@dsh-enhanced/assistant-isolation 0.1.49 → 0.1.53

package/lib/native-runtime.js

@@ -0,0 +1,121 @@
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { createReadStream } from 'node:fs';
+import { lstat, readFile, readdir, realpath } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { promisify } from 'node:util';
+const hex = (value) => typeof value === 'string' && /^[0-9a-f]{64}$/.test(value);
+const canonical = (value) => typeof value === 'string' && isAbsolute(value) && resolve(value) === value
+    && !value.includes('\0') && !value.includes('\r') && !value.includes('\n');
+const within = (path, root) => path === root || path.startsWith(root + sep);
+const MAX_ENTRIES = 200_000;
+const MAX_BYTES = 2 * 1024 * 1024 * 1024;
+const execFileAsync = promisify(execFile);
+/** Pure, synchronous shape check; no filesystem state is trusted by this check. */
+export function validateNativeMacRuntime(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('invalid native runtime');
+    const runtime = value;
+    if (Object.keys(runtime).sort().join() !== 'modulesPath,nodePath,nodeSha256,platform,roots,schemaVersion,versions'
+        || runtime.schemaVersion !== 1 || runtime.platform !== `darwin-${process.arch}` || !canonical(runtime.nodePath)
+        || !hex(runtime.nodeSha256) || !canonical(runtime.modulesPath) || !Array.isArray(runtime.roots)
+        || runtime.roots.length < 1 || runtime.roots.length > 32 || !runtime.versions || typeof runtime.versions !== 'object'
+        || Object.keys(runtime.versions).sort().join() !== 'cordis,node,systemPrompt,tools,typescript'
+        || Object.values(runtime.versions).some(version => typeof version !== 'string' || version.length < 1 || version.length > 128)
+        || runtime.roots.some(root => !root || Object.keys(root).sort().join() !== 'dev,ino,path,sha256'
+            || !canonical(root.path) || root.path === '/' || !Number.isSafeInteger(root.dev) || root.dev < 0
+            || !Number.isSafeInteger(root.ino) || root.ino < 0 || !hex(root.sha256))
+        || new Set(runtime.roots.map(root => root.path)).size !== runtime.roots.length
+        || !runtime.roots.some(root => within(runtime.nodePath, root.path) && runtime.nodePath !== root.path)
+        || !runtime.roots.some(root => within(runtime.modulesPath, root.path)))
+        throw new Error('invalid native runtime');
+    return Object.freeze({ ...runtime, roots: runtime.roots.map(root => Object.freeze({ ...root })), versions: Object.freeze({ ...runtime.versions }) });
+}
+/** Hash sorted path/type/mode/content records. Internal symlinks are recorded, not followed. */
+export async function hashNativeMacRuntimeTree(root) {
+    if (!canonical(root) || await realpath(root) !== root)
+        throw new Error('noncanonical native runtime root');
+    const rootInfo = await lstat(root);
+    if (!rootInfo.isDirectory())
+        throw new Error('invalid native runtime root');
+    let entries = 0;
+    let bytes = 0;
+    const hash = createHash('sha256');
+    const visit = async (path) => {
+        if (++entries > MAX_ENTRIES)
+            throw new Error('native runtime entry limit');
+        const info = await lstat(path);
+        if (info.uid !== process.getuid?.())
+            throw new Error('native runtime entry owner mismatch');
+        const name = relative(root, path).split(sep).join('/');
+        if (info.isSymbolicLink()) {
+            const target = await realpath(path);
+            if (!within(target, root))
+                throw new Error('native runtime external symlink');
+            hash.update(JSON.stringify(['link', name, relative(root, target).split(sep).join('/')]) + '\n');
+        }
+        else if (info.isDirectory()) {
+            if ((info.mode & 0o022) !== 0)
+                throw new Error('writable native runtime entry');
+            hash.update(JSON.stringify(['dir', name, info.mode & 0o777]) + '\n');
+            for (const child of (await readdir(path)).sort())
+                await visit(join(path, child));
+        }
+        else if (info.isFile() && info.nlink === 1) {
+            if ((info.mode & 0o022) !== 0)
+                throw new Error('writable native runtime entry');
+            bytes += info.size;
+            if (bytes > MAX_BYTES)
+                throw new Error('native runtime byte limit');
+            const file = createHash('sha256');
+            for await (const chunk of createReadStream(path))
+                file.update(chunk);
+            hash.update(JSON.stringify(['file', name, info.mode & 0o777, info.size, file.digest('hex')]) + '\n');
+        }
+        else
+            throw new Error('native runtime special or linked file');
+    };
+    await visit(root);
+    return hash.digest('hex');
+}
+export function nativeMacRuntimeDigest(value) {
+    const runtime = validateNativeMacRuntime(value);
+    return createHash('sha256').update(JSON.stringify(runtime)).digest('hex');
+}
+/** Recheck each approved root, executable and package version before dispatch. */
+export async function verifyNativeMacRuntime(value) {
+    const runtime = validateNativeMacRuntime(value);
+    if (process.platform !== 'darwin')
+        throw new Error('native runtime requires macOS');
+    for (const root of runtime.roots) {
+        if (await realpath(root.path) !== root.path)
+            throw new Error('native runtime root moved');
+        const info = await lstat(root.path);
+        if (!info.isDirectory() || info.uid !== process.getuid?.() || info.dev !== root.dev || info.ino !== root.ino
+            || await hashNativeMacRuntimeTree(root.path) !== root.sha256)
+            throw new Error('native runtime root mismatch');
+    }
+    const nodeInfo = await lstat(runtime.nodePath);
+    if (!nodeInfo.isFile() || nodeInfo.nlink !== 1 || (nodeInfo.mode & 0o022) !== 0
+        || await realpath(runtime.nodePath) !== runtime.nodePath
+        || createHash('sha256').update(await readFile(runtime.nodePath)).digest('hex') !== runtime.nodeSha256)
