@dsh-enhanced/assistant-isolation 0.1.66 → 0.1.68

package/lib/runner.js

@@ -1,227 +0,0 @@
-import { fork } from 'node:child_process';
-import { cleanupIsolationResources } from './cleanup-receipt.js';
-import { captureSystemdBinding } from './daemon-binding.js';
-import { captureDaemonWitness, processWitness, sameDaemonWitness } from './runtime-witness.js';
-import { configuredDockerSocketPath, resolveLocalDockerSocket, sameLocalDockerSocket } from './docker-socket.js';
-const NAME = /^dsh-isolation-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/;
-const IMAGE = /^sha256:[0-9a-f]{64}$/;
-const CLEANUP_GRACE_MS = 45_000;
-function safeEnvironment() {
-    return {
-        PATH: process.env.PATH === undefined || process.env.PATH === '' ? '/usr/bin:/bin' : process.env.PATH,
-        LANG: 'C',
-        LC_ALL: 'C',
-    };
-}
-function failure(reason, quiescent = true) {
-    return { status: quiescent ? 'failed' : 'unknown', quiescent, stdout: '', stderr: '', reason };
-}
-function validLimits(limits) {
-    const maxima = { maxDurationMs: 300_000, maxInputBytes: 1_048_576, maxOutputBytes: 262_144,
-        maxArtifactBytes: 1_048_576, maxFiles: 128, memoryMiB: 4096, pidsLimit: 512, cpus: 8, workspaceMiB: 1024, workspaceInodes: 65_536 };
-    return Object.entries(maxima).every(([key, maximum]) => {
-        const value = limits[key];
-        return Number.isFinite(value) && value > 0 && value <= maximum && (key === 'cpus' ? value >= 0.1 : Number.isSafeInteger(value));
-    });
-}
-function validate(input) {
-    if (!NAME.test(input.containerName))
-        return 'invalid-container-name';
-    if (!IMAGE.test(input.image))
-        return 'image-must-be-a-sha256-digest';
-    if (!input.dockerPath.startsWith('/'))
-        return 'docker-path-must-be-absolute';
-    if (!input.workspacePath.startsWith('/') || /[\p{Cc},]/u.test(input.workspacePath))
-        return 'invalid-workspace-path';
-    if (input.artifacts !== undefined && (!Array.isArray(input.artifacts) || input.artifacts.length > input.limits.maxFiles || !input.artifacts.every(path => typeof path === 'string' && path.length > 0 && path.length <= 4096 && !path.startsWith('/') && !/[\p{Cc}\\]/u.test(path) && path.split('/').every(part => part !== '' && part !== '.' && part !== '..'))))
-        return 'invalid-artifacts';
-    if (typeof input.command !== 'string' || input.command.length === 0)
-        return 'invalid-command';
-    if (!Number.isSafeInteger(input.deadline) || input.deadline <= Date.now())
-        return 'deadline-expired';
-    if (!validLimits(input.limits))
-        return 'invalid-limits';
-    if (!['linux', 'darwin'].includes(process.platform) || typeof process.getuid !== 'function' || process.getuid() === 0)
-        return 'non-root-unix-host-required';
-    try {
-        configuredDockerSocketPath(input.socketPath);
-    }
-    catch {
-        return 'invalid-local-docker-socket';
-    }
-    return undefined;
-}
-function send(child, message) {
-    if (!child.connected)
-        return false;
-    try {
-        return child.send(message);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Starts a one-shot supervisor. The supervisor owns Docker after creation so a
- * Host crash closes IPC and causes container cleanup instead of an orphaned job.
- */
-export async function runIsolatedProcess(input) {
-    const invalid = validate(input);
-    if (invalid !== undefined)
-        return failure(invalid);
-    if (input.signal.aborted)
-        return { status: 'cancelled', quiescent: true, stdout: '', stderr: '', reason: 'aborted-before-create' };
-    let socket;
-    try {
-        socket = resolveLocalDockerSocket(configuredDockerSocketPath(input.socketPath));
-    }
-    catch {
-        return failure('local-docker-socket-unavailable');
-    }
-    const daemonBefore = process.platform === 'linux' ? await captureDaemonWitness({ dockerPath: input.dockerPath, socketPath: socket.path }) : undefined;
-    const bindingBefore = daemonBefore ? await captureSystemdBinding(daemonBefore) : undefined;
-    if (input.signal.aborted)
-        return { status: 'cancelled', quiescent: true, stdout: '', stderr: '', reason: 'aborted-before-create' };
-    if (Date.now() >= input.deadline)
-        return failure('deadline-expired-before-create');
-    const config = {
-        dockerPath: input.dockerPath,
-        socket,
-        containerName: input.containerName,
-        image: input.image,
-        workspacePath: input.workspacePath,
-        artifacts: input.artifacts ?? [],
-        command: input.command,
-        deadline: input.deadline,
-        limits: input.limits,
-    };
-    const supervisor = fork(new URL('../runtime/supervisor.mjs', import.meta.url), [], {
-        detached: true,
-        execArgv: [],
-        env: safeEnvironment(),
-        serialization: 'json',
-        stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
-    });
-    // The supervisor uses IPC for control. Drain diagnostics so an unexpected
-    // Node warning cannot block its pipe, but do not mix it with worker output.
-    supervisor.stdout?.resume();
-    supervisor.stderr?.resume();
-    let supervisorWitness;
-    return await new Promise((resolve) => {
-        let settled = false;
-        let ready = false;
-        let finalReceipt = false;
-        let cancelSent = false;
-        let grace;
-        let deadlineTimer;
-        const settle = (result) => {
-            if (settled)
-                return;
-            settled = true;
-            if (grace !== undefined)
-                clearTimeout(grace);
-            if (deadlineTimer !== undefined)
