@descryy/runtime-controller 0.2.1 → 0.3.1

package/dist/environment-version-check.js

@@ -1,62 +1,31 @@
 /**
- * `DEC-NEXT-fault-layer-empirical-confirmation.md`'s `environment`
- * mechanism: "declared/expected runner version (CI config) vs. observed
- * runner version at execution." Same shape as `dependency-version-check.ts`'s
- * comparison -- cheap, always available, no rerun needed.
+ * `DEC-NEXT-fault-layer-empirical-confirmation.md`'s `environment` mechanism:
+ * declared/expected runner version vs observed, at execution. Same shape as
+ * `dependency-version-check.ts` -- cheap, always available, no rerun needed.
  *
- * ## "Declared" is the project's own `.nvmrc`/`engines.node`, not a
- * CI-workflow parser
- *
- * The ruling names "a CI config's pinned Node/language version" as one
- * example of what "declared" can mean, not the only one -- its actual
- * requirement is "whatever 'declared environment' already means elsewhere
- * in this repo," checked directly rather than assumed (`environment-profile`
- * turned out to mean something else entirely: DEC-270's safety level and
- * credentials, not a version declaration). Nothing in this repo already
- * parses a CI workflow file, and doing so first here would mean writing a
- * YAML parser (or a regex sketch of one) for a signal that is, in every
- * real Node project, already restated in `package.json` -- `.nvmrc` and
- * `engines.node` are the actual, load-bearing declarations `nvm`/`npm`
- * themselves read, checked directly against this repo's own root
- * `package.json` (`engines: { node: ">=22.5" }`) and every fixture app
- * under `fixture-apps/`, which all carry the same field. A future CI-file
- * reader is a real, disclosed extension point, not a silent omission --
- * this function's `declaredSource` is a closed union specifically so a
- * third source can be added later without changing the shape callers
- * already read.
- *
- * ## `satisfiesDeclaredNodeVersion`'s grammar is a real, narrower subset
- *
- * Supports `^x.y.z`, `~x.y.z`, `>=`/`<=`/`>`/`<` clauses, a bare version at
- * any precision (`"20"`, `"20.11"`, `"20.11.5"`, each an x-range at that
- * precision -- `"20"` means "any 20.x.y", matching what `actions/setup-node`
- * itself does for a bare major), and space-separated AND clauses
- * (`">=20.0.0 <21.0.0"`), npm's own shape for a bounded range. Does **not**
- * support `||` (OR), hyphen ranges (`"1.2.3 - 2.3.4"`), prerelease/build
- * tags, or the `x`/`*` wildcard tokens (`"20.x"`) -- an input using any of
- * those parses to `null` ("cannot say") rather than a silently wrong
- * true/false, the same "disclosed narrower scope, not a guess" pattern this
- * repo already applies to `EnvironmentMetadata.toolchainVersions`' `null`
- * entries.
+ * - "Declared" reads `.nvmrc`/`package.json engines.node`, not a CI-workflow parser
+ *   -- nothing here already parses CI YAML, and these are the load-bearing
+ *   declarations `nvm`/`npm` themselves read. A future CI-file reader is a
+ *   disclosed extension point: `declaredSource` is a closed union so a third source
+ *   can be added without changing callers' shape.
+ * - `satisfiesDeclaredNodeVersion`'s grammar supports `^x.y.z`, `~x.y.z`,
+ *   `>=`/`<=`/`>`/`<`, a bare version at any precision (x-range at that precision,
+ *   matching `actions/setup-node`), and space-separated AND clauses. Does NOT
+ *   support `||`, hyphen ranges, prerelease/build tags, or `x`/`*` wildcards --
+ *   those parse to `null` ("cannot say"), never a guessed true/false.
  */
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 export const DECLARED_VERSION_SOURCES = ["nvmrc", "package.json engines.node"];
 /**
- * Reads the declared Node version for the project rooted at `cwd` and
- * compares it against `observedVersion` (the real, already-known runtime
- * value -- `process.version`, or `EnvironmentMetadata.nodeVersion`, the same
- * "always known, never probed" value this repo already captures elsewhere;
- * this function never probes for it itself).
+ * Reads the declared Node version for the project at `cwd`, compares against
+ * `observedVersion` (`process.version`/`EnvironmentMetadata.nodeVersion` -- never
+ * probed here).
  *
- * `.nvmrc` takes precedence over `package.json engines.node` when both are
- * present -- `.nvmrc` names one exact intended version a developer actually
- * runs locally; `engines.node` is more often a permissive range meant to
- * describe compatibility rather than pin a single runtime. The narrower,
- * more specific declaration wins, the same precedence
- * `classifyFaultLayer` (`descry-core`) already applies between `dependency`
- * and `environment` themselves ("the narrower, more specific structural
- * fact... is checked first").
+ * `.nvmrc` takes precedence over `engines.node` when both exist -- it names one
+ * exact version a developer runs locally, vs. a more often permissive compatibility
+ * range. Narrower/more specific wins, same precedence `classifyFaultLayer`
+ * (`descry-core`) applies between `dependency` and `environment`.
