@abelxiaoxing/cadence 1.4.0 → 1.5.0

package/src/operator-cli.mjs

@@ -0,0 +1,1421 @@
+// Generated by scripts/build-workspace-io.mjs; edit operator-cli-entry.mjs and its source modules.
+// src/operator-cli-entry.mjs
+import path6 from "node:path";
+
+// src/operator-tools.ts
+import { spawnSync } from "node:child_process";
+import { lstatSync as lstatSync6, readdirSync as readdirSync4, readFileSync as readFileSync4, realpathSync as realpathSync4 } from "node:fs";
+import path5 from "node:path";
+import { DatabaseSync } from "node:sqlite";
+
+// src/execution-profile.ts
+function executionProfile(env = process.env) {
+  const mode = env.ABEL_EXECUTION_MODE ?? "isolated";
+  if (mode !== "isolated" && mode !== "local-trusted")
+    throw new Error("execution-mode-invalid");
+  const timeoutMs = Number(env.ABEL_VERIFICATION_TIMEOUT_MS ?? 600000);
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 86400000)
+    throw new Error("verification-timeout-invalid");
+  const inheritEnvironment = (env.ABEL_VERIFICATION_ENV ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+  if (inheritEnvironment.some((name) => !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(name)))
+    throw new Error("verification-environment-names-invalid");
+  if (mode === "isolated" && inheritEnvironment.length)
+    throw new Error("verification-environment-requires-trusted-mode");
+  return {
+    mode,
+    timeoutMs,
+    bwrapPath: env.ABEL_BWRAP_PATH ?? "/usr/bin/bwrap",
+    inheritEnvironment
+  };
+}
+
+// src/openspec-cli.ts
+import { lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+var PACKAGE_NAME = "@fission-ai/openspec";
+var OPENSPEC_LIMITS = Object.freeze({
+  timeoutMs: 30000,
+  maxBuffer: 4 * 1024 * 1024
+});
+
+class OpenSpecCliError extends Error {
+  diagnostic;
+  constructor(command, phase, reason, detail = {}) {
+    super("design-openspec-unavailable");
+    this.name = "OpenSpecCliError";
+    this.diagnostic = Object.freeze({
+      code: "design-openspec-unavailable",
+      command,
+      phase,
+      reason,
+      ...["ENOENT", "EINVAL", "EACCES", "EPERM", "ENOEXEC", "E2BIG"].includes(detail.systemCode ?? "") ? { systemCode: detail.systemCode } : {},
+      ...Number.isSafeInteger(detail.exitCode) && (detail.exitCode ?? -1) >= 0 ? { exitCode: String(detail.exitCode) } : {}
+    });
+  }
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function inside(root, target) {
+  const relative = path.relative(root, target);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function envValue(environment, name) {
+  const key = Object.keys(environment).sort().find((candidate) => process.platform === "win32" ? candidate.toUpperCase() === name.toUpperCase() : candidate === name);
+  return key === undefined ? undefined : environment[key];
+}
+function packageEntry(root) {
+  const canonicalRoot = realpathSync(root);
+  const manifestPath = realpathSync(path.join(canonicalRoot, "package.json"));
+  const manifestStat = lstatSync(manifestPath);
+  if (!inside(canonicalRoot, manifestPath) || !manifestStat.isFile() || manifestStat.size > 1024 * 1024)
+    throw new Error("manifest-limit");
+  const manifest = record(JSON.parse(readFileSync(manifestPath, "utf8")));
+  const bin = typeof manifest?.bin === "string" ? manifest.bin : record(manifest?.bin)?.openspec;
+  if (manifest?.name !== PACKAGE_NAME || typeof bin !== "string" || path.isAbsolute(bin))
+    throw new Error("manifest-invalid");
+  const entry = realpathSync(path.resolve(canonicalRoot, bin));
+  if (!inside(canonicalRoot, entry) || !/\.(?:cjs|mjs|js)$/iu.test(entry) || !lstatSync(entry).isFile())
+    throw new Error("entry-invalid");
+  return entry;
+}
+function canonicalConsumerRoot(consumerRoot) {
+  try {
+    const root = realpathSync(consumerRoot);
+    if (!lstatSync(root).isDirectory())
+      throw new Error("cwd-invalid");
+    return root;
+  } catch (error) {
+    throw new OpenSpecCliError("resolve", "resolution", "cwd-unavailable", {
+      systemCode: error.code
+    });
+  }
+}
+function commandIn(directory) {
+  const names = process.platform === "win32" ? ["openspec.exe", "openspec.cmd", "openspec"] : ["openspec"];
+  const entries = process.platform === "win32" ? readdirSync(directory) : names;
+  for (const name of names) {
+    const matches = entries.filter((entry) => entry.toLowerCase() === name);
+    if (matches.length > 1)
+      throw new Error("ambiguous-command");
+    if (matches.length === 1) {
+      const candidate = path.join(directory, matches[0]);
+      if (lstatSync(candidate, { throwIfNoEntry: false }))
+        return candidate;
+    }
+  }
+  return;
+}
+function resolveOpenSpecInvocation(consumerRoot, environment = process.env) {
+  const configuredRoot = envValue(environment, "ABEL_OPENSPEC_PACKAGE_ROOT");
+  const configuredNode = envValue(environment, "ABEL_OPENSPEC_NODE");
+  const node = configuredNode ?? (process.release.name === "node" && !process.versions.bun ? process.execPath : undefined);
+  let executable;
+  try {
+    if (!node || !path.isAbsolute(node) || /\.(?:cmd|bat|ps1)$/iu.test(node)) {
+      throw new Error("runtime-invalid");
+    }
+    executable = realpathSync(node);
+    if (!lstatSync(executable).isFile())
+      throw new Error("runtime-invalid");
+  } catch {
+    throw new OpenSpecCliError("resolve", "resolution", "runtime-unavailable");
+  }
+  if (configuredRoot !== undefined) {
+    try {
+      if (!path.isAbsolute(configuredRoot))
+        throw new Error("root-invalid");
+      return { executable, entry: packageEntry(configuredRoot) };
+    } catch {
+      throw new OpenSpecCliError("resolve", "resolution", "installation-invalid");
+    }
+  }
+  const consumer = canonicalConsumerRoot(consumerRoot);
+  const directories = (envValue(environment, "PATH") ?? "").split(path.delimiter);
+  for (const directory of directories) {
+    if (!path.isAbsolute(directory))
+      continue;
+    let command;
+    let canonicalDirectory;
+    try {
+      canonicalDirectory = realpathSync(directory);
+      if (inside(consumer, canonicalDirectory))
+        continue;
+      command = commandIn(canonicalDirectory);
+    } catch {
+      continue;
+    }
+    if (!command)
+      continue;
+    try {
+      const target = realpathSync(command);
+      if (inside(consumer, target)) {
+        throw new OpenSpecCliError("resolve", "resolution", "unsafe-installation");
+      }
+      const layoutRoots = [
+        path.join(canonicalDirectory, "node_modules", PACKAGE_NAME),
+        path.resolve(canonicalDirectory, "../lib/node_modules", PACKAGE_NAME)
+      ];
+      const roots = [];
+      let ancestor = path.dirname(target);
+      for (let depth = 0;depth < 8; depth++) {
+        roots.push(ancestor);
+        const parent = path.dirname(ancestor);
+        if (parent === ancestor)
+          break;
+        ancestor = parent;
+      }
+      const linked = lstatSync(command).isSymbolicLink();
+      const candidates = linked ? roots : layoutRoots;
