@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/runtime/process/resource/darwin-native-host-bootstrap.js

@@ -0,0 +1,196 @@
+import { spawn } from "node:child_process";
+import { lstat } from "node:fs/promises";
+import * as NodeStream from "@effect/platform-node-shared/NodeStream";
+import { Effect } from "effect";
+import { asNodeRuntimeError, makeNodeRuntimeError, } from "../../errors.js";
+import { openDarwinVouchedTarget, } from "./darwin-vouch-policy.js";
+const bootstrapError = (message) => makeNodeRuntimeError("transport_failed", message);
+// Node Writable streams emit an `error` event and invoke the write callback.
+// The callback below owns the typed transport failure; this
+// listener prevents the duplicate EPIPE event from escaping Effect as an
+// uncaught exception when the helper wins a shutdown race.
+const observeHelperInputError = () => undefined;
+const requireDarwinHost = (artifact) => process.platform === "darwin" &&
+    process.arch === "arm64" &&
+    artifact.targetTriple === "darwin-arm64"
+    ? Effect.void
+    : Effect.fail(makeNodeRuntimeError("transport_failed", "The darwin-arm64 native process host is unavailable."));
+const removeSpawnListeners = (child, onError, onSpawn) => {
+    child.off("error", onError);
+    child.off("spawn", onSpawn);
+};
+const killHelper = (child) => {
+    if (child.exitCode === null && child.signalCode === null) {
+        child.kill("SIGKILL");
+    }
+};
+const verifyArtifactBinding = (artifact) => Effect.tryPromise({
+    catch: () => bootstrapError("The native process-host artifact identity changed."),
+    try: async () => {
+        const metadata = await lstat(artifact.path, { bigint: true });
+        if (metadata.ctimeNs !== artifact.changedAtNanoseconds ||
+            metadata.dev !== artifact.device ||
+            metadata.ino !== artifact.inode ||
+            metadata.mtimeNs !== artifact.modifiedAtNanoseconds ||
+            metadata.size !== artifact.size) {
+            throw bootstrapError("The native process-host artifact identity changed.");
+        }
+    },
+});
+const spawnHelper = (artifact, targetDescriptor, detached) => Effect.callback((resume) => {
+    const child = spawn(artifact.path, [], {
+        detached,
+        env: {},
+        shell: false,
+        stdio: ["pipe", "pipe", "ignore", artifact.descriptor, targetDescriptor],
+    });
+    child.stdin.on("error", observeHelperInputError);
+    const onError = () => {
+        removeSpawnListeners(child, onError, onSpawn);
+        resume(Effect.fail(bootstrapError("The native process host failed to start.")));
+    };
+    const onSpawn = () => {
+        removeSpawnListeners(child, onError, onSpawn);
+        resume(Effect.succeed(child));
+    };
+    child.once("error", onError);
+    child.once("spawn", onSpawn);
+    return Effect.sync(() => {
+        removeSpawnListeners(child, onError, onSpawn);
+        killHelper(child);
+    });
+});
+const helperExit = (child) => Effect.callback((resume) => {
+    if (child.exitCode !== null || child.signalCode !== null) {
+        resume(Effect.succeed({ code: child.exitCode, signal: child.signalCode }));
+        return;
+    }
+    const onError = () => {
+        child.off("error", onError);
+        child.off("exit", onExit);
+        resume(Effect.fail(bootstrapError("The native process host failed.")));
+    };
+    const onExit = (code, signal) => {
+        child.off("error", onError);
+        child.off("exit", onExit);
+        resume(Effect.succeed({ code, signal }));
+    };
+    child.once("error", onError);
+    child.once("exit", onExit);
+    return Effect.sync(() => {
+        child.off("error", onError);
+        child.off("exit", onExit);
+    });
+});
+const writeHelper = (child, bytes) => Effect.callback((resume) => {
+    child.stdin.write(Buffer.from(bytes), (error) => {
+        resume(error === null || error === undefined
+            ? Effect.void
+            : Effect.fail(bootstrapError("The process-host write failed.")));
+    });
+});
+class SerializedHelperListener {
+    #accept;
+    #child;
+    #listening = true;
+    #resume;
+    constructor(child, accept, resume) {
+        this.#accept = accept;
+        this.#child = child;
+        this.#resume = resume;
+    }
+    start() {
+        this.#child.stdout.on("data", this.#onData);
+        this.#child.stdout.once("end", this.#onEnd);
+        this.#child.stdout.once("error", this.#onError);
+        if (this.#child.stdout.readableEnded)
+            this.#onEnd();
+    }
+    stop() {
+        this.#listening = false;
+        this.#child.stdout.off("data", this.#onData);
+        this.#child.stdout.off("end", this.#onEnd);
+        this.#child.stdout.off("error", this.#onError);
+    }
+    #onData = (chunk) => {
+        try {
+            this.#accept(chunk);
+        }
+        catch (error) {
+            this.#complete(Effect.fail(asNodeRuntimeError(error, "transport_failed", "The process-host output failed validation.")));
+        }
+    };
+    #onEnd = () => {
+        this.#complete(Effect.void);
+    };
+    #onError = (error) => {
+        this.#complete(Effect.fail(asNodeRuntimeError(error, "transport_failed", "The process-host output failed.")));
+    };
+    #complete(effect) {
+        if (!this.#listening)
+            return;
+        this.stop();
+        this.#resume(effect);
+    }
+}
+const listenHelper = (child, accept) => Effect.callback((resume) => {
+    const listener = new SerializedHelperListener(child, accept, resume);
+    listener.start();
+    return Effect.sync(() => {
+        listener.stop();
+    });
+});
+const helperTransport = (child) => ({
+    abortHelper: Effect.sync(() => {
+        killHelper(child);
+    }),
+    closeInput: Effect.sync(() => {
+        if (!child.stdin.destroyed && !child.stdin.writableEnded)
+            child.stdin.end();
+    }),
+    exit: helperExit(child),
+    listenSerialized: (accept) => listenHelper(child, accept),
+    read: NodeStream.fromReadable({
+        evaluate: () => child.stdout,
