@bjoernrochel/sevro 1.0.0 → 1.1.0

package/dist/src/identity.js

@@ -0,0 +1,167 @@
+import { createHash } from "node:crypto";
+const ALGORITHM = "sevro.identity.v1";
+const DIGEST = /^[a-f0-9]{64}$/;
+const DIMENSION_KEYS = [
+    "runnerBuildDigest",
+    "projectDigest",
+    "configurationDigest",
+    "extensionDigest",
+    "extensionProtocol",
+    "caseDigest",
+    "fixtureDigest",
+    "checksDigest",
+    "requiredEvidenceDigest",
+    "evaluatorDigest",
+    "graderDigest",
+    "instrumentationDigest",
+    "routeDigest",
+    "condition",
+    "trialCount",
+    "passThreshold",
+];
+function surrogateKind(code) {
+    if (code >= 0xd800 && code <= 0xdbff)
+        return "high";
+    return code >= 0xdc00 && code <= 0xdfff ? "low" : null;
+}
+function assertUnicode(value) {
+    for (let index = 0; index < value.length; index++) {
+        const kind = surrogateKind(value.charCodeAt(index));
+        if (kind === "high") {
+            if (surrogateKind(value.charCodeAt(++index)) !== "low")
+                throw new Error("JSON string contains an unpaired surrogate");
+        }
+        else if (kind === "low") {
+            throw new Error("JSON string contains an unpaired surrogate");
+        }
+    }
+}
+class CanonicalJsonWriter {
+    visiting = new WeakSet();
+    write(item) {
+        if (item === null)
+            return "null";
+        switch (typeof item) {
+            case "string":
+                assertUnicode(item);
+                return JSON.stringify(item);
+            case "number":
+                return this.number(item);
+            case "boolean":
+                return item ? "true" : "false";
+            case "object":
+                return this.object(item);
+            default:
+                throw new Error("value is not JSON data");
+        }
+    }
+    number(item) {
+        if (!Number.isFinite(item))
+            throw new Error("JSON number must be finite");
+        return JSON.stringify(item);
+    }
+    object(item) {
+        if (this.visiting.has(item))
+            throw new Error("JSON value contains a cycle");
+        this.visiting.add(item);
+        try {
+            if (Array.isArray(item))
+                return `[${item.map((value) => this.write(value)).join(",")}]`;
+            this.assertPlainObject(item);
+            const entries = Object.keys(item)
+                .sort()
+                .map((key) => this.property(item, key));
+            return `{${entries.join(",")}}`;
+        }
+        finally {
+            this.visiting.delete(item);
+        }
+    }
+    assertPlainObject(item) {
+        const prototype = Object.getPrototypeOf(item);
+        if (prototype !== Object.prototype && prototype !== null)
+            throw new Error("value is not a plain JSON object");
+        if (Object.getOwnPropertySymbols(item).length)
+            throw new Error("JSON object has symbol keys");
+    }
+    property(item, key) {
+        assertUnicode(key);
+        const descriptor = Object.getOwnPropertyDescriptor(item, key);
+        if (!descriptor || !Object.hasOwn(descriptor, "value"))
+            throw new Error("JSON object has an accessor property");
+        const value = descriptor.value;
+        return `${JSON.stringify(key)}:${this.write(value)}`;
+    }
+}
+/** RFC 8785 JSON canonicalization for ordinary JSON values. */
+export function canonicalJson(value) {
+    return new CanonicalJsonWriter().write(value);
+}
+/** Hash exact bytes, or a string's UTF-8 bytes, without JSON canonicalization. */
+export function sha256(content) {
+    return createHash("sha256").update(content).digest("hex");
+}
+export function hashJson(value) {
+    return sha256(canonicalJson(value));
+}
+function validatedDimensions(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("identity dimensions must be a JSON object");
+    const record = value;
+    validateDimensionKeys(record);
+    validateDigestDimensions(record);
+    validateExtensionDimension(record);
+    validateTrialDimensions(record);
+    return record;
+}
+function validateDimensionKeys(record) {
+    for (const key of DIMENSION_KEYS)
+        if (!Object.hasOwn(record, key))
+            throw new Error(`missing identity dimension: ${key}`);
+    const unexpected = Object.keys(record).filter((key) => !DIMENSION_KEYS.includes(key));
+    const firstUnexpected = unexpected[0];
+    if (firstUnexpected !== undefined)
+        throw new Error(`unexpected identity dimension: ${firstUnexpected}`);
+}
+function validateDigestDimensions(record) {
+    for (const key of DIMENSION_KEYS.filter((name) => name.endsWith("Digest"))) {
+        if (key === "extensionDigest" && record[key] === null)
+            continue;
+        if (!validDigest(record[key]))
+            throw new Error(`invalid identity dimension: ${key}`);
+    }
+}
+function validateExtensionDimension(record) {
+    if ((record.extensionDigest === null) !== (record.extensionProtocol === null) ||
+        (record.extensionProtocol !== null &&
+            record.extensionProtocol !== "sevro.extension.v1"))
+        throw new Error("extension identity requires its matching protocol");
+}
+function validateTrialDimensions(record) {
+    if (record.condition !== "passive" && record.condition !== "enforced")
+        throw new Error("invalid identity condition");
+    if (!Number.isSafeInteger(record.trialCount) ||
+        record.trialCount < 1)
+        throw new Error("invalid identity trial count");
+    validatePassThreshold(record.passThreshold);
+}
+function validatePassThreshold(value) {
+    if (typeof value !== "number" ||
+        !Number.isFinite(value) ||
+        value <= 0 ||
+        value > 1)
+        throw new Error("invalid identity pass threshold");
+}
