@dsh-enhanced/plugin-control-plane 0.1.48 → 0.1.53

package/lib/live-qualification.d.ts

@@ -0,0 +1,73 @@
+import type { TaskObservationOwner, TaskObservationVote } from './task-observation-types.js';
+export interface LiveQualificationTerms {
+    protocol: 'dsh-bounded-live/v1';
+    maximumWindowMs: number;
+    minimumTasks: number;
+    authority: string;
+    keyId: string;
+}
+/** A finite, profile-wide pre-adoption observation; no exposure cap is implied. */
+export interface LiveQualificationBatch {
+    schemaVersion: 1;
+    kind: 'dsh-live-qualification';
+    id: string;
+    digest: string;
+    lane: string;
+    configDigest: string;
+    trustDigest: string;
+    planId: string;
+    planDigest: string;
+    installationId: string;
+    profilePath: string;
+    owner: TaskObservationOwner;
+    terms: LiveQualificationTerms;
+    activationId: string;
+    fence: number;
+    startedAt: number;
+    deadlineAt: number;
+    readinessDigest: string;
+    hostGeneration: number;
+    votes: readonly TaskObservationVote[];
+    createdAt: number;
+    expiresAt: number;
+}
+export interface LiveQualificationReceipt {
+    schemaVersion: 1;
+    kind: 'dsh-live-qualification-receipt';
+    receiptId: string;
+    authority: string;
+    keyId: string;
+    batchId: string;
+    batchDigest: string;
+    planId: string;
+    planDigest: string;
+    activationId: string;
+    fence: number;
+    hostGeneration: number;
+    disposition: 'qualified' | 'failed';
+    observedAt: number;
+    expiresAt: number;
+    signature: string;
+}
+export interface LiveQualificationRequest {
+    protocol: 'dsh-live-qualification/v1';
+    batchId: string;
+    batchDigest: string;
+}
+export interface LiveQualificationRecord {
+    batch: LiveQualificationBatch;
+    state: 'pending' | 'signed' | 'applied' | 'stale';
+    receipt?: LiveQualificationReceipt;
+}
+export declare function validateLiveQualificationTerms(value: unknown): asserts value is LiveQualificationTerms;
+/** Content identity excludes the creation clock, as with task observation. */
+export declare function liveQualificationId(batch: Omit<LiveQualificationBatch, 'schemaVersion' | 'kind' | 'id' | 'digest' | 'createdAt' | 'expiresAt'>): string;
+export declare function liveQualificationDigest(batch: Omit<LiveQualificationBatch, 'digest'>): string;
+export declare function assertLiveQualificationBatch(value: unknown): asserts value is LiveQualificationBatch;
+export declare function parseLiveQualificationReceipt(value: unknown): LiveQualificationReceipt;
+/** Domain-separated canonical signing payload; never valid as a Host phase receipt. */
+export declare function liveQualificationSigningPayload(receipt: Omit<LiveQualificationReceipt, 'signature'>): string;
+export declare function verifyLiveQualificationReceipt(receiptInput: unknown, batchInput: unknown, publicKeyPem: string | Buffer, now?: number): LiveQualificationReceipt;
+/** Shared exact identity constructor for the independent authority. */
+export declare function liveQualificationReceiptId(receipt: Omit<LiveQualificationReceipt, 'receiptId' | 'signature'>): string;
+//# sourceMappingURL=live-qualification.d.ts.map

package/lib/live-qualification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-qualification.d.ts","sourceRoot":"","sources":["../src/live-qualification.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAY5F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,wBAAwB,CAAA;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,oBAAoB,CAAA;IAC3B,KAAK,EAAE,sBAAsB,CAAA;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,gCAAgC,CAAA;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,WAAW,GAAG,QAAQ,CAAA;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,2BAA2B,CAAA;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,sBAAsB,CAAA;IAC7B,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAA;IACjD,OAAO,CAAC,EAAE,wBAAwB,CAAA;CACnC;AA0BD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAMtG;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC,GAAG,MAAM,CAOvJ;AACD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,GAAG,MAAM,CAG7F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAgCpG;AAMD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAkBtF;AAED,uFAAuF;AACvF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GAAG,MAAM,CAI5G;AASD,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAa,GAAG,wBAAwB,CAoBpK;AAED,uEAAuE;AACvE,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,GAAG,WAAW,CAAC,GAAG,MAAM,CAErH"}