+        throw new Error('native runtime Node mismatch');
+    if (await realpath(runtime.modulesPath) !== runtime.modulesPath || !(await lstat(runtime.modulesPath)).isDirectory())
+        throw new Error('native runtime modules mismatch');
+    const packages = { typescript: 'typescript', cordis: '@deepseek-ai/cordis', tools: '@deepseek-ai/dsh-tools', systemPrompt: '@deepseek-ai/dsh-system-prompt' };
+    for (const [name, packageName] of Object.entries(packages)) {
+        const file = join(runtime.modulesPath, packageName, 'package.json');
+        if (!within(await realpath(file), runtime.roots.find(root => within(runtime.modulesPath, root.path)).path))
+            throw new Error('native runtime package escaped root');
+        const manifest = JSON.parse(await readFile(file, 'utf8'));
+        if (manifest.version !== runtime.versions[name])
+            throw new Error('native runtime package version mismatch');
+    }
+    const observedNode = await execFileAsync(runtime.nodePath, ['--version'], {
+        timeout: 5_000, maxBuffer: 1024, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' }, windowsHide: true,
+    });
+    if (observedNode.stdout.trim() !== runtime.versions.node)
+        throw new Error('native Node version mismatch');
+    return runtime;
+}
+//# sourceMappingURL=native-runtime.js.map

package/lib/native-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-runtime.js","sourceRoot":"","sources":["../src/native-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAYrC,MAAM,GAAG,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC1G,MAAM,SAAS,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK;OAC5H,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC5E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;AACpG,MAAM,WAAW,GAAG,OAAO,CAAA;AAC3B,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AACxC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC,mFAAmF;AACnF,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1G,MAAM,OAAO,GAAG,KAAyB,CAAA;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,uEAAuE;WAC7G,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;WAC5G,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;WAC5F,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;WAClH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,2CAA2C;WAC3F,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;WAC1H,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,qBAAqB;eAC3F,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC;eAC7F,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;WACvE,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM;WAC3E,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC;WAClG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IACnH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;AACtJ,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY;IACzD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAC1G,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAC3E,IAAI,OAAO,GAAG,CAAC,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,CAAA;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QAClD,IAAI,EAAE,OAAO,GAAG,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAC1E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QAC3F,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;YAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;QACjG,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;YAC/E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;YACpE,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QAClF,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;YAC/E,KAAK,IAAI,IAAI,CAAC,IAAI,CAAA;YAClB,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;YACnE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;YACjC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAA;YAC9E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;QACtG,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IACjE,CAAC,CAAA;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IACjB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAuB;IAC5D,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3E,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAuB;IAClE,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;IAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACnF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACzF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;eACvG,MAAM,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;WAC1E,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ;WACrD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACxJ,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACxK,MAAM,QAAQ,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE,YAAY,EAAE,gCAAgC,EAAE,CAAA;IAC7J,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAA;QACnE,IAAI,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAE,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACnK,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAyB,CAAA;QACjF,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,IAA6B,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IACtI,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;QACxE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI;KAC3G,CAAC,CAAA;IACF,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACzG,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/lib/native-verifier-runner.d.ts

@@ -0,0 +1,23 @@
+import { type NativeMacRuntime } from './native-runtime.js';
+import type { IsolationFile, IsolationResult } from './types.js';
+export interface NativeMacVerifierRunnerConfig {
+    backend: 'macos-seatbelt';
+    stateRoot: string;
+    authorityDigest: string;
+    runtime: NativeMacRuntime;
+    source: string;
+    expiresAt: number;
+    maxRuns: number;
+    maxTotalDurationMs: number;
+    maxDurationMs: number;
+    maxOutputBytes: number;
+}
+/** Trusted Host-side finite verifier; no model or candidate receives its ledger. */
+export declare class NativeMacVerifierRunner {