+/** Digest the exact comparison dimensions with a versioned domain prefix. */
+export function createEvaluationIdentity(dimensions) {
+    const checked = validatedDimensions(dimensions);
+    const digest = createHash("sha256")
+        .update(`${ALGORITHM}\n`, "utf8")
+        .update(canonicalJson(checked), "utf8")
+        .digest("hex");
+    return { algorithm: ALGORITHM, digest, dimensions: checked };
+}
+function validDigest(value) {
+    return typeof value === "string" && DIGEST.test(value);
+}
+//# sourceMappingURL=identity.js.map

package/dist/src/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB;AAEzC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,cAAc,GAAG;IACrB,mBAAmB;IACnB,eAAe;IACf,qBAAqB;IACrB,iBAAiB;IACjB,mBAAmB;IACnB,YAAY;IACZ,eAAe;IACf,cAAc;IACd,wBAAwB;IACxB,iBAAiB;IACjB,cAAc;IACd,uBAAuB;IACvB,aAAa;IACb,WAAW;IACX,YAAY;IACZ,eAAe;CACP,CAAC;AAqBX,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACpD,OAAO,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK;gBACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB;IACN,QAAQ,GAAG,IAAI,OAAO,EAAE,CAAC;IAE1C,KAAK,CAAC,IAAa;QACjB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACjC,QAAQ,OAAO,IAAI,EAAE,CAAC;YACpB,KAAK,QAAQ;gBACX,aAAa,CAAC,IAAI,CAAC,CAAC;gBACpB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9B,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACjC,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B;gBACE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,IAAY;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAEO,MAAM,CAAC,IAAY;QACzB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrB,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAC1E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC9B,IAAI,EAAE;iBACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,IAAY;QACpC,MAAM,SAAS,GAAY,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;YACtD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM;YAC3C,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACnD,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,GAAW;QACxC,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAY,UAAU,CAAC,KAAK,CAAC;QACxC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACvD,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,mBAAmB,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,MAAM,CAAC,OAA4B;IACjD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACnC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAuC,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA+B;IAC5D,KAAK,MAAM,GAAG,IAAI,cAAc;QAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAsC,CAAC,CAC1E,CAAC;IACF,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,eAAe,KAAK,SAAS;QAC/B,MAAM,IAAI,KAAK,CAAC,kCAAkC,eAAe,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,wBAAwB,CAAC,MAA+B;IAC/D,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,GAAG,KAAK,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,SAAS;QAChE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAA+B;IACjE,IACE,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC;QACzE,CAAC,MAAM,CAAC,iBAAiB,KAAK,IAAI;YAChC,MAAM,CAAC,iBAAiB,KAAK,oBAAoB,CAAC;QAEpD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU;QACnE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC;QACvC,MAAM,CAAC,UAAqB,GAAG,CAAC;QAEjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACvB,KAAK,IAAI,CAAC;QACV,KAAK,GAAG,CAAC;QAET,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACvD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CAAC,UAAmB;IAK1D,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,SAAS,IAAI,EAAE,MAAM,CAAC;SAChC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;SACtC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\n\nconst ALGORITHM = \"sevro.identity.v1\";\nconst DIGEST = /^[a-f0-9]{64}$/;\nconst DIMENSION_KEYS = [\n  \"runnerBuildDigest\",\n  \"projectDigest\",\n  \"configurationDigest\",\n  \"extensionDigest\",\n  \"extensionProtocol\",\n  \"caseDigest\",\n  \"fixtureDigest\",\n  \"checksDigest\",\n  \"requiredEvidenceDigest\",\n  \"evaluatorDigest\",\n  \"graderDigest\",\n  \"instrumentationDigest\",\n  \"routeDigest\",\n  \"condition\",\n  \"trialCount\",\n  \"passThreshold\",\n] as const;\n\nexport interface IdentityDimensions {\n  runnerBuildDigest: string;\n  projectDigest: string;\n  configurationDigest: string;\n  extensionDigest: string | null;\n  extensionProtocol: \"sevro.extension.v1\" | null;\n  caseDigest: string;\n  fixtureDigest: string;\n  checksDigest: string;\n  requiredEvidenceDigest: string;\n  evaluatorDigest: string;\n  graderDigest: string;\n  instrumentationDigest: string;\n  routeDigest: string;\n  condition: \"passive\" | \"enforced\";\n  trialCount: number;\n  passThreshold: number;\n}\n\nfunction surrogateKind(code: number): \"high\" | \"low\" | null {\n  if (code >= 0xd800 && code <= 0xdbff) return \"high\";\n  return code >= 0xdc00 && code <= 0xdfff ? \"low\" : null;\n}\n\nfunction assertUnicode(value: string): void {\n  for (let index = 0; index < value.length; index++) {\n    const kind = surrogateKind(value.charCodeAt(index));\n    if (kind === \"high\") {\n      if (surrogateKind(value.charCodeAt(++index)) !