package/lib/live-qualification.js

@@ -0,0 +1,164 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { isAbsolute, resolve } from 'node:path';
+import { controlPlaneDigest, ControlPlaneStoreError } from './store.js';
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+const DIGEST = /^[a-f0-9]{64}$/u;
+const SIGNATURE = /^[A-Za-z0-9+/]+={0,2}$/u;
+const FIELDS = ['schemaVersion', 'kind', 'id', 'digest', 'lane', 'configDigest', 'trustDigest', 'planId', 'planDigest',
+    'installationId', 'profilePath', 'owner', 'terms', 'activationId', 'fence', 'startedAt', 'deadlineAt',
+    'readinessDigest', 'hostGeneration', 'votes', 'createdAt', 'expiresAt'];
+const RECEIPT_FIELDS = ['schemaVersion', 'kind', 'receiptId', 'authority', 'keyId', 'batchId', 'batchDigest',
+    'planId', 'planDigest', 'activationId', 'fence', 'hostGeneration', 'disposition', 'observedAt', 'expiresAt', 'signature'];
+function fail(message) { throw new ControlPlaneStoreError('invalid-input', message); }
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail('live qualification object is invalid');
+    return value;
+}
+function exact(value, fields) {
+    if (Object.keys(value).sort().join('\0') !== [...fields].sort().join('\0'))
+        fail('live qualification fields differ');
+}
+function integer(value, minimum, maximum = Number.MAX_SAFE_INTEGER) {
+    return Number.isSafeInteger(value) && Number(value) >= minimum && Number(value) <= maximum;
+}
+function text(value) {
+    return typeof value === 'string' && value.length > 0 && Buffer.byteLength(value) <= 4096
+        && value.normalize('NFC').trim() === value && !/[\p{Cc}]/u.test(value);
+}
+function path(value) { return text(value) && isAbsolute(value) && resolve(value) === value; }
+function owner(value) {
+    const item = object(value);
+    exact(item, ['authorityId', 'authorityHash', 'principalId', 'principalRecordId', 'principalVersion', 'workspace', 'agentPreset']);
+    return [item.authorityId, item.principalId, item.principalRecordId, item.agentPreset].every(text)
+        && typeof item.authorityHash === 'string' && DIGEST.test(item.authorityHash)
+        && path(item.workspace) && integer(item.principalVersion, 1);
+}
+export function validateLiveQualificationTerms(value) {
+    const item = object(value);
+    exact(item, ['protocol', 'maximumWindowMs', 'minimumTasks', 'authority', 'keyId']);
+    if (item.protocol !== 'dsh-bounded-live/v1' || !integer(item.maximumWindowMs, 60_000, 86_400_000)
+        || !integer(item.minimumTasks, 1, 32) || typeof item.authority !== 'string' || !ID.test(item.authority)
+        || typeof item.keyId !== 'string' || !ID.test(item.keyId))
+        fail('live qualification terms are invalid');
+}
+/** Content identity excludes the creation clock, as with task observation. */
+export function liveQualificationId(batch) {
+    return `live-qualification-${controlPlaneDigest({ lane: batch.lane, configDigest: batch.configDigest,
+        trustDigest: batch.trustDigest, planId: batch.planId, planDigest: batch.planDigest,
+        installationId: batch.installationId, profilePath: batch.profilePath, owner: batch.owner, terms: batch.terms,
+        activationId: batch.activationId, fence: batch.fence, startedAt: batch.startedAt,
+        deadlineAt: batch.deadlineAt, readinessDigest: batch.readinessDigest,
+        hostGeneration: batch.hostGeneration, votes: batch.votes })}`;
+}
+export function liveQualificationDigest(batch) {
+    const { digest: _digest, ...unsigned } = batch;
+    return controlPlaneDigest(unsigned);
+}
+export function assertLiveQualificationBatch(value) {
+    const item = object(value);
+    exact(item, FIELDS);
+    validateLiveQualificationTerms(item.terms);
+    const batch = item;
+    if (batch.schemaVersion !== 1 || batch.kind !== 'dsh-live-qualification'
+        || !/^live-qualification-[a-f0-9]{64}$/u.test(batch.id) || !DIGEST.test(batch.digest)
+        || !DIGEST.test(batch.lane) || !DIGEST.test(batch.configDigest) || !DIGEST.test(batch.trustDigest)
+        || !ID.test(batch.planId) || !DIGEST.test(batch.planDigest) || !text(batch.installationId)
+        || !path(batch.profilePath) || !owner(batch.owner) || !ID.test(batch.activationId)
+        || !integer(batch.fence, 1) || !integer(batch.startedAt, 1) || !integer(batch.deadlineAt, batch.startedAt + 1)
+        || batch.deadlineAt - batch.startedAt > batch.terms.maximumWindowMs || !DIGEST.test(batch.readinessDigest)
+        || !integer(batch.hostGeneration, 1) || !Array.isArray(batch.votes)
+        || !integer(batch.createdAt, batch.startedAt, batch.deadlineAt - 1)
+        || !integer(batch.expiresAt, batch.createdAt + 1)
+        || Buffer.byteLength(JSON.stringify(batch)) > 262_144)
+        fail('live qualification batch is invalid');
+    const seen = new Set();
+    for (const vote of batch.votes) {
+        if (!vote || !text(vote.inboxId) || !text(vote.outcomeId) || !DIGEST.test(vote.sourceDigest)