+    #private;
+    constructor(input: NativeMacVerifierRunnerConfig);
+    run: (key: string, files: IsolationFile[], stdin: string, signal: AbortSignal) => Promise<IsolationResult>;
+    inspectQuiescence: (key: string) => Promise<"quiescent" | "unknown">;
+    close: () => Promise<void>;
+}
+//# sourceMappingURL=native-verifier-runner.d.ts.map

package/lib/native-verifier-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-verifier-runner.d.ts","sourceRoot":"","sources":["../src/native-verifier-runner.ts"],"names":[],"mappings":"AAOA,OAAO,EAA4E,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAErI,OAAO,KAAK,EAAE,aAAa,EAAgB,eAAe,EAAE,MAAM,YAAY,CAAA;AAE9E,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,gBAAgB,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,gBAAgB,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,kBAAkB,EAAE,MAAM,CAAA;IAC1B,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB;AAmGD,oFAAoF;AACpF,qBAAa,uBAAuB;;gBAUtB,KAAK,EAAE,6BAA6B;IAsEhD,GAAG,GAAU,KAAK,MAAM,EAAE,OAAO,aAAa,EAAE,EAAE,OAAO,MAAM,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,eAAe,CAAC,CA4B9G;IAoED,iBAAiB,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAKxE;IACD,KAAK,QAAa,OAAO,CAAC,IAAI,CAAC,CAQ9B;CACF"}

package/lib/native-verifier-runner.js

@@ -0,0 +1,379 @@
+import { fork } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { chmodSync, closeSync, constants, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, writeSync } from 'node:fs';
+import { lstat, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { IsolationLedger } from './ledger.js';
+import { validateNativeMacRuntime, verifyNativeMacRuntime, nativeMacRuntimeDigest } from './native-runtime.js';
+import { observeStorage } from './storage.js';
+const SHA = /^[0-9a-f]{64}$/u;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
+const MAX_INPUT = 1_048_576;
+const MAX_FILES = 128;
+const MAX_STATE_BYTES = 256 * 1024 * 1024;
+const MAX_RECORDS = 10_000;
+const MARKER = 'native-backend';
+const supervisor = fileURLToPath(new URL('../runtime/native-macos-supervisor.mjs', import.meta.url));
+const unknown = (jobId, reason) => ({ jobId, status: 'unknown', quiescent: false, stdout: '', stderr: '', artifacts: [], reason });
+function validateConfig(input) {
+    if (!input || Object.keys(input).sort().join() !== 'authorityDigest,backend,expiresAt,maxDurationMs,maxOutputBytes,maxRuns,maxTotalDurationMs,runtime,source,stateRoot'
+        || input.backend !== 'macos-seatbelt' || typeof input.stateRoot !== 'string' || !isAbsolute(input.stateRoot)
+        || resolve(input.stateRoot) !== input.stateRoot || input.stateRoot.includes('\0') || input.stateRoot.includes('\n')
+        || !SHA.test(input.authorityDigest) || typeof input.source !== 'string' || input.source.length === 0
+        || input.source.includes('\0') || Buffer.byteLength(input.source) > 65_536
+        || !Number.isSafeInteger(input.expiresAt) || input.expiresAt < 1
+        || !Number.isSafeInteger(input.maxRuns) || input.maxRuns < 1 || input.maxRuns > 10_000
+        || !Number.isSafeInteger(input.maxTotalDurationMs) || input.maxTotalDurationMs < 1 || input.maxTotalDurationMs > 86_400_000
+        || !Number.isSafeInteger(input.maxDurationMs) || input.maxDurationMs < 1 || input.maxDurationMs > 300_000
+        || input.maxDurationMs > input.maxTotalDurationMs || !Number.isSafeInteger(input.maxOutputBytes)
+        || input.maxOutputBytes < 1 || input.maxOutputBytes > 1_048_576)
+        throw new Error('invalid native verifier authority');
+    return Object.freeze({ ...input, runtime: validateNativeMacRuntime(input.runtime) });
+}
+function bindStateRoot(root) {
+    const existed = existsSync(root);
+    if (!existed)
+        mkdirSync(root, { recursive: true, mode: 0o700 });
+    const info = lstatSync(root);
+    if (!info.isDirectory() || info.isSymbolicLink() || realpathSync(root) !== root || info.uid !== process.getuid?.()
+        || (info.mode & 0o077) !== 0)
+        throw new Error('native verifier requires canonical private state root');
+    if (existsSync(join(root, 'docker-socket-path')))
+        throw new Error('native state root contains Docker binding');
+    const marker = join(root, MARKER);
+    const ledger = join(root, 'ledger.sqlite');
+    if (existsSync(marker)) {
+        const entry = lstatSync(marker);
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1 || entry.uid !== process.getuid?.()
+            || (entry.mode & 0o077) !== 0 || entry.size > 64 || readFileSync(marker, 'utf8') !== 'macos-seatbelt-v1\n' || !existsSync(ledger))
+            throw new Error('invalid native state binding');
+        const database = lstatSync(ledger);
+        if (!database.isFile() || database.isSymbolicLink() || database.nlink !== 1 || database.uid !== process.getuid?.()
+            || (database.mode & 0o077) !== 0)
+            throw new Error('invalid native ledger');
+    }
+    else {
+        if (existsSync(ledger))
+            throw new Error('unbound existing ledger');
+        const fd = openSync(marker, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try {
+            writeSync(fd, Buffer.from('macos-seatbelt-v1\n'));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        const dir = openSync(root, constants.O_RDONLY);
+        try {
+            fsyncSync(dir);
+        }
+        finally {
+            closeSync(dir);
+        }
+    }
+    chmodSync(root, 0o700);
+}
+function normalizeFiles(files) {
+    if (!Array.isArray(files) || files.length > MAX_FILES)
+        throw new Error('invalid native files');
+    const output = files.map(file => {
+        if (!file || Object.keys(file).sort().join() !== 'content,path' || typeof file.content !== 'string'
+            || typeof file.path !== 'string' || file.path.length < 1 || file.path.length > 4096
+            || file.path.startsWith('/') || file.path.includes('\\') || /[\p{Cc}]/u.test(file.path)
+            || file.path.split('/').some(part => part === '' || part === '.' || part === '..'))