  */
 export function checkEnvironmentVersion(cwd, observedVersion) {
     const notApplicable = {
@@ -98,9 +67,8 @@ export function checkEnvironmentVersion(cwd, observedVersion) {
     }
     const satisfies = satisfiesDeclaredNodeVersion(declaredVersion, observedVersion);
     if (satisfies === null) {
-        // Declared with a grammar this reader does not cover (or the observed
-        // string was not parseable), so honestly "not applicable" rather than
-        // implying a comparison was actually made -- see this module's header.
+        // Grammar not covered (or observed string unparseable) -- "not applicable",
+        // not a comparison that was actually made.
         return { applicable: false, mismatch: false, declaredVersion, declaredSource, observedVersion };
     }
     return { applicable: true, mismatch: !satisfies, declaredVersion, declaredSource, observedVersion };
@@ -132,11 +100,7 @@ function compareVersions(a, b) {
 const CARET_PATTERN = /^\^(\d+)(?:\.(\d+))?(?:\.(\d+))?$/;
 const TILDE_PATTERN = /^~(\d+)(?:\.(\d+))?(?:\.(\d+))?$/;
 const COMPARATOR_PATTERN = /^(>=|<=|>|<|=)?(\d+)(?:\.(\d+))?(?:\.(\d+))?$/;
-/**
- * `null` means "this clause's grammar is not one of the ones documented in
- * this module's header" -- propagated up as `null`, never coerced to a
- * guessed `true`/`false`.
- */
+/** `null` means the clause's grammar isn't covered -- propagated up, never coerced to a guessed true/false. */
 function satisfiesClause(clause, observed) {
     const trimmed = clause.trim();
     if (trimmed.length === 0)
@@ -196,13 +160,7 @@ function satisfiesClause(clause, observed) {
             return null;
     }
 }
-/**
- * Whether `observedVersion` satisfies `declaredRange` under the grammar
- * documented in this module's header. `null` means the comparison could not
- * be made at all (either string used a construct this reader does not
- * cover) -- distinct from `false`, which is a real, positive "does not
- * satisfy" answer.
- */
+/** Whether `observedVersion` satisfies `declaredRange` under the grammar above. `null` means the comparison couldn't be made -- distinct from `false`, a real "does not satisfy" answer. */
 export function satisfiesDeclaredNodeVersion(declaredRange, observedVersion) {
     const observed = parseVersion(observedVersion);
     if (observed === null)

package/dist/environment-version-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment-version-check.js","sourceRoot":"","sources":["../src/environment-version-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,2BAA2B,CAAU,CAAC;AAsBxF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,eAAuB;IAC1E,MAAM,aAAa,GAAkC;QACnD,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,IAAI;QACpB,eAAe;KAChB,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,cAAc,GAAiC,IAAI,CAAC;IAExD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,eAAe,GAAG,GAAG,CAAC;YACtB,cAAc,GAAG,OAAO,CAAC;QAC3B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,IAAI,MAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAiB,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;YACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvD,eAAe,GAAG,IAAI,CAAC;gBACvB,cAAc,GAAG,2BAA2B,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,eAAe,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,4BAA4B,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACjF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;IAClG,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AACtG,CAAC;AAUD,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO;QACL,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACtC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;KACvC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,eAAe,CAAC,CAAgB,EAAE,CAAgB;IACzD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;AAC3B,CAAC;AAED,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAC1D,MAAM,aAAa,GAAG,kCAAkC,CAAC;AACzD,MAAM,kBAAkB,GAAG,+CAA+C,CAAC;AAE3E;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,QAAuB;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,GAAkB;YAC1B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,IAAI;YACpB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;IAC/E,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,GAAkB;YAC1B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,IAAI;YACpB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;IAChH,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAkB;QAC1B,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS;QAC3C,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS;KAC5C,CAAC;IACF,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE5C,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,IAAI;YACP,OAAO,GAAG,IAAI,CAAC,CAAC;QAClB,KAAK,IAAI;YACP,OAAO,GAAG,IAAI,CAAC,CAAC;QAClB,KAAK,GAAG;YACN,OAAO,GAAG,GAAG,CAAC,CAAC;QACjB,KAAK,GAAG;YACN,OAAO,GAAG,GAAG,CAAC,CAAC;QACjB,KAAK,GAAG,CAAC;QACT,KAAK,SAAS;YACZ,qEAAqE;YACrE,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,OAAO,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;YAC/D,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,OAAO,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;YAChG,OAAO,GAAG,KAAK,CAAC,CAAC;QACnB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,aAAqB,EAAE,eAAuB;IACzF,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"environment-version-check.js","sourceRoot":"","sources":["../src/environment-version-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,2BAA2B,CAAU,CAAC;AAgBxF;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,eAAuB;IAC1E,MAAM,aAAa,GAAkC;QACnD,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,IAAI;QACpB,eAAe;KAChB,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,cAAc,GAAiC,IAAI,CAAC;IAExD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,eAAe,GAAG,GAAG,CAAC;YACtB,cAAc,GAAG,OAAO,CAAC;QAC3B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,IAAI,MAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAiB,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;YACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvD,eAAe,GAAG,IAAI,CAAC;gBACvB,cAAc,GAAG,2BAA2B,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,eAAe,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,4BAA4B,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACjF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,4EAA4E;QAC5E,2CAA2C;QAC3C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;IAClG,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AACtG,CAAC;AAUD,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO;QACL,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACtC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;KACvC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,eAAe,CAAC,CAAgB,EAAE,CAAgB;IACzD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;AAC3B,CAAC;AAED,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAC1D,MAAM,aAAa,GAAG,kCAAkC,CAAC;AACzD,MAAM,kBAAkB,GAAG,+CAA+C,CAAC;AAE3E,+GAA+G;AAC/G,SAAS,eAAe,CAAC,MAAc,EAAE,QAAuB;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,GAAkB;YAC1B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,IAAI;YACpB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;IAC/E,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,GAAkB;YAC1B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,IAAI;YACpB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;IAChH,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAkB;QAC1B,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS;QAC3C,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS;KAC5C,CAAC;IACF,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE5C,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,IAAI;YACP,OAAO,GAAG,IAAI,CAAC,CAAC;QAClB,KAAK,IAAI;YACP,OAAO,GAAG,IAAI,CAAC,CAAC;QAClB,KAAK,GAAG;YACN,OAAO,GAAG,GAAG,CAAC,CAAC;QACjB,KAAK,GAAG;YACN,OAAO,GAAG,GAAG,CAAC,CAAC;QACjB,KAAK,GAAG,CAAC;QACT,KAAK,SAAS;YACZ,qEAAqE;YACrE,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,OAAO,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;YAC/D,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,OAAO,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;YAChG,OAAO,GAAG,KAAK,CAAC,CAAC;QACnB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,4LAA4L;AAC5L,MAAM,UAAU,4BAA4B,CAAC,aAAqB,EAAE,eAAuB;IACzF,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AACpD,CAAC"}

package/dist/execution-safety.d.ts

@@ -1,153 +1,95 @@
 /**
- * §21's execution boundary (RT-070): resource limits and privilege
- * reporting for a runtime whose declared mode is trusted-local (see
- * DECISIONS.md RT-070) -- every spawned process runs with the invoking
- * user's own OS privileges, no filesystem or network restriction. That
- * declaration does not make unrestricted execution safe; it names the
- * boundary instead of leaving it absent, which is what §38's "arbitrary
- * application code runs without a defined safety boundary" actually bans.
- * Real isolation (containers/namespaces) is a separate architectural
- * decision this module does not invent (plan §29's own instruction).
+ * §21/RT-070's execution boundary: resource limits and privilege reporting for a
+ * runtime declared trusted-local -- every spawned process runs with the invoking
+ * user's own OS privileges, no filesystem/network restriction. Names the boundary
+ * rather than leaving it absent (§38); real isolation (containers/namespaces) is a
+ * separate decision this module does not invent (§29).
  *
- * What this module DOES enforce, for real, via the OS: CPU time, virtual
- * memory, and process count, through `prlimit` -- an exec wrapper, never a
- * shell. Reintroducing `sh -c 'ulimit ...; exec ...'` to get these would
- * undo RT-036's `tokenizeCommand` refusal of shell metacharacters. `prlimit`
- * is util-linux and absent on macOS, so it is reported as a capability,
- * never assumed.
+ * Enforces for real, via the OS: CPU time, virtual memory, process count, through
+ * `prlimit` -- an exec wrapper, never a shell (a shell would undo RT-036's
+ * `tokenizeCommand` refusal of shell metacharacters). `prlimit` is util-linux, absent
+ * on macOS, so it's reported as a capability, never assumed.
  */
 import type { CapabilityStatus, ResourceLimits } from "@descryy/runtime-contracts";
-/**
- * Whether `prlimit` is reachable on this platform's `PATH`. Takes `env` as
- * a parameter (defaulting to `process.env`) rather than reading it
- * internally so the "unavailable" branch is directly testable without
- * mutating this process's own real environment or depending on running on
- * a platform that genuinely lacks it.
- */
+/** Whether `prlimit` is reachable on PATH. `env` is a parameter (default `process.env`) so the "unavailable" branch is testable without mutating the real environment. */
 export declare function resourceLimitCapability(env?: NodeJS.ProcessEnv): CapabilityStatus;
 /**
- * RT-193 originally made this always `unavailable` -- no platform had any
- * enforcement mechanism wired up. The sandbox-isolation lane changes that
- * on Linux: `networkIsolationCapability()` (`./sandbox.ts`) is real, backed
- * by a bwrap network namespace. This function is kept as the stable name
- * every existing caller (`ExecutionController.run()`, this package's own
- * tests) already imports, delegating rather than duplicating the check --
- * exactly the seam RT-193's own comment anticipated ("if a real mechanism
- * is ever built, this one function changes and every caller keeps working
- * unmodified"). Still unconditionally `unavailable` on macOS/Windows, where
- * nothing enforces it yet.
+ * RT-193 originally made this always `unavailable`. Now delegates to
+ * `networkIsolationCapability()` (`./sandbox.ts`), real on Linux via a bwrap network
+ * namespace -- kept as the stable name every caller already imports (the seam
+ * RT-193 anticipated). Still unconditionally `unavailable` on macOS/Windows.
  */
 export declare function networkPolicyCapability(env?: NodeJS.ProcessEnv): CapabilityStatus;
 /**
- * Wraps `command`/`args` so the OS enforces `limits`, via `prlimit`.