+            || !DIGEST.test(vote.deploymentDigest) || !['achieved', 'not-achieved'].includes(vote.status)
+            || !integer(vote.completedAt, batch.startedAt, Math.min(batch.createdAt, batch.deadlineAt - 1))
+            || !vote.projection || vote.projection.subjectKind !== 'foreground-turn'
+            || vote.projection.subjectRef !== vote.inboxId || vote.projection.disposition !== 'upsert'
+            || !integer(vote.projection.version, 1) || !DIGEST.test(vote.projection.digest)
+            || seen.has(vote.inboxId))
+            fail('live qualification vote is invalid');
+        seen.add(vote.inboxId);
+    }
+    const failed = batch.votes.some(vote => vote.status === 'not-achieved');
+    if (failed ? batch.votes.length < 1 : batch.votes.length < batch.terms.minimumTasks) {
+        fail('live qualification lacks the required task or failure evidence');
+    }
+    if (batch.id !== liveQualificationId(batch) || batch.digest !== liveQualificationDigest(batch))
+        fail('live qualification digest differs');
+}
+function receiptIdentity(receipt) {
+    return `live-qualification-receipt-${controlPlaneDigest(receipt)}`;
+}
+export function parseLiveQualificationReceipt(value) {
+    const item = object(value);
+    exact(item, RECEIPT_FIELDS);
+    const receipt = item;
+    if (receipt.schemaVersion !== 1 || receipt.kind !== 'dsh-live-qualification-receipt'
+        || !/^live-qualification-receipt-[a-f0-9]{64}$/u.test(receipt.receiptId)
+        || !ID.test(receipt.authority) || !ID.test(receipt.keyId)
+        || !/^live-qualification-[a-f0-9]{64}$/u.test(receipt.batchId) || !DIGEST.test(receipt.batchDigest)
+        || !ID.test(receipt.planId) || !DIGEST.test(receipt.planDigest) || !ID.test(receipt.activationId)
+        || !integer(receipt.fence, 1) || !integer(receipt.hostGeneration, 1)
+        || !['qualified', 'failed'].includes(receipt.disposition)
+        || !integer(receipt.observedAt, 1) || !integer(receipt.expiresAt, receipt.observedAt + 1)
+        || typeof receipt.signature !== 'string' || receipt.signature.length > 512
+        || !SIGNATURE.test(receipt.signature)
+        || Buffer.byteLength(JSON.stringify(receipt)) > 16_384)
+        fail('live qualification receipt is invalid');
+    const { receiptId: _receiptId, signature: _signature, ...identity } = receipt;
+    if (receipt.receiptId !== receiptIdentity(identity))
+        fail('live qualification receipt identity differs');
+    return receipt;
+}
+/** Domain-separated canonical signing payload; never valid as a Host phase receipt. */
+export function liveQualificationSigningPayload(receipt) {
+    const { receiptId: _receiptId, ...identity } = receipt;
+    if (receipt.receiptId !== receiptIdentity(identity))
+        fail('live qualification receipt identity differs');
+    return `dsh-bounded-live/v1\n${controlPlaneCanonical(receipt)}`;
+}
+function controlPlaneCanonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(controlPlaneCanonical).join(',')}]`;
+    if (value !== null && typeof value === 'object')
+        return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, part]) => `${JSON.stringify(key)}:${controlPlaneCanonical(part)}`).join(',')}}`;
+    return JSON.stringify(value);
+}
+export function verifyLiveQualificationReceipt(receiptInput, batchInput, publicKeyPem, now = Date.now()) {
+    assertLiveQualificationBatch(batchInput);
+    const batch = batchInput;
+    const receipt = parseLiveQualificationReceipt(receiptInput);
+    const failed = batch.votes.some(vote => vote.status === 'not-achieved');
+    if (receipt.authority !== batch.terms.authority || receipt.keyId !== batch.terms.keyId
+        || receipt.batchId !== batch.id || receipt.batchDigest !== batch.digest || receipt.planId !== batch.planId
+        || receipt.planDigest !== batch.planDigest || receipt.activationId !== batch.activationId
+        || receipt.fence !== batch.fence || receipt.hostGeneration !== batch.hostGeneration
+        || receipt.disposition !== (failed ? 'failed' : 'qualified')
+        || receipt.observedAt < batch.createdAt || receipt.observedAt >= batch.deadlineAt
+        || receipt.observedAt > now || now >= receipt.expiresAt
+        || receipt.expiresAt > batch.expiresAt || !integer(now, 1))
+        fail('live qualification receipt context differs');
+    const { signature, ...unsigned } = receipt;
+    let key;
+    try {
+        key = createPublicKey(publicKeyPem);
+    }
+    catch {
+        return fail('live qualification public key is invalid');
+    }
+    if (key.asymmetricKeyType !== 'ed25519' || !verify(null, Buffer.from(liveQualificationSigningPayload(unsigned)), key, Buffer.from(signature, 'base64'))) {
+        fail('live qualification signature is invalid');
+    }
+    return receipt;
+}
+/** Shared exact identity constructor for the independent authority. */
+export function liveQualificationReceiptId(receipt) {
+    return receiptIdentity(receipt);
+}
+//# sourceMappingURL=live-qualification.js.map