+            throw new Error('invalid native file');
+        return { path: file.path, content: file.content };
+    }).sort((a, b) => a.path.localeCompare(b.path, 'en'));
+    if (output.some((file, i) => i > 0 && (file.path === output[i - 1].path || file.path.startsWith(output[i - 1].path + '/'))))
+        throw new Error('native file collision');
+    return output;
+}
+async function stage(root, jobId, files) {
+    if (!UUID.test(jobId))
+        throw new Error('invalid native job id');
+    const parent = join(root, 'workspaces');
+    await mkdir(parent, { recursive: true, mode: 0o700 });
+    const workspace = join(parent, jobId);
+    await mkdir(workspace, { mode: 0o700 });
+    for (const file of files) {
+        const target = join(workspace, file.path);
+        let current = dirname(target);
+        const stack = [];
+        while (current !== workspace) {
+            stack.unshift(current);
+            current = dirname(current);
+        }
+        for (const dir of stack) {
+            await mkdir(dir, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+                throw error; });
+            const info = await lstat(dir);
+            if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== process.getuid?.())
+                throw new Error('unsafe native workspace directory');
+        }
+        await writeFile(target, file.content, { flag: 'wx', mode: 0o600 });
+    }
+    return workspace;
+}
+/** Trusted Host-side finite verifier; no model or candidate receives its ledger. */
+export class NativeMacVerifierRunner {
+    #input;
+    #ledger;
+    #controller;
+    #ready;
+    #abort = new AbortController();
+    #pending = new Map();
+    #timer;
+    #active = true;
+    #closePromise;
+    constructor(input) {
+        this.#input = validateConfig(input);
+        if (process.platform !== 'darwin' || process.getuid?.() === 0)
+            throw new Error('native verifier requires non-root macOS');
+        if (this.#input.runtime.roots.some(root => this.#input.stateRoot === root.path || this.#input.stateRoot.startsWith(root.path + sep)
+            || root.path.startsWith(this.#input.stateRoot + sep)))
+            throw new Error('native state overlaps runtime');
+        bindStateRoot(this.#input.stateRoot);
+        this.#ledger = new IsolationLedger(join(this.#input.stateRoot, 'ledger.sqlite'));
+        try {
+            this.#controller = this.#ledger.claimController(randomUUID(), 30_000);
+            this.#ledger.syncGrants([{ id: 'verification', revision: 1, principalDigest: this.#input.authorityDigest,
+                    principalRecordId: `verification:${this.#input.authorityDigest}`, principalVersion: 1,
+                    workspace: this.#input.stateRoot, agentPreset: 'verification', expiresAt: this.#input.expiresAt,
+                    maxRuns: this.#input.maxRuns, maxTotalDurationMs: this.#input.maxTotalDurationMs }], this.#controller);
+        }
+        catch (error) {
+            this.#ledger.close();
+            throw error;
+        }
+        this.#timer = setInterval(() => {
+            try {
+                if (this.#ledger.renewController(this.#controller, 30_000))
+                    return;
+            }
+            catch { }
+            this.#active = false;
+            this.#abort.abort();
+        }, 5_000);
+        this.#timer.unref();
+        this.#ready = this.#recover();
+        void this.#ready.catch(() => { this.#active = false; this.#abort.abort(); });
+    }
+    async #receipt(job) {
+        if (job.backend !== 'macos-seatbelt' || !job.dispatchAttempted || !job.nativeNonce || !job.nativeResourceId)
+            return undefined;
+        const path = join(this.#input.stateRoot, 'receipts', `${job.id}.json`);
+        try {
+            const info = await lstat(path);
+            if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.uid !== process.getuid?.()
+                || (info.mode & 0o077) !== 0 || info.size > 2_000_000)
+                return undefined;
+            const receipt = JSON.parse(await readFile(path, 'utf8'));
+            if (receipt.schemaVersion !== 1 || receipt.backend !== 'macos-seatbelt' || receipt.jobId !== job.id
+                || receipt.requestDigest !== job.requestDigest || receipt.nonce !== job.nativeNonce
+                || receipt.nativeResourceId !== job.nativeResourceId || receipt.closed !== true
+                || !Number.isSafeInteger(receipt.closedAt) || receipt.closedAt < job.createdAt
+                || !receipt.result || receipt.result.quiescent !== true
+                || !['succeeded', 'failed', 'cancelled', 'timed-out', 'output-limit'].includes(receipt.result.status)
+                || typeof receipt.result.stdout !== 'string' || typeof receipt.result.stderr !== 'string'
+                || Buffer.byteLength(receipt.result.stdout) + Buffer.byteLength(receipt.result.stderr) > this.#input.maxOutputBytes)
+                return undefined;
+            return { jobId: job.id, status: receipt.result.status === 'output-limit' ? 'failed' : receipt.result.status,
+                quiescent: true, stdout: receipt.result.stdout, stderr: receipt.result.stderr, artifacts: [],
+                ...(receipt.result.exitCode === undefined ? {} : { exitCode: receipt.result.exitCode }),
+                ...(receipt.result.status === 'output-limit' ? { reason: 'output-limit' }
+                    : receipt.result.reason === undefined ? {} : { reason: receipt.result.reason }) };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async #settleReceipt(job) {
+        const result = await this.#receipt(job);
+        if (!result)
+            return undefined;
+        if (job.result?.quiescent)
+            return job.result;
+        const settled = this.#ledger.settleNativeReceipt(job.id, job.version, { requestDigest: job.requestDigest,
+            nonce: job.nativeNonce, nativeResourceId: job.nativeResourceId }, result, this.#controller);