-                clearTimeout(deadlineTimer);
-            input.signal.removeEventListener('abort', abort);
-            supervisor.removeAllListeners('message');
-            supervisor.removeAllListeners('error');
-            supervisor.removeAllListeners('exit');
-            if (supervisor.connected)
-                supervisor.disconnect();
-            resolve(result);
-        };
-        const cancel = (reason) => {
-            if (cancelSent)
-                return;
-            cancelSent = true;
-            send(supervisor, { type: 'cancel', reason });
-            grace = setTimeout(() => settle({ status: 'unknown', quiescent: false, stdout: '', stderr: '', reason: 'supervisor-cleanup-unconfirmed' }), CLEANUP_GRACE_MS);
-            grace.unref();
-        };
-        const abort = () => cancel('aborted');
-        deadlineTimer = setTimeout(() => cancel('deadline-expired'), Math.max(1, input.deadline - Date.now()));
-        deadlineTimer.unref();
-        input.signal.addEventListener('abort', abort, { once: true });
-        supervisor.once('error', (error) => settle(failure(`supervisor-spawn-failed:${error.message}`, false)));
-        supervisor.once('exit', (code, signal) => {
-            if (!settled && !finalReceipt)
-                settle({ status: 'unknown', quiescent: false, stdout: '', stderr: '', reason: `supervisor-exited:${code ?? signal ?? 'unknown'}` });
-        });
-        supervisor.on('message', async (message) => {
-            if (settled)
-                return;
-            if (message?.type === 'error') {
-                settle(failure(message.reason, false));
-                return;
-            }
-            if (message?.type === 'result') {
-                if (finalReceipt)
-                    return;
-                finalReceipt = true;
-                if (!sameLocalDockerSocket(socket)) {
-                    settle({ ...message.result, status: 'unknown', quiescent: false, artifacts: [], reason: 'docker-socket-changed' });
-                    return;
-                }
-                // Only the supervisor's final receipt brackets the create operations.
-                // This is private diagnostic evidence, never by itself a release permit.
-                const daemonAfter = message.result.status === 'unknown' && daemonBefore && supervisorWitness
-                    ? await captureDaemonWitness({ dockerPath: input.dockerPath, socketPath: socket.path }) : undefined;
-                if (daemonBefore && daemonAfter && supervisorWitness && sameDaemonWitness(daemonBefore, daemonAfter)
-                    && supervisorWitness.bootId === daemonBefore.process.bootId) {
-                    const bindingAfter = bindingBefore ? await captureSystemdBinding(daemonAfter) : undefined;
-                    const binding = bindingBefore && bindingAfter && JSON.stringify(bindingBefore) === JSON.stringify(bindingAfter) ? bindingAfter : undefined;
-                    settle({ ...message.result, creationWitness: { daemon: daemonAfter, supervisor: supervisorWitness,
-                            ...(message.settlementProtocol === 'all-cli-closed/v1' && typeof message.requestsSettled === 'boolean' ? { requestsSettled: message.requestsSettled } : {}),
-                            ...(binding ? { binding } : {}) } });
-                }
-                else
-                    settle(message.result);
-                return;
-            }
-            if (message?.type !== 'ready' || ready)
-                return;
-            ready = true;
-            if (input.signal.aborted || Date.now() >= input.deadline) {
-                cancel(input.signal.aborted ? 'aborted' : 'deadline-expired');
-                return;
-            }
-            let allowed = false;
-            try {
-                allowed = await input.authorizeStart();
-            }
-            catch {
-                allowed = false;
-            }
-            if (!allowed || input.signal.aborted || Date.now() >= input.deadline) {
-                cancel(!allowed ? 'authorization-denied' : (input.signal.aborted ? 'aborted' : 'deadline-expired'));
-                return;
-            }
-            if (!send(supervisor, { type: 'start' }))
-                settle({ status: 'unknown', quiescent: false, stdout: '', stderr: '', reason: 'supervisor-ipc-closed-before-start' });
-        });
-        const configure = async () => {
-            supervisorWitness = supervisor.pid === undefined ? undefined : await processWitness(supervisor.pid);
-            if (settled)
-                return;
-            if (cancelSent || input.signal.aborted || Date.now() >= input.deadline) {
-                settle({ status: input.signal.aborted ? 'cancelled' : 'timed-out', quiescent: true, stdout: '', stderr: '', reason: 'cancelled-before-configure' });
-                return;
-            }
-            if (!send(supervisor, { type: 'configure', config }))
-                settle({ status: 'unknown', quiescent: false, stdout: '', stderr: '', reason: 'supervisor-ipc-closed-before-configure' });
-        };
-        void configure();
-    });
-}
-/** Removes only names generated by this plugin; arbitrary Docker names are rejected. */
-export async function removeIsolatedContainer(dockerPath, name, options = {}) {
-    let socket;
-    try {
-        socket = resolveLocalDockerSocket(configuredDockerSocketPath(options.socketPath));
-    }
-    catch {
-        return false;
-    }
-    return await cleanupIsolationResources(dockerPath, name, { ...options, socketPath: socket.path, socket }) !== undefined;
-}
-//# sourceMappingURL=runner.js.map