package/lib/live-qualification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-qualification.js","sourceRoot":"","sources":["../src/live-qualification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE/C,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAEvE,MAAM,EAAE,GAAG,sCAAsC,CAAA;AACjD,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,SAAS,GAAG,yBAAyB,CAAA;AAC3C,MAAM,MAAM,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY;IACpH,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY;IACrG,iBAAiB,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAU,CAAA;AAClF,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa;IAC1G,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAU,CAAA;AAmEpI,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA,CAAC,CAAC;AACpG,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IAC7G,OAAO,KAAgC,CAAA;AACzC,CAAC;AACD,SAAS,KAAK,CAAC,KAA8B,EAAE,MAAyB;IACtE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;AACtH,CAAC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,OAAe,EAAE,OAAO,GAAG,MAAM,CAAC,gBAAgB;IACjF,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAA;AAC5F,CAAC;AACD,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI;WACnF,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC1E,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,IAAqB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAA,CAAC,CAAC;AACtH,SAAS,KAAK,CAAC,KAAc;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAA;IACjI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;WAC5F,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;WACzE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;IAClF,IAAI,IAAI,CAAC,QAAQ,KAAK,qBAAqB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,CAAC;WAC5F,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;WACpG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;AAC3G,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,KAA2G;IAC7I,OAAO,sBAAsB,kBAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QAClG,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QAClF,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;QAC5G,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;QAChF,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe;QACpE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAA;AACjE,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,KAA6C;IACnF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,KAA+B,CAAA;IACxE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnB,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAyC,CAAA;IACvD,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB;WACnE,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;WAClF,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;WAC/F,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;WACvF,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;WAC/E,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;WAC3G,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;WACvG,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;WAChE,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;WAChE,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;WAC9C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACpG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;eACvF,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;eAC1F,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;eAC5F,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,KAAK,iBAAiB;eACrE,IAAI,CAAC,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,KAAK,QAAQ;eACvF,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;eAC5E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;QACvE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,CAAC,CAAA;IACvE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACpF,IAAI,CAAC,gEAAgE,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,KAAK,CAAC,EAAE,KAAK,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,uBAAuB,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;AAC3I,CAAC;AAED,SAAS,eAAe,CAAC,OAAkE;IACzF,OAAO,8BAA8B,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;IAC3B,MAAM,OAAO,GAAG,IAA2C,CAAA;IAC3D,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,gCAAgC;WAC/E,CAAC,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;WACrE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;WACtD,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;WAChG,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;WAC9F,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;WACjE,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;WACtD,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;WACtF,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;WACvE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;WAClC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;IACvG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC7E,IAAI,OAAO,CAAC,SAAS,KAAK,eAAe,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;IACxG,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,+BAA+B,CAAC,OAAoD;IAClG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;IACtD,IAAI,OAAO,CAAC,SAAS,KAAK,eAAe,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;IACxG,OAAO,wBAAwB,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAA;AACjE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAClF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACrH,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC7F,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,YAAqB,EAAE,UAAmB,EAAE,YAA6B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACxI,4BAA4B,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAA;IACxB,MAAM,OAAO,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,CAAC,CAAA;IACvE,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK;WACjF,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;WACvG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WACtF,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;WAChF,OAAO,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;WACzD,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU;WAC9E,OAAO,CAAC,UAAU,GAAG,GAAG,IAAI,GAAG,IAAI,OAAO,CAAC,SAAS;WACpD,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;IAChH,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC1C,IAAI,GAAuC,CAAA;IAC3C,IAAI,CAAC;QAAC,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,0CAA0C,CAAC,CAAA;IAAC,CAAC;IAC7G,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QACxJ,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,0BAA0B,CAAC,OAAkE;IAC3G,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC"}