+        return settled.result;
+    }
+    async #recover() {
+        let cursor = '';
+        for (;;) {
+            const jobs = this.#ledger.recoverable(cursor);
+            if (jobs.length === 0)
+                return;
+            cursor = jobs.at(-1).id;
+            for (const job of jobs) {
+                if (job.backend !== 'macos-seatbelt')
+                    throw new Error('mixed native state root');
+                if (await this.#settleReceipt(job))
+                    continue;
+                if (job.status === 'prepared' || job.status === 'running') {
+                    const result = job.dispatchAttempted ? unknown(job.id, 'native-recovery-no-receipt')
+                        : { jobId: job.id, status: 'failed', quiescent: true, stdout: '', stderr: '', artifacts: [], reason: 'native-recovery-before-dispatch' };
+                    this.#ledger.settle(job.id, job.version, result, this.#controller);
+                }
+            }
+        }
+    }
+    run = async (key, files, stdin, signal) => {
+        await this.#ready;
+        if (!this.#active || signal?.aborted || typeof signal?.addEventListener !== 'function')
+            throw new Error('native verifier unavailable');
+        if (typeof key !== 'string' || key.length < 1 || key.length > 256 || /[\p{Cc}]/u.test(key)
+            || typeof stdin !== 'string')
+            throw new Error('invalid native verifier input');
+        const staged = normalizeFiles(files);
+        const bytes = Buffer.byteLength(stdin) + Buffer.byteLength(this.#input.source)
+            + staged.reduce((sum, file) => sum + Buffer.byteLength(file.path) + Buffer.byteLength(file.content), 0);
+        if (bytes > MAX_INPUT)
+            throw new Error('native verifier input limit');
+        const digest = createHash('sha256').update(JSON.stringify({ backend: 'macos-seatbelt', source: this.#input.source,
+            runtime: nativeMacRuntimeDigest(this.#input.runtime), authority: this.#input.authorityDigest, files: staged, stdin })).digest('hex');
+        const observation = await observeStorage(this.#input.stateRoot);
+        if (!observation || !this.#active || signal.aborted)
+            throw new Error('native verifier storage or authority unavailable');
+        const { job, created } = this.#ledger.prepare({ backend: 'macos-seatbelt', identity: { principalDigest: this.#input.authorityDigest,
+                principalRecordId: `verification:${this.#input.authorityDigest}`, principalVersion: 1, workspace: this.#input.stateRoot,
+                agentPreset: 'verification' }, sessionId: `authority:${this.#input.authorityDigest}`, grantId: 'verification',
+            idempotencyKey: key, requestDigest: digest, durationMs: this.#input.maxDurationMs,
+            maxActiveJobs: 2, authority: this.#controller, storageBudget: { maxStateBytes: MAX_STATE_BYTES,
+                maxJobRecords: MAX_RECORDS, reservedBytes: 2 * 1024 * 1024 + 6 * this.#input.maxOutputBytes + MAX_INPUT, observation } });
+        if (!created) {
+            const pending = this.#pending.get(job.id);
+            if (pending)
+                return await pending;
+            const received = await this.#settleReceipt(job).catch(() => undefined);
+            return received ?? job.result ?? unknown(job.id, 'native-in-progress-no-replay');
+        }
+        const pending = this.#execute(job, staged, stdin, AbortSignal.any([signal, this.#abort.signal]));
+        this.#pending.set(job.id, pending);
+        try {
+            return await pending;
+        }
+        finally {
+            this.#pending.delete(job.id);
+        }
+    };
+    async #execute(initial, files, stdin, signal) {
+        let job = initial;
+        let dispatched = false;
+        const current = () => this.#active && !signal.aborted && this.#ledger.hasController(this.#controller) && this.#ledger.usable(job.id);
+        try {
+            const workspacePath = await stage(this.#input.stateRoot, job.id, files);
+            await verifyNativeMacRuntime(this.#input.runtime);
+            if (!current())
+                throw new Error('native authority changed');
+            job = this.#ledger.markDispatched(job.id, job.version, this.#controller);
+            dispatched = true;
+            const receipts = join(this.#input.stateRoot, 'receipts');
+            await mkdir(receipts, { recursive: true, mode: 0o700 });
+            const receiptInfo = await lstat(receipts);
+            if (!receiptInfo.isDirectory() || receiptInfo.isSymbolicLink() || receiptInfo.uid !== process.getuid?.()
+                || (receiptInfo.mode & 0o077) !== 0)
+                throw new Error('invalid native receipt directory');
+            if (!current())
+                throw new Error('native authority changed before start');
+            const child = fork(supervisor, [], { execPath: this.#input.runtime.nodePath, execArgv: [], detached: true,
+                cwd: this.#input.stateRoot, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: this.#input.stateRoot, TMPDIR: this.#input.stateRoot },
+                stdio: ['ignore', 'ignore', 'ignore', 'ipc'] });
+            try {
+                job = this.#ledger.start(job.id, job.version, this.#controller);
+            }
+            catch (error) {
+                child.disconnect();
+                child.unref();
+                throw error;
+            }
+            const outcome = await this.#waitSupervisor(child, job, workspacePath, receipts, stdin, signal);
+            const receipt = await this.#settleReceipt(job);
+            if (receipt) {
+                await rm(workspacePath, { recursive: true, force: true }).catch(() => { });
+                return receipt;
+            }
+            if (outcome === 'unconfirmed')
+                throw new Error('native close unconfirmed');
+            throw new Error('native receipt unavailable');
+        }