package/lib/runner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAEzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,EAAuB,MAAM,sBAAsB,CAAA;AACnH,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,qBAAqB,EAAqB,MAAM,oBAAoB,CAAA;AAGnI,MAAM,IAAI,GAAG,6DAA6D,CAAA;AAC1E,MAAM,KAAK,GAAG,uBAAuB,CAAA;AACrC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAmB/B,SAAS,eAAe;IACtB,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI;QACpG,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;KACZ,CAAA;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,SAAS,GAAG,IAAI;IAC/C,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;AAChG,CAAC;AAED,SAAS,WAAW,CAAC,MAAuB;IAC1C,MAAM,MAAM,GAAoB,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO;QACzG,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;IACrI,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,GAA4B,CAAC,CAAA;QAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;IACjI,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAwB;IACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,wBAAwB,CAAA;IACpE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,+BAA+B,CAAA;IACpE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,8BAA8B,CAAA;IAC5E,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,wBAAwB,CAAA;IACnH,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,mBAAmB,CAAA;IAC/X,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAA;IAC7F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,kBAAkB,CAAA;IACpG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,gBAAgB,CAAA;IACvD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,6BAA6B,CAAA;IAC3J,IAAI,CAAC;QAAC,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,6BAA6B,CAAA;IAAC,CAAC;IACnG,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,IAAI,CAAC,KAAmB,EAAE,OAAe;IAChD,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAClC,IAAI,CAAC;QAAC,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAwB;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;IAElI,IAAI,MAAoB,CAAA;IACxB,IAAI,CAAC;QAAC,MAAM,GAAG,wBAAwB,CAAC,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IAAC,CAAC;IACvF,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAAC,CAAC;IAE3D,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACrJ,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1F,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;IAClI,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,gCAAgC,CAAC,CAAA;IAElF,MAAM,MAAM,GAAqB;QAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM;QACN,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE;QACjF,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,eAAe,EAAE;QACtB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;KACzC,CAAC,CAAA;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,CAAA;IAC3B,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,CAAA;IAE3B,IAAI,iBAA6C,CAAA;IACjD,OAAO,MAAM,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,EAAE;QAC3D,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,IAAI,YAAY,GAAG,KAAK,CAAA;QACxB,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,IAAI,KAAiC,CAAA;QACrC,IAAI,aAAyC,CAAA;QAE7C,MAAM,MAAM,GAAG,CAAC,MAA8B,EAAQ,EAAE;YACtD,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC5C,IAAI,aAAa,KAAK,SAAS;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAA;YAC5D,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAChD,UAAU,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;YACxC,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACtC,UAAU,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,UAAU,CAAC,SAAS;gBAAE,UAAU,CAAC,UAAU,EAAE,CAAA;YACjD,OAAO,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAQ,EAAE;YACtC,IAAI,UAAU;gBAAE,OAAM;YACtB,UAAU,GAAG,IAAI,CAAA;YACjB,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAC5C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAA;YAC7J,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAE3C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACtG,aAAa,CAAC,KAAK,EAAE,CAAA;QACrB,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;QACvG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACvC,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY;gBAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,IAAI,IAAI,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC,CAAA;QACpK,CAAC,CAAC,CAAA;QACF,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,OAA0B,EAAE,EAAE;YAC5D,IAAI,OAAO;gBAAE,OAAM;YACnB,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YACjF,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,IAAI,YAAY;oBAAE,OAAM;gBACxB,YAAY,GAAG,IAAI,CAAA;gBACnB,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAA;oBAClH,OAAM;gBACR,CAAC;gBACD,sEAAsE;gBACtE,yEAAyE;gBACzE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,IAAI,iBAAiB;oBAC1F,CAAC,CAAC,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBACrG,IAAI,YAAY,IAAI,WAAW,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,YAAY,EAAE,WAAW,CAAC;uBAC/F,iBAAiB,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBACzF,MAAM,OAAO,GAAG,aAAa,IAAI,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;oBAC1I,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB;4BAC/F,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,mBAAmB,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC3J,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;gBACxC,CAAC;;oBAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBAC7B,OAAM;YACR,CAAC;YACD,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,IAAI,KAAK;gBAAE,OAAM;YAC9C,KAAK,GAAG,IAAI,CAAA;YACZ,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YACnI,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,IAAI,CAAC;gBAAC,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAA;YAAC,CAAC;YACxE,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAA;gBACnG,OAAM;YACR,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAA;QACjK,CAAC,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,KAAK,IAAmB,EAAE;YAC1C,iBAAiB,GAAG,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACnG,IAAI,OAAO;gBAAE,OAAM;YACnB,IAAI,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACvE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAA;gBACnJ,OAAM;YACR,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;gBAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAA;QACjL,CAAC,CAAA;QACD,KAAK,SAAS,EAAE,CAAA;IAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAAkB,EAAE,IAAY,EAAE,UAAyD,EAAE;IACzI,IAAI,MAAoB,CAAA;IACxB,IAAI,CAAC;QAAC,MAAM,GAAG,wBAAwB,CAAC,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAChH,OAAO,MAAM,yBAAyB,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,SAAS,CAAA;AACzH,CAAC"}