== \"low\")\n        throw new Error(\"JSON string contains an unpaired surrogate\");\n    } else if (kind === \"low\") {\n      throw new Error(\"JSON string contains an unpaired surrogate\");\n    }\n  }\n}\n\nclass CanonicalJsonWriter {\n  private readonly visiting = new WeakSet();\n\n  write(item: unknown): string {\n    if (item === null) return \"null\";\n    switch (typeof item) {\n      case \"string\":\n        assertUnicode(item);\n        return JSON.stringify(item);\n      case \"number\":\n        return this.number(item);\n      case \"boolean\":\n        return item ? \"true\" : \"false\";\n      case \"object\":\n        return this.object(item);\n      default:\n        throw new Error(\"value is not JSON data\");\n    }\n  }\n\n  private number(item: number): string {\n    if (!Number.isFinite(item)) throw new Error(\"JSON number must be finite\");\n    return JSON.stringify(item);\n  }\n\n  private object(item: object): string {\n    if (this.visiting.has(item)) throw new Error(\"JSON value contains a cycle\");\n    this.visiting.add(item);\n    try {\n      if (Array.isArray(item))\n        return `[${item.map((value: unknown) => this.write(value)).join(\",\")}]`;\n      this.assertPlainObject(item);\n      const entries = Object.keys(item)\n        .sort()\n        .map((key) => this.property(item, key));\n      return `{${entries.join(\",\")}}`;\n    } finally {\n      this.visiting.delete(item);\n    }\n  }\n\n  private assertPlainObject(item: object): void {\n    const prototype: unknown = Object.getPrototypeOf(item);\n    if (prototype !== Object.prototype && prototype !== null)\n      throw new Error(\"value is not a plain JSON object\");\n    if (Object.getOwnPropertySymbols(item).length)\n      throw new Error(\"JSON object has symbol keys\");\n  }\n\n  private property(item: object, key: string): string {\n    assertUnicode(key);\n    const descriptor = Object.getOwnPropertyDescriptor(item, key);\n    if (!descriptor || !Object.hasOwn(descriptor, \"value\"))\n      throw new Error(\"JSON object has an accessor property\");\n    const value: unknown = descriptor.value;\n    return `${JSON.stringify(key)}:${this.write(value)}`;\n  }\n}\n\n/** RFC 8785 JSON canonicalization for ordinary JSON values. */\nexport function canonicalJson(value: unknown): string {\n  return new CanonicalJsonWriter().write(value);\n}\n\n/** Hash exact bytes, or a string's UTF-8 bytes, without JSON canonicalization. */\nexport function sha256(content: string | Uint8Array): string {\n  return createHash(\"sha256\").update(content).digest(\"hex\");\n}\n\nexport function hashJson(value: unknown): string {\n  return sha256(canonicalJson(value));\n}\n\nfunction validatedDimensions(value: unknown): IdentityDimensions {\n  if (!value || typeof value !== \"object\" || Array.isArray(value))\n    throw new Error(\"identity dimensions must be a JSON object\");\n  const record = value as Record<string, unknown>;\n  validateDimensionKeys(record);\n  validateDigestDimensions(record);\n  validateExtensionDimension(record);\n  validateTrialDimensions(record);\n  return record as unknown as IdentityDimensions;\n}\n\nfunction validateDimensionKeys(record: Record<string, unknown>): void {\n  for (const key of DIMENSION_KEYS)\n    if (!Object.hasOwn(record, key))\n      throw new Error(`missing identity dimension: ${key}`);\n  const unexpected = Object.keys(record).filter(\n    (key) => !DIMENSION_KEYS.includes(key as (typeof DIMENSION_KEYS)[number]),\n  );\n  const firstUnexpected = unexpected[0];\n  if (firstUnexpected !== undefined)\n    throw new Error(`unexpected identity dimension: ${firstUnexpected}`);\n}\n\nfunction validateDigestDimensions(record: Record<string, unknown>): void {\n  for (const key of DIMENSION_KEYS.filter((name) => name.endsWith(\"Digest\"))) {\n    if (key === \"extensionDigest\" && record[key] === null) continue;\n    if (!validDigest(record[key]))\n      throw new Error(`invalid identity dimension: ${key}`);\n  }\n}\n\nfunction validateExtensionDimension(record: Record<string, unknown>): void {\n  if (\n    (record.extensionDigest === null) !== (record.extensionProtocol === null) ||\n    (record.extensionProtocol !== null &&\n      record.extensionProtocol !== \"sevro.extension.v1\")\n  )\n    throw new Error(\"extension identity requires its matching protocol\");\n}\n\nfunction validateTrialDimensions(record: Record<string, unknown>): void {\n  if (record.condition !== \"passive\" && record.condition !== \"enforced\")\n    throw new Error(\"invalid identity condition\");\n  if (\n    !Number.isSafeInteger(record.trialCount) ||\n    (record.trialCount as number) < 1\n  )\n    throw new Error(\"invalid identity trial count\");\n  validatePassThreshold(record.passThreshold);\n}\n\nfunction validatePassThreshold(value: unknown): void {\n  if (\n    typeof value !== \"number\" ||\n    !Number.isFinite(value) ||\n    value <= 0 ||\n    value > 1\n  )\n    throw new Error(\"invalid identity pass threshold\");\n}\n\n/** Digest the exact comparison dimensions with a versioned domain prefix. */\nexport function createEvaluationIdentity(dimensions: unknown): {\n  algorithm: typeof ALGORITHM;\n  digest: string;\n  dimensions: IdentityDimensions;\n} {\n  const checked = validatedDimensions(dimensions);\n  const digest = createHash(\"sha256\")\n    .update(`${ALGORITHM}\\n`, \"utf8\")\n    .update(canonicalJson(checked), \"utf8\")\n    .digest(\"hex\");\n  return { algorithm: ALGORITHM, digest, dimensions: checked };\n}\n\nfunction validDigest(value: unknown): value is string {\n  return typeof value === \"string\" && DIGEST.test(value);\n}\n"]}

package/dist/src/instrumentation.js

@@ -0,0 +1,83 @@
+import { isRecord, isUnknownArray, validQualifiedId as validInstrumentationId, } from "./value-guards.js";
+import { canonicalJson } from "./identity.js";
+export class InstrumentationEvidenceError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "InstrumentationEvidenceError";
+    }
+}
+function validRequest(value) {
+    return (isRecord(value) &&
+        validInstrumentationId(value.id) &&
+        isRecord(value.configuration));
+}
+function validateSupportedInstrumentation(supported) {
+    const ids = new Set(supported.map((item) => item.id));
+    if (supported.some((item) => !validInstrumentationId(item.id) ||
+        typeof item.executionChanging !== "boolean") ||
+        ids.size !== supported.length)