+        catch {
+            const result = dispatched ? unknown(job.id, 'native-dispatch-unconfirmed')
+                : { jobId: job.id, status: 'failed', quiescent: true, stdout: '', stderr: '', artifacts: [], reason: 'native-preparation-failed' };
+            try {
+                this.#ledger.settle(job.id, job.version, result, this.#controller);
+            }
+            catch { /* A recovered receipt may have won the CAS. */ }
+            if (!dispatched)
+                await rm(join(this.#input.stateRoot, 'workspaces', job.id), { recursive: true, force: true }).catch(() => { });
+            return result;
+        }
+    }
+    async #waitSupervisor(child, job, workspacePath, receipts, stdin, signal) {
+        return await new Promise(resolveOutcome => {
+            let done = false;
+            const finish = (value) => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(grace);
+                signal.removeEventListener('abort', cancel);
+                child.removeAllListeners('message');
+                child.removeAllListeners('exit');
+                child.removeAllListeners('error');
+                if (child.connected)
+                    child.disconnect();
+                child.unref();
+                resolveOutcome(value);
+            };
+            const cancel = () => { if (child.connected)
+                child.send({ kind: 'cancel' }); };
+            // The candidate's own deadline timer determines timed-out versus cancelled.
+            // A Host cancel at that same instant races its timer and misclassifies the receipt.
+            const grace = setTimeout(() => finish('unconfirmed'), Math.max(1, job.deadline - Date.now()) + 8_000);
+            signal.addEventListener('abort', cancel, { once: true });
+            child.on('message', message => {
+                if (message && typeof message === 'object' && 'kind' in message && message.kind === 'receipt')
+                    finish('receipt');
+                else if (message && typeof message === 'object' && 'kind' in message && message.kind === 'unconfirmed')
+                    finish('unconfirmed');
+            });
+            child.on('exit', () => finish('unconfirmed'));
+            child.on('error', () => finish('unconfirmed'));
+            if (signal.aborted)
+                cancel();
+            child.send({ kind: 'start', jobId: job.id, requestDigest: job.requestDigest, nonce: job.nativeNonce,
+                nativeResourceId: job.nativeResourceId, receiptRoot: receipts, input: { workspacePath, nodePath: this.#input.runtime.nodePath,
+                    nodeSha256: this.#input.runtime.nodeSha256, runtimeReadRoots: this.#input.runtime.roots.map(root => ({ path: root.path, dev: root.dev, ino: root.ino })),
+                    sourceType: 'module', source: this.#input.source, stdin, deadline: job.deadline, maxOutputBytes: this.#input.maxOutputBytes } }, error => {
+                if (error)
+                    finish('unconfirmed');
+            });
+        });
+    }
+    inspectQuiescence = async (key) => {
+        await this.#ready;
+        const job = this.#ledger.findNativeVerifierJob(this.#input.authorityDigest, this.#input.stateRoot, key);
+        if (!job)
+            return 'unknown';
+        return await this.#receipt(job) ? 'quiescent' : 'unknown';
+    };
+    close = async () => {
+        if (this.#closePromise)
+            return await this.#closePromise;
+        this.#closePromise = (async () => {
+            this.#active = false;
+            this.#abort.abort();
+            clearInterval(this.#timer);
+            await Promise.allSettled([this.#ready, ...this.#pending.values()]);
+            try {
+                this.#ledger.releaseController(this.#controller);
+            }
+            finally {
+                this.#ledger.close();
+            }
+        })();
+        return await this.#closePromise;
+    };
+}
+//# sourceMappingURL=native-verifier-runner.js.map

package/lib/native-verifier-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-verifier-runner.js","sourceRoot":"","sources":["../src/native-verifier-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAqB,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACvJ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAqC,MAAM,aAAa,CAAA;AAChF,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,sBAAsB,EAAyB,MAAM,qBAAqB,CAAA;AACrI,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAgB7C,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,IAAI,GAAG,iEAAiE,CAAA;AAC9E,MAAM,SAAS,GAAG,SAAS,CAAA;AAC3B,MAAM,SAAS,GAAG,GAAG,CAAA;AACrB,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAA;AACzC,MAAM,WAAW,GAAG,MAAM,CAAA;AAC1B,MAAM,MAAM,GAAG,gBAAgB,CAAA;AAC/B,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,wCAAwC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACpG,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,MAAc,EAAmB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AAEnK,SAAS,cAAc,CAAC,KAAoC;IAC1D,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,oHAAoH;WAClK,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;WACzG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;WAChH,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;WACjG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM;WACvE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC;WAC7D,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,MAAM;WACnF,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,UAAU;WACxH,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,OAAO;WACtG,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,kBAAkB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC;WAC7F,KAAK,CAAC,cAAc,GAAG,CAAC,IAAI,KAAK,CAAC,cAAc,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACvH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO;QAAE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;WAC7G,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