package/lib/runtime-witness.d.ts

@@ -1,32 +0,0 @@
-import type { SystemdBinding } from './daemon-binding.js';
-export interface ProcessWitness {
-    bootId: string;
-    pid: number;
-    startTicks: string;
-}
-export interface DaemonWitness {
-    process: ProcessWitness;
-    engineId: string;
-    dockerPath: string;
-    socketPath: string;
-    pidFile: string;
-}
-export interface CreationWitness {
-    daemon: DaemonWitness;
-    supervisor: ProcessWitness;
-    /** Present only after the supervisor has reaped every CLI it started. */
-    requestsSettled?: boolean;
-    binding?: SystemdBinding;
-}
-export declare function validateCreationWitness(value: unknown): CreationWitness;
-export declare function processWitness(pid?: number): Promise<ProcessWitness | undefined>;
-export declare function processExited(witness: ProcessWitness): boolean;
-export declare function captureDaemonWitness({ dockerPath, socketPath, pidFile }: {
-    dockerPath: string;
-    socketPath?: string;
-    pidFile?: string;
-}): Promise<DaemonWitness | undefined>;
-export declare function sameDaemonWitness(a: DaemonWitness, b: DaemonWitness): boolean;
-/** Diagnostic candidate only: does not prove socket ownership or authorize quota release. */
-export declare function eligibleRestartWitness(original: CreationWitness): Promise<DaemonWitness | undefined>;
-//# sourceMappingURL=runtime-witness.d.ts.map

package/lib/runtime-witness.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime-witness.d.ts","sourceRoot":"","sources":["../src/runtime-witness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAOzD,MAAM,WAAW,cAAc;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AACnF,MAAM,WAAW,aAAa;IAAG,OAAO,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACrI,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,aAAa,CAAA;IACrB,UAAU,EAAE,cAAc,CAAA;IAC1B,yEAAyE;IACzE,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,OAAO,CAAC,EAAE,cAAc,CAAA;CACzB;AAeD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAavE;AAoBD,wBAAsB,cAAc,CAAC,GAAG,SAAc,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAG3F;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAmB9D;AAkDD,wBAAsB,oBAAoB,CAAC,EAAE,UAAU,EAAE,UAA8B,EAAE,OAAwB,EAAE,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAYtN;AAQD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAG7E;AAED,6FAA6F;AAC7F,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAO1G"}