+      for (const root of candidates) {
+        let entry;
+        try {
+          entry = packageEntry(root);
+          if (linked && entry !== target)
+            continue;
+        } catch {
+          continue;
+        }
+        if (inside(consumer, entry)) {
+          throw new OpenSpecCliError("resolve", "resolution", "unsafe-installation");
+        }
+        return { executable, entry };
+      }
+    } catch (error) {
+      if (error instanceof OpenSpecCliError)
+        throw error;
+    }
+    throw new OpenSpecCliError("resolve", "resolution", "installation-invalid");
+  }
+  throw new OpenSpecCliError("resolve", "resolution", "installation-not-found");
+}
+
+// src/state-root.ts
+import { createHash } from "node:crypto";
+import { chmodSync, lstatSync as lstatSync2, mkdirSync, realpathSync as realpathSync2 } from "node:fs";
+import os from "node:os";
+import path2 from "node:path";
+class StateRootError extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.name = "StateRootError";
+    this.code = code;
+  }
+}
+function isContainedBy(parent, candidate) {
+  const relative = path2.relative(parent, candidate);
+  return relative === "" || !relative.startsWith("..") && !path2.isAbsolute(relative);
+}
+function inspectExistingComponents(absolutePath) {
+  const parsed = path2.parse(absolutePath);
+  const relativeParts = absolutePath.slice(parsed.root.length).split(path2.sep).filter(Boolean);
+  let current = parsed.root;
+  for (const part of relativeParts) {
+    current = path2.join(current, part);
+    let stat;
+    try {
+      stat = lstatSync2(current);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return;
+      throw error;
+    }
+    if (stat.isSymbolicLink()) {
+      throw new StateRootError("state-component-symlink");
+    }
+    if (!stat.isDirectory() && current !== absolutePath) {
+      throw new StateRootError("state-component-type");
+    }
+  }
+}
+function canonicalFuturePath(input) {
+  const absolute = path2.resolve(input);
+  inspectExistingComponents(absolute);
+  let cursor = absolute;
+  const missing = [];
+  for (;; ) {
+    try {
+      return path2.join(realpathSync2.native(cursor), ...missing.reverse());
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+      const parent = path2.dirname(cursor);
+      if (parent === cursor)
+        throw error;
+      missing.push(path2.basename(cursor));
+      cursor = parent;
+    }
+  }
+}
+function requireAbsoluteDirectoryBase(xdgStateHome, homeDir) {
+  if (xdgStateHome && path2.isAbsolute(xdgStateHome)) {
+    return canonicalFuturePath(xdgStateHome);
+  }
+  if (!path2.isAbsolute(homeDir)) {
+    throw new StateRootError("invalid-state-base");
+  }
+  return canonicalFuturePath(path2.join(homeDir, ".local", "state"));
+}
+function resolveStateRoot(options) {
+  let consumerRoot;
+  try {
+    consumerRoot = realpathSync2.native(path2.resolve(options.consumerRoot));
+    if (!lstatSync2(consumerRoot).isDirectory()) {
+      throw new StateRootError("consumer-root-unavailable");
+    }
+  } catch (error) {
+    if (error instanceof StateRootError)
+      throw error;
+    throw new StateRootError("consumer-root-unavailable");
+  }
+  const stateBase = requireAbsoluteDirectoryBase(options.xdgStateHome, options.homeDir ?? os.homedir());
+  const consumerRootHash = createHash("sha256").update(consumerRoot).digest("hex");
+  const productRoot = canonicalFuturePath(path2.join(stateBase, "abel-cadence"));
+  const rootsDir = canonicalFuturePath(path2.join(productRoot, "roots"));
+  const rootDir = canonicalFuturePath(path2.join(rootsDir, consumerRootHash));
+  if (isContainedBy(consumerRoot, rootDir)) {
+    throw new StateRootError("state-root-inside-consumer");
+  }
+  return {
+    consumerRoot,
+    consumerRootHash,
+    stateBase,
+    productRoot,
+    rootsDir,
+    rootDir,
+    databasePath: path2.join(rootDir, "control.sqlite3"),
+    artifactsDir: path2.join(rootDir, "artifacts"),
+    workspacesDir: path2.join(rootDir, "workspaces"),
+    transactionsDir: path2.join(rootDir, "transactions")
+  };
+}
+
+// src/transport-budget.ts
+var REQUEST_BOUNDS = Object.freeze({
+  firstProgressMs: 90000,
+  streamIdleMs: 180000,
+  cancellationDrainMs: 250
+});
+function requestBounds(env = process.env) {
+  const read = (name, fallback) => {
+    const value = Number(env[name] ?? fallback);
+    if (!Number.isSafeInteger(value) || value < 1 || value > 1200000)
+      throw new Error("request-budget-invalid");
+    return value;
+  };
+  return {
+    ...REQUEST_BOUNDS,
+    firstProgressMs: read("ABEL_FIRST_PROGRESS_MS", REQUEST_BOUNDS.firstProgressMs),
+    streamIdleMs: read("ABEL_STREAM_IDLE_MS", REQUEST_BOUNDS.streamIdleMs)
+  };
+}
+
+// src/verification-capability.ts
+import {
+  lstatSync as lstatSync5,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync3,
+  realpathSync as realpathSync3
+} from "node:fs";
+import path4 from "node:path";
+
+// src/control-contracts.ts
+var CONTROL_SCHEMA_PROPERTIES = {
+  command: {
+    type: "string",
+    enum: ["start", "status", "resume", "rebind", "cancel", "discard"]
+  },
+  stage: { type: "string", enum: ["abel-implement"] },
+  change: { type: "string" },
+  operationId: { type: "string" },
+  deliveryRevision: { type: "integer", minimum: 1 },
+  receiptHash: { type: "string" },
+  routeId: { type: "string" },
+  recovery: {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      incidentKey: { type: "string", pattern: "^[a-f0-9]{64}$" },
+      failureSequence: { type: "integer", minimum: 1 },
+      reason: {
+        type: "string",
+        enum: ["parent-directed-retry", "route-changed", "context-extended"]
+      }
+    },
+    required: ["incidentKey", "failureSequence", "reason"]
+  }
+};
+var commandSchema = (command, fields) => ({
+  type: "object",
+  properties: {
+    command: { type: "string", enum: [command] },
+    ...Object.fromEntries(fields.map((field) => [field, CONTROL_SCHEMA_PROPERTIES[field]]))
+  },
+  required: ["command", ...fields],
+  additionalProperties: false
+});
+var CONTROL_COMMAND_PARAMETERS = {
+  type: "object",
+  properties: CONTROL_SCHEMA_PROPERTIES,
+  required: ["command", "stage", "change"],
+  anyOf: [
+    commandSchema("start", ["stage", "change", "operationId"]),
+    commandSchema("status", ["stage", "change"]),
+    commandSchema("resume", ["stage", "change", "operationId"]),
+    commandSchema("resume", ["stage", "change", "operationId", "recovery"]),
+    commandSchema("resume", [
+      "stage",
+      "change",
+      "operationId",
+      "deliveryRevision",
+      "receiptHash",
+      "recovery"
+    ]),
+    commandSchema("resume", [
+      "stage",
+      "change",
+      "operationId",
+      "deliveryRevision",
+      "receiptHash"
+    ]),
+    commandSchema("rebind", ["stage", "change", "operationId", "routeId"]),
+    commandSchema("cancel", ["stage", "change", "operationId"]),
+    commandSchema("discard", ["stage", "change", "operationId"])
+  ],