IACxG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9G,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;IAC1C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;eACjG,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,qBAAqB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACpL,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;eAC7G,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC9E,CAAC;SAAM,CAAC;QACN,IAAI,UAAU,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QAClE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QACpH,IAAI,CAAC;YAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;QAClG,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC9C,IAAI,CAAC;YAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAAC,CAAC;IACnD,CAAC;IACD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IAC9F,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC9B,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,cAAc,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;eAC9F,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI;eAChF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;eACpF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QAC5H,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IACnD,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACrD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IACvK,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,KAAa,EAAE,KAAsB;IACtE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IACvC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACrC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7B,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,OAAO,OAAO,KAAK,SAAS,EAAE,CAAC;YAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QAAC,CAAC;QACpF,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;YACzH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QAC3I,CAAC;QACD,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACpE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAcD,oFAAoF;AACpF,MAAM,OAAO,uBAAuB;IACzB,MAAM,CAA+B;IACrC,OAAO,CAAiB;IACxB,WAAW,CAA8B;IACzC,MAAM,CAAe;IACrB,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IAC9B,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAA;IACtD,MAAM,CAAgB;IAC/B,OAAO,GAAG,IAAI,CAAA;IACd,aAAa,CAA2B;IACxC,YAAY,KAAoC;QAC9C,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACzH,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;eAC9H,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACzG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAA;QAChF,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;YACrE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;oBACtG,iBAAiB,EAAE,gBAAgB,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,gBAAgB,EAAE,CAAC;oBACrF,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC/F,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QAC1G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,KAAK,CAAA;QAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC;gBAAC,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;oBAAE,OAAM;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACnF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC3C,CAAC,EAAE,KAAK,CAAC,CAAA;QACT,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC7B,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,GAAiB;QAC9B,IAAI,GAAG,CAAC,OAAO,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,gBAAgB;YAAE,OAAO,SAAS,CAAA;QAC7H,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;QACtE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;mBAC7F,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkB,CAAA;YACzE,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,gBAAgB,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,EAAE;mBAC9F,OAAO,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,WAAW;mBAChF,OAAO,CAAC,gBAAgB,KAAK,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;mBAC5E,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,SAAS;mBAC3E,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI;mBACpD,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;mBAClG,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;mBACtF,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc;gBAAE,OAAO,SAAS,CAAA;YACvI,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAmC;gBACtI,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE;gBAC5F,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACvF,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE;oBACvE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAA;QACvF,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,GAAiB;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAC7B,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS;YAAE,OAAO,GAAG,CAAC,MAAM,CAAA;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa;YACtG,KAAK,EAAE,GAAG,CAAC,WAAY,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QAC/F,OAAO,OAAO,CAAC,MAAM,CAAA;IACvB,CAAC;IACD,KAAK,CAAC,QAAQ;QACZ,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YAC7B,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;YACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,OAAO,KAAK,gBAAgB;oBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;gBAChF,IAAI,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;oBAAE,SAAQ;gBAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1D,MAAM,MAAM,GAAoB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,4BAA4B,CAAC;wBACnG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;oBAC1I,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,GAAG,GAAG,KAAK,EAAE,GAAW,EAAE,KAAsB,EAAE,KAAa,EAAE,MAAmB,EAA4B,EAAE;QAChH,MAAM,IAAI,CAAC,MAAM,CAAA;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,IAAI,OAAO,MAAM,EAAE,gBAAgB,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;QACtI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;eACrF,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAChF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;cAC1E,