+        throw new Error("host instrumentation capabilities are invalid");
+}
+function validateRequestedInstrumentation(requested) {
+    const ids = new Set(requested.map((item) => item.id));
+    if (requested.some((item) => !validRequest(item)) ||
+        ids.size !== requested.length)
+        throw new Error("requested instrumentation is invalid or duplicated");
+}
+function requestedCapability(item, supported, negotiated) {
+    const capability = supported.find((entry) => entry.id === item.id);
+    if (!capability || !negotiated.includes(item.id))
+        throw new Error("extension preparation requested unsupported instrumentation");
+    return capability;
+}
+function validateInstrumentationCondition(capability, condition) {
+    if (condition === "passive" && capability.executionChanging)
+        throw new Error("passive condition cannot apply execution-changing instrumentation");
+}
+/** Validate an extension's request before the candidate host starts. */
+export function prepareInstrumentation(requested, supported, negotiated, condition) {
+    validateSupportedInstrumentation(supported);
+    validateRequestedInstrumentation(requested);
+    for (const item of requested)
+        validateInstrumentationCondition(requestedCapability(item, supported, negotiated), condition);
+    return snapshotInstrumentation(requested);
+}
+/** Own the canonical JSON parameters independently of adapter state. */
+export function snapshotInstrumentation(requested) {
+    return JSON.parse(canonicalJson(requested));
+}
+/** A host must report exactly the instrumentation it applied. */
+export function verifyAppliedInstrumentation(requested, applied, requestedCondition, actualCondition) {
+    const actual = applied ?? [];
+    validateAppliedRequests(actual, requested);
+    validateActualCondition(actualCondition);
+    if (mismatchedCondition(actualCondition, requestedCondition) ||
+        (requested.length > 0 && actualCondition !== requestedCondition))
+        throw new InstrumentationEvidenceError("host did not confirm the requested condition");
+    return snapshotInstrumentation(actual);
+}
+function requestArray(value) {
+    return isUnknownArray(value) && value.every(validRequest);
+}
+function validateAppliedRequests(actual, requested) {
+    if (!requestArray(actual) ||
+        new Set(actual.map((item) => item.id)).size !== actual.length ||
+        canonicalJson(actual) !== canonicalJson(requested))
+        throw new InstrumentationEvidenceError("host applied instrumentation does not match the request");
+}
+function validActualCondition(value) {
+    return (value === undefined ||
+        value === "unknown" ||
+        value === "passive" ||
+        value === "enforced");
+}
+function validateActualCondition(value) {
+    if (!validActualCondition(value))
+        throw new InstrumentationEvidenceError("host condition evidence is invalid");
+}
+function mismatchedCondition(actual, requested) {
+    if (actual === undefined || actual === "unknown")
+        return false;
+    return actual !== requested;
+}
+//# sourceMappingURL=instrumentation.js.map

package/dist/src/instrumentation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumentation.js","sourceRoot":"","sources":["instrumentation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,cAAc,EACd,gBAAgB,IAAI,sBAAsB,GAC3C,0BAAuB;AACxB,OAAO,EAAE,aAAa,EAAE,sBAAmB;AAY3C,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,SAAsC;IAEtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,IACE,SAAS,CAAC,IAAI,CACZ,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAC9C;QACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;QAE7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,gCAAgC,CACvC,SAAmC;IAEnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,IACE,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;QAE7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAA4B,EAC5B,SAAsC,EACtC,UAAoB;IAEpB,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gCAAgC,CACvC,UAAqC,EACrC,SAAiC;IAEjC,IAAI,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,iBAAiB;QACzD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;AACN,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CACpC,SAAmC,EACnC,SAAsC,EACtC,UAAoB,EACpB,SAAiC;IAEjC,gCAAgC,CAAC,SAAS,CAAC,CAAC;IAC5C,gCAAgC,CAAC,SAAS,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,SAAS;QAC1B,gCAAgC,CAC9B,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAChD,SAAS,CACV,CAAC;IACJ,OAAO,uBAAuB,CAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CACrC,SAAmC;IAEnC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAA6B,CAAC;AAC1E,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,4BAA4B,CAC1C,SAAmC,EACnC,OAA6C,EAC7C,kBAA0C,EAC1C,eAA+D;IAE/D,MAAM,MAAM,GAAG,OAAO,IAAI,EAAE,CAAC;IAC7B,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3C,uBAAuB,CAAC,eAAe,CAAC,CAAC;IACzC,IACE,mBAAmB,CAAC,eAAe,EAAE,kBAAkB,CAAC;QACxD,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,KAAK,kBAAkB,CAAC;QAEhE,MAAM,IAAI,4BAA4B,CACpC,8CAA8C,CAC/C,CAAC;IACJ,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAe,EACf,SAAmC;IAEnC,IACE,CAAC,YAAY,CAAC,MAAM,CAAC;QACrB,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;QAC7D,aAAa,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,SAAS,CAAC;QAElD,MAAM,IAAI,4BAA4B,CACpC,yDAAyD,CAC1D,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,UAAU,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;QAC9B,MAAM,IAAI,4BAA4B,CACpC,oCAAoC,CACrC,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA0B,EAC1B,SAAiB;IAEjB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,MAAM,KAAK,SAAS,CAAC;AAC9B,CAAC","sourcesContent":["import {\n  isRecord,\n  isUnknownArray,\n  validQualifiedId as validInstrumentationId,\n} from \"./value-guards\";\nimport { canonicalJson } from \"./identity\";\n\nexport interface InstrumentationRequest {\n  id: string;\n  configuration: Record<string, unknown>;\n}\n\nexport interface InstrumentationCapability {\n  id: string;\n  executionChanging: boolean;\n}\n\nexport class InstrumentationEvidenceError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InstrumentationEvidenceError\";\n  }\n}\n\nfunction validRequest(value: unknown): value is InstrumentationRequest {\n  return (\n    isRecord(value) &&\n    validInstrumentationId(value.id) &&\n    isRecord(value.configuration)\n  );\n}\n\nfunction validateSupportedInstrumentation(\n  supported: InstrumentationCapability[],\n): void {\n  const ids = new Set(supported.map((item) => item.id));\n  if (\n    supported.some(\n      (item) =>\n        !validInstrumentationId(item.id) ||\n        typeof item.executionChanging !