package/lib/native-source-build-worker.d.ts

@@ -0,0 +1,4 @@
+/** Fixed code run inside the native macOS Seatbelt. Candidate package scripts,
+ * tests, tsconfig files and JavaScript are never executed during preparation. */
+export declare const NATIVE_SOURCE_COMPILER: string;
+//# sourceMappingURL=native-source-build-worker.d.ts.map

package/lib/native-source-build-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-source-build-worker.d.ts","sourceRoot":"","sources":["../src/native-source-build-worker.ts"],"names":[],"mappings":"AAAA;iFACiF;AACjF,eAAO,MAAM,sBAAsB,QAmFlC,CAAA"}

package/lib/native-source-build-worker.js

@@ -0,0 +1,87 @@
+/** Fixed code run inside the native macOS Seatbelt. Candidate package scripts,
+ * tests, tsconfig files and JavaScript are never executed during preparation. */
+export const NATIVE_SOURCE_COMPILER = String.raw `
+import { readFileSync } from 'node:fs'
+import { isAbsolute, posix, resolve, sep } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+const fail = reason => { process.stderr.write(String(reason).slice(0, 4096)); process.exitCode = 1 }
+try {
+  const input = JSON.parse(readFileSync(0, 'utf8'))
+  if (!input || input.schemaVersion !== 1 || !Array.isArray(input.files) || input.files.length < 1 || input.files.length > 64
+    || typeof input.modulesPath !== 'string' || !isAbsolute(input.modulesPath)) throw new Error('invalid compiler input')
+  const modulesPath = resolve(input.modulesPath)
+  const ts = await import(pathToFileURL(resolve(modulesPath, 'typescript/lib/typescript.js')).href)
+  const virtualRoot = '/candidate'
+  const sources = new Map()
+  let total = 0
+  for (const file of input.files) {
+    if (!file || typeof file.path !== 'string' || typeof file.content !== 'string'
+      || !/^(?:src\/)?[A-Za-z0-9][A-Za-z0-9._/-]*\.(?:ts|tsx)$/u.test(file.path)
+      || file.path.split('/').some(part => part === '.' || part === '..' || part === '')
+      || Buffer.byteLength(file.content) > 65_536) throw new Error('unsafe compiler source')
+    total += Buffer.byteLength(file.content)
+    if (total > 262_144) throw new Error('compiler source limit')
+    const key = posix.join(virtualRoot, file.path)
+    if (sources.has(key)) throw new Error('duplicate compiler source')
+    sources.set(key, file.content)
+  }
+  const roots = [...sources.keys()].filter(name => name.startsWith('/candidate/src/') && /\.tsx?$/u.test(name))
+  if (roots.length < 1) throw new Error('missing plugin TypeScript source')
+  const options = { target: ts.ScriptTarget.ES2024, module: ts.ModuleKind.ESNext,
+    moduleResolution: ts.ModuleResolutionKind.Bundler, lib: ['lib.es2024.d.ts'],
+    rootDir: '/candidate/src', outDir: '/candidate/lib', strict: true,
+    noUncheckedIndexedAccess: true, exactOptionalPropertyTypes: true,
+    noImplicitOverride: true, noFallthroughCasesInSwitch: true,
+    noUnusedLocals: true, noUnusedParameters: true, verbatimModuleSyntax: true,
+    isolatedModules: true, skipLibCheck: true, declaration: true,
+    sourceMap: false, declarationMap: false, noEmitOnError: true,
+    typeRoots: [resolve(modulesPath, '@types')], types: ['node'] }
+  const permitted = new Set(['@deepseek-ai/cordis', '@deepseek-ai/dsh-tools', '@deepseek-ai/dsh-system-prompt'])
+  const outputs = new Map()
+  const host = ts.createCompilerHost(options, true)
+  const originalRead = host.readFile.bind(host)
+  const originalExists = host.fileExists.bind(host)
+  const withinRuntime = path => path === modulesPath || path.startsWith(modulesPath + sep)
+  host.readFile = path => sources.get(path) ?? (withinRuntime(path) ? originalRead(path) : undefined)
+  host.fileExists = path => sources.has(path) || withinRuntime(path) && originalExists(path)
+  host.directoryExists = path => path === '/candidate' || path === '/candidate/src'
+    || [...sources.keys()].some(key => key.startsWith(path + '/'))
+    || withinRuntime(path) && ts.sys.directoryExists(path)
+  host.getDirectories = path => withinRuntime(path) ? ts.sys.getDirectories(path) : []
+  host.resolveModuleNames = (names, containingFile) => names.map(name => {
+    if (name.startsWith('.')) {
+      if (withinRuntime(containingFile)) return ts.resolveModuleName(name, containingFile, options, host).resolvedModule
+      const target = posix.resolve(posix.dirname(containingFile), name)
+      if (!target.startsWith('/candidate/src/')) return undefined
+      return ts.resolveModuleName(name, containingFile, options, host).resolvedModule
+    }
+    if (withinRuntime(containingFile)) return ts.resolveModuleName(name, containingFile, options, host).resolvedModule
+    if (!permitted.has(name) && !name.startsWith('node:')) return undefined
+    if (name.startsWith('node:')) return ts.resolveModuleName(name, containingFile, options, host).resolvedModule
+    const manifest = JSON.parse(readFileSync(resolve(modulesPath, name, 'package.json'), 'utf8'))
+    const declaration = manifest.exports?.['.']?.types ?? manifest.types
+    if (typeof declaration !== 'string' || !/^\.?\/?[A-Za-z0-9._/-]+\.d\.ts$/u.test(declaration)
+      || declaration.split('/').includes('..')) return undefined
+    const entry = resolve(modulesPath, name, declaration)
+    if (!withinRuntime(entry) || !host.fileExists(entry)) return undefined
+    return { resolvedFileName: entry, extension: ts.Extension.Dts, isExternalLibraryImport: true }
+  })
+  host.writeFile = (fileName, content) => {
+    if (!fileName.startsWith('/candidate/lib/') || !/\.(?:js|d\.ts)$/u.test(fileName)
+      || Buffer.byteLength(content) > 131_072 || outputs.size >= 128 || outputs.has(fileName)) throw new Error('unsafe compiler output')
+    outputs.set(fileName.slice('/candidate/'.length), content)
+  }
+  const program = ts.createProgram(roots, options, host)
+  const diagnostics = ts.getPreEmitDiagnostics(program)
+  if (diagnostics.length) throw new Error('semantic TypeScript diagnostics: ' + ts.formatDiagnostics(diagnostics.slice(0, 8), {
+    getCanonicalFileName: name => name, getCurrentDirectory: () => virtualRoot, getNewLine: () => '\n' }).slice(0, 4096))
+  const emitted = program.emit()
+  if (emitted.emitSkipped || emitted.diagnostics.length || !outputs.has('lib/index.js') || !outputs.has('lib/index.d.ts')) {
+    throw new Error('TypeScript JS/declaration emit failed')
+  }
+  const files = [...outputs].sort(([a], [b]) => a.localeCompare(b)).map(([path, content]) => ({ path, content }))
+  process.stdout.write(JSON.stringify({ schemaVersion: 1, typescriptVersion: ts.version, checks: ['semantic-typecheck', 'js-declaration-emit'], files }))
+} catch (error) { fail(error instanceof Error ? error.message : 'compiler failure') }
+`;
+//# sourceMappingURL=native-source-build-worker.js.map