- * `undefined` or an empty `limits` returns `command`/`args` unchanged --
- * every execution before RT-070 keeps behaving exactly as before unless it
- * opts in.
+ * Wraps `command`/`args` so the OS enforces `limits`, via `prlimit`. `undefined` or
+ * empty `limits` returns them unchanged -- opt-in only.
  *
- * **Throws rather than silently spawning unconstrained** when a limit was
- * requested and `prlimit` is unavailable. `tokenizeCommand`'s own precedent
- * (RT-036) is refuse rather than guess; the equivalent failure here would
- * be a caller asking for a memory cap and getting a process that can
- * allocate without bound, silently -- exactly the "sandbox that doesn't
- * sandbox" shape §38 bans, one row up from this one.
+ * **Throws rather than silently spawning unconstrained** when a limit was requested
+ * and `prlimit` is unavailable (refuse-not-guess, per RT-036) -- the alternative is a
+ * caller asking for a memory cap and silently getting an unbounded process, the
+ * "sandbox that doesn't sandbox" shape §38 bans.
  */
 export declare function applyResourceLimits(command: string, args: readonly string[], limits: ResourceLimits | undefined, env?: NodeJS.ProcessEnv): {
     readonly command: string;
     readonly args: readonly string[];
 };
 /**
- * DEC-272's disclosure requirement: the sandbox boundary (RT-070) must be
- * stated to the user directly in-product, not left as a silent gap in a
- * doc. Fixed, not derived from `runningAsRoot` -- the boundary is the same
- * regardless of which privilege level was found; only the observed fact
- * changes.
+ * DEC-272: the sandbox boundary (RT-070) must be stated to the user directly, not
+ * left as a silent doc gap. Fixed, not derived from `runningAsRoot` -- the boundary
+ * is the same regardless of privilege level found.
  *
- * **Scope, corrected by the attach-mode-mitigations lane: this is the
- * unconditional-unisolated text, not a universal one.** Written when
- * RT-193/RT-070 landed, before `sandbox.ts` existed -- at that point it was
- * accurate for every execution, because nothing anywhere in this runtime
- * could isolate anything. That stopped being true the moment the
- * sandbox-isolation lane gave spawn-mode real, bwrap-backed filesystem/
- * network isolation (`applySandbox`, this same package): a spawned process
- * that actually got a `FilesystemPolicy`/`NetworkPolicy` applied to it is
- * genuinely more contained than "the same as if you started it yourself"
- * says. Using this constant unconditionally for that process would be a
- * real disclosure-accuracy bug -- understating a boundary is not the safe
- * direction to be wrong in, it just happens to be a less alarming one.
- * `sandboxBoundaryDisclosureFor()` below is the mode-aware replacement: it
- * returns this exact string when no policy was applied (attach-mode always,
- * and any spawn that declared none -- unchanged from before this lane), and
- * a real, specific description of what is and is not contained when a
- * policy genuinely was. This constant is kept, unchanged, as that function's
- * own no-policy-applied return value and as attach-mode's own disclosure,
- * not deprecated -- attach-mode never has anything more accurate to say.
+ * **Scope: this is the unconditional-unisolated text, not a universal one.** Accurate
+ * for every execution before `sandbox.ts` existed; no longer true once spawn-mode got
+ * real bwrap-backed isolation (`applySandbox`) -- using this unconditionally for an
+ * isolated process would understate its boundary, which is not the safe direction to
+ * be wrong in. `sandboxBoundaryDisclosureFor()` below is the mode-aware replacement;
+ * this constant remains its no-policy-applied return value and attach-mode's own
+ * disclosure (attach-mode never has anything more accurate to say).
  */
 export declare const SANDBOX_BOUNDARY_DISCLOSURE: string;
 /**
- * Whether a real `FilesystemPolicy`/`NetworkPolicy` was actually enforced on
- * the process this disclosure describes -- not merely requested.
- * `applySandbox` already refuses to spawn (throws) rather than proceed
- * unconstrained when a declared policy cannot be enforced (see its own
- * comment), so by the time a caller can observe a successfully spawned
- * process, "declared" and "applied" are the same fact; this type exists so
- * a caller states that fact explicitly rather than this function silently
- * assuming it.
+ * Whether a real policy was actually enforced, not merely requested. `applySandbox`
+ * already throws rather than proceed unconstrained when a declared policy can't be
+ * enforced, so by the time a process is observed running, "declared" and "applied"
+ * are the same fact -- this type makes the caller state it explicitly.
  */
 export interface AppliedIsolationPolicies {
     readonly filesystemPolicyApplied: boolean;
     readonly networkPolicyApplied: boolean;
 }
 /**
- * The mode-aware replacement for reading `SANDBOX_BOUNDARY_DISCLOSURE`
- * unconditionally. Defaults to reporting no policy applied -- so calling
- * this with no argument at all is identical to the pre-existing constant,
- * the same non-regression contract every other opt-in in this file
- * (`applyResourceLimits`, `applySandbox`) already keeps.
+ * Mode-aware replacement for reading `SANDBOX_BOUNDARY_DISCLOSURE` unconditionally.
+ * Defaults to no-policy-applied, so a no-arg call matches the old constant exactly.