+        onError: (error) => asNodeRuntimeError(error, "transport_failed", "The process-host output failed."),
+    }),
+    write: (bytes) => writeHelper(child, bytes),
+});
+const codexLaunchTarget = (authorization) => {
+    const codex = authorization?.codex;
+    return codex?.vouchTarget.adapter === "codex" ? codex.vouchTarget : undefined;
+};
+const piRpcLaunchTarget = (authorization) => {
+    const piRpc = authorization?.piRpc;
+    if (piRpc === undefined)
+        return;
+    return {
+        adapter: "pi-rpc",
+        adapterVersion: piRpc.policy.adapterVersion,
+        conversationPolicyRevision: piRpc.policy.conversationPolicyRevision,
+        executablePath: piRpc.artifact.interpreterPath,
+        ownerKinds: ["pi-rpc-probe", "pi-rpc-session"],
+        sandboxPolicyRevision: piRpc.policy.conversationPolicyRevision,
+        sha256: piRpc.artifact.interpreterSha256,
+        vouchPolicyRevision: piRpc.policy.vouchPolicyRevision,
+    };
+};
+const resolvedTargets = (authorization, options) => {
+    const target = codexLaunchTarget(authorization) ?? piRpcLaunchTarget(authorization);
+    return target === undefined ? options.targets : Object.freeze([target]);
+};
+const spawnVouchedHelper = (input) => Effect.scoped(openDarwinVouchedTarget(input.request, resolvedTargets(input.authorization, input.options)).pipe(Effect.flatMap((target) => spawnHelper(input.artifact, target.descriptor, input.request.owner.kind === "interactive-terminal"))));
+const openHelper = Effect.fnUntraced(function* (input) {
+    yield* requireDarwinHost(input.artifact);
+    const child = yield* Effect.acquireRelease(spawnVouchedHelper(input), (helper) => Effect.sync(() => {
+        helper.stdin.destroy();
+        helper.stdout.destroy();
+        killHelper(helper);
+    }));
+    yield* verifyArtifactBinding(input.artifact);
+    return helperTransport(child);
+});
+export const makeDarwinNativeProcessHostBootstrap = (options) => ({
+    open: (artifact, request, authorization) => openHelper({ artifact, authorization, options, request }),
+});
+//# sourceMappingURL=darwin-native-host-bootstrap.js.map

package/dist/runtime/process/resource/darwin-native-host-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin-native-host-bootstrap.js","sourceRoot":"","sources":["../../../../src/runtime/process/resource/darwin-native-host-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAGzC,OAAO,KAAK,UAAU,MAAM,yCAAyC,CAAC;AACtE,OAAO,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAE5C,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAEL,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAclC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAoB,EAAE,CAC3D,oBAAoB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,4DAA4D;AAC5D,yEAAyE;AACzE,2DAA2D;AAC3D,MAAM,uBAAuB,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;AAEtD,MAAM,iBAAiB,GAAG,CACxB,QAAwC,EACD,EAAE,CACzC,OAAO,CAAC,QAAQ,KAAK,QAAQ;IAC7B,OAAO,CAAC,IAAI,KAAK,OAAO;IACxB,QAAQ,CAAC,YAAY,KAAK,cAAc;IACtC,CAAC,CAAC,MAAM,CAAC,IAAI;IACb,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,oBAAoB,CAClB,kBAAkB,EAClB,sDAAsD,CACvD,CACF,CAAC;AAER,MAAM,oBAAoB,GAAG,CAC3B,KAAmB,EACnB,OAAmB,EACnB,OAAmB,EACb,EAAE;IACR,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAmB,EAAQ,EAAE;IAC/C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,QAAwC,EACD,EAAE,CACzC,MAAM,CAAC,UAAU,CAAC;IAChB,KAAK,EAAE,GAAG,EAAE,CACV,cAAc,CAAC,oDAAoD,CAAC;IACtE,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,IACE,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,oBAAoB;YAClD,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM;YAChC,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK;YAC/B,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,qBAAqB;YACnD,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAC/B,CAAC;YACD,MAAM,cAAc,CAClB,oDAAoD,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,CAClB,QAAwC,EACxC,gBAAwB,EACxB,QAAiB,EAC8B,EAAE,CACjD,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE;QACrC,QAAQ;QACR,GAAG,EAAE,EAAE;QACP,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;KACzE,CAAiB,CAAC;IACnB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,CACJ,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,0CAA0C,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACtB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,UAAU,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,GAAG,CACjB,KAAmB,EAC2C,EAAE,CAChE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;IACzB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,CACJ,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CACnE,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAAqB,EAAQ,EAAE;QAClE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACtB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,CAClB,KAAmB,EACnB,KAAiB,EACsB,EAAE,CACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;IACzB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE;QAC9C,MAAM,CACJ,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YACnC,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,gCAAgC,CAAC,CAAC,CAClE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAIL,MAAM,wBAAwB;IACnB,OAAO,CAA8B;IACrC,MAAM,CAAe;IAC9B,UAAU,GAAG,IAAI,CAAC;IACT,OAAO,CAAiB;IAEjC,YACE,KAAmB,EACnB,MAAmC,EACnC,MAAsB;QAEtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;YAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAEQ,OAAO,GAAG,CAAC,KAAa,EAAQ,EAAE;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,IAAI,CACT,kBAAkB,CAChB,KAAK,EACL,kBAAkB,EAClB,4CAA4C,CAC7C,CACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEO,MAAM,GAAG,GAAS,EAAE;QAC3B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC;IAEO,QAAQ,GAAG,CAAC,KAAc,EAAQ,EAAE;QAC3C,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,IAAI,CACT,kBAAkB,CAChB,KAAK,EACL,kBAAkB,EAClB,iCAAiC,CAClC,CACF,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,SAAS,CAAC,MAA6C;QACrD,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;CACF;AAED,MAAM,YAAY,GAAG,CACnB,KAAmB,EACnB,MAAmC,EACI,EAAE,CACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;IACzB,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACrE,QAAQ,CAAC,KAAK,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,eAAe,GAAG,CAAC,KAAmB,EAA8B,EAAE,CAAC,CAAC;IAC5E,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QAC5B,UAAU,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QAC3B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa;YAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9E,CAAC,CAAC;IACF,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC;IACvB,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;IACzD,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM;QAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,kBAAkB,CAChB,KAAK,EACL,kBAAkB,EAClB,iCAAiC,CAClC;KACJ,CAAC;IACF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CACxB,aAA0C,EACE,EAAE;IAC9C,MAAM,KAAK,GAAG,aAAa,EAAE,KAAK,CAAC;IACnC,OAAO,KAAK,EAAE,WAAW,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,aAA0C,EACE,EAAE;IAC9C,MAAM,KAAK,GAAG,aAAa,EAAE,KAAK,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,0BAA0B,EAAE,KAAK,CAAC,MAAM,CAAC,0BAA0B;QACnE,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;QAC9C,UAAU,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAC9C,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,0BAA0B;QAC9D,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,iBAAiB;QACxC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB;KACtD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CACtB,aAAqD,EACrD,OAAuC,EACI,EAAE;IAC7C,MAAM,MAAM,GACV,iBAAiB,CAAC,aAAa,CAAC,IAAI,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACvE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC;AASF,MAAM,kBAAkB,GAAG,CAAC,KAAyB,EAAE,EAAE,CACvD,MAAM,CAAC,MAAM,CACX,uBAAuB,CACrB,KAAK,CAAC,OAAO,EACb,eAAe,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CACpD,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,WAAW,CACT,KAAK,CAAC,QAAQ,EACd,MAAM,CAAC,UAAU,EACjB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,sBAAsB,CACpD,CACF,CACF,CACF,CAAC;AAEJ,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC5C,KAAyB;IAEzB,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CACxC,kBAAkB,CAAC,KAAK,CAAC,EACzB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACf,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC,CACL,CAAC;IACF,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,OAAuC,EACX,EAAE,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CACzC,UAAU,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;CAC5D,CAAC,CAAC"}

package/dist/runtime/process/resource/darwin-source-candidate-layer.d.ts

@@ -0,0 +1,16 @@
+import { Layer } from "effect";
+import { type NodeRuntimeError } from "../../errors.js";
+import type { NativeProcessHostReleaseIdentity } from "./native-host-release-identity.js";
+import { ProcessResourceManager } from "./service.js";
+export type DarwinCompatibilitySourceCandidateInput = {
+    readonly identity: NativeProcessHostReleaseIdentity;
+    readonly nodeExecutablePath: string;
+};
+/**
+ * H2 source composition plus the E2 system-Git consumer migration for the
+ * exact Darwin compatibility tier. Layer acquisition verifies both the helper
+ * and the fixed system Git target. All other targets remain fail-closed;
+ * higher-level composition owns Codex's separate durable authorization.
+ */
+export declare const makeDarwinCompatibilitySourceCandidateLayer: (input: DarwinCompatibilitySourceCandidateInput) => Layer.Layer<ProcessResourceManager, NodeRuntimeError>;
+//# sourceMappingURL=darwin-source-candidate-layer.d.ts.map

package/dist/runtime/process/resource/darwin-source-candidate-layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin-source-candidate-layer.d.ts","sourceRoot":"","sources":["../../../../src/runtime/process/resource/darwin-source-candidate-layer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEvC,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAS9E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,MAAM,uCAAuC,GAAG;IACpD,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,CAAC;AA+CF;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C,GACtD,OAAO,uCAAuC,KAC7C,KAAK,CAAC,KAAK,CAAC,sBAAsB,EAAE,gBAAgB,CAatD,CAAC"}

package/dist/runtime/process/resource/darwin-source-candidate-layer.js

@@ -0,0 +1,51 @@
+import { Effect, Layer } from "effect";
+import { makeNodeRuntimeError } from "../../errors.js";
+import { makeDarwinNativeProcessHostBootstrap } from "./darwin-native-host-bootstrap.js";
+import { inspectDarwinVouchedTarget, } from "./darwin-vouch-policy.js";
+import { openNativeProcessHostArtifact } from "./native-host-artifact.js";
+import { ProcessResourceManager } from "./service.js";
+const DARWIN_SYSTEM_GIT_PATH = "/usr/bin/git";
+const inspectDarwinSystemGit = Effect.fn("DarwinCompatibilitySourceCandidate.inspectSystemGit")(function* () {
+    const identity = yield* inspectDarwinVouchedTarget(DARWIN_SYSTEM_GIT_PATH);
+    return {
+        adapter: "git",
+        adapterVersion: "apple-system-git-v1",
+        executablePath: identity.path,
+        ownerKinds: ["git-inspection"],
+        sandboxPolicyRevision: "git-read-only-inspection-v1",
+        sha256: identity.sha256,
+        vouchPolicyRevision: "adr-009-e2-v1",
+    };
+});
+const unsupportedSourceCandidate = () => makeNodeRuntimeError("transport_failed", "The darwin-arm64 process-resource source candidate is unavailable.");
+const requireDarwinArm64 = (identity) => process.platform === "darwin" &&
+    process.arch === "arm64" &&
+    identity.targetTriple === "darwin-arm64"
+    ? Effect.void
+    : Effect.fail(unsupportedSourceCandidate());
+const artifactExpectation = (input) => ({
+    basename: input.identity.basename,
+    nodeExecutablePath: input.nodeExecutablePath,
+    protocolVersion: input.identity.protocolVersion,
+    sha256: input.identity.sha256,
+    targetTriple: input.identity.targetTriple,
+});
+/**
+ * H2 source composition plus the E2 system-Git consumer migration for the
+ * exact Darwin compatibility tier. Layer acquisition verifies both the helper
+ * and the fixed system Git target. All other targets remain fail-closed;
+ * higher-level composition owns Codex's separate durable authorization.