package/lib/native-source-build-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-source-build-worker.js","sourceRoot":"","sources":["../src/native-source-build-worker.ts"],"names":[],"mappings":"AAAA;iFACiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmF/C,CAAA"}

package/lib/native-source-build.d.ts

@@ -0,0 +1,36 @@
+import { type NativeMacVerifierRunner } from '@dsh-enhanced/assistant-isolation';
+import { type SourceCreationBinding } from './source-creation.js';
+import { type SourceRevisionBinding } from './source-revision.js';
+import { type ScopedPluginFile } from './source-workspace.js';
+import type { CreationCapabilitySourceSnapshot } from './creation-capability-source.js';
+import type { PluginCreationVerificationCertificate } from '@dsh-enhanced/assistant-growth-contract';
+import type { NativeSourceBuildConfig, SourceBuildResult } from './source-build.js';
+import type { NativeSourcePreparedEvidence } from './types.js';
+interface NativeBuildInput {
+    config: NativeSourceBuildConfig;
+    runner: NativeMacVerifierRunner;
+    worktree: string;
+    baseCommit: string;
+    name: string;
+    scope: readonly string[];
+    environment: NodeJS.ProcessEnv;
+    signal: AbortSignal;
+    assertCurrent: () => Promise<void>;
+    preparedAt: number;
+    sourceJob: {
+        id: string;
+    };
+    creation?: SourceCreationBinding;
+    revision?: {
+        binding: SourceRevisionBinding;
+        parentSource: CreationCapabilitySourceSnapshot;
+        parentCertificate: PluginCreationVerificationCertificate;
+        files: readonly ScopedPluginFile[];
+    };
+    capturePack?: true;
+}
+/** Only the Host-scaffolded create/revise-created lane may call this. The
+ * candidate is passed to a fixed compiler as data, never launched as code. */
+export declare function runNativePreparedChecks(input: NativeBuildInput): Promise<SourceBuildResult<NativeSourcePreparedEvidence>>;
+export {};
+//# sourceMappingURL=native-source-build.d.ts.map

package/lib/native-source-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-source-build.d.ts","sourceRoot":"","sources":["../src/native-source-build.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkD,KAAK,uBAAuB,EAAE,MAAM,mCAAmC,CAAA;AAEhI,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC/F,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC/F,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACpF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAA;AACvF,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,yCAAyC,CAAA;AACpG,OAAO,KAAK,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAGnF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AAK9D,UAAU,gBAAgB;IACxB,MAAM,EAAE,uBAAuB,CAAA;IAC/B,MAAM,EAAE,uBAAuB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACzB,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,qBAAqB,CAAC;QAAC,YAAY,EAAE,gCAAgC,CAAC;QAC1F,iBAAiB,EAAE,qCAAqC,CAAC;QAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAA;KAAE,CAAA;IAChG,WAAW,CAAC,EAAE,IAAI,CAAA;CACnB;AAsDD;8EAC8E;AAC9E,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CAAC,CAuD/H"}