+  additionalProperties: false
+};
+var CONTROL_TOOL_FIELDS = new Set([
+  "command",
+  "stage",
+  "change",
+  "operationId",
+  "deliveryRevision",
+  "receiptHash",
+  "routeId",
+  "recovery"
+]);
+var COMMAND_FIELDS = Object.freeze({
+  start: new Set(["command", "stage", "change", "operationId"]),
+  status: new Set(["command", "stage", "change"]),
+  resume: new Set([
+    "command",
+    "stage",
+    "change",
+    "operationId",
+    "deliveryRevision",
+    "receiptHash",
+    "recovery"
+  ]),
+  rebind: new Set(["command", "stage", "change", "operationId", "routeId"]),
+  cancel: new Set(["command", "stage", "change", "operationId"]),
+  discard: new Set(["command", "stage", "change", "operationId"])
+});
+// src/contracts.ts
+var LIMITS = {
+  maxActiveChildSessions: 4,
+  maxEnvelopeBytes: 64 * 1024,
+  phaseTimeoutMs: 20 * 60 * 1000,
+  maxCompleteResultBytes: 64 * 1024
+};
+var VERIFICATION_LIMITS = Object.freeze({
+  minSteps: 1,
+  maxSteps: 8,
+  minTestFiles: 1,
+  maxTestFiles: 64
+});
+var NONCANONICAL = /(^|\/)\.\.(\/|$)|(^|\/)\/|^\//;
+var RELATIVE_PATH_PATTERN = String.raw`^(?:\.|(?!/)(?![a-zA-Z]:/)(?!\./)(?![\s\S]*\.\.)(?![\s\S]*[\\\u0000])(?![\s\S]*//)(?![\s\S]*/\.(?:/|$))(?![\s\S]*/$)[\s\S]+)$`;
+function isValidRelativePath(p) {
+  return typeof p === "string" && p.length > 0 && p.length <= 512 && !NONCANONICAL.test(p) && !p.startsWith("/") && !/^[a-z]:\//iu.test(p) && (p === "." || !p.startsWith("./") && !p.endsWith("/") && !p.split("/").includes(".")) && !p.includes("..") && !p.includes("\\") && !p.includes("\x00");
+}
+var UNSAFE_VERIFICATION_TOKEN = /[;&|`$<>\n\r\0]/u;
+var VERIFICATION_NAME = /^[a-z0-9][a-z0-9._:@/-]*$/iu;
+var EXECUTABLE_NAME = /^[a-z0-9][a-z0-9._-]*$/iu;
+var IDENTIFIER = /^[a-z0-9](?:[a-z0-9._:-]{0,126}[a-z0-9])?$/iu;
+function validVerificationToken(value) {
+  const optionValue = typeof value === "string" && value.includes("=") ? value.slice(value.indexOf("=") + 1) : value;
+  return typeof value === "string" && value.length > 0 && value.length <= 512 && value.trim() === value && !UNSAFE_VERIFICATION_TOKEN.test(value) && !value.includes("\\") && !value.startsWith("/") && !/^[a-z]:\//iu.test(value) && !/(^|\/)\.\.(\/|$)/u.test(value) && typeof optionValue === "string" && !optionValue.startsWith("/") && !/^[a-z]:\//iu.test(optionValue) && !/(^|\/)\.\.(\/|$)/u.test(optionValue);
+}
+function validVerificationArgs(value) {
+  return Array.isArray(value) && value.length <= 128 && value.every(validVerificationToken);
+}
+function validScriptCommand(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 1024 && value.trim() === value && !value.includes("\x00");
+}
+function validVerificationIdentity(contract) {
+  if (!validIdentifier(contract.id) || !["expected-red", "expected-green", "expected-refactor"].includes(String(contract.classification))) {
+    return false;
+  }
+  return contract.classification === "expected-red" ? typeof contract.expectedFailure === "string" && contract.expectedFailure.length > 0 && contract.expectedFailure.length <= 512 : contract.expectedFailure === undefined;
+}
+function validatePackageScriptRunner(value) {
+  if (!hasExactKeys(value, ["kind", "packageManager", "script", "command"]) || value.kind !== "package-script" || !["bun", "npm", "pnpm", "yarn"].includes(String(value.packageManager)) || typeof value.script !== "string" || !VERIFICATION_NAME.test(value.script) || value.script.includes("/") || !validScriptCommand(value.command)) {
+    return false;
+  }
+  return true;
+}
+function validateExecutableRunner(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const runner = value;
+  if (runner.kind === "package-script") {
+    return validatePackageScriptRunner(runner);
+  }
+  if (runner.kind === "local-binary" && hasExactKeys(runner, ["kind", "executable"])) {
+    return typeof runner.executable === "string" && EXECUTABLE_NAME.test(runner.executable);
+  }
+  return runner.kind === "npx" && hasExactKeys(runner, ["kind", "executable", "noInstall"]) && typeof runner.executable === "string" && EXECUTABLE_NAME.test(runner.executable) && runner.noInstall === true;
+}
+function validateVitestRunner(value) {
+  if (value.kind === "package-script") {
+    if (UNSAFE_VERIFICATION_TOKEN.test(value.command))
+      return false;
+    const tokens = value.command.split(/\s+/u);
+    return tokens[0] === "vitest" || tokens[0] === "npx" && tokens[1] === "--no-install" && tokens[2] === "vitest";
+  }
+  return value.executable === "vitest";
+}
+function validateAtomicVerification(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const contract = value;
+  if (contract.executionBindings !== undefined && (!contract.executionBindings || typeof contract.executionBindings !== "object" || Array.isArray(contract.executionBindings) || Object.entries(contract.executionBindings).some(([key, hash]) => !VERIFICATION_CONFIGURATION_PATHS.includes(key) || hash !== null && (typeof hash !== "string" || !/^[a-f0-9]{64}$/u.test(hash)))))
+    return false;
+  const expectedFailure = [
+    ...contract.classification === "expected-red" ? ["expectedFailure"] : [],
+    ...contract.executionBindings === undefined ? [] : ["executionBindings"]
+  ];
+  if (contract.kind === "vitest") {
+    const executableRunner = contract.runner;
+    return hasExactKeys(contract, [
+      "kind",
+      "id",
+      "runner",
+      "testFiles",
+      "args",
+      "classification",
+      ...expectedFailure,
+      "minTests"
+    ]) && validVerificationIdentity(contract) && validateExecutableRunner(contract.runner) && validateVitestRunner(executableRunner) && Array.isArray(contract.testFiles) && contract.testFiles.length >= VERIFICATION_LIMITS.minTestFiles && contract.testFiles.length <= VERIFICATION_LIMITS.maxTestFiles && contract.testFiles.every(isValidRelativePath) && new Set(contract.testFiles).size === contract.testFiles.length && validVerificationArgs(contract.args) && Number.isSafeInteger(contract.minTests) && contract.minTests >= 1;
+  }
+  if (contract.kind === "package-script") {
+    const runner2 = {
+      kind: "package-script",
+      packageManager: contract.packageManager,
+      script: contract.script,
+      command: contract.command
+    };
+    return hasExactKeys(contract, [
+      "kind",
+      "id",
+      "packageManager",
+      "script",
+      "command",
+      "args",
+      "classification",
+      ...expectedFailure
+    ]) && validVerificationIdentity(contract) && validatePackageScriptRunner(runner2) && validVerificationArgs(contract.args);
+  }
+  if (contract.kind !== "static-check")
+    return false;
+  const runner = contract.runner;
+  const validRunner = validateExecutableRunner(runner) || hasExactKeys(runner, ["kind", "script"]) && runner.kind === "node" && isValidRelativePath(runner.script);
+  return hasExactKeys(contract, [
+    "kind",
+    "id",
+    "runner",
+    "args",
+    "classification",
+    ...expectedFailure
+  ]) && validVerificationIdentity(contract) && validRunner && validVerificationArgs(contract.args);
