pr: { type: "string" },
+            session: { type: "string", multiple: true },
+            output: { type: "string", short: "o" },
+            "list-sessions": { type: "boolean", default: false },
+        },
+        strict: true,
+    });
+    const repositoryPath = resolve(parsed.values.repo ?? fail("--repo is required"));
+    const [repository, collected] = await Promise.all([
+        resolveRepository(repositoryPath),
+        collectRepositoryProvenanceWithMetadata(repositoryPath, process.env.HOME ?? homedir()),
+    ]);
+    const localMessages = collected.messages;
+    const sessions = associationSessionSummaries(localMessages, collected.sessions);
+    if (parsed.values["list-sessions"]) {
+        console.log(JSON.stringify({ repository: repository.url, sessions }, null, 2));
+        return;
+    }
+    const sourcePr = positiveInteger(parsed.values.pr ?? fail("--pr is required"), "--pr");
+    const output = resolve(parsed.values.output ?? fail("--output is required"));
+    const selectors = parsed.values.session ?? [];
+    const pullRequest = await resolveMergedPullRequest(repository.url, sourcePr);
+    const manifest = createProvenanceAssociationManifest({
+        repositoryUrl: repository.url,
+        pullRequest,
+        messages: localMessages,
+        sessionSelectors: selectors,
+    });
+    await writeProvenanceAssociationManifest(output, manifest);
+    console.log(JSON.stringify({
+        output,
+        repository: manifest.repository,
+        sourcePr: manifest.sourcePr,
+        sourceUrl: manifest.sourceUrl,
+        sessions: selectors.length,
+        messages: manifest.messages.length,
+    }, null, 2));
+}
+//# sourceMappingURL=associate.js.map

package/dist/cli/associate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"associate.js","sourceRoot":"","sources":["../../src/cli/associate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,uCAAuC,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,EACnC,wBAAwB,EACxB,kCAAkC,GACnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC;QACvB,IAAI;QACJ,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACpC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACtB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC3C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;SACrD;QACD,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACjF,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,iBAAiB,CAAC,cAAc,CAAC;QACjC,uCAAuC,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC;IACzC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,mCAAmC,CAAC;QACnD,aAAa,EAAE,UAAU,CAAC,GAAG;QAC7B,WAAW;QACX,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,SAAS;KAC5B,CAAC,CAAC;IACH,MAAM,kCAAkC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,MAAM;QACN,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,SAAS,CAAC,MAAM;QAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;KACnC,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC"}

package/dist/cli/help.d.ts

@@ -0,0 +1,2 @@
+export declare function printHelp(): void;
+//# sourceMappingURL=help.d.ts.map

package/dist/cli/help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAAA,wBAAgB,SAAS,IAAI,IAAI,CAkDhC"}

package/dist/cli/help.js

@@ -0,0 +1,52 @@
+export function printHelp() {
+    console.log(`SelfBench creates durable tiered Harbor evaluations.
+
+Usage:
+  self-bench setup vercel [--profile NAME] [--verbose]
+  self-bench setup e2b --name NAME[:TAG] [--cpus N] [--memory-mib N]
+  self-bench up [--backend docker|modal|vercel|e2b]
+                [--harbor-environment docker|modal|vercel|e2b|daytona]
+                [--modal-config PATH] [--vercel-profile NAME]
+  self-bench down
+  self-bench associate --repo PATH --list-sessions
+  self-bench associate --repo PATH --pr NUMBER --session TYPE:SESSION_ID [...]
+                       --output ASSOCIATION.json
+  self-bench run --repo PATH [--easy-count N] [--medium-count N] [--hard-count N]
+                  [--model MODEL] [--association ASSOCIATION.json ...]
+                  [--exclude-run RUN_ID ...] [--run-id ID] [--wait] [--output OUTPUT.tar.gz]
+  self-bench replay --source-run RUN_ID --candidate ID [--candidate ID ...]
+                     [--model MODEL] [--run-id ID] [--wait] [--output OUTPUT.tar.gz]
+  self-bench status RUN_ID
+  self-bench cancel RUN_ID
+  self-bench download RUN_ID OUTPUT.tar.gz
+  self-bench list
+  self-bench view TASKS_DIR [--port N] [--host HOST]
+
+The up command starts the local stack, one Compose project per checkout so worktrees run side by
+side. Every generation backend defaults Harbor to the matching environment; --harbor-environment
+picks a different one, and Daytona is Harbor-only. Modal generation or Harbor uses
+~/.modal.toml unless --modal-config overrides it. Run self-bench setup vercel once to create or select a
+project, publish the pinned runtime image, verify access, and save an owner-only local profile. E2B setup
+is noninteractive: with E2B_API_KEY set, it builds Dockerfile.sandbox under the requested versioned name;
+set SELFBENCH_E2B_TEMPLATE to the printed template before starting the stack.
+
+The associate command runs locally. --list-sessions prints selectors, counts, local paths, and modification
+times, but never request text. Association writes a create-only, text-free manifest; it never uploads or
+starts a run. Pass the manifest to run with --association (repeatable). No LLM participates in association.
+
+The tier counts are accepted-task targets. A rejected candidate is replaced from the leftover discovery
+pool until each tier is filled or the pool is exhausted, and the export contains only accepted tasks. The
+run command performs only repository metadata and sanitized provenance upload locally; discovery, authoring
+rounds, mechanical verification, and independent verification rounds run remotely. --output implies --wait,
+blocks until completion, and downloads the SHA-256-verified export. --exclude-run (repeatable) names
+earlier runs whose source pull requests discovery must skip, whatever their outcome there; the export also
+drops accepted tasks that repeat a source pull request and lists them in its manifest.
+
+The replay command skips discovery: the worker rebuilds the named candidates from the source run's stored
+provenance, discovery reports, and authored definitions, then runs authoring and verification fresh.
+
+The view command serves the Harbor viewer over any directory of Harbor tasks (directories containing
+task.toml, searched four levels deep) without Temporal or an API token. The same viewer is served by the
+self-bench API at / and adds a run mode that shows every candidate, its stage, artifacts, and logs.`);
+}
+//# sourceMappingURL=help.js.map