== \"boolean\",\n    ) ||\n    ids.size !== supported.length\n  )\n    throw new Error(\"host instrumentation capabilities are invalid\");\n}\n\nfunction validateRequestedInstrumentation(\n  requested: InstrumentationRequest[],\n): void {\n  const ids = new Set(requested.map((item) => item.id));\n  if (\n    requested.some((item) => !validRequest(item)) ||\n    ids.size !== requested.length\n  )\n    throw new Error(\"requested instrumentation is invalid or duplicated\");\n}\n\nfunction requestedCapability(\n  item: InstrumentationRequest,\n  supported: InstrumentationCapability[],\n  negotiated: string[],\n): InstrumentationCapability {\n  const capability = supported.find((entry) => entry.id === item.id);\n  if (!capability || !negotiated.includes(item.id))\n    throw new Error(\n      \"extension preparation requested unsupported instrumentation\",\n    );\n  return capability;\n}\n\nfunction validateInstrumentationCondition(\n  capability: InstrumentationCapability,\n  condition: \"passive\" | \"enforced\",\n): void {\n  if (condition === \"passive\" && capability.executionChanging)\n    throw new Error(\n      \"passive condition cannot apply execution-changing instrumentation\",\n    );\n}\n\n/** Validate an extension's request before the candidate host starts. */\nexport function prepareInstrumentation(\n  requested: InstrumentationRequest[],\n  supported: InstrumentationCapability[],\n  negotiated: string[],\n  condition: \"passive\" | \"enforced\",\n): InstrumentationRequest[] {\n  validateSupportedInstrumentation(supported);\n  validateRequestedInstrumentation(requested);\n  for (const item of requested)\n    validateInstrumentationCondition(\n      requestedCapability(item, supported, negotiated),\n      condition,\n    );\n  return snapshotInstrumentation(requested);\n}\n\n/** Own the canonical JSON parameters independently of adapter state. */\nexport function snapshotInstrumentation(\n  requested: InstrumentationRequest[],\n): InstrumentationRequest[] {\n  return JSON.parse(canonicalJson(requested)) as InstrumentationRequest[];\n}\n\n/** A host must report exactly the instrumentation it applied. */\nexport function verifyAppliedInstrumentation(\n  requested: InstrumentationRequest[],\n  applied: InstrumentationRequest[] | undefined,\n  requestedCondition: \"passive\" | \"enforced\",\n  actualCondition: \"passive\" | \"enforced\" | \"unknown\" | undefined,\n): InstrumentationRequest[] {\n  const actual = applied ?? [];\n  validateAppliedRequests(actual, requested);\n  validateActualCondition(actualCondition);\n  if (\n    mismatchedCondition(actualCondition, requestedCondition) ||\n    (requested.length > 0 && actualCondition !== requestedCondition)\n  )\n    throw new InstrumentationEvidenceError(\n      \"host did not confirm the requested condition\",\n    );\n  return snapshotInstrumentation(actual);\n}\n\nfunction requestArray(value: unknown): value is InstrumentationRequest[] {\n  return isUnknownArray(value) && value.every(validRequest);\n}\n\nfunction validateAppliedRequests(\n  actual: unknown,\n  requested: InstrumentationRequest[],\n): asserts actual is InstrumentationRequest[] {\n  if (\n    !requestArray(actual) ||\n    new Set(actual.map((item) => item.id)).size !== actual.length ||\n    canonicalJson(actual) !== canonicalJson(requested)\n  )\n    throw new InstrumentationEvidenceError(\n      \"host applied instrumentation does not match the request\",\n    );\n}\n\nfunction validActualCondition(value: unknown): boolean {\n  return (\n    value === undefined ||\n    value === \"unknown\" ||\n    value === \"passive\" ||\n    value === \"enforced\"\n  );\n}\n\nfunction validateActualCondition(value: unknown): void {\n  if (!validActualCondition(value))\n    throw new InstrumentationEvidenceError(\n      \"host condition evidence is invalid\",\n    );\n}\n\nfunction mismatchedCondition(\n  actual: string | undefined,\n  requested: string,\n): boolean {\n  if (actual === undefined || actual === \"unknown\") return false;\n  return actual !== requested;\n}\n"]}

package/dist/src/native-transcript-state.js

@@ -0,0 +1,85 @@
+import { lstat, mkdir, mkdtemp, realpath } from "node:fs/promises";
+import { realpathSync } from "node:fs";
+import { tmpdir, userInfo } from "node:os";
+import { basename, dirname, join, sep } from "node:path";
+/** A permanent deny boundary also covers roles allocated after command launch. */
+export async function nativeStateParent() {
+    const root = nativeStatePath();
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    const info = await lstat(root);
+    requirePrivateNamespace(info);
+    return realpath(root);
+}
+/** Canonical base also binds declaration symlinks before any private tree is read. */
+export function nativeStatePath() {
+    return join(realpathSync(nativeStateBase()), "sevro-native-private");
+}
+export function nativeStateProtectedRoots() {
+    return [nativeStatePath(), join(nativeStateBase(), "sevro-native-private")];
+}