+ */
+export const makeDarwinCompatibilitySourceCandidateLayer = (input) => {
+    const artifact = artifactExpectation(input);
+    return Layer.unwrap(Effect.gen(function* () {
+        yield* requireDarwinArm64(input.identity);
+        yield* Effect.scoped(openNativeProcessHostArtifact(artifact));
+        const git = yield* inspectDarwinSystemGit();
+        return ProcessResourceManager.configuredNativeLayer({
+            artifact,
+            bootstrap: makeDarwinNativeProcessHostBootstrap({ targets: [git] }),
+        });
+    }));
+};
+//# sourceMappingURL=darwin-source-candidate-layer.js.map

package/dist/runtime/process/resource/darwin-source-candidate-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin-source-candidate-layer.js","sourceRoot":"","sources":["../../../../src/runtime/process/resource/darwin-source-candidate-layer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAyB,MAAM,iBAAiB,CAAC;AAE9E,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,EAEL,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAOtD,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAE9C,MAAM,sBAAsB,GAAG,MAAM,CAAC,EAAE,CACtC,qDAAqD,CACtD,CAAC,QAAQ,CAAC;IAIT,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC3E,OAAO;QACL,OAAO,EAAE,KAAK;QACd,cAAc,EAAE,qBAAqB;QACrC,cAAc,EAAE,QAAQ,CAAC,IAAI;QAC7B,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,qBAAqB,EAAE,6BAA6B;QACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,mBAAmB,EAAE,eAAe;KACrC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,GAAqB,EAAE,CACxD,oBAAoB,CAClB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;AAEJ,MAAM,kBAAkB,GAAG,CACzB,QAA0C,EACH,EAAE,CACzC,OAAO,CAAC,QAAQ,KAAK,QAAQ;IAC7B,OAAO,CAAC,IAAI,KAAK,OAAO;IACxB,QAAQ,CAAC,YAAY,KAAK,cAAc;IACtC,CAAC,CAAC,MAAM,CAAC,IAAI;IACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC;AAEhD,MAAM,mBAAmB,GAAG,CAC1B,KAA8C,EACR,EAAE,CAAC,CAAC;IAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;IACjC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;IAC5C,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;IAC/C,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;IAC7B,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;CAC1C,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CACzD,KAA8C,EACS,EAAE;IACzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,CACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,KAAK,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,sBAAsB,EAAE,CAAC;QAC5C,OAAO,sBAAsB,CAAC,qBAAqB,CAAC;YAClD,QAAQ;YACR,SAAS,EAAE,oCAAoC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/runtime/process/resource/darwin-vouch-policy.d.ts

@@ -0,0 +1,44 @@
+import { Effect, type Scope } from "effect";
+import { type NodeRuntimeError } from "../../errors.js";
+import type { ProcessOwnerKind, RegisteredProcessResourceLaunchRequest } from "./contract.js";
+export type DarwinVouchedAdapter = "codex" | "git" | "pi-rpc" | "terminal";
+export type DarwinVouchedTargetExpectation = {
+    readonly adapter: DarwinVouchedAdapter;
+    readonly adapterVersion: string;
+    readonly conversationPolicyRevision?: string;
+    readonly executablePath: string;
+    readonly ownerKinds: readonly ProcessOwnerKind[];
+    readonly sandboxPolicyRevision: string;
+    readonly sha256: string;
+    readonly vouchPolicyRevision: string;
+};
+export type DarwinVouchedTargetIdentity = {
+    readonly device: string;
+    readonly inode: string;
+    readonly path: string;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+};
+export type DarwinVouchedTargetLease = {
+    readonly adapter: DarwinVouchedAdapter;
+    readonly adapterVersion: string;
+    readonly descriptor: number;
+    readonly identity: TargetIdentity;
+    readonly path: string;
+    readonly sandboxPolicyRevision: string;
+    readonly sha256: string;
+    readonly vouchPolicyRevision: string;
+};
+type TargetIdentity = {
+    readonly changedAtNanoseconds: bigint;
+    readonly device: bigint;
+    readonly inode: bigint;
+    readonly modifiedAtNanoseconds: bigint;
+    readonly size: bigint;
+};
+export declare const inspectDarwinVouchedTarget: (path: string) => Effect.Effect<DarwinVouchedTargetIdentity, NodeRuntimeError, never>;
+export declare const retainDarwinVouchedAuthorizationTarget: (expectation: DarwinVouchedTargetExpectation) => Effect.Effect<DarwinVouchedTargetLease, NodeRuntimeError, Scope.Scope>;
+export declare const verifyRetainedDarwinVouchedTargetPath: (lease: DarwinVouchedTargetLease) => void;
+export declare const openDarwinVouchedTarget: (request: RegisteredProcessResourceLaunchRequest, expectations: readonly DarwinVouchedTargetExpectation[]) => Effect.Effect<DarwinVouchedTargetLease, NodeRuntimeError, Scope.Scope>;
+export {};
+//# sourceMappingURL=darwin-vouch-policy.d.ts.map

package/dist/runtime/process/resource/darwin-vouch-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin-vouch-policy.d.ts","sourceRoot":"","sources":["../../../../src/runtime/process/resource/darwin-vouch-policy.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAE5C,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EACV,gBAAgB,EAChB,sCAAsC,EACvC,MAAM,eAAe,CAAC;AAQvB,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE3E,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACjD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAuSF,eAAO,MAAM,0BAA0B,uFAcrC,CAAC;AAwCH,eAAO,MAAM,sCAAsC,yHAQlD,CAAC;AAEF,eAAO,MAAM,qCAAqC,GAChD,OAAO,wBAAwB,KAC9B,IAmBF,CAAC;AAEF,eAAO,MAAM,uBAAuB,sLASlC,CAAC"}