+}
+function validateStructuredVerification(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const contract = value;
+  if (contract.kind !== "steps") {
+    return validateAtomicVerification(contract);
+  }
+  if (!hasExactKeys(contract, ["kind", "id", "classification", "steps"]) || !validIdentifier(contract.id) || !["expected-red", "expected-green", "expected-refactor"].includes(String(contract.classification)) || !Array.isArray(contract.steps) || contract.steps.length < VERIFICATION_LIMITS.minSteps || contract.steps.length > VERIFICATION_LIMITS.maxSteps || !contract.steps.every((step) => validateAtomicVerification(step))) {
+    return false;
+  }
+  const steps = contract.steps;
+  return steps.slice(0, -1).every((step) => step.classification === "expected-green") && steps.at(-1)?.classification === contract.classification && new Set(steps.map((step) => step.id)).size === steps.length;
+}
+function validateVerificationContract(value) {
+  if (validateStructuredVerification(value)) {
+    return { ok: true, value: structuredClone(value) };
+  }
+  return {
+    ok: false,
+    reason: "verification contract is unsupported by the Implement runtime"
+  };
+}
+function verificationSteps(verification) {
+  const normalized = validateVerificationContract(verification);
+  if (!normalized.ok)
+    return [];
+  return normalized.value.kind === "steps" ? structuredClone(normalized.value.steps) : [structuredClone(normalized.value)];
+}
+var VERIFICATION_CONFIGURATION_PATHS = [
+  "package.json",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "bun.lock",
+  "bun.lockb",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  ".npmrc",
+  ".yarnrc",
+  ".yarnrc.yml",
+  "bunfig.toml",
+  "pnpm-workspace.yaml"
+];
+function verificationBoundInputPaths(verification) {
+  return [
+    ...new Set([
+      ...verificationInputPaths(verification),
+      ...verificationSteps(verification).flatMap((step) => step.kind === "vitest" || step.kind === "package-script" || ("runner" in step) && step.runner.kind === "package-script" ? VERIFICATION_CONFIGURATION_PATHS : [])
+    ])
+  ];
+}
+function verificationInputPaths(verification) {
+  return [
+    ...new Set(verificationSteps(verification).flatMap((step) => {
+      const paths = step.kind === "vitest" ? [...step.testFiles] : step.kind === "static-check" && step.runner.kind === "node" ? [step.runner.script] : [];
+      if (step.kind === "package-script" || "runner" in step && step.runner.kind === "package-script") {
+        paths.push("package.json");
+      }
+      return paths;
+    }))
+  ];
+}
+function hasExactKeys(value, required, optional = []) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const record2 = value;
+  const allowed = new Set([...required, ...optional]);
+  return required.every((key) => Object.hasOwn(record2, key)) && Object.keys(record2).every((key) => allowed.has(key));
+}
+function validIdentifier(value) {
+  return typeof value === "string" && IDENTIFIER.test(value);
+}
+
+// src/file-snapshot.ts
+import { createHash as createHash2 } from "node:crypto";
+import { lstatSync as lstatSync4, readdirSync as readdirSync2, readFileSync as readFileSync2, readlinkSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+// src/safe-path.ts
+import { lstatSync as lstatSync3 } from "node:fs";
+import path3 from "node:path";
+function observeSafePath(root, relative) {
+  if (!isValidRelativePath(relative)) {
+    return { kind: "unsafe", reason: "invalid-path" };
+  }
+  try {
+    const resolvedRoot = path3.resolve(root);
+    const rootStat = lstatSync3(resolvedRoot, { throwIfNoEntry: false });
+    if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
+      return { kind: "unsafe", reason: "root-unavailable" };
+    }
+    if (relative === ".")
+      return { kind: "directory" };
+    let current = resolvedRoot;
+    const parts = relative.split("/");
+    for (const [index, part] of parts.entries()) {
+      current = path3.join(current, part);
+      if (!current.startsWith(`${resolvedRoot}${path3.sep}`)) {
+        return { kind: "unsafe", reason: "invalid-path" };
+      }
+      const stat = lstatSync3(current, { throwIfNoEntry: false });
+      if (!stat)
+        return { kind: "absent" };
+      if (stat.isSymbolicLink()) {
+        return { kind: "unsafe", reason: "symlink" };
+      }
+      if (index < parts.length - 1) {
+        if (!stat.isDirectory()) {
+          return { kind: "unsafe", reason: "parent-not-directory" };
+        }
+        continue;
+      }
+      if (stat.isFile())
+        return { kind: "file" };
+      if (stat.isDirectory())
+        return { kind: "directory" };
+      return { kind: "unsafe", reason: "special-file" };
+    }
+  } catch {
+    return { kind: "unsafe", reason: "path-unavailable" };
+  }
+  return { kind: "unsafe", reason: "invalid-path" };
+}
+function isSafeRegularFile(root, relative) {
+  return observeSafePath(root, relative).kind === "file";
+}
+
+// src/file-snapshot.ts
+function sha256(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+function snapshotFile(root, relPath) {
+  if (observeSafePath(root, relPath).kind !== "file")
+    return null;
+  const abs = resolve(root, relPath);
+  const bytes = readFileSync2(abs);
+  return { sha256: sha256(bytes), bytes: bytes.length, kind: "file" };
+}
+
+// src/verification-capability.ts
+var WINDOWS_EXECUTABLE_EXTENSIONS = new Set([".exe", ".cmd"]);
+var DEFAULT_WINDOWS_PATH_EXT = ".COM;.EXE;.BAT;.CMD";
+var SYSTEM_MOUNT_ROOTS = ["/usr", "/bin", "/lib", "/lib64", "/etc"];
+var BROAD_MOUNT_ROOTS = new Set([
+  "/",
+  "/home",
+  "/root",
+  "/tmp",
+  "/var",
+  "/var/tmp"
+]);
+function capabilitySuccess(verificationId, runnerBindings = []) {
+  const seen = new Set;
+  return {
+    ok: true,
+    verificationId,
+    runnerBindings: runnerBindings.filter((binding) => {
+      const key = `${binding.command}\x00${binding.executablePath}\x00${JSON.stringify(binding.fixedArgs ?? [])}\x00${binding.mountSource ?? ""}`;
+      if (seen.has(key))
+        return false;
+      seen.add(key);
+      return true;
+    }).map((binding) => ({
+      ...binding,
+      ...binding.fixedArgs ? { fixedArgs: [...binding.fixedArgs] } : {}
+    }))
+  };
+}
+function adapterFailure(verificationId, code, message) {
+  return {
+    ok: false,
+    diagnostic: { kind: "verification-adapter", code, verificationId, message }
+  };
+}
+function fileStatus(root, relative) {
+  const observation = observeSafePath(root, relative);
+  if (observation.kind === "file")
+    return "regular";
+  return observation.kind === "absent" ? "absent" : "unsafe";
+}
+function regularFile(root, relative) {
+  return fileStatus(root, relative) === "regular";
+}
+function localExecutable(root, executable, dependencyOwner = root, environment = {}) {
+  const dependencyRoot = path4.resolve(dependencyOwner, "node_modules");
+  try {
+    const canonicalDependencyRoot = realpathSync3(dependencyRoot);