package/lib/runtime-witness.js

@@ -1,225 +0,0 @@
-import { spawn } from 'node:child_process';
-import { constants, readFileSync } from 'node:fs';
-import { chmod, lstat, mkdtemp, open, readFile, realpath, rm, stat } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { isAbsolute, join } from 'node:path';
-const bootIdPattern = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/;
-const ticksPattern = /^[1-9][0-9]{0,63}$/;
-const engineIdPattern = /^[A-Za-z0-9:-]{1,256}$/;
-const pathMaximum = 4096;
-const defaultSocketPath = '/var/run/docker.sock';
-const defaultPidFile = '/run/docker.pid';
-const validPath = (value) => typeof value === 'string' && value.length > 0 && value.length <= pathMaximum && isAbsolute(value) && !/[\p{Cc}]/u.test(value);
-const validProcess = (value) => !!value && typeof value === 'object'
-    && Object.keys(value).length === 3 && typeof value.bootId === 'string' && bootIdPattern.test(value.bootId)
-    && Number.isSafeInteger(value.pid) && value.pid > 0
-    && typeof value.startTicks === 'string' && ticksPattern.test(value.startTicks);
-export function validateCreationWitness(value) {
-    if (!value || typeof value !== 'object' || ![2, 3, 4].includes(Object.keys(value).length) || Object.keys(value).some(key => !['daemon', 'supervisor', 'requestsSettled', 'binding'].includes(key)) || !validProcess(value.supervisor))
-        throw new TypeError('invalid creation witness');
-    const daemon = value.daemon;
-    if (!daemon || typeof daemon !== 'object' || Object.keys(daemon).length !== 5 || !validProcess(daemon.process)
-        || typeof daemon.engineId !== 'string' || !engineIdPattern.test(daemon.engineId)
-        || !validPath(daemon.dockerPath) || !validPath(daemon.socketPath) || !validPath(daemon.pidFile))
-        throw new TypeError('invalid creation witness');
-    if (daemon.process.bootId !== value.supervisor.bootId)
-        throw new TypeError('creation witness crosses boot generations');
-    const witness = value;
-    if (witness.requestsSettled !== undefined && typeof witness.requestsSettled !== 'boolean')
-        throw new TypeError('invalid settlement proof');
-    if (witness.binding !== undefined && (!witness.binding || Object.keys(witness.binding).length !== 3 || witness.binding.kind !== 'systemd'
-        || !/^[0-9a-f]{32}$/.test(witness.binding.serviceInvocationId) || !/^[0-9a-f]{32}$/.test(witness.binding.socketInvocationId)))
-        throw new TypeError('invalid daemon binding');
-    return { ...(witness.requestsSettled === undefined ? {} : { requestsSettled: witness.requestsSettled }),
-        ...(witness.binding === undefined ? {} : { binding: { ...witness.binding } }), daemon: { process: { ...daemon.process }, engineId: daemon.engineId, dockerPath: daemon.dockerPath, socketPath: daemon.socketPath, pidFile: daemon.pidFile }, supervisor: { ...value.supervisor } };
-}
-async function bootId() {
-    try {
-        const value = (await readFile('/proc/sys/kernel/random/boot_id', 'utf8')).trim().toLowerCase();
-        return bootIdPattern.test(value) ? value : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function proc(pid) {
-    if (!Number.isSafeInteger(pid) || pid <= 0)
-        return undefined;
-    try {
-        const [currentBootId, raw, metadata] = await Promise.all([bootId(), readFile(`/proc/${pid}/stat`, 'utf8'), stat(`/proc/${pid}`)]);
-        const close = raw.lastIndexOf(') ');
-        const opening = raw.indexOf('(');
-        if (!currentBootId || opening < 0 || close <= opening || !Number.isSafeInteger(metadata.uid))
-            return undefined;
-        const fields = raw.slice(close + 2).trim().split(/\s+/);
-        const startTicks = fields[19];
-        if (!startTicks || !ticksPattern.test(startTicks) || !fields[0])
-            return undefined;
-        return { bootId: currentBootId, pid, startTicks, comm: raw.slice(opening + 1, close), state: fields[0], uid: metadata.uid };
-    }
-    catch {
-        return undefined;
-    }
-}
-export async function processWitness(pid = process.pid) {
-    const value = await proc(pid);
-    return value ? { bootId: value.bootId, pid: value.pid, startTicks: value.startTicks } : undefined;
-}
-export function processExited(witness) {
-    if (!validProcess(witness))
-        return false;
-    let currentBootId;
-    try {
-        currentBootId = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim().toLowerCase();
-    }
-    catch {
-        return false;
-    }
-    if (!bootIdPattern.test(currentBootId))
-        return false;
-    if (currentBootId !== witness.bootId)
-        return true;
-    try {
-        const raw = readFileSync(`/proc/${witness.pid}/stat`, 'utf8');
-        const close = raw.lastIndexOf(') ');
-        if (close < 0)
-            return false;
-        const fields = raw.slice(close + 2).trim().split(/\s+/);
-        // A zombie retains its proc entry; it is not proof that all waiters reaped it.
-        if (fields[0] === 'Z' || !fields[19] || !ticksPattern.test(fields[19]))
-            return false;
-        return fields[19] !== witness.startTicks;
-    }
-    catch (error) {
-        return !!error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT';
-    }
-}
-async function stablePidFile(path) {
-    if (!validPath(path))
-        return undefined;
-    try {
-        const canonical = await realpath(path);
-        if (!isAbsolute(canonical))
-            return undefined;
-        const handle = await open(canonical, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-        try {
-            const before = await handle.stat();
-            if (!before.isFile() || before.nlink !== 1 || (before.mode & 0o022) !== 0 || (before.uid !== 0 && before.uid !== process.getuid?.()) || before.size < 1 || before.size >= 64)
-                return undefined;
-            const bytes = Buffer.alloc(64);
-            const read = await handle.read(bytes, 0, bytes.length, 0);
-            const after = await handle.stat();