package/dist/cli/help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,SAAS;IACvB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oGAgDsF,CAAC,CAAC;AACtG,CAAC"}

package/dist/cli/main.d.ts

@@ -0,0 +1,2 @@
+export declare function runCli(args: string[]): Promise<void>;
+//# sourceMappingURL=main.d.ts.map

package/dist/cli/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AASA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6C1D"}

package/dist/cli/main.js

@@ -0,0 +1,55 @@
+import { download, passthrough } from "./api-client.js";
+import { associate } from "./associate.js";
+import { printHelp } from "./help.js";
+import { replay } from "./replay.js";
+import { run } from "./run.js";
+import { down, setup, up } from "./stack.js";
+import { fail, requiredArgument } from "./values.js";
+import { view } from "./view.js";
+export async function runCli(args) {
+    const [command, ...rest] = args;
+    switch (command) {
+        case "setup":
+            await setup(rest);
+            break;
+        case "up":
+            await up(rest);
+            break;
+        case "run":
+            await run(rest);
+            break;
+        case "associate":
+            await associate(rest);
+            break;
+        case "replay":
+            await replay(rest);
+            break;
+        case "down":
+            await down();
+            break;
+        case "status":
+            await passthrough("GET", `/v1/runs/${requiredArgument(rest, "run ID")}`);
+            break;
+        case "cancel":
+            await passthrough("POST", `/v1/runs/${requiredArgument(rest, "run ID")}/cancel`);
+            break;
+        case "list":
+            await passthrough("GET", "/v1/runs");
+            break;
+        case "view":
+            await view(rest);
+            break;
+        case "download":
+            await download(requiredArgument(rest, "run ID"), rest[1] ?? fail("output path is required"));
+            break;
+        case "help":
+        case "--help":
+        case "-h":
+        case undefined:
+            printHelp();
+            break;
+        default:
+            throw new Error(`unknown command: ${command}`);
+    }
+}
+//# sourceMappingURL=main.js.map

package/dist/cli/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAClB,MAAM;QACR,KAAK,IAAI;YACP,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YACf,MAAM;QACR,KAAK,KAAK;YACR,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM;QACR,KAAK,WAAW;YACd,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,MAAM;QACR,KAAK,MAAM;YACT,MAAM,IAAI,EAAE,CAAC;YACb,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,WAAW,CAAC,KAAK,EAAE,YAAY,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACzE,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,WAAW,CAAC,MAAM,EAAE,YAAY,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjF,MAAM;QACR,KAAK,MAAM;YACT,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YACrC,MAAM;QACR,KAAK,MAAM;YACT,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,MAAM;QACR,KAAK,UAAU;YACb,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC7F,MAAM;QACR,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,SAAS;YACZ,SAAS,EAAE,CAAC;YACZ,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}

package/dist/cli/replay.d.ts

@@ -0,0 +1,3 @@
+/** Re-runs known candidates of an earlier run through fresh authoring and verification. */
+export declare function replay(args: string[]): Promise<void>;
+//# sourceMappingURL=replay.d.ts.map

package/dist/cli/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../src/cli/replay.ts"],"names":[],"mappings":"AAMA,2FAA2F;AAC3F,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyD1D"}