+    for (const name of localExecutableNames(executable, environment)) {
+      const unresolved = resolveCandidateName(path4.resolve(dependencyRoot, ".bin"), name, environment.platform ?? process.platform);
+      if (!unresolved)
+        continue;
+      const canonical = realpathSync3(unresolved);
+      const stat = lstatSync5(canonical);
+      if (canonical !== canonicalDependencyRoot && pathWithin(canonicalDependencyRoot, canonical, environment.platform ?? process.platform) && regularExecutableFile(stat, environment.platform ?? process.platform)) {
+        return true;
+      }
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+function pathApi(platform, ...values) {
+  if (platform !== "win32")
+    return path4.posix;
+  if (process.platform === "win32" || values.some((value) => /^[a-z]:[\\/]/iu.test(value) || value.startsWith("\\\\"))) {
+    return path4.win32;
+  }
+  return path4.posix;
+}
+function pathWithin(root, candidate, platform) {
+  const platformPath = pathApi(platform, root, candidate);
+  const normalizedRoot = platformPath.resolve(root);
+  const relative = platformPath.relative(normalizedRoot, platformPath.resolve(candidate));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${platformPath.sep}`) && !platformPath.isAbsolute(relative);
+}
+function regularExecutableFile(stat, platform) {
+  return stat.isFile() && (platform === "win32" || (stat.mode & 73) !== 0);
+}
+function windowsPathExtensions(pathExt) {
+  const seen = new Set;
+  const extensions = [];
+  for (const entry of (pathExt ?? DEFAULT_WINDOWS_PATH_EXT).split(";")) {
+    const extension = entry.trim().toLowerCase();
+    if (!WINDOWS_EXECUTABLE_EXTENSIONS.has(extension) || seen.has(extension)) {
+      continue;
+    }
+    seen.add(extension);
+    extensions.push(extension);
+  }
+  return extensions;
+}
+function runnerNames(command, environment) {
+  if (!/^[a-z0-9][a-z0-9._-]*$/iu.test(command))
+    return [];
+  if ((environment.platform ?? process.platform) !== "win32") {
+    return [command];
+  }
+  const extension = path4.extname(command).toLowerCase();
+  if (extension) {
+    return WINDOWS_EXECUTABLE_EXTENSIONS.has(extension) ? [command] : [];
+  }
+  return windowsPathExtensions(environment.pathExt).map((candidateExtension) => `${command}${candidateExtension}`);
+}
+function localExecutableNames(executable, environment) {
+  if (!/^[a-z0-9][a-z0-9._-]*$/iu.test(executable))
+    return [];
+  if ((environment.platform ?? process.platform) !== "win32") {
+    return [executable];
+  }
+  const extension = path4.extname(executable).toLowerCase();
+  if (extension) {
+    return WINDOWS_EXECUTABLE_EXTENSIONS.has(extension) ? [executable] : [];
+  }
+  return [
+    executable,
+    ...windowsPathExtensions(environment.pathExt).map((candidateExtension) => `${executable}${candidateExtension}`)
+  ];
+}
+function resolveCandidateName(directory, name, platform) {
+  const exact = path4.join(directory, name);
+  if (platform !== "win32")
+    return exact;
+  try {
+    const matches = readdirSync3(directory).filter((entry) => entry.toLowerCase() === name.toLowerCase());
+    return matches.length === 1 ? path4.join(directory, matches[0]) : null;
+  } catch {
+    return null;
+  }
+}
+function within(root, candidate) {
+  return candidate === root || candidate.startsWith(`${root}${path4.sep}`);
+}
+function commonDirectory(left, right, platform = process.platform) {
+  const platformPath = pathApi(platform, left, right);
+  const leftResolved = platformPath.resolve(left);
+  const rightResolved = platformPath.resolve(right);
+  const leftRoot = platformPath.parse(leftResolved).root;
+  const rightRoot = platformPath.parse(rightResolved).root;
+  const comparable = (value) => platform === "win32" ? value.toLowerCase() : value;
+  if (comparable(leftRoot) !== comparable(rightRoot))
+    return leftRoot;
+  const parts = (value, root) => platformPath.relative(root, value).split(platformPath.sep).filter(Boolean);
+  const leftParts = parts(leftResolved, leftRoot);
+  const rightParts = parts(rightResolved, rightRoot);
+  const common = [];
+  for (let index = 0;index < Math.min(leftParts.length, rightParts.length); index++) {
+    const leftPart = leftParts[index];
+    const rightPart = rightParts[index];
+    if (comparable(leftPart) !== comparable(rightPart))
+      break;
+    common.push(leftPart);
+  }
+  return platformPath.join(leftRoot, ...common);
+}
+function unsafeMountSource(source) {
+  if (BROAD_MOUNT_ROOTS.has(source))
+    return true;
+  if (path4.resolve(source) === path4.parse(path4.resolve(source)).root)
+    return true;
+  const parts = path4.relative(path4.parse(path4.resolve(source)).root, path4.resolve(source)).split(path4.sep).filter(Boolean).map((part) => part.toLowerCase());
+  return parts[0] === "home" && parts.length <= 2 || parts[0] === "users" && parts.length <= 2 || parts[0] === "root" && parts.length <= 1;
+}
+function safeRunnerSource(paths, platform) {
+  let source = path4.dirname(paths[0]);
+  for (const candidate of paths.slice(1)) {
+    source = commonDirectory(source, path4.dirname(candidate), platform);
+  }
+  if (unsafeMountSource(source))
+    return null;
+  try {
+    const stat = lstatSync5(source);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+      return null;
+  } catch {
+    return null;
+  }
+  return paths.every((candidate) => pathWithin(source, candidate, platform)) ? source : null;
+}
+function resolvedRunnerEnvironment(environment) {
+  return {
+    platform: environment.platform ?? process.platform,
+    path: environment.path ?? process.env.PATH ?? "",
+    pathExt: environment.pathExt ?? process.env.PATHEXT ?? DEFAULT_WINDOWS_PATH_EXT,
+    pathDelimiter: environment.pathDelimiter ?? path4.delimiter
+  };
+}
+function windowsShimBinding(command, launcherPath, environment) {
+  const name = path4.basename(command, path4.extname(command)).toLowerCase();
+  if (name !== "npm" && name !== "npx")
+    return null;
+  const node = resolveVerificationRunner("node", environment);
+  if (!node || node.fixedArgs || path4.extname(node.executablePath).toLowerCase() !== ".exe") {
+    return null;
+  }
+  const cli = path4.join(path4.dirname(launcherPath), "node_modules", "npm", "bin", `${name}-cli.js`);
+  try {
+    const canonicalLauncher = realpathSync3(launcherPath);
+    const canonicalCli = realpathSync3(cli);
+    const cliStat = lstatSync5(canonicalCli);
+    if (!cliStat.isFile())
+      return null;
+    const source = safeRunnerSource([node.executablePath, canonicalLauncher, canonicalCli], environment.platform);
+    if (!source)
+      return null;
+    return {
+      command,
+      executablePath: node.executablePath,
+      fixedArgs: [canonicalCli]
+    };
+  } catch {
+    return null;
+  }
+}
+function localPackageDirectories(dependencyRoot) {
+  const packages = [];
+  try {
+    for (const entry of readdirSync3(dependencyRoot, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.name.startsWith("."))