  *
- * **Still only ever true for spawn-mode.** Attach-mode has no code path
- * that can produce `filesystemPolicyApplied: true` or
- * `networkPolicyApplied: true` for any process it did not itself spawn --
- * see `sandbox.ts`'s own module doc for why that is structural, not a gap
- * in this function. A caller in attach-mode should simply never pass
- * anything but the default here, and the default's return value is this
- * disclosure's original, unconditional "not isolated" text, unchanged.
+ * **Only ever true for spawn-mode.** Attach-mode has no path to produce
+ * `filesystemPolicyApplied`/`networkPolicyApplied: true` for a process it didn't
+ * spawn (structural, see `sandbox.ts`) -- attach-mode callers should never pass
+ * anything but the default.
  */
 export declare function sandboxBoundaryDisclosureFor(policies?: AppliedIsolationPolicies): string;
 /**
- * Attach mode's own contractual scope guarantee -- distinct from the
- * sandbox-*boundary* disclosure above (what is or isn't contained) because
- * this is a claim about what an attach-mode `Collector` is even permitted
- * to *do*, not about what OS boundary wraps it. See `Collector` in
- * `@descryy/runtime-contracts` for the interface-level statement this
- * mirrors, and `sandbox.ts`'s own module doc for why attach-mode can never
- * acquire the isolation `sandboxBoundaryDisclosureFor` describes for
- * spawn-mode. Stated once, here, so every attach-mode caller surfaces the
- * identical sentence rather than each writing its own paraphrase.
+ * Attach mode's contractual scope guarantee -- distinct from the sandbox-boundary
+ * disclosure above: this is what an attach-mode `Collector` is permitted to *do*, not
+ * what OS boundary wraps it. Mirrors `Collector` in `@descryy/runtime-contracts`.
+ * Stated once so every attach-mode caller surfaces the identical sentence.
  */
 export declare const ATTACH_MODE_SCOPE_DISCLOSURE: string;
 export interface PrivilegeReport {
-    /** Null when this platform has no uid concept at all (`process.getuid` is undefined on Windows) -- distinct from `false`, which is a real answer, not an absent one. */
+    /** Null when the platform has no uid concept (`process.getuid` undefined on Windows) -- distinct from `false`, a real answer. */
     readonly runningAsRoot: boolean | null;
-    /** DEC-272: plain-language statement of the sandbox boundary, carried on the same result the privilege level already travels on rather than a new return path. Always populated -- the disclosure is unconditional, not dependent on `runningAsRoot`. */
+    /** DEC-272: plain-language sandbox boundary statement, carried on this result rather than a new return path. Always populated, independent of `runningAsRoot`. */
     readonly disclosure: string;
 }
 /**
- * Reports, never enforces. §21's privilege policy for a runtime declared
- * trusted-local (RT-070) is not "refuse to run as root" -- CI containers
- * commonly run as root by default, and a hard refusal there would turn a
- * documented boundary into an undocumented outage. The policy is: the real
- * privilege level becomes an observable fact instead of an invisible one,
- * which is what nothing before RT-070 made it.
+ * Reports, never enforces. §21's policy for trusted-local (RT-070) is not "refuse to
+ * run as root" -- CI containers commonly do, and a hard refusal would turn a
+ * documented boundary into an undocumented outage. The privilege level just becomes
+ * observable instead of invisible.
  *
- * A required parameter, not a defaulted one: `undefined` is the real,
- * meaningful value a platform with no uid concept produces
- * (`process.getuid` is itself `undefined` on Windows), and a *default*
- * parameter cannot tell "caller explicitly passed undefined" apart from
- * "caller omitted the argument" -- both look identical to the function.
- * `currentPrivilegeReport()` below is the zero-argument convenience wrapper
- * real callers use; this is what makes both branches -- root, and no uid
- * concept at all -- directly testable without this process actually
- * needing to run as root or on Windows.
+ * A required parameter, not defaulted: `undefined` is the real value a no-uid-concept
+ * platform produces, and a default can't distinguish "explicitly undefined" from
+ * "omitted." `currentPrivilegeReport()` below is the convenience wrapper; this makes
+ * both branches testable without actually running as root or on Windows.
  */
 export declare function privilegeReportFor(getuid: (() => number) | undefined): PrivilegeReport;
 export declare function currentPrivilegeReport(): PrivilegeReport;

package/dist/execution-safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-safety.d.ts","sourceRoot":"","sources":["../src/execution-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGnF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAU9F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAE9F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAchE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,2BAA2B,QAGT,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;CACxC;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,GAAE,wBAA8C,GAAG,MAAM,CAwB7G;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,QAKoC,CAAC;AAE9E,MAAM,WAAW,eAAe;IAC9B,wKAAwK;IACxK,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,yPAAyP;IACzP,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,GAAG,eAAe,CAGtF;AAED,wBAAgB,sBAAsB,IAAI,eAAe,CAExD"}
+{"version":3,"file":"execution-safety.d.ts","sourceRoot":"","sources":["../src/execution-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGnF,0KAA0K;AAC1K,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAU9F;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAE9F;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAchE;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,QAGT,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;CACxC;AAID;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,GAAE,wBAA8C,GAAG,MAAM,CAwB7G;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,QAKoC,CAAC;AAE9E,MAAM,WAAW,eAAe;IAC9B,iIAAiI;IACjI,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,kKAAkK;IAClK,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,GAAG,eAAe,CAGtF;AAED,wBAAgB,sBAAsB,IAAI,eAAe,CAExD"}

package/dist/execution-safety.js

@@ -1,30 +1,18 @@
 /**
- * §21's execution boundary (RT-070): resource limits and privilege
- * reporting for a runtime whose declared mode is trusted-local (see
- * DECISIONS.md RT-070) -- every spawned process runs with the invoking
- * user's own OS privileges, no filesystem or network restriction. That
- * declaration does not make unrestricted execution safe; it names the
- * boundary instead of leaving it absent, which is what §38's "arbitrary
- * application code runs without a defined safety boundary" actually bans.