-            if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs)
-                return undefined;
-            const text = bytes.subarray(0, read.bytesRead).toString('ascii').trim();
-            if (!/^[1-9][0-9]{0,15}$/.test(text))
-                return undefined;
-            const pid = Number(text);
-            return Number.isSafeInteger(pid) && pid > 0 ? { path: canonical, pid, uid: before.uid, dev: before.dev, ino: before.ino } : undefined;
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    catch {
-        return undefined;
-    }
-}
-async function canonicalSocket(path) {
-    if (!validPath(path))
-        return undefined;
-    try {
-        const canonical = await realpath(path);
-        const info = await lstat(canonical);
-        return isAbsolute(canonical) && info.isSocket() ? { path: canonical, dev: info.dev, ino: info.ino } : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function canonicalExecutable(path) {
-    if (!validPath(path))
-        return undefined;
-    try {
-        const canonical = await realpath(path);
-        const info = await stat(canonical);
-        return isAbsolute(canonical) && info.isFile() && (info.mode & 0o111) !== 0 ? canonical : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function engineId(dockerPath, socketPath) {
-    let directory;
-    try {
-        directory = await mkdtemp(join(tmpdir(), 'dsh-isolation-docker-'));
-        await chmod(directory, 0o700);
-        return await new Promise(resolve => {
-            let output = Buffer.alloc(0);
-            let done = false;
-            const finish = (value) => { if (done)
-                return; done = true; clearTimeout(timer); resolve(value); };
-            const child = spawn(dockerPath, ['--config', directory, '-H', `unix://${socketPath}`, 'info', '--format', '{{.ID}}'], { shell: false, env: { PATH: process.env.PATH || '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' }, stdio: ['ignore', 'pipe', 'ignore'] });
-            const timer = setTimeout(() => { child.kill('SIGKILL'); finish(undefined); }, 5_000);
-            timer.unref();
-            child.stdout.on('data', (chunk) => { if (output.length + chunk.length > 4096) {
-                child.kill('SIGKILL');
-                finish(undefined);
-            }
-            else
-                output = Buffer.concat([output, chunk]); });
-            child.once('error', () => finish(undefined));
-            child.once('close', code => { const value = output.toString('utf8').trim(); finish(code === 0 && engineIdPattern.test(value) ? value : undefined); });
-        });
-    }
-    catch {
-        return undefined;
-    }
-    finally {
-        if (directory !== undefined)
-            await rm(directory, { recursive: true, force: true }).catch(() => undefined);
-    }
-}
-export async function captureDaemonWitness({ dockerPath, socketPath = defaultSocketPath, pidFile = defaultPidFile }) {
-    const [executable, socket, pid] = await Promise.all([canonicalExecutable(dockerPath), canonicalSocket(socketPath), stablePidFile(pidFile)]);
-    if (!executable || !socket || !pid)
-        return undefined;
-    const first = await proc(pid.pid);
-    if (!first || first.comm !== 'dockerd' || first.uid !== pid.uid || first.state === 'Z')
-        return undefined;
-    const id = await engineId(executable, socket.path);
-    const [recheckedPid, recheckedSocket] = await Promise.all([stablePidFile(pidFile), canonicalSocket(socketPath)]);
-    const second = await proc(pid.pid);
-    if (!id || !recheckedPid || !recheckedSocket || recheckedPid.path !== pid.path || recheckedPid.dev !== pid.dev || recheckedPid.ino !== pid.ino || recheckedPid.pid !== pid.pid || recheckedPid.uid !== pid.uid
-        || recheckedSocket.path !== socket.path || recheckedSocket.dev !== socket.dev || recheckedSocket.ino !== socket.ino
-        || !second || second.comm !== 'dockerd' || second.uid !== pid.uid || second.state === 'Z' || first.bootId !== second.bootId || first.startTicks !== second.startTicks)
-        return undefined;
-    return { process: { bootId: second.bootId, pid: second.pid, startTicks: second.startTicks }, engineId: id, dockerPath: executable, socketPath: socket.path, pidFile: pid.path };
-}
-function validDaemon(value) {
-    return !!value && typeof value === 'object' && Object.keys(value).length === 5 && validProcess(value.process)
-        && typeof value.engineId === 'string' && engineIdPattern.test(value.engineId)
-        && validPath(value.dockerPath) && validPath(value.socketPath) && validPath(value.pidFile);
-}
-export function sameDaemonWitness(a, b) {
-    if (!validDaemon(a) || !validDaemon(b))
-        return false;
-    return a.process.bootId === b.process.bootId && a.process.pid === b.process.pid && a.process.startTicks === b.process.startTicks && a.engineId === b.engineId && a.dockerPath === b.dockerPath && a.socketPath === b.socketPath && a.pidFile === b.pidFile;
-}
-/** Diagnostic candidate only: does not prove socket ownership or authorize quota release. */
-export async function eligibleRestartWitness(original) {
-    let value;
-    try {
-        value = validateCreationWitness(original);
-    }
-    catch {
-        return undefined;
-    }
-    if (!processExited(value.supervisor) || !processExited(value.daemon.process))
-        return undefined;
-    const current = await captureDaemonWitness({ dockerPath: value.daemon.dockerPath, socketPath: value.daemon.socketPath, pidFile: value.daemon.pidFile });
-    if (!current || current.engineId !== value.daemon.engineId || current.dockerPath !== value.daemon.dockerPath || current.socketPath !== value.daemon.socketPath || current.pidFile !== value.daemon.pidFile)
-        return undefined;
-    return current.process.bootId === value.daemon.process.bootId && current.process.pid === value.daemon.process.pid && current.process.startTicks === value.daemon.process.startTicks ? undefined : current;
-}
-//# sourceMappingURL=runtime-witness.js.map