+        continue;
+      const candidate = path4.join(dependencyRoot, entry.name);
+      if (!entry.name.startsWith("@")) {
+        packages.push(candidate);
+        continue;
+      }
+      for (const scoped of readdirSync3(candidate, { withFileTypes: true })) {
+        if (scoped.isDirectory() && !scoped.name.startsWith(".")) {
+          packages.push(path4.join(candidate, scoped.name));
+        }
+      }
+    }
+  } catch {
+    return [];
+  }
+  return packages;
+}
+function localPackageBinTargets(dependencyOwner, executable, platform) {
+  const dependencyRoot = path4.resolve(dependencyOwner, "node_modules");
+  let canonicalDependencyRoot;
+  try {
+    canonicalDependencyRoot = realpathSync3(dependencyRoot);
+  } catch {
+    return [];
+  }
+  const targets = [];
+  for (const packageDirectory of localPackageDirectories(dependencyRoot)) {
+    try {
+      const directoryStat = lstatSync5(packageDirectory);
+      if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) {
+        continue;
+      }
+      const canonicalPackage = realpathSync3(packageDirectory);
+      if (!pathWithin(canonicalDependencyRoot, canonicalPackage, platform) || canonicalPackage === canonicalDependencyRoot) {
+        continue;
+      }
+      const manifestPath = path4.join(canonicalPackage, "package.json");
+      const manifestStat = lstatSync5(manifestPath);
+      if (!manifestStat.isFile() || manifestStat.isSymbolicLink())
+        continue;
+      const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+      if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+        continue;
+      }
+      const record2 = manifest;
+      const packageName = typeof record2.name === "string" ? record2.name.split("/").pop() ?? "" : "";
+      const bin = record2.bin;
+      let relative;
+      if (typeof bin === "string" && (platform === "win32" ? packageName.toLowerCase() === executable.toLowerCase() : packageName === executable)) {
+        relative = bin;
+      } else if (bin && typeof bin === "object" && !Array.isArray(bin)) {
+        const entries = Object.entries(bin).filter(([name]) => platform === "win32" ? name.toLowerCase() === executable.toLowerCase() : name === executable);
+        if (entries.length === 1)
+          relative = entries[0]?.[1];
+      }
+      if (typeof relative !== "string" || relative.length === 0 || relative.includes("\x00")) {
+        continue;
+      }
+      const unresolved = path4.resolve(canonicalPackage, relative);
+      if (!pathWithin(canonicalPackage, unresolved, platform))
+        continue;
+      const canonical = realpathSync3(unresolved);
+      const stat = lstatSync5(canonical);
+      if (stat.isFile() && pathWithin(canonicalPackage, canonical, platform) && pathWithin(canonicalDependencyRoot, canonical, platform)) {
+        targets.push(canonical);
+      }
+    } catch {}
+  }
+  return [...new Set(targets)];
+}
+function resolveLocalVerificationRunner(dependencyOwner, executable, runnerEnvironment) {
+  const environment = resolvedRunnerEnvironment(runnerEnvironment);
+  if (environment.platform !== "win32")
+    return null;
+  const targets = localPackageBinTargets(dependencyOwner, executable, environment.platform);
+  if (targets.length !== 1)
+    return null;
+  const target = targets[0];
+  const extension = path4.extname(target).toLowerCase();
+  if (extension === ".exe") {
+    return { command: executable, executablePath: target };
+  }
+  if (![".js", ".cjs", ".mjs"].includes(extension))
+    return null;
+  const node = resolveVerificationRunner("node", environment);
+  if (!node || node.fixedArgs)
+    return null;
+  return {
+    command: executable,
+    executablePath: node.executablePath,
+    fixedArgs: [target]
+  };
+}
+function resolveVerificationRunner(command, runnerEnvironment = {}) {
+  const environment = resolvedRunnerEnvironment(runnerEnvironment);
+  const directories = environment.path.split(environment.pathDelimiter).filter(Boolean);
+  const seenDirectories = new Set;
+  const candidates = [
+    ...command === "bun" && process.versions.bun && environment.platform === process.platform ? [process.execPath] : [],
+    ...directories.flatMap((directory) => {
+      const resolvedDirectory = path4.resolve(directory);
+      const key = environment.platform === "win32" ? resolvedDirectory.toLowerCase() : resolvedDirectory;
+      if (seenDirectories.has(key))
+        return [];
+      seenDirectories.add(key);
+      return runnerNames(command, environment).flatMap((name) => {
+        const candidate = resolveCandidateName(resolvedDirectory, name, environment.platform);
+        return candidate ? [candidate] : [];
+      });
+    })
+  ];
+  const seenCandidates = new Set;
+  for (const candidate of candidates) {
+    try {
+      const executablePath = path4.resolve(candidate);
+      const candidateKey = environment.platform === "win32" ? executablePath.toLowerCase() : executablePath;
+      if (seenCandidates.has(candidateKey))
+        continue;
+      seenCandidates.add(candidateKey);
+      const canonical = realpathSync3(executablePath);
+      const stat = lstatSync5(canonical);
+      if (!regularExecutableFile(stat, environment.platform))
+        continue;
+      if (environment.platform === "win32") {
+        const extension = path4.extname(executablePath).toLowerCase();
+        if (extension === ".cmd") {
+          const shim = windowsShimBinding(command, executablePath, environment);
+          if (shim)
+            return shim;
+          continue;
+        }
+        if (extension !== ".exe")
+          continue;
+        if (!safeRunnerSource([executablePath, canonical], environment.platform)) {
+          continue;
+        }
+        return { command, executablePath };
+      }
+      const systemVisible = SYSTEM_MOUNT_ROOTS.some((root) => within(root, executablePath) && within(root, canonical));
+      if (systemVisible)
+        return { command, executablePath };
+      const mountSource = commonDirectory(path4.dirname(executablePath), path4.dirname(canonical), environment.platform);
+      if (unsafeMountSource(mountSource))
+        continue;
+      const sourceStat = lstatSync5(mountSource);
+      if (!sourceStat.isDirectory() || sourceStat.isSymbolicLink())
+        continue;
+      return { command, executablePath, mountSource };
+    } catch {}
+  }
+  return null;
+}
+function packageManifest(root) {
+  if (!regularFile(root, "package.json"))
+    return null;
+  try {
+    const value = JSON.parse(readFileSync3(path4.join(root, "package.json"), "utf8"));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function validatePackageScript(root, verificationId, packageManager, script, approvedCommand, _dependencyOwner = root, runnerEnvironment = {}) {
+  const packageRunner = resolveVerificationRunner(packageManager, runnerEnvironment);
+  if (!packageRunner) {
+    return adapterFailure(verificationId, "runner-missing", `approved package manager ${packageManager} is unavailable or cannot be mounted safely`);
+  }
+  const manifest = packageManifest(root);
+  const scripts = manifest?.scripts;
+  const actual = scripts && typeof scripts === "object" && !Array.isArray(scripts) ? scripts[script] : undefined;
+  if (typeof actual !== "string") {
+    return adapterFailure(verificationId, "script-missing", `package.json script ${script} is missing`);
+  }
+  if (actual !== approvedCommand) {
+    return adapterFailure(verificationId, "script-command-mismatch", `package.json script ${script} differs from the Gate B contract`);
+  }
+  const runtimes = ["node", "bun", "npm", "npx", "pnpm", "yarn"].flatMap((command) => {