- * Real isolation (containers/namespaces) is a separate architectural
- * decision this module does not invent (plan §29's own instruction).
+ * §21/RT-070's execution boundary: resource limits and privilege reporting for a
+ * runtime declared trusted-local -- every spawned process runs with the invoking
+ * user's own OS privileges, no filesystem/network restriction. Names the boundary
+ * rather than leaving it absent (§38); real isolation (containers/namespaces) is a
+ * separate decision this module does not invent (§29).
  *
- * What this module DOES enforce, for real, via the OS: CPU time, virtual
- * memory, and process count, through `prlimit` -- an exec wrapper, never a
- * shell. Reintroducing `sh -c 'ulimit ...; exec ...'` to get these would
- * undo RT-036's `tokenizeCommand` refusal of shell metacharacters. `prlimit`
- * is util-linux and absent on macOS, so it is reported as a capability,
- * never assumed.
+ * Enforces for real, via the OS: CPU time, virtual memory, process count, through
+ * `prlimit` -- an exec wrapper, never a shell (a shell would undo RT-036's
+ * `tokenizeCommand` refusal of shell metacharacters). `prlimit` is util-linux, absent
+ * on macOS, so it's reported as a capability, never assumed.
  */
 import { execFileSync } from "node:child_process";
 import { networkIsolationCapability } from "./sandbox.js";
-/**
- * Whether `prlimit` is reachable on this platform's `PATH`. Takes `env` as
- * a parameter (defaulting to `process.env`) rather than reading it
- * internally so the "unavailable" branch is directly testable without
- * mutating this process's own real environment or depending on running on
- * a platform that genuinely lacks it.
- */
+/** Whether `prlimit` is reachable on PATH. `env` is a parameter (default `process.env`) so the "unavailable" branch is testable without mutating the real environment. */
 export function resourceLimitCapability(env = process.env) {
     try {
         execFileSync("prlimit", ["--version"], { env, stdio: "ignore" });
@@ -38,32 +26,22 @@ export function resourceLimitCapability(env = process.env) {
     }
 }
 /**
- * RT-193 originally made this always `unavailable` -- no platform had any
- * enforcement mechanism wired up. The sandbox-isolation lane changes that
- * on Linux: `networkIsolationCapability()` (`./sandbox.ts`) is real, backed
- * by a bwrap network namespace. This function is kept as the stable name
- * every existing caller (`ExecutionController.run()`, this package's own
- * tests) already imports, delegating rather than duplicating the check --
- * exactly the seam RT-193's own comment anticipated ("if a real mechanism
- * is ever built, this one function changes and every caller keeps working
- * unmodified"). Still unconditionally `unavailable` on macOS/Windows, where
- * nothing enforces it yet.
+ * RT-193 originally made this always `unavailable`. Now delegates to
+ * `networkIsolationCapability()` (`./sandbox.ts`), real on Linux via a bwrap network
+ * namespace -- kept as the stable name every caller already imports (the seam
+ * RT-193 anticipated). Still unconditionally `unavailable` on macOS/Windows.
  */
 export function networkPolicyCapability(env = process.env) {
     return networkIsolationCapability(env);
 }
 /**
- * Wraps `command`/`args` so the OS enforces `limits`, via `prlimit`.
- * `undefined` or an empty `limits` returns `command`/`args` unchanged --
- * every execution before RT-070 keeps behaving exactly as before unless it
- * opts in.
+ * Wraps `command`/`args` so the OS enforces `limits`, via `prlimit`. `undefined` or
+ * empty `limits` returns them unchanged -- opt-in only.
  *
- * **Throws rather than silently spawning unconstrained** when a limit was
- * requested and `prlimit` is unavailable. `tokenizeCommand`'s own precedent
- * (RT-036) is refuse rather than guess; the equivalent failure here would
- * be a caller asking for a memory cap and getting a process that can
- * allocate without bound, silently -- exactly the "sandbox that doesn't
- * sandbox" shape §38 bans, one row up from this one.
+ * **Throws rather than silently spawning unconstrained** when a limit was requested
+ * and `prlimit` is unavailable (refuse-not-guess, per RT-036) -- the alternative is a
+ * caller asking for a memory cap and silently getting an unbounded process, the
+ * "sandbox that doesn't sandbox" shape §38 bans.
  */
 export function applyResourceLimits(command, args, limits, env = process.env) {
     if (limits === undefined)
@@ -84,50 +62,30 @@ export function applyResourceLimits(command, args, limits, env = process.env) {
     return { command: "prlimit", args: [...flags, "--", command, ...args] };
 }
 /**
- * DEC-272's disclosure requirement: the sandbox boundary (RT-070) must be
- * stated to the user directly in-product, not left as a silent gap in a
- * doc. Fixed, not derived from `runningAsRoot` -- the boundary is the same
- * regardless of which privilege level was found; only the observed fact
- * changes.