package/dist/runtime/process/resource/darwin-vouch-policy.js

@@ -0,0 +1,253 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { constants, fstatSync, lstatSync } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { isAbsolute, resolve } from "node:path";
+import { Effect } from "effect";
+import { asNodeRuntimeError, makeNodeRuntimeError, } from "../../errors.js";
+const maximumVouchedTargetBytes = 256 * 1024 * 1024;
+const targetDigestChunkBytes = 64 * 1024;
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/u;
+const POSIX_WRITABLE_BY_OTHERS = 0o022;
+const POSIX_EXECUTABLE = 0o100;
+const vouchError = () => makeNodeRuntimeError("transport_failed", "The requested executable is not admitted by the macOS vouch policy.");
+const identityOf = (metadata) => ({
+    changedAtNanoseconds: metadata.ctimeNs,
+    device: metadata.dev,
+    inode: metadata.ino,
+    modifiedAtNanoseconds: metadata.mtimeNs,
+    size: metadata.size,
+});
+const sameIdentity = (metadata, identity) => metadata.ctimeNs === identity.changedAtNanoseconds &&
+    metadata.dev === identity.device &&
+    metadata.ino === identity.inode &&
+    metadata.mtimeNs === identity.modifiedAtNanoseconds &&
+    metadata.size === identity.size;
+const safeOwner = (metadata) => metadata.uid === 0n ||
+    typeof process.getuid !== "function" ||
+    metadata.uid === BigInt(process.getuid());
+const safeLinkCount = (metadata) => metadata.uid === 0n ? metadata.nlink > 0n : metadata.nlink === 1n;
+const safeMetadata = (metadata) => metadata.isFile() &&
+    !metadata.isSymbolicLink() &&
+    safeLinkCount(metadata) &&
+    metadata.size > 0n &&
+    metadata.size <= BigInt(maximumVouchedTargetBytes) &&
+    safeOwner(metadata) &&
+    (Number(metadata.mode) & POSIX_WRITABLE_BY_OTHERS) === 0 &&
+    (Number(metadata.mode) & POSIX_EXECUTABLE) !== 0;
+const digestMatches = (actual, expected) => {
+    const expectedBytes = Buffer.from(expected, "hex");
+    return (actual.byteLength === expectedBytes.byteLength &&
+        timingSafeEqual(actual, expectedBytes));
+};
+const ownerMatchesExpectation = (expectation, ownerKind) => {
+    switch (expectation.adapter) {
+        case "git":
+            return ownerKind === "git-inspection";
+        case "terminal":
+            return ownerKind === "interactive-terminal";
+        case "codex":
+            return ownerKind === "codex-probe" || ownerKind === "codex-session";
+        case "pi-rpc":
+            return ownerKind === "pi-rpc-probe" || ownerKind === "pi-rpc-session";
+    }
+};
+const tierMatchesExpectation = (expectation, request) => {
+    switch (expectation.adapter) {
+        case "git":
+            return request.selectedTier === "vouched_runtime";
+        case "terminal":
+            return request.selectedTier === "local_user_interactive_terminal";
+        case "codex":
+            return request.selectedTier === "cooperative_multi_pgid";
+        case "pi-rpc":
+            return request.selectedTier === "cooperative_pi_rpc_conversation";
+    }
+};
+const expectationFor = (request, expectations) => {
+    const expectation = expectations.find((candidate) => candidate.executablePath === request.executable &&
+        candidate.ownerKinds.includes(request.owner.kind));
+    if (expectation === undefined ||
+        !ownerMatchesExpectation(expectation, request.owner.kind) ||
+        !tierMatchesExpectation(expectation, request) ||
+        !isAbsolute(expectation.executablePath) ||
+        resolve(expectation.executablePath) !== expectation.executablePath ||
+        !SHA256_HEX_PATTERN.test(expectation.sha256) ||
+        expectation.adapterVersion.length === 0 ||
+        expectation.sandboxPolicyRevision.length === 0 ||
+        (expectation.adapter === "pi-rpc" &&
+            (expectation.conversationPolicyRevision === undefined ||
+                expectation.conversationPolicyRevision.length === 0)) ||
+        expectation.vouchPolicyRevision.length === 0) {
+        throw vouchError();
+    }
+    return expectation;
+};
+const validateTargetIdentity = (input) => {
+    const identity = identityOf(input.openedMetadata);
+    if (!safeMetadata(input.openedMetadata) ||
+        !sameIdentity(input.pathMetadata, identity) ||
+        !sameIdentity(input.currentMetadata, identity) ||
+        !digestMatches(input.digest, input.expectedDigest)) {
+        throw vouchError();
+    }
+    return identity;
+};
+const readTargetIdentity = async (input) => validateTargetIdentity({
+    currentMetadata: await lstat(input.expectation.executablePath, {
+        bigint: true,
+    }),
+    digest: await readTargetDigest(input.handle, input.pathMetadata.size, input.signal),
+    expectedDigest: input.expectation.sha256,
+    openedMetadata: await input.handle.stat({ bigint: true }),
+    pathMetadata: input.pathMetadata,
+});
+const readTargetDigest = async (handle, size, signal) => {
+    const digest = createHash("sha256");
+    const chunk = Buffer.allocUnsafe(targetDigestChunkBytes);
+    const expectedBytes = Number(size);
+    const readNext = async (position) => {
+        if (position >= expectedBytes)
+            return;
+        signal.throwIfAborted();