package/lib/runtime-witness.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime-witness.js","sourceRoot":"","sources":["../src/runtime-witness.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAY5C,MAAM,aAAa,GAAG,+CAA+C,CAAA;AACrE,MAAM,YAAY,GAAG,oBAAoB,CAAA;AACzC,MAAM,eAAe,GAAG,wBAAwB,CAAA;AAChD,MAAM,WAAW,GAAG,IAAI,CAAA;AACxB,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAChD,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAExC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACpL,MAAM,YAAY,GAAG,CAAC,KAAc,EAA2B,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;OACjG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAQ,KAAwB,CAAC,MAAM,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAE,KAAwB,CAAC,MAAM,CAAC;OAC/I,MAAM,CAAC,aAAa,CAAE,KAAwB,CAAC,GAAG,CAAC,IAAK,KAAwB,CAAC,GAAG,GAAG,CAAC;OACxF,OAAQ,KAAwB,CAAC,UAAU,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAE,KAAwB,CAAC,UAAU,CAAC,CAAA;AAExH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAE,KAAyB,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAA;IAC3S,MAAM,MAAM,GAAI,KAAyB,CAAC,MAAM,CAAA;IAChD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;WACzG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;WAC7E,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAA;IAClJ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAM,KAAyB,CAAC,UAAU,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAA;IAC5I,MAAM,OAAO,GAAG,KAAwB,CAAA;IACxC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAA;IAC1I,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;WACpI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAA;IAC9K,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACrG,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAI,KAAyB,CAAC,UAAU,EAAE,EAAE,CAAA;AAC3S,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,IAAI,CAAC;QAAC,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAAC,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AACzL,CAAC;AAGD,KAAK,UAAU,IAAI,CAAC,GAAW;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5D,IAAI,CAAC;QACH,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;QACjI,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;QAC9G,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACvD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;QAC7B,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACjF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;IAC7H,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7B,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACnG,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,aAAqB,CAAA;IACzB,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC9F,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IACxB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,IAAI,aAAa,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,OAAO,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACvD,+EAA+E;QAC/E,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACpF,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,UAAU,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ,CAAA;IAClH,CAAC;AACH,CAAC;AAGD,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QACtG,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAClC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE;gBAAE,OAAO,SAAS,CAAA;YAC9L,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACzF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YACjC,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAA;YAChL,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;YACvE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAA;YACtD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;YACxB,OAAO,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACvI,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AAC9B,CAAC;AAGD,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,CAAC;QAAC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AACjO,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,CAAC;QAAC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AACnN,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,UAAkB,EAAE,UAAkB;IAC5D,IAAI,SAA6B,CAAA;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACjG,OAAO,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;YACjC,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,IAAI,GAAG,KAAK,CAAA;YAC9C,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAQ,EAAE,GAAG,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAA;YAC1H,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,SAAU,EAAE,IAAI,EAAE,UAAU,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;YACzP,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YAClG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAAC,CAAC;;gBAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAClL,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;YAC5C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACtJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;YAAS,CAAC;QAAC,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;AACpJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,iBAAiB,EAAE,OAAO,GAAG,cAAc,EAAiE;IAChL,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3I,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IACxG,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAChH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe,IAAI,YAAY,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,YAAY,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG;WACzM,eAAe,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;WAChH,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACzL,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;AACjL,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAE,KAAuB,CAAC,OAAO,CAAC;WAC3H,OAAQ,KAAuB,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAE,KAAuB,CAAC,QAAQ,CAAC;WAChH,SAAS,CAAE,KAAuB,CAAC,UAAU,CAAC,IAAI,SAAS,CAAE,KAAuB,CAAC,UAAU,CAAC,IAAI,SAAS,CAAE,KAAuB,CAAC,OAAO,CAAC,CAAA;AACtJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAgB,EAAE,CAAgB;IAClE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAA;AAC5P,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAyB;IACpE,IAAI,KAAsB,CAAA;IAC1B,IAAI,CAAC;QAAC,KAAK,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;IAC5E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9F,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IACvJ,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC5N,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;AAC3M,CAAC"}