+ * DEC-272: the sandbox boundary (RT-070) must be stated to the user directly, not
+ * left as a silent doc gap. Fixed, not derived from `runningAsRoot` -- the boundary
+ * is the same regardless of privilege level found.
  *
- * **Scope, corrected by the attach-mode-mitigations lane: this is the
- * unconditional-unisolated text, not a universal one.** Written when
- * RT-193/RT-070 landed, before `sandbox.ts` existed -- at that point it was
- * accurate for every execution, because nothing anywhere in this runtime
- * could isolate anything. That stopped being true the moment the
- * sandbox-isolation lane gave spawn-mode real, bwrap-backed filesystem/
- * network isolation (`applySandbox`, this same package): a spawned process
- * that actually got a `FilesystemPolicy`/`NetworkPolicy` applied to it is
- * genuinely more contained than "the same as if you started it yourself"
- * says. Using this constant unconditionally for that process would be a
- * real disclosure-accuracy bug -- understating a boundary is not the safe
- * direction to be wrong in, it just happens to be a less alarming one.
- * `sandboxBoundaryDisclosureFor()` below is the mode-aware replacement: it
- * returns this exact string when no policy was applied (attach-mode always,
- * and any spawn that declared none -- unchanged from before this lane), and
- * a real, specific description of what is and is not contained when a
- * policy genuinely was. This constant is kept, unchanged, as that function's
- * own no-policy-applied return value and as attach-mode's own disclosure,
- * not deprecated -- attach-mode never has anything more accurate to say.
+ * **Scope: this is the unconditional-unisolated text, not a universal one.** Accurate
+ * for every execution before `sandbox.ts` existed; no longer true once spawn-mode got
+ * real bwrap-backed isolation (`applySandbox`) -- using this unconditionally for an
+ * isolated process would understate its boundary, which is not the safe direction to
+ * be wrong in. `sandboxBoundaryDisclosureFor()` below is the mode-aware replacement;
+ * this constant remains its no-policy-applied return value and attach-mode's own
+ * disclosure (attach-mode never has anything more accurate to say).
  */
 export const SANDBOX_BOUNDARY_DISCLOSURE = "This app runs with your own user permissions, the same as if you started it yourself. " +
     "The filesystem and network are not isolated -- anything your own account could read, write, " +
     "or reach, this run can too.";
 const NO_POLICIES_APPLIED = { filesystemPolicyApplied: false, networkPolicyApplied: false };
 /**
- * The mode-aware replacement for reading `SANDBOX_BOUNDARY_DISCLOSURE`
- * unconditionally. Defaults to reporting no policy applied -- so calling
- * this with no argument at all is identical to the pre-existing constant,
- * the same non-regression contract every other opt-in in this file
- * (`applyResourceLimits`, `applySandbox`) already keeps.
+ * Mode-aware replacement for reading `SANDBOX_BOUNDARY_DISCLOSURE` unconditionally.
+ * Defaults to no-policy-applied, so a no-arg call matches the old constant exactly.
  *
- * **Still only ever true for spawn-mode.** Attach-mode has no code path
- * that can produce `filesystemPolicyApplied: true` or
- * `networkPolicyApplied: true` for any process it did not itself spawn --
- * see `sandbox.ts`'s own module doc for why that is structural, not a gap
- * in this function. A caller in attach-mode should simply never pass
- * anything but the default here, and the default's return value is this
- * disclosure's original, unconditional "not isolated" text, unchanged.
+ * **Only ever true for spawn-mode.** Attach-mode has no path to produce
+ * `filesystemPolicyApplied`/`networkPolicyApplied: true` for a process it didn't
+ * spawn (structural, see `sandbox.ts`) -- attach-mode callers should never pass
+ * anything but the default.
  */
 export function sandboxBoundaryDisclosureFor(policies = NO_POLICIES_APPLIED) {
     const { filesystemPolicyApplied, networkPolicyApplied } = policies;
@@ -150,15 +108,10 @@ export function sandboxBoundaryDisclosureFor(policies = NO_POLICIES_APPLIED) {
         "it can read, write, or reach anything your own account's filesystem could.");
 }
 /**
- * Attach mode's own contractual scope guarantee -- distinct from the
- * sandbox-*boundary* disclosure above (what is or isn't contained) because
- * this is a claim about what an attach-mode `Collector` is even permitted
- * to *do*, not about what OS boundary wraps it. See `Collector` in
- * `@descryy/runtime-contracts` for the interface-level statement this
- * mirrors, and `sandbox.ts`'s own module doc for why attach-mode can never
- * acquire the isolation `sandboxBoundaryDisclosureFor` describes for
- * spawn-mode. Stated once, here, so every attach-mode caller surfaces the
- * identical sentence rather than each writing its own paraphrase.
+ * Attach mode's contractual scope guarantee -- distinct from the sandbox-boundary
+ * disclosure above: this is what an attach-mode `Collector` is permitted to *do*, not
+ * what OS boundary wraps it. Mirrors `Collector` in `@descryy/runtime-contracts`.