package/lib/native-source-build.js

@@ -0,0 +1,143 @@
+import { createHash } from 'node:crypto';
+import { lstat, readdir, readFile, realpath } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { nativeMacRuntimeDigest, verifyNativeMacRuntime } from '@dsh-enhanced/assistant-isolation';
+import { ControlPlaneCliError } from './errors.js';
+import { verifyCreatedPluginWorkspace } from './source-creation.js';
+import { verifyRevisedPluginWorkspace } from './source-revision.js';
+import { checkedSourceSnapshot } from './source-workspace.js';
+import { NATIVE_SOURCE_COMPILER } from './native-source-build-worker.js';
+import { packNativeCreatedPlugin } from './native-source-pack.js';
+const DIGEST = /^[a-f0-9]{64}$/u;
+const compilerSha256 = createHash('sha256').update(NATIVE_SOURCE_COMPILER).digest('hex');
+function fail(message) { throw new ControlPlaneCliError('SOURCE_BOUNDARY', `native source build ${message}`); }
+async function pluginFiles(root) {
+    const files = new Map();
+    let bytes = 0;
+    let count = 0;
+    const visit = async (directory, prefix, depth) => {
+        if (depth > 32)
+            fail('directory depth exceeds bound');
+        for (const name of (await readdir(directory)).sort()) {
+            if (!/^[A-Za-z0-9._-]+$/u.test(name) || name === '.' || name === '..')
+                fail('unsafe path');
+            const path = join(directory, name), relative = prefix === '' ? name : `${prefix}/${name}`;
+            const info = await lstat(path);
+            if (info.isSymbolicLink() || info.nlink !== 1 && info.isFile())
+                fail('linked plugin file');
+            if (info.isDirectory())
+                await visit(path, relative, depth + 1);
+            else if (info.isFile()) {
+                if (info.size > 65_536 || ++count > 64)
+                    fail('file size/count exceeds bound');
+                const content = await readFile(path);
+                bytes += content.length;
+                if (bytes > 262_144 || content.includes(0))
+                    fail('plugin bytes exceed bound');
+                const decoded = new TextDecoder('utf-8', { fatal: true }).decode(content);
+                if (!Buffer.from(decoded).equals(content))
+                    fail('noncanonical UTF-8 plugin file');
+                files.set(relative, decoded);
+            }
+            else
+                fail('special plugin file');
+        }
+    };
+    const canonical = await realpath(root);
+    if (canonical !== resolve(root) || !(await lstat(root)).isDirectory())
+        fail('plugin root is not canonical');
+    await visit(root, '', 0);
+    return files;
+}
+function compilerOutput(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail('compiler output is invalid');
+    const item = value;
+    if (Object.keys(item).sort().join() !== 'checks,files,schemaVersion,typescriptVersion'
+        || item.schemaVersion !== 1 || !Array.isArray(item.checks)
+        || item.checks.join() !== 'semantic-typecheck,js-declaration-emit'
+        || !Array.isArray(item.files) || item.files.length < 2 || item.files.length > 128)
+        fail('compiler output contract differs');
+    const files = new Map();
+    let total = 0;
+    for (const value of item.files) {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            fail('compiler file is invalid');
+        const file = value;
+        if (Object.keys(file).sort().join() !== 'content,path' || typeof file.path !== 'string' || typeof file.content !== 'string'
+            || !/^lib\/[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*\.(?:js|d\.ts)$/u.test(file.path)
+            || files.has(file.path))
+            fail('compiler file path is unsafe');
+        total += Buffer.byteLength(file.content);
+        if (total > 512 * 1024)
+            fail('compiler output exceeds bound');
+        files.set(file.path, file.content);
+    }
+    return files;
+}
+/** Only the Host-scaffolded create/revise-created lane may call this. The
+ * candidate is passed to a fixed compiler as data, never launched as code. */
+export async function runNativePreparedChecks(input) {
+    if (process.platform !== 'darwin' || !/^source-job-[a-f0-9]{64}$/u.test(input.sourceJob.id)
+        || !DIGEST.test(input.config.authorityDigest) || input.config.expiresAt <= Date.now()
+        || (input.creation === undefined) === (input.revision === undefined))
+        fail('durable creation authority is required');
+    const verify = async () => {
+        const grant = input.creation?.grant ?? input.revision.binding.grant;
+        if (grant.expiresAt <= Date.now())
+            fail('creation or revision grant expired');
+        const result = input.creation === undefined
+            ? await verifyRevisedPluginWorkspace({ worktree: input.worktree, baseCommit: input.baseCommit,
+                name: input.name, environment: input.environment, signal: input.signal, assertCurrent: input.assertCurrent,
+                revision: input.revision.binding, parentSource: input.revision.parentSource,
+                parentCertificate: input.revision.parentCertificate, files: input.revision.files })
+            : await verifyCreatedPluginWorkspace({ worktree: input.worktree, baseCommit: input.baseCommit,
+                name: input.name, environment: input.environment, signal: input.signal, assertCurrent: input.assertCurrent,
+                creation: input.creation });
+        const expected = [...input.scope].sort(), actual = [...result.scope].sort();
+        if (expected.length !== actual.length || expected.some((path, i) => path !== actual[i]))
+            fail('scope differs from Host scaffold');
+        await input.assertCurrent();
+    };
+    await verifyNativeMacRuntime(input.config.runtime);
+    await verify();
+    const before = await checkedSourceSnapshot(input.worktree, input.baseCommit, input.scope, input.environment, undefined, input.signal);
+    const files = await pluginFiles(join(input.worktree, 'plugins', input.name));
+    const sources = [...files].filter(([path]) => path.startsWith('src/') && /\.tsx?$/u.test(path))
+        .map(([path, content]) => ({ path, content }));
+    if (!sources.some(file => file.path === 'src/index.ts'))
+        fail('source entry is missing');
+    const result = await input.runner.run(input.sourceJob.id, [], JSON.stringify({ schemaVersion: 1,
+        modulesPath: input.config.runtime.modulesPath, files: sources }), input.signal);
+    await input.assertCurrent();
+    if (!result.quiescent || result.status !== 'succeeded' || result.exitCode !== 0 || result.stderr !== '') {
+        throw new ControlPlaneCliError('EXECUTOR_FAILED', `native source compiler ${result.status}: ${result.reason ?? result.stderr.slice(0, 512)}`);
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(result.stdout);
+    }
+    catch {
+        fail('compiler output is not JSON');
+    }
+    const compiler = compilerOutput(decoded);
+    if (decoded.typescriptVersion !== input.config.runtime.versions.typescript)
+        fail('TypeScript version differs');
+    const packed = packNativeCreatedPlugin(input.name, files, compiler);
+    await verifyNativeMacRuntime(input.config.runtime);
+    await verify();
+    const after = await checkedSourceSnapshot(input.worktree, input.baseCommit, input.scope, input.environment, undefined, input.signal);
+    if (after.checkedTreeDigest !== before.checkedTreeDigest || after.checkedPatchDigest !== before.checkedPatchDigest) {
+        fail('source changed during native compilation');
+    }
+    const checkedAt = Date.now();
+    return { treeDigest: after.checkedTreeDigest, patchDigest: after.checkedPatchDigest, checkedAt,
+        ...(input.capturePack ? { packArtifact: packed.bytes } : {}),
+        evidence: Object.freeze({ schemaVersion: 2, kind: 'dsh-source-prepared-evidence',
+            boundary: 'macos-seatbelt-single-process-v1', runtimeDigest: nativeMacRuntimeDigest(input.config.runtime),
+            fixedCompilerSha256: compilerSha256,
+            checks: Object.freeze(['semantic-typecheck', 'js-declaration-emit', 'host-safe-pack']),
+            pack: Object.freeze({ name: packed.name, version: packed.version, sizeBytes: packed.bytes.length, sha256: packed.sha256 }),
+            preparedAt: input.preparedAt }) };
+}
+//# sourceMappingURL=native-source-build.js.map