+        const { bytesRead } = await handle.read(chunk, 0, Math.min(chunk.byteLength, expectedBytes - position), position);
+        if (bytesRead <= 0)
+            throw vouchError();
+        digest.update(chunk.subarray(0, bytesRead));
+        await readNext(position + bytesRead);
+    };
+    await readNext(0);
+    signal.throwIfAborted();
+    return digest.digest();
+};
+const requireUnchangedOpenedTarget = async (input, identity) => {
+    const [currentMetadata, currentPathMetadata] = await Promise.all([
+        input.handle.stat({ bigint: true }),
+        lstat(input.path, { bigint: true }),
+    ]);
+    if (!sameIdentity(currentMetadata, identity) ||
+        !sameIdentity(currentPathMetadata, identity)) {
+        throw vouchError();
+    }
+};
+const inspectedTargetIdentity = (path, identity, digest) => ({
+    device: identity.device.toString(),
+    inode: identity.inode.toString(),
+    path,
+    sha256: digest.toString("hex"),
+    sizeBytes: identity.size.toString(),
+});
+const inspectOpenedTargetCandidate = async (input) => {
+    const openedMetadata = await input.handle.stat({ bigint: true });
+    const identity = identityOf(openedMetadata);
+    if (!safeMetadata(openedMetadata) ||
+        !sameIdentity(input.pathMetadata, identity))
+        throw vouchError();
+    const digest = await readTargetDigest(input.handle, openedMetadata.size, input.signal);
+    await requireUnchangedOpenedTarget(input, identity);
+    return inspectedTargetIdentity(input.path, identity, digest);
+};
+const inspectTargetCandidate = async (path, signal) => {
+    if (!isAbsolute(path) || resolve(path) !== path)
+        throw vouchError();
+    const pathMetadata = await lstat(path, { bigint: true });
+    if (!safeMetadata(pathMetadata))
+        throw vouchError();
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        return await inspectOpenedTargetCandidate({
+            handle,
+            path,
+            pathMetadata,
+            signal,
+        });
+    }
+    finally {
+        await handle.close();
+    }
+};
+const inspectTarget = async (expectation, signal) => {
+    const pathMetadata = await lstat(expectation.executablePath, {
+        bigint: true,
+    });
+    if (!safeMetadata(pathMetadata))
+        throw vouchError();
+    const handle = await open(expectation.executablePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const identity = await readTargetIdentity({
+            expectation,
+            handle,
+            pathMetadata,
+            signal,
+        });
+        return { handle, identity };
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+};
+const targetLease = (expectation, handle, identity) => ({
+    adapter: expectation.adapter,
+    adapterVersion: expectation.adapterVersion,
+    descriptor: handle.fd,
+    identity,
+    path: expectation.executablePath,
+    sandboxPolicyRevision: expectation.sandboxPolicyRevision,
+    sha256: expectation.sha256,
+    vouchPolicyRevision: expectation.vouchPolicyRevision,
+});
+export const inspectDarwinVouchedTarget = Effect.fn("DarwinVouch.inspectTarget")(function* (path) {
+    return yield* Effect.tryPromise({
+        catch: (error) => asNodeRuntimeError(error, "transport_failed", "The requested executable is not admitted by the macOS vouch policy."),
+        try: (signal) => inspectTargetCandidate(path, signal),
+    });
+});
+const retainExpectation = Effect.fnUntraced(function* (expectation) {
+    const opened = yield* Effect.acquireRelease(Effect.tryPromise({
+        catch: (error) => asNodeRuntimeError(error, "transport_failed", "The requested executable is not admitted by the macOS vouch policy."),
+        try: (signal) => inspectTarget(expectation, signal),
+    }), ({ handle }) => Effect.promise(() => handle.close()).pipe(Effect.ignore));
+    return targetLease(expectation, opened.handle, opened.identity);
+});
+const validAuthorizationExpectation = (expectation) => (expectation.adapter === "codex" || expectation.adapter === "pi-rpc") &&
+    isAbsolute(expectation.executablePath) &&
+    resolve(expectation.executablePath) === expectation.executablePath &&
+    SHA256_HEX_PATTERN.test(expectation.sha256) &&
+    expectation.adapterVersion.length > 0 &&
+    expectation.sandboxPolicyRevision.length > 0 &&
+    (expectation.adapter !== "pi-rpc" ||
+        (expectation.conversationPolicyRevision !== undefined &&
+            expectation.conversationPolicyRevision.length > 0)) &&
+    expectation.vouchPolicyRevision.length > 0 &&
+    expectation.ownerKinds.length > 0 &&
+    expectation.ownerKinds.every((owner) => expectation.adapter === "pi-rpc"
+        ? owner === "pi-rpc-probe" || owner === "pi-rpc-session"
+        : owner === "codex-probe" || owner === "codex-session");
+export const retainDarwinVouchedAuthorizationTarget = Effect.fnUntraced(function* (expectation) {
+    if (!validAuthorizationExpectation(expectation))
+        return yield* Effect.fail(vouchError());
+    return yield* retainExpectation(expectation);
+});
+export const verifyRetainedDarwinVouchedTargetPath = (lease) => {
+    try {
+        const openedMetadata = fstatSync(lease.descriptor, { bigint: true });
+        const pathMetadata = lstatSync(lease.path, { bigint: true });
+        if (!safeMetadata(openedMetadata) ||
+            !safeMetadata(pathMetadata) ||
+            !sameIdentity(openedMetadata, lease.identity) ||