+function nativeStateBase() {
+    return process.platform === "linux" ? "/var/tmp" : tmpdir();
+}
+function requirePrivateNamespace(info) {
+    if (!info.isDirectory() ||
+        info.uid !== userInfo().uid ||
+        (info.mode & 0o077) !== 0)
+        throw new Error("native state namespace must be an owned private directory");
+}
+export async function allocateNativeState(prefix, runtimeWorkspace) {
+    await requireExternalNativeNamespace(runtimeWorkspace);
+    return realpath(await mkdtemp(join(await nativeStateParent(), prefix)));
+}
+/** Workspace writes must never reach existing or future native peer state. */
+async function requireExternalNativeNamespace(workspace) {
+    if (workspace === undefined)
+        return;
+    const fixtureRoot = join(await realpath(workspace), sep);
+    const namespaceRoot = join(nativeStatePath(), sep);
+    if (fixtureRoot.startsWith(namespaceRoot) ||
+        namespaceRoot.startsWith(fixtureRoot))
+        throw new Error("native runtime namespace overlaps the fixture workspace");
+}
+export async function requireNativeTranscriptView(root) {
+    if (root === undefined)
+        return;
+    const parent = await nativeStateParent();
+    if (dirname(root) !== parent ||
+        !basename(root).startsWith("view-") ||
+        (await realpath(root)) !== root)
+        throw new Error("native transcript view must be runner-owned and canonical");
+    requirePrivateNamespace(await lstat(root));
+}
+export async function requireNativeTranscriptViews(roots) {
+    for (const root of roots ?? [])
+        await requireNativeTranscriptView(root);
+}
+/** Curated hook copies are a separate runner-owned exception, never policy roots. */
+export async function requireNativeHookRoots(roots, privateRoot) {
+    for (const root of roots ?? [])
+        await requireNativeHookRoot(root, privateRoot);
+}
+async function requireNativeHookRoot(root, privateRoot) {
+    const parent = await nativeStateParent();
+    const state = dirname(dirname(root));
+    if (!nativeHookLayout(root, state, parent) || (await realpath(root)) !== root)
+        throw new Error("native hook read root must be a canonical curated mount");
+    await requireNativeHookOwner(state, privateRoot);
+    const info = await lstat(root);
+    if (!info.isDirectory() || info.uid !== userInfo().uid)
+        throw new Error("native hook read root must be owned");
+}
+async function requireNativeHookOwner(state, privateRoot) {
+    if (dirname(privateRoot) !== state ||
+        (await realpath(privateRoot)) !== privateRoot)
+        throw new Error("native hook read root must belong to the current request");
+    requirePrivateNamespace(await lstat(state));
+    requirePrivateNamespace(await lstat(privateRoot));
+}
+function nativeHookLayout(root, state, parent) {
+    return (dirname(state) === parent &&
+        /^(?:claude|codex)-/.test(basename(state)) &&
+        basename(dirname(root)) === "runtime-plugins" &&
+        /^plugin-[0-9]+$/.test(basename(root)));
+}
+//# sourceMappingURL=native-transcript-state.js.map

package/dist/src/native-transcript-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-transcript-state.js","sourceRoot":"","sources":["native-transcript-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB;AAEnE,OAAO,EAAE,YAAY,EAAE,gBAAgB;AACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB;AAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,kBAAkB;AAEzD,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAW;IAC1C,IACE,CAAC,IAAI,CAAC,WAAW,EAAE;QACnB,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC,GAAG;QAC3B,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAEzB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,gBAAyB;IAEzB,MAAM,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,8BAA8B,CAC3C,SAAkB;IAElB,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,IACE,WAAW,CAAC,UAAU,CAAC,aAAa,CAAC;QACrC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC;QAErC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAwB;IAExB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,IACE,OAAO,CAAC,IAAI,CAAC,KAAK,MAAM;QACxB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QACnC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAE/B,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,uBAAuB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAA2B;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE;QAAE,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA2B,EAC3B,WAAmB;IAEnB,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE;QAC5B,MAAM,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,WAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAC3E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,MAAM,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC,GAAG;QACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAAa,EACb,WAAmB;IAEnB,IACE,OAAO,CAAC,WAAW,CAAC,KAAK,KAAK;QAC9B,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,WAAW;QAE7C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,uBAAuB,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,uBAAuB,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAY,EACZ,KAAa,EACb,MAAc;IAEd,OAAO,CACL,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM;QACzB,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,iBAAiB;QAC7C,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACvC,CAAC;AACJ,CAAC","sourcesContent":["import { lstat, mkdir, mkdtemp, realpath } from \"node:fs/promises\";\nimport type { Stats } from \"node:fs\";\nimport { realpathSync } from \"node:fs\";\nimport { tmpdir, userInfo } from \"node:os\";\nimport { basename, dirname, join, sep } from \"node:path\";\n\n/** A permanent deny boundary also covers roles allocated after command launch. */\nexport async function nativeStateParent(): Promise<string> {\n  const root = nativeStatePath();\n  await mkdir(root, { recursive: true, mode: 0o700 });\n  const info = await lstat(root);\n  requirePrivateNamespace(info);\n  return realpath(root);\n}\n\n/** Canonical base also binds declaration symlinks before any private tree is read. */\nexport function nativeStatePath(): string {\n  return join(realpathSync(nativeStateBase()), \"sevro-native-private\");\n}\n\nexport function nativeStateProtectedRoots(): string[] {\n  return [nativeStatePath(), join(nativeStateBase(), \"sevro-native-private\")];\n}\n\nfunction nativeStateBase(): string {\n  return process.platform === \"linux\" ? \"/var/tmp\" : tmpdir();\n}\n\nfunction requirePrivateNamespace(info: Stats): void {\n  if (\n    !info.isDirectory() ||\n    info.uid !