package/lib/native-source-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-source-build.js","sourceRoot":"","sources":["../src/native-source-build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAgC,MAAM,mCAAmC,CAAA;AAChI,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,4BAA4B,EAA8B,MAAM,sBAAsB,CAAA;AAC/F,OAAO,EAAE,4BAA4B,EAA8B,MAAM,sBAAsB,CAAA;AAC/F,OAAO,EAAE,qBAAqB,EAAyB,MAAM,uBAAuB,CAAA;AAIpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAGjE,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAoBxF,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,uBAAuB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAE7H,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,IAAI,KAAK,GAAG,CAAC,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,CAAA;IAC5B,MAAM,KAAK,GAAG,KAAK,EAAE,SAAiB,EAAE,MAAc,EAAE,KAAa,EAAiB,EAAE;QACtF,IAAI,KAAK,GAAG,EAAE;YAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;QACrD,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;gBAAE,IAAI,CAAC,aAAa,CAAC,CAAA;YAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAA;YACzF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,IAAI,CAAC,oBAAoB,CAAC,CAAA;YAC1F,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,MAAM,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;iBACzD,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,IAAI,EAAE,KAAK,GAAG,EAAE;oBAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;gBAC7E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;gBACpC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAA;gBACvB,IAAI,KAAK,GAAG,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;gBAC7E,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACzE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;gBACjF,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAC9B,CAAC;;gBAAM,IAAI,CAAC,qBAAqB,CAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC3G,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACxB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACnG,MAAM,IAAI,GAAG,KAAgC,CAAA;IAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,8CAA8C;WACjF,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;WACvD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,wCAAwC;WAC/D,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAC7H,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;QACjG,MAAM,IAAI,GAAG,KAAgC,CAAA;QAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,cAAc,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;eACtH,CAAC,6DAA6D,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;eAC9E,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;QAC/D,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACxC,IAAI,KAAK,GAAG,GAAG,GAAG,IAAI;YAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;QAC7D,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAuB;IACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;WACtF,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;WAClF,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC;QAAE,IAAI,CAAC,wCAAwC,CAAC,CAAA;IACtH,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,KAAK,CAAC,QAAS,CAAC,OAAO,CAAC,KAAK,CAAA;QACpE,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS;YACzC,CAAC,CAAC,MAAM,4BAA4B,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC3F,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAC1G,QAAQ,EAAE,KAAK,CAAC,QAAS,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,QAAS,CAAC,YAAY;gBAC7E,iBAAiB,EAAE,KAAK,CAAC,QAAS,CAAC,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,QAAS,CAAC,KAAK,EAAE,CAAC;YACvF,CAAC,CAAC,MAAM,4BAA4B,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC3F,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAC1G,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/B,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;QACjI,MAAM,KAAK,CAAC,aAAa,EAAE,CAAA;IAC7B,CAAC,CAAA;IACD,MAAM,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAClD,MAAM,MAAM,EAAE,CAAA;IACd,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EACzG,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5E,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC5F,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IAChD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACxF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC;QAC7F,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACjF,MAAM,KAAK,CAAC,aAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxG,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,0BAA0B,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IAC/I,CAAC;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAY,CAAA;IAAC,CAAC;IACtD,MAAM,CAAC;QAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;IAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACxC,IAAK,OAA2C,CAAC,iBAAiB,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACnJ,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnE,MAAM,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAClD,MAAM,MAAM,EAAE,CAAA;IACd,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EACxG,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,KAAK,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB,IAAI,KAAK,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACnH,IAAI,CAAC,0CAA0C,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,iBAAiB,EAAE,WAAW,EAAE,KAAK,CAAC,kBAAkB,EAAE,SAAS;QAC5F,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,8BAA8B;YAC9E,QAAQ,EAAE,kCAAkC,EAAE,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;YACzG,mBAAmB,EAAE,cAAc;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,gBAAgB,CAAU,CAAC;YAC/F,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1H,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,CAAA;AACvC,CAAC"}

package/lib/native-source-pack.d.ts

@@ -0,0 +1,11 @@
+export interface NativePackedSource {
+    bytes: Buffer;
+    name: string;
+    version: string;
+    sha256: string;
+}
+/** Host-built deterministic npm-compatible ustar. The caller provides exact
+ * Host-verified fixed files and bounded compiler output, never a filesystem
+ * path, symlink or candidate-controlled archive. */
+export declare function packNativeCreatedPlugin(name: string, fixed: ReadonlyMap<string, string>, emitted: ReadonlyMap<string, string>): NativePackedSource;
+//# sourceMappingURL=native-source-pack.d.ts.map

package/lib/native-source-pack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-source-pack.d.ts","sourceRoot":"","sources":["../src/native-source-pack.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AA4BD;;oDAEoD;AACpD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACtF,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,kBAAkB,CAmC1D"}