+            !sameIdentity(pathMetadata, lease.identity)) {
+            throw vouchError();
+        }
+    }
+    catch (error) {
+        throw asNodeRuntimeError(error, "transport_failed", "The requested executable is not admitted by the macOS vouch policy.");
+    }
+};
+export const openDarwinVouchedTarget = Effect.fnUntraced(function* (request, expectations) {
+    const expectation = yield* Effect.try({
+        catch: () => vouchError(),
+        try: () => expectationFor(request, expectations),
+    });
+    return yield* retainExpectation(expectation);
+});
+//# sourceMappingURL=darwin-vouch-policy.js.map

package/dist/runtime/process/resource/darwin-vouch-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin-vouch-policy.js","sourceRoot":"","sources":["../../../../src/runtime/process/resource/darwin-vouch-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAoB,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAmB,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAE5C,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAOzB,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAC7C,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AA0C/B,MAAM,UAAU,GAAG,GAAqB,EAAE,CACxC,oBAAoB,CAClB,kBAAkB,EAClB,qEAAqE,CACtE,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,QAAqB,EAAkB,EAAE,CAAC,CAAC;IAC7D,oBAAoB,EAAE,QAAQ,CAAC,OAAO;IACtC,MAAM,EAAE,QAAQ,CAAC,GAAG;IACpB,KAAK,EAAE,QAAQ,CAAC,GAAG;IACnB,qBAAqB,EAAE,QAAQ,CAAC,OAAO;IACvC,IAAI,EAAE,QAAQ,CAAC,IAAI;CACpB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CACnB,QAAqB,EACrB,QAAwB,EACf,EAAE,CACX,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,oBAAoB;IAClD,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM;IAChC,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK;IAC/B,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,qBAAqB;IACnD,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;AAElC,MAAM,SAAS,GAAG,CAAC,QAAqB,EAAW,EAAE,CACnD,QAAQ,CAAC,GAAG,KAAK,EAAE;IACnB,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;IACpC,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAE5C,MAAM,aAAa,GAAG,CAAC,QAAqB,EAAW,EAAE,CACvD,QAAQ,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;AAEpE,MAAM,YAAY,GAAG,CAAC,QAAqB,EAAW,EAAE,CACtD,QAAQ,CAAC,MAAM,EAAE;IACjB,CAAC,QAAQ,CAAC,cAAc,EAAE;IAC1B,aAAa,CAAC,QAAQ,CAAC;IACvB,QAAQ,CAAC,IAAI,GAAG,EAAE;IAClB,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,yBAAyB,CAAC;IAClD,SAAS,CAAC,QAAQ,CAAC;IACnB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,KAAK,CAAC;IACxD,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAEnD,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAW,EAAE;IAClE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,CACL,MAAM,CAAC,UAAU,KAAK,aAAa,CAAC,UAAU;QAC9C,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,CACvC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAC9B,WAA2C,EAC3C,SAA2B,EAClB,EAAE;IACX,QAAQ,WAAW,CAAC,OAAO,EAAE,CAAC;QAC5B,KAAK,KAAK;YACR,OAAO,SAAS,KAAK,gBAAgB,CAAC;QACxC,KAAK,UAAU;YACb,OAAO,SAAS,KAAK,sBAAsB,CAAC;QAC9C,KAAK,OAAO;YACV,OAAO,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,eAAe,CAAC;QACtE,KAAK,QAAQ;YACX,OAAO,SAAS,KAAK,cAAc,IAAI,SAAS,KAAK,gBAAgB,CAAC;IAC1E,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,WAA2C,EAC3C,OAA+C,EACtC,EAAE;IACX,QAAQ,WAAW,CAAC,OAAO,EAAE,CAAC;QAC5B,KAAK,KAAK;YACR,OAAO,OAAO,CAAC,YAAY,KAAK,iBAAiB,CAAC;QACpD,KAAK,UAAU;YACb,OAAO,OAAO,CAAC,YAAY,KAAK,iCAAiC,CAAC;QACpE,KAAK,OAAO;YACV,OAAO,OAAO,CAAC,YAAY,KAAK,wBAAwB,CAAC;QAC3D,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,YAAY,KAAK,iCAAiC,CAAC;IACtE,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,OAA+C,EAC/C,YAAuD,EACvB,EAAE;IAClC,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CACnC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,cAAc,KAAK,OAAO,CAAC,UAAU;QAC/C,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CACpD,CAAC;IACF,IACE,WAAW,KAAK,SAAS;QACzB,CAAC,uBAAuB,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QACzD,CAAC,sBAAsB,CAAC,WAAW,EAAE,OAAO,CAAC;QAC7C,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC;QACvC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,cAAc;QAClE,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAC5C,WAAW,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QACvC,WAAW,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC;QAC9C,CAAC,WAAW,CAAC,OAAO,KAAK,QAAQ;YAC/B,CAAC,WAAW,CAAC,0BAA0B,KAAK,SAAS;gBACnD,WAAW,CAAC,0BAA0B,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACzD,WAAW,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAC5C,CAAC;QACD,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAUF,MAAM,sBAAsB,GAAG,CAC7B,KAAiC,EACjB,EAAE;IAClB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClD,IACE,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC;QACnC,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC3C,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,EAAE,QAAQ,CAAC;QAC9C,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,EAClD,CAAC;QACD,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAAE,KAKjC,EAA2B,EAAE,CAC5B,sBAAsB,CAAC;IACrB,eAAe,EAAE,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE;QAC7D,MAAM,EAAE,IAAI;KACb,CAAC;IACF,MAAM,EAAE,MAAM,gBAAgB,CAC5B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,YAAY,CAAC,IAAI,EACvB,KAAK,CAAC,MAAM,CACb;IACD,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