+ * Stated once so every attach-mode caller surfaces the identical sentence.
  */
 export const ATTACH_MODE_SCOPE_DISCLOSURE = "Attach mode observes an already-running process; it never executes code in it or applies changes to it. " +
     "This is a permanent, documented architectural limitation, not a temporary gap -- there is no honest way to " +
@@ -166,22 +119,15 @@ export const ATTACH_MODE_SCOPE_DISCLOSURE = "Attach mode observes an already-run
     "Respawn-and-supervise and the cgroup resource-limit move are real alternatives next to attach mode, not " +
     "fixes to it; see their own documentation for what each actually gets you.";
 /**
- * Reports, never enforces. §21's privilege policy for a runtime declared
- * trusted-local (RT-070) is not "refuse to run as root" -- CI containers
- * commonly run as root by default, and a hard refusal there would turn a
- * documented boundary into an undocumented outage. The policy is: the real
- * privilege level becomes an observable fact instead of an invisible one,
- * which is what nothing before RT-070 made it.
+ * Reports, never enforces. §21's policy for trusted-local (RT-070) is not "refuse to
+ * run as root" -- CI containers commonly do, and a hard refusal would turn a
+ * documented boundary into an undocumented outage. The privilege level just becomes
+ * observable instead of invisible.
  *
- * A required parameter, not a defaulted one: `undefined` is the real,
- * meaningful value a platform with no uid concept produces
- * (`process.getuid` is itself `undefined` on Windows), and a *default*
- * parameter cannot tell "caller explicitly passed undefined" apart from
- * "caller omitted the argument" -- both look identical to the function.
- * `currentPrivilegeReport()` below is the zero-argument convenience wrapper
- * real callers use; this is what makes both branches -- root, and no uid
- * concept at all -- directly testable without this process actually
- * needing to run as root or on Windows.
+ * A required parameter, not defaulted: `undefined` is the real value a no-uid-concept
+ * platform produces, and a default can't distinguish "explicitly undefined" from
+ * "omitted." `currentPrivilegeReport()` below is the convenience wrapper; this makes
+ * both branches testable without actually running as root or on Windows.
  */
 export function privilegeReportFor(getuid) {
     if (getuid === undefined)

package/dist/execution-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-safety.js","sourceRoot":"","sources":["../src/execution-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,IAAI,CAAC;QACH,YAAY,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,+KAA+K;SACxL,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,IAAuB,EACvB,MAAkC,EAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEjD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2EAA2E,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GACtC,wFAAwF;IACxF,8FAA8F;IAC9F,6BAA6B,CAAC;AAiBhC,MAAM,mBAAmB,GAA6B,EAAE,uBAAuB,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;AAEtH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAAC,WAAqC,mBAAmB;IACnG,MAAM,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,GAAG,QAAQ,CAAC;IACnE,IAAI,CAAC,uBAAuB,IAAI,CAAC,oBAAoB;QAAE,OAAO,2BAA2B,CAAC;IAC1F,IAAI,uBAAuB,IAAI,oBAAoB,EAAE,CAAC;QACpD,OAAO,CACL,wGAAwG;YACxG,2GAA2G;YAC3G,6GAA6G;YAC7G,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,uBAAuB,EAAE,CAAC;QAC5B,OAAO,CACL,wGAAwG;YACxG,2GAA2G;YAC3G,wGAAwG;YACxG,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,CACL,uGAAuG;QACvG,4GAA4G;QAC5G,4EAA4E,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,0GAA0G;IAC1G,6GAA6G;IAC7G,qGAAqG;IACrG,0GAA0G;IAC1G,2EAA2E,CAAC;AAS9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkC;IACnE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,2BAA2B,EAAE,CAAC;IAClG,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,2BAA2B,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"execution-safety.js","sourceRoot":"","sources":["../src/execution-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE1D,0KAA0K;AAC1K,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,IAAI,CAAC;QACH,YAAY,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,+KAA+K;SACxL,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,IAAuB,EACvB,MAAkC,EAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEjD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2EAA2E,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GACtC,wFAAwF;IACxF,8FAA8F;IAC9F,6BAA6B,CAAC;AAahC,MAAM,mBAAmB,GAA6B,EAAE,uBAAuB,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;AAEtH;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,WAAqC,mBAAmB;IACnG,MAAM,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,GAAG,QAAQ,CAAC;IACnE,IAAI,CAAC,uBAAuB,IAAI,CAAC,oBAAoB;QAAE,OAAO,2BAA2B,CAAC;IAC1F,IAAI,uBAAuB,IAAI,oBAAoB,EAAE,CAAC;QACpD,OAAO,CACL,wGAAwG;YACxG,2GAA2G;YAC3G,6GAA6G;YAC7G,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,uBAAuB,EAAE,CAAC;QAC5B,OAAO,CACL,wGAAwG;YACxG,2GAA2G;YAC3G,wGAAwG;YACxG,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,CACL,uGAAuG;QACvG,4GAA4G;QAC5G,4EAA4E,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,0GAA0G;IAC1G,6GAA6G;IAC7G,qGAAqG;IACrG,0GAA0G;IAC1G,2EAA2E,CAAC;AAS9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkC;IACnE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,2BAA2B,EAAE,CAAC;IAClG,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,2BAA2B,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3D,CAAC"}