package/lib/state-socket-binding.d.ts

@@ -1,4 +0,0 @@
-/** Legacy state roots were Linux-only and always used the default socket. */
-export declare function stateSocketBindingMatches(stateRoot: string, socketPath: string): boolean;
-export declare function bindIsolationStateSocket(stateRoot: string, socketPath: string): void;
-//# sourceMappingURL=state-socket-binding.d.ts.map

package/lib/state-socket-binding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"state-socket-binding.d.ts","sourceRoot":"","sources":["../src/state-socket-binding.ts"],"names":[],"mappings":"AAoBA,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAMxF;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuBpF"}

package/lib/state-socket-binding.js

@@ -1,64 +0,0 @@
-import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, openSync, readFileSync, writeSync } from 'node:fs';
-import { join } from 'node:path';
-import { configuredDockerSocketPath } from './docker-socket.js';
-const filename = 'docker-socket-path';
-function readBinding(stateRoot) {
-    const file = join(stateRoot, filename);
-    if (!existsSync(file))
-        return undefined;
-    const info = lstatSync(file);
-    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.uid !== process.getuid?.() || (info.mode & 0o077) !== 0 || info.size > 4096) {
-        throw new Error('assistant-isolation: invalid state Docker socket binding');
-    }
-    const value = readFileSync(file, 'utf8');
-    if (!value.endsWith('\n') || value.slice(0, -1) !== configuredDockerSocketPath(value.slice(0, -1))) {
-        throw new Error('assistant-isolation: invalid state Docker socket binding');
-    }
-    return value.slice(0, -1);
-}
-/** Legacy state roots were Linux-only and always used the default socket. */
-export function stateSocketBindingMatches(stateRoot, socketPath) {
-    try {
-        if (existsSync(join(stateRoot, 'native-backend')))
-            return false;
-        const existing = readBinding(stateRoot);
-        return existing === undefined ? process.platform === 'linux' && socketPath === '/var/run/docker.sock' : existing === socketPath;
-    }
-    catch {
-        return false;
-    }
-}
-export function bindIsolationStateSocket(stateRoot, socketPath) {
-    configuredDockerSocketPath(socketPath);
-    if (existsSync(join(stateRoot, 'native-backend')))
-        throw new Error('assistant-isolation: state root is native-bound');
-    const existing = readBinding(stateRoot);
-    if (existing !== undefined) {
-        if (existing !== socketPath)
-            throw new Error('assistant-isolation: state root is bound to a different Docker socket');
-        return;
-    }
-    if (existsSync(join(stateRoot, 'ledger.sqlite')) && !stateSocketBindingMatches(stateRoot, socketPath)) {
-        throw new Error('assistant-isolation: legacy state root requires its original Linux Docker socket');
-    }
-    const file = join(stateRoot, filename);
-    let handle;
-    try {
-        handle = openSync(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-    }
-    catch (error) {
-        if (error && typeof error === 'object' && 'code' in error && error.code === 'EEXIST' && stateSocketBindingMatches(stateRoot, socketPath))
-            return;
-        throw error;
-    }
-    try {
-        const bytes = Buffer.from(`${socketPath}\n`);
-        if (writeSync(handle, bytes) !== bytes.length || !fstatSync(handle).isFile())
-            throw new Error('assistant-isolation: cannot persist Docker socket binding');
-        fsyncSync(handle);
-    }
-    finally {
-        closeSync(handle);
-    }
-}
-//# sourceMappingURL=state-socket-binding.js.map

package/lib/state-socket-binding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"state-socket-binding.js","sourceRoot":"","sources":["../src/state-socket-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC9H,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAE/D,MAAM,QAAQ,GAAG,oBAAoB,CAAA;AAErC,SAAS,WAAW,CAAC,SAAiB;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;QACpJ,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,UAAkB;IAC7E,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QAC/D,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;QACvC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,KAAK,sBAAsB,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAA;IACjI,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,UAAkB;IAC5E,0BAA0B,CAAC,UAAU,CAAC,CAAA;IACtC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACrH,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,QAAQ,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;QACrH,OAAM;IACR,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACtC,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAAC,CAAC;IACxH,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,SAAS,EAAE,UAAU,CAAC;YAAE,OAAM;QAChJ,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,CAAC,CAAA;QAC5C,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC1J,SAAS,CAAC,MAAM,CAAC,CAAA;IACnB,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAAC,CAAC;AACjC,CAAC"}