== userInfo().uid ||\n    (info.mode & 0o077) !== 0\n  )\n    throw new Error(\n      \"native state namespace must be an owned private directory\",\n    );\n}\n\nexport async function allocateNativeState(\n  prefix: string,\n  runtimeWorkspace?: string,\n): Promise<string> {\n  await requireExternalNativeNamespace(runtimeWorkspace);\n  return realpath(await mkdtemp(join(await nativeStateParent(), prefix)));\n}\n\n/** Workspace writes must never reach existing or future native peer state. */\nasync function requireExternalNativeNamespace(\n  workspace?: string,\n): Promise<void> {\n  if (workspace === undefined) return;\n  const fixtureRoot = join(await realpath(workspace), sep);\n  const namespaceRoot = join(nativeStatePath(), sep);\n  if (\n    fixtureRoot.startsWith(namespaceRoot) ||\n    namespaceRoot.startsWith(fixtureRoot)\n  )\n    throw new Error(\"native runtime namespace overlaps the fixture workspace\");\n}\n\nexport async function requireNativeTranscriptView(\n  root: string | undefined,\n): Promise<void> {\n  if (root === undefined) return;\n  const parent = await nativeStateParent();\n  if (\n    dirname(root) !== parent ||\n    !basename(root).startsWith(\"view-\") ||\n    (await realpath(root)) !== root\n  )\n    throw new Error(\n      \"native transcript view must be runner-owned and canonical\",\n    );\n  requirePrivateNamespace(await lstat(root));\n}\n\nexport async function requireNativeTranscriptViews(\n  roots: string[] | undefined,\n): Promise<void> {\n  for (const root of roots ?? []) await requireNativeTranscriptView(root);\n}\n\n/** Curated hook copies are a separate runner-owned exception, never policy roots. */\nexport async function requireNativeHookRoots(\n  roots: string[] | undefined,\n  privateRoot: string,\n): Promise<void> {\n  for (const root of roots ?? [])\n    await requireNativeHookRoot(root, privateRoot);\n}\n\nasync function requireNativeHookRoot(\n  root: string,\n  privateRoot: string,\n): Promise<void> {\n  const parent = await nativeStateParent();\n  const state = dirname(dirname(root));\n  if (!nativeHookLayout(root, state, parent) || (await realpath(root)) !== root)\n    throw new Error(\"native hook read root must be a canonical curated mount\");\n  await requireNativeHookOwner(state, privateRoot);\n  const info = await lstat(root);\n  if (!info.isDirectory() || info.uid !== userInfo().uid)\n    throw new Error(\"native hook read root must be owned\");\n}\n\nasync function requireNativeHookOwner(\n  state: string,\n  privateRoot: string,\n): Promise<void> {\n  if (\n    dirname(privateRoot) !== state ||\n    (await realpath(privateRoot)) !== privateRoot\n  )\n    throw new Error(\"native hook read root must belong to the current request\");\n  requirePrivateNamespace(await lstat(state));\n  requirePrivateNamespace(await lstat(privateRoot));\n}\n\nfunction nativeHookLayout(\n  root: string,\n  state: string,\n  parent: string,\n): boolean {\n  return (\n    dirname(state) === parent &&\n    /^(?:claude|codex)-/.test(basename(state)) &&\n    basename(dirname(root)) === \"runtime-plugins\" &&\n    /^plugin-[0-9]+$/.test(basename(root))\n  );\n}\n"]}

package/dist/src/native-transcript-view.js

@@ -0,0 +1,65 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { gunzipSync } from "node:zlib";
+import { allocateNativeState } from "./native-transcript-state.js";
+import { fixtureParts } from "./fixtures/preparation.js";
+import { isRecord, isUnknownArray } from "./value-guards.js";
+import { sha256 } from "./identity.js";
+const MAX_NATIVE_BYTES = 5 * 1024 * 1024;
+export async function materializeNativeTranscriptView(bytes) {
+    const value = JSON.parse(Buffer.from(bytes).toString("utf8"));
+    const bundle = nativeBundle(value);
+    const root = await allocateNativeState("view-");
+    await writeFile(join(root, "index.json"), bytes, { flag: "wx", mode: 0o600 });
+    const filesRoot = join(root, bundle.host);
+    let remainingBytes = MAX_NATIVE_BYTES;
+    for (const item of bundle.files)
+        remainingBytes -= await materializeNativeFile(filesRoot, item, bundle.format, remainingBytes);
+    return root;
+}
+function nativeBundle(value) {
+    if (!isRecord(value) || !nativeFormat(value.format))
+        throw new Error("invalid native transcript bundle");
+    if (!nativeHost(value.host))
+        throw new Error("invalid native transcript host");
+    if (!isUnknownArray(value.files))
+        throw new Error("invalid native transcript files");
+    return { host: value.host, files: value.files, format: value.format };
+}
+function nativeFormat(value) {
+    return (value === "sevro.native-transcripts.v1" ||
+        value === "sevro.native-transcripts.v2");
+}
+function nativeHost(value) {
+    return value === "codex" || value === "claude";
+}
+async function materializeNativeFile(root, value, format, remainingBytes) {
+    if (!isRecord(value) || typeof value.path !== "string")
+        throw new Error("invalid native transcript file");
+    const path = join(root, ...fixtureParts(value.path));