+    const binding = resolveVerificationRunner(command, runnerEnvironment);
+    return binding ? [binding] : [];
+  });
+  return capabilitySuccess(verificationId, [packageRunner, ...runtimes]);
+}
+function unsupportedExecutionConfiguration(source) {
+  const restricted = new Set([
+    "scriptshell",
+    "userconfig",
+    "globalconfig",
+    "yarnpath",
+    "plugins",
+    "auth",
+    "authtoken",
+    "password",
+    "token",
+    "npmauthtoken",
+    "npmauthident"
+  ]);
+  for (const line of source.split(/\r?\n/u)) {
+    let quote = "";
+    let escaped = false;
+    let active = "";
+    const parts = [];
+    let flowDepth = 0;
+    for (const character of line) {
+      if (escaped) {
+        active += character;
+        escaped = false;
+        continue;
+      }
+      if (character === "\\" && quote === '"') {
+        active += character;
+        escaped = true;
+        continue;
+      }
+      if (quote) {
+        active += character;
+        if (character === quote)
+          quote = "";
+      } else if (character === '"' || character === "'") {
+        quote = character;
+        active += character;
+      } else if (character === "#" || character === ";" && active.trim() === "") {
+        break;
+      } else if (character === "{" || character === "}" || character === "," && flowDepth > 0) {
+        if (character === "{")
+          flowDepth++;
+        if (character === "}")
+          flowDepth = Math.max(0, flowDepth - 1);
+        parts.push(active);
+        active = "";
+      } else
+        active += character;
+    }
+    parts.push(active);
+    for (const part of parts) {
+      if (part.includes("${"))
+        return true;
+      const directive = part.match(/^\s*(?:"((?:\\.|[^"\\])*)"|'([^']*)'|([^\s=]+))\s*(.*)$/u);
+      if (!directive)
+        continue;
+      const rawKey = directive[1] ?? directive[2] ?? directive[3];
+      if (!rawKey.endsWith(":") && !directive[4])
+        continue;
+      const key = rawKey.replace(/:$/u, "").split(":").at(-1)?.replace(/[-_]/gu, "").toLowerCase();
+      if (key && restricted.has(key))
+        return true;
+    }
+  }
+  return false;
+}
+function validateAtomicCapability(root, step, dependencyOwner, runnerEnvironment, executionWritePaths) {
+  if (step.kind === "vitest" && [
+    ...step.args,
+    ...step.runner.kind === "package-script" ? step.runner.command.split(/\s+/u) : []
+  ].some((arg) => /^--(?:reporters?|outputFile)(?:[.=]|$)/u.test(arg))) {
+    return adapterFailure(step.id, "report-arguments-conflict", "Vitest report arguments are owned by the adapter");
+  }
+  if (step.executionBindings) {
+    for (const [relative, expected] of Object.entries(step.executionBindings)) {
+      if (executionWritePaths.includes(relative))
+        continue;
+      const observation = observeSafePath(root, relative);
+      if (expected === null && observation.kind !== "absent" || expected !== null && snapshotFile(root, relative)?.sha256 !== expected) {
+        return adapterFailure(step.id, "verification-config-mismatch", "Bound execution inputs changed; recompile the verification contract");
+      }
+    }
+  }
+  for (const relative of verificationBoundInputPaths(step).filter((file) => VERIFICATION_CONFIGURATION_PATHS.includes(file))) {
+    const observation = observeSafePath(root, relative);
+    if (!["file", "absent"].includes(observation.kind))
+      return adapterFailure(step.id, "verification-config-unsafe", "Execution configuration must be a regular file");
+    if (observation.kind !== "file" || ![
+      ".npmrc",
+      ".yarnrc",
+      ".yarnrc.yml",
+      "bunfig.toml",
+      "pnpm-workspace.yaml"
+    ].includes(relative))
+      continue;
+    if (lstatSync5(path4.join(root, relative)).size > 64 * 1024 || executionProfile().mode !== "local-trusted" && unsupportedExecutionConfiguration(readFileSync3(path4.join(root, relative), "utf8"))) {
+      return adapterFailure(step.id, "verification-config-unsafe", "Execution configuration requires unsupported credentials or host configuration");
+    }
+  }
+  if (step.kind === "package-script") {
+    return validatePackageScript(root, step.id, step.packageManager, step.script, step.command, dependencyOwner, runnerEnvironment);
+  }
+  const runner = step.runner;
+  if (runner.kind === "package-script") {
+    const script = validatePackageScript(root, step.id, runner.packageManager, runner.script, runner.command, dependencyOwner, runnerEnvironment);
+    if (!script.ok)
+      return script;
+    if (step.kind === "vitest" && !localExecutable(root, "vitest", dependencyOwner, runnerEnvironment)) {
+      return adapterFailure(step.id, "local-executable-missing", "Vitest is not installed in consumer node_modules");
+    }
+    return script;
+  }
+  if (runner.kind === "node") {
+    const node = resolveVerificationRunner("node", runnerEnvironment);
+    return node ? capabilitySuccess(step.id, [node]) : adapterFailure(step.id, "runner-missing", "Node is unavailable or cannot be mounted safely");
+  }
+  if (!localExecutable(root, runner.executable, dependencyOwner, runnerEnvironment)) {
+    return adapterFailure(step.id, "local-executable-missing", `local executable ${runner.executable} is unavailable`);
+  }
+  if (runner.kind === "npx") {
+    const npx = resolveVerificationRunner("npx", runnerEnvironment);
+    return npx ? capabilitySuccess(step.id, [npx]) : adapterFailure(step.id, "runner-missing", "npx is unavailable or cannot be mounted safely");
+  }
+  if ((runnerEnvironment.platform ?? process.platform) === "win32") {
+    const binding = resolveLocalVerificationRunner(dependencyOwner, runner.executable, runnerEnvironment);
+    return binding ? capabilitySuccess(step.id, [binding]) : adapterFailure(step.id, "local-executable-missing", `local executable ${runner.executable} has no safe direct Windows binding`);
+  }
+  return capabilitySuccess(step.id);
+}
+function validateVerificationAdapterCapability(root, value, options = {}) {
+  return validateCapability(root, value, options, false);
+}
+function validateCapability(root, value, options, requireInputAvailability) {
+  const validation = validateVerificationContract(value);
+  if (!validation.ok) {
+    const id = value && typeof value === "object" && !Array.isArray(value) && typeof value.id === "string" ? String(value.id) : undefined;
+    return {
+      ok: false,
+      diagnostic: {
+        kind: "design-readiness",
+        code: "verification-contract-unsupported",
+        ...id ? { verificationId: id } : {},
+        message: validation.reason
+      }
+    };
+  }
+  const dependencyOwner = options.dependencyOwner ?? root;
+  return validateAcceptedVerificationCapability(root, validation.value, dependencyOwner, options.runnerEnvironment ?? {}, requireInputAvailability, options.executionWritePaths ?? []);
+}
+function validateAcceptedVerificationCapability(root, verification, dependencyOwner, runnerEnvironment, requireInputAvailability, executionWritePaths) {
+  if (requireInputAvailability) {
+    for (const input of verificationInputPaths(verification)) {
+      if (!isSafeRegularFile(root, input)) {
+        return adapterFailure(verification.id, "input-missing", `verification input ${input} is missing or unsafe`);
+      }
+    }
+  }
+  const runnerBindings = [];
+  for (const step of verificationSteps(verification)) {
+    const capability = validateAtomicCapability(root, step, dependencyOwner, runnerEnvironment, executionWritePaths);
+    if (!capability.ok)
+      return capability;