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;QACzG,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC/G,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtI,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACxH,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;gBACjI,iBAAiB,EAAE,gBAAgB,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBACvH,WAAW,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc;YAC7G,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACjF,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,eAAe;gBAC5F,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QAC7H,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzC,IAAI,OAAO;gBAAE,OAAO,MAAM,OAAO,CAAA;YACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACtE,OAAO,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAClF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAChG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC;YAAC,OAAO,MAAM,OAAO,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;IACvE,CAAC,CAAA;IACD,KAAK,CAAC,QAAQ,CAAC,OAAqB,EAAE,KAAsB,EAAE,KAAa,EAAE,MAAmB;QAC9F,IAAI,GAAG,GAAG,OAAO,CAAA;QACjB,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpI,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YACvE,MAAM,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACjD,IAAI,CAAC,OAAO,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;YAC3D,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;YACxE,UAAU,GAAG,IAAI,CAAA;YACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;YACxD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACvD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;YACzC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;mBACnG,CAAC,WAAW,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;YAC1F,IAAI,CAAC,OAAO,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;YACxE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI;gBACvG,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC9I,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;YACjD,IAAI,CAAC;gBAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;YAAC,CAAC;YACvE,OAAO,KAAK,EAAE,CAAC;gBAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAA;YAAC,CAAC;YAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;YAC9F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;YAC9C,IAAI,OAAO,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAAC,OAAO,OAAO,CAAA;YAAC,CAAC;YAC1G,IAAI,OAAO,KAAK,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;YAC1E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAoB,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,6BAA6B,CAAC;gBACzF,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAA;YACpI,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,+CAA+C,CAAC,CAAC;YACpI,IAAI,CAAC,UAAU;gBAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAC9H,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,KAAmB,EAAE,GAAiB,EAAE,aAAqB,EAAE,QAAgB,EAAE,KAAa,EAAE,MAAmB;QACvI,OAAO,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE;YACxC,IAAI,IAAI,GAAG,KAAK,CAAA;YAChB,MAAM,MAAM,GAAG,CAAC,KAAgC,EAAE,EAAE;gBAClD,IAAI,IAAI;oBAAE,OAAM;gBAChB,IAAI,GAAG,IAAI,CAAA;gBACX,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC3C,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;gBACxG,IAAI,KAAK,CAAC,SAAS;oBAAE,KAAK,CAAC,UAAU,EAAE,CAAA;gBACvC,KAAK,CAAC,KAAK,EAAE,CAAA;gBACb,cAAc,CAAC,KAAK,CAAC,CAAA;YACvB,CAAC,CAAA;YACD,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA,CAAC,CAAC,CAAA;YAC5E,4EAA4E;YAC5E,oFAAoF;YACpF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,CAAA;YACrG,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACxD,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE;gBAC5B,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;oBAAE,MAAM,CAAC,SAAS,CAAC,CAAA;qBAC3G,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa;oBAAE,MAAM,CAAC,aAAa,CAAC,CAAA;YAC/H,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;YAC7C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;YAC9C,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,EAAE,CAAA;YAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW;gBACjG,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;oBAC3H,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBACxJ,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE;gBAC3I,IAAI,KAAK;oBAAE,MAAM,CAAC,aAAa,CAAC,CAAA;YAClC,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,iBAAiB,GAAG,KAAK,EAAE,GAAW,EAAoC,EAAE;QAC1E,MAAM,IAAI,CAAC,MAAM,CAAA;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACvG,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAA;QAC1B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3D,CAAC,CAAA;IACD,KAAK,GAAG,KAAK,IAAmB,EAAE;QAChC,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,MAAM,IAAI,CAAC,aAAa,CAAA;QACvD,IAAI,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YAClE,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAAC,CAAC;oBAAS,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;QAC3F,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,MAAM,IAAI,CAAC,aAAa,CAAA;IACjC,CAAC,CAAA;CACF"}

package/lib/probe.d.ts

@@ -1,5 +1,5 @@
 /** Operator-only readiness probe using the same supervisor and work-volume path as jobs. */
-export declare function probeIsolationRuntime(image: string, dockerPath?: string): Promise<{
+export declare function probeIsolationRuntime(image: string, dockerPath?: string, socketPath?: string): Promise<{
     ready: true;
 }>;
 //# sourceMappingURL=probe.d.ts.map

package/lib/probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../src/probe.ts"],"names":[],"mappings":"AAQA,4FAA4F;AAC5F,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,SAAoB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,CAAC,CA0BnH"}
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../src/probe.ts"],"names":[],"mappings":"AASA,4FAA4F;AAC5F,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,SAA8E,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,CAAC,CA2BlM"}