;IACxC,cAAc,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzD,YAAY,EAAE,KAAK,CAAC,YAAY;CACjC,CAAC,CAAC;AAEL,MAAM,gBAAgB,GAAG,KAAK,EAC5B,MAAkB,EAClB,IAAY,EACZ,MAAmB,EACF,EAAE;IACnB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAgB,EAAiB,EAAE;QACzD,IAAI,QAAQ,IAAI,aAAa;YAAE,OAAO;QACtC,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CACrC,KAAK,EACL,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,GAAG,QAAQ,CAAC,EACpD,QAAQ,CACT,CAAC;QACF,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM,UAAU,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5C,MAAM,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IACvC,CAAC,CAAC;IACF,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAG,KAAK,EACxC,KAA6D,EAC7D,QAAwB,EACT,EAAE;IACjB,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACnC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,IACE,CAAC,YAAY,CAAC,eAAe,EAAE,QAAQ,CAAC;QACxC,CAAC,YAAY,CAAC,mBAAmB,EAAE,QAAQ,CAAC,EAC5C,CAAC;QACD,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAC9B,IAAY,EACZ,QAAwB,EACxB,MAAc,EACe,EAAE,CAAC,CAAC;IACjC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE;IAChC,IAAI;IACJ,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC9B,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,KAAK,EAAE,KAK3C,EAAwC,EAAE;IACzC,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC5C,IACE,CAAC,YAAY,CAAC,cAAc,CAAC;QAC7B,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC;QAE3C,MAAM,UAAU,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,KAAK,CAAC,MAAM,EACZ,cAAc,CAAC,IAAI,EACnB,KAAK,CAAC,MAAM,CACb,CAAC;IACF,MAAM,4BAA4B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpD,OAAO,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,KAAK,EAClC,IAAY,EACZ,MAAmB,EACmB,EAAE;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,UAAU,EAAE,CAAC;IACpE,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;QAAE,MAAM,UAAU,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CAAC;YACxC,MAAM;YACN,IAAI;YACJ,YAAY;YACZ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EACzB,WAA2C,EAC3C,MAAmB,EAIlB,EAAE;IACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE;QAC3D,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;QAAE,MAAM,UAAU,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,WAAW,CAAC,cAAc,EAC1B,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAC1C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;YACxC,WAAW;YACX,MAAM;YACN,YAAY;YACZ,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,WAA2C,EAC3C,MAAkB,EAClB,QAAwB,EACE,EAAE,CAAC,CAAC;IAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;IAC5B,cAAc,EAAE,WAAW,CAAC,cAAc;IAC1C,UAAU,EAAE,MAAM,CAAC,EAAE;IACrB,QAAQ;IACR,IAAI,EAAE,WAAW,CAAC,cAAc;IAChC,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;IACxD,MAAM,EAAE,WAAW,CAAC,MAAM;IAC1B,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,EAAE,CACjD,2BAA2B,CAC5B,CAAC,QAAQ,CAAC,EACT,IAAY;IAEZ,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAC9B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,kBAAkB,CAChB,KAAK,EACL,kBAAkB,EAClB,qEAAqE,CACtE;QACH,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC;KACtD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACnD,WAA2C;IAE3C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CACzC,MAAM,CAAC,UAAU,CAAC;QAChB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,kBAAkB,CAChB,KAAK,EACL,kBAAkB,EAClB,qEAAqE,CACtE;QACH,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC;KACpD,CAAC,EACF,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACzE,CAAC;IACF,OAAO,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CACpC,WAA2C,EAClC,EAAE,CACX,CAAC,WAAW,CAAC,OAAO,KAAK,OAAO,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAC;IACrE,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC;IACtC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,cAAc;IAClE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;IAC3C,WAAW,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;IACrC,WAAW,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;IAC5C,CAAC,WAAW,CAAC,OAAO,KAAK,QAAQ;QAC/B,CAAC,WAAW,CAAC,0BAA0B,KAAK,SAAS;YACnD,WAAW,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvD,WAAW,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;IAC1C,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;IACjC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrC,WAAW,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,gBAAgB;QACxD,CAAC,CAAC,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,eAAe,CACzD,CAAC;AAEJ,MAAM,CAAC,MAAM,sCAAsC,GAAG,MAAM,CAAC,UAAU,CACrE,QAAQ,CAAC,EACP,WAA2C;IAE3C,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC;QAC7C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CACnD,KAA+B,EACzB,EAAE;IACR,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IACE,CAAC,YAAY,CAAC,cAAc,CAAC;YAC7B,CAAC,YAAY,CAAC,YAAY,CAAC;YAC3B,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC;YAC7C,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,EAC3C,CAAC;YACD,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CACtB,KAAK,EACL,kBAAkB,EAClB,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAChE,OAA+C,EAC/C,YAAuD;IAEvD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACpC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;QACzB,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC;KACjD,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC"}