+    runnerBindings.push(...capability.runnerBindings);
+  }
+  return capabilitySuccess(verification.id, runnerBindings);
+}
+
+// src/operator-tools.ts
+function inspectConsumer(root) {
+  root = realpathSync4(root);
+  const checks = [];
+  const check = (name, action, nextStep) => {
+    try {
+      checks.push({ name, ok: true, detail: action() });
+    } catch (error) {
+      checks.push({
+        name,
+        ok: false,
+        detail: error instanceof Error ? error.message : "unavailable",
+        nextStep
+      });
+    }
+  };
+  check("node", () => {
+    if (Number(process.versions.node.split(".")[0]) < 22 || Number(process.versions.node.split(".")[0]) === 22 && Number(process.versions.node.split(".")[1]) < 13)
+      throw new Error("Node 22.13+ required");
+    return process.versions.node;
+  }, "Install Node >=22.13.");
+  check("git", () => {
+    const result = spawnSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd: root,
+      encoding: "utf8",
+      timeout: 5000,
+      maxBuffer: 65536
+    });
+    if (result.status !== 0)
+      throw new Error("git-repository-unavailable");
+    return result.stdout.trim();
+  }, "Install Git and initialize the consumer repository.");
+  check("openspec", () => {
+    resolveOpenSpecInvocation(root);
+    return "resolved (protocol not executed)";
+  }, "Install @fission-ai/openspec@1.5.0, or configure ABEL_OPENSPEC_PACKAGE_ROOT / ABEL_OPENSPEC_NODE before launching the host.");
+  check("execution", () => {
+    const profile = executionProfile();
+    if (process.platform !== "linux")
+      throw new Error("linux-pid-isolation-required");
+    const result = spawnSync(profile.bwrapPath, [
+      "--ro-bind",
+      "/",
+      "/",
+      profile.mode === "local-trusted" ? "--unshare-pid" : "--unshare-all",
+      "--",
+      "/bin/true"
+    ], { timeout: 5000, encoding: "utf8", maxBuffer: 65536 });
+    if (result.status !== 0)
+      throw new Error("bubblewrap-probe-failed");
+    return `${profile.mode}: Bubblewrap PID namespace probe passed`;
+  }, "On Linux install/enable Bubblewrap; set ABEL_BWRAP_PATH for a custom install. Trusted Linux projects may explicitly set ABEL_EXECUTION_MODE=local-trusted; Windows should use WSL.");
+  check("request-budgets", () => JSON.stringify(requestBounds()), "Set ABEL_FIRST_PROGRESS_MS and ABEL_STREAM_IDLE_MS to positive milliseconds <=1200000.");
+  check("state-root", () => resolveStateRoot({
+    consumerRoot: root,
+    xdgStateHome: process.env.XDG_STATE_HOME
+  }).rootDir, "Use an absolute repository-external XDG_STATE_HOME.");
+  check("workspace-dependencies", () => {
+    const dependencies = path5.join(root, "node_modules");
+    if (!lstatSync6(dependencies, { throwIfNoEntry: false }))
+      return "no node_modules; prepare dependencies before verification";
+    const names = readdirSync4(dependencies).flatMap((name) => name.startsWith("@") && lstatSync6(path5.join(dependencies, name)).isDirectory() ? readdirSync4(path5.join(dependencies, name)).map((child) => `${name}/${child}`) : [name]);
+    if (names.length > 20000)
+      throw new Error("dependency-view-too-large");
+    let links = 0;
+    for (const name of names) {
+      const file = path5.join(dependencies, name);
+      if (!lstatSync6(file).isSymbolicLink())
+        continue;
+      const resolved = realpathSync4(file);
+      const relative = path5.relative(root, resolved);
+      if (relative === ".." || relative.startsWith(`..${path5.sep}`) || path5.isAbsolute(relative))
+        throw new Error("dependency-link-outside-consumer");
+      if (!resolved.startsWith(`${dependencies}${path5.sep}`))
+        links++;
+    }
+    return `${links} repository workspace link(s); their targets must be included in the candidate baseline`;
+  }, "Repair dangling/external workspace links and ensure local package sources are tracked or admitted in the candidate.");
+  const manifest = path5.join(root, "package.json");
+  if (lstatSync6(manifest, { throwIfNoEntry: false })?.isFile()) {
+    check("manifest", () => {
+      const parsed2 = JSON.parse(readFileSync4(manifest, "utf8"));
+      if (!parsed2 || typeof parsed2 !== "object")
+        throw new Error("manifest-invalid");
+      return Object.keys(parsed2.scripts ?? {}).join(", ") || "no package scripts";
+    }, "Repair package.json.");
+    const parsed = (() => {
+      try {
+        return JSON.parse(readFileSync4(manifest, "utf8"));
+      } catch {
+        return {};
+      }
+    })();
+    for (const script of ["test", "check", "build"].filter((name) => typeof parsed.scripts?.[name] === "string")) {
+      check(`script:${script}`, () => {
+        const manager = ["bun", "pnpm", "yarn", "npm"].find((name) => lstatSync6(path5.join(root, {
+          bun: "bun.lock",
+          pnpm: "pnpm-lock.yaml",
+          yarn: "yarn.lock",
+          npm: "package-lock.json"
+        }[name]), { throwIfNoEntry: false })) ?? "npm";
+        const result = validateVerificationAdapterCapability(root, {
+          kind: "package-script",
+          id: `doctor-${script}`,
+          packageManager: manager,
+          script,
+          command: parsed.scripts[script],
+          args: [],
+          classification: "expected-green"
+        });
+        if (!result.ok)
+          throw new Error(result.diagnostic.code);
+        return "statically admitted; tests not executed";
+      }, "Check the runner, installed dependencies and execution configuration; this probe does not execute your tests.");
+    }
+  }
+  return { root, ok: checks.every((entry) => entry.ok), checks };
+}
+function storageUsage(root, maximum = 1e5) {
+  let entries = 0;
+  let bytes = 0;
+  let truncated = false;
+  const visit = (file) => {
+    if (entries >= maximum) {
+      truncated = true;
+      return;
+    }
+    const stat = lstatSync6(file, { throwIfNoEntry: false });
+    if (!stat)
+      return;
+    entries++;
+    if (stat.isFile())
+      bytes += stat.size;
+    else if (stat.isDirectory())
+      for (const name of readdirSync4(file)) {
+        visit(path5.join(file, name));
+        if (truncated)
+          break;
+      }
+  };
+  visit(root);
+  return { entries, bytes, truncated };
+}
+function inspectRuns(root) {
+  const state = resolveStateRoot({
+    consumerRoot: root,
+    xdgStateHome: process.env.XDG_STATE_HOME
+  });
+  const usage = storageUsage(state.rootDir);
+  if (!lstatSync6(state.databasePath, { throwIfNoEntry: false }))
+    return { stateRoot: state.rootDir, usage, runs: [], truncated: false };
+  const db = new DatabaseSync(state.databasePath, { readOnly: true });
+  try {
+    const rows = db.prepare("SELECT run_id, stage, change_name, state, sequence FROM runs ORDER BY run_id LIMIT 1001").all();
+    return {
+      stateRoot: state.rootDir,
+      usage,
+      runs: rows.slice(0, 1000),
+      truncated: rows.length > 1000
+    };
+  } finally {
+    db.close();
+  }
+}
+
+// src/operator-cli-entry.mjs
+var [command = "doctor", root = process.cwd()] = process.argv.slice(2);
+try {
+  if (!["doctor", "runs"].includes(command))
+    throw new Error("Usage: node --experimental-strip-types <cadence>/src/operator-cli.mjs doctor|runs [consumer-root]");
+  const result = command === "doctor" ? inspectConsumer(path6.resolve(root)) : inspectRuns(path6.resolve(root));
+  console.log(JSON.stringify(result, null, 2));
+  if (command === "doctor" && !result.ok)
+    process.exitCode = 1;
+} catch (error) {
+  console.error(JSON.stringify({
+    ok: false,
+    error: error instanceof Error ? error.message : "operator-command-failed"
+  }));
+  process.exitCode = 1;
+}