+    const bytes = nativeFileBytes(value, format, remainingBytes);
+    if (bytes.length > remainingBytes)
+        throw new Error("native transcript byte limit exceeded");
+    if (sha256(bytes) !== value.sha256)
+        throw new Error("native transcript hash mismatch");
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, bytes, { flag: "wx", mode: 0o600 });
+    return bytes.length;
+}
+function nativeFileBytes(value, format, remainingBytes) {
+    const encoded = format === "sevro.native-transcripts.v1"
+        ? value.bytesBase64
+        : value.gzipBase64;
+    if (typeof encoded !== "string")
+        throw new Error("invalid native transcript file");
+    const bytes = Buffer.from(encoded, "base64");
+    if (format === "sevro.native-transcripts.v1")
+        return bytes;
+    try {
+        return gunzipSync(bytes, { maxOutputLength: Math.max(1, remainingBytes) });
+    }
+    catch (cause) {
+        throw new Error("invalid native transcript gzip", { cause });
+    }
+}
+//# sourceMappingURL=native-transcript-view.js.map

package/dist/src/native-transcript-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-transcript-view.js","sourceRoot":"","sources":["native-transcript-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,yBAAyB;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB;AAC1C,OAAO,EAAE,UAAU,EAAE,kBAAkB;AACvC,OAAO,EAAE,mBAAmB,EAAE,qCAAkC;AAChE,OAAO,EAAE,YAAY,EAAE,kCAA+B;AACtD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,0BAAuB;AAC1D,OAAO,EAAE,MAAM,EAAE,sBAAmB;AAEpC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAIzC,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAiB;IAEjB,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,cAAc,GAAG,gBAAgB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;QAC7B,cAAc,IAAI,MAAM,qBAAqB,CAC3C,SAAS,EACT,IAAI,EACJ,MAAM,CAAC,MAAM,EACb,cAAc,CACf,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,KAAK,KAAK,6BAA6B;QACvC,KAAK,KAAK,6BAA6B,CACxC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,KAAc,EACd,MAAoB,EACpB,cAAsB;IAEtB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACpD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;QAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM;QAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CACtB,KAA8B,EAC9B,MAAoB,EACpB,cAAsB;IAEtB,MAAM,OAAO,GACX,MAAM,KAAK,6BAA6B;QACtC,CAAC,CAAC,KAAK,CAAC,WAAW;QACnB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IACvB,IAAI,OAAO,OAAO,KAAK,QAAQ;QAC7B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,6BAA6B;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC","sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { gunzipSync } from \"node:zlib\";\nimport { allocateNativeState } from \"./native-transcript-state\";\nimport { fixtureParts } from \"./fixtures/preparation\";\nimport { isRecord, isUnknownArray } from \"./value-guards\";\nimport { sha256 } from \"./identity\";\n\nconst MAX_NATIVE_BYTES = 5 * 1024 * 1024;\ntype NativeFormat =\n  \"sevro.native-transcripts.v1\" | \"sevro.native-transcripts.v2\";\n\nexport async function materializeNativeTranscriptView(\n  bytes: Uint8Array,\n): Promise<string> {\n  const value: unknown = JSON.parse(Buffer.from(bytes).toString(\"utf8\"));\n  const bundle = nativeBundle(value);\n  const root = await allocateNativeState(\"view-\");\n  await writeFile(join(root, \"index.json\"), bytes, { flag: \"wx\", mode: 0o600 });\n  const filesRoot = join(root, bundle.host);\n  let remainingBytes = MAX_NATIVE_BYTES;\n  for (const item of bundle.files)\n    remainingBytes -= await materializeNativeFile(\n      filesRoot,\n      item,\n      bundle.format,\n      remainingBytes,\n    );\n  return root;\n}\n\nfunction nativeBundle(value: unknown) {\n  if (!isRecord(value) || !nativeFormat(value.format))\n    throw new Error(\"invalid native transcript bundle\");\n  if (!nativeHost(value.host))\n    throw new Error(\"invalid native transcript host\");\n  if (!isUnknownArray(value.files))\n    throw new Error(\"invalid native transcript files\");\n  return { host: value.host, files: value.files, format: value.format };\n}\n\nfunction nativeFormat(value: unknown): value is NativeFormat {\n  return (\n    value === \"sevro.native-transcripts.v1\" ||\n    value === \"sevro.native-transcripts.v2\"\n  );\n}\n\nfunction nativeHost(value: unknown): value is \"codex\" | \"claude\" {\n  return value === \"codex\" || value === \"claude\";\n}\n\nasync function materializeNativeFile(\n  root: string,\n  value: unknown,\n  format: NativeFormat,\n  remainingBytes: number,\n): Promise<number> {\n  if (!isRecord(value) || typeof value.path !== \"string\")\n    throw new Error(\"invalid native transcript file\");\n  const path = join(root, ...fixtureParts(value.path));\n  const bytes = nativeFileBytes(value, format, remainingBytes);\n  if (bytes.length > remainingBytes)\n    throw new Error(\"native transcript byte limit exceeded\");\n  if (sha256(bytes) !== value.sha256)\n    throw new Error(\"native transcript hash mismatch\");\n  await mkdir(dirname(path), { recursive: true, mode: 0o700 });\n  await writeFile(path, bytes, { flag: \"wx\", mode: 0o600 });\n  return bytes.length;\n}\n\nfunction nativeFileBytes(\n  value: Record<string, unknown>,\n  format: NativeFormat,\n  remainingBytes: number,\n): Buffer {\n  const encoded =\n    format === \"sevro.native-transcripts.v1\"\n      ? value.bytesBase64\n      : value.gzipBase64;\n  if (typeof encoded !== \"string\")\n    throw new Error(\"invalid native transcript file\");\n  const bytes = Buffer.from(encoded, \"base64\");\n  if (format === \"sevro.native-transcripts.v1\") return bytes;\n  try {\n    return gunzipSync(bytes, { maxOutputLength: Math.max(1, remainingBytes) });\n  } catch (cause) {\n    throw new Error(\"invalid native transcript gzip\", { cause });\n  }\n}\n"]}