@mannyc1/ts-release 0.0.6 → 0.2.2

package/dist/drivers/glob.js

@@ -0,0 +1,162 @@
+// Portable matcher for the documented archive `files` grammar: `*` and `?`
+// inside one segment, `**` as a whole segment spanning segments, `[...]`
+// classes, and `{a,b}` alternation. Patterns reach here already slash
+// normalized, so a backslash is only ever an explicit escape.
+// A malformed pattern (unclosed `[` or `{`) matches nothing, so a typo fails
+// loudly upstream as "patterns matched no workspace files".
+const alternativeLimit = 1024;
+const metacharacters = new Set(["\\", "^", "$", ".", "*", "+", "?", "(", ")", "[", "]", "{", "}", "|", "/"]);
+const literal = (value) => metacharacters.has(value) ? `\\${value}` : value;
+const classLiteral = (value) => ["\\", "]", "^", "["].includes(value) ? `\\${value}` : value;
+const classEnd = (pattern, open) => {
+    let index = open + 1;
+    if (pattern[index] === "!" || pattern[index] === "^")
+        index += 1;
+    if (pattern[index] === "]")
+        index += 1;
+    while (index < pattern.length) {
+        if (pattern[index] === "\\")
+            index += 2;
+        else if (pattern[index] === "]")
+            return index;
+        else
+            index += 1;
+    }
+    return undefined;
+};
+const characterClass = (body) => {
+    const negated = body.startsWith("!") || body.startsWith("^");
+    const members = negated ? body.slice(1) : body;
+    let source = "";
+    let index = 0;
+    while (index < members.length) {
+        const value = members[index];
+        if (value === "\\" && index + 1 < members.length) {
+            source += `\\${members[index + 1]}`;
+            index += 2;
+            continue;
+        }
+        source += value === "-" ? "-" : classLiteral(value);
+        index += 1;
+    }
+    return `[${negated ? "^" : ""}${source}]`;
+};
+// `{a,b}` expands to whole alternative patterns because a branch may contain
+// separators (`{src/a,b}/x`); a class is copied verbatim so `,` inside it stays
+// a class member.
+const expand = (pattern, start, depth) => {
+    const completed = [];
+    let current = [""];
+    let index = start;
+    const append = (text) => { current = current.map((value) => value + text); };
+    const flush = () => { completed.push(...current); current = [""]; };
+    while (index < pattern.length) {
+        const value = pattern[index];
+        if (value === "\\") {
+            if (index + 1 >= pattern.length)
+                return undefined;
+            append(pattern.slice(index, index + 2));
+            index += 2;
+        }
+        else if (value === "[") {
+            const end = classEnd(pattern, index);
+            if (end === undefined)
+                return undefined;
+            append(pattern.slice(index, end + 1));
+            index = end + 1;
+        }
+        else if (value === "{") {
+            const group = expand(pattern, index + 1, depth + 1);
+            if (group === undefined)
+                return undefined;
+            current = current.flatMap((prefix) => group.alternatives.map((suffix) => prefix + suffix));
+            if (current.length > alternativeLimit)
+                return undefined;
+            index = group.next;
+        }
+        else if (depth > 0 && value === "}") {
+            flush();
+            return { alternatives: completed, next: index + 1 };
+        }
+        else if (depth > 0 && value === ",") {
+            flush();
+            index += 1;
+        }
+        else {
+            append(value);
+            index += 1;
+        }
+    }
+    if (depth > 0)
+        return undefined;
+    flush();
+    return { alternatives: completed, next: index };
+};
+const globstarAt = (pattern, index) => pattern.startsWith("**", index) &&
+    (index + 2 === pattern.length || pattern[index + 2] === "/");
+const compile = (pattern) => {
+    let source = "^";
+    let index = 0;
+    while (index < pattern.length) {
+        const value = pattern[index];
+        if (value === "\\") {
+            if (index + 1 >= pattern.length)
+                return undefined;
+            source += literal(pattern[index + 1]);
+            index += 2;
+        }
+        else if (value === "[") {
+            const end = classEnd(pattern, index);
+            if (end === undefined)
+                return undefined;
+            source += characterClass(pattern.slice(index + 1, end));
+            index = end + 1;
+        }
+        else if (value === "*") {
+            let run = 1;
+            while (pattern[index + run] === "*")
+                run += 1;
+            const whole = (index === 0 || pattern[index - 1] === "/") &&
+                (index + run === pattern.length || pattern[index + run] === "/");
+            const rest = index + run + 1;
+            if (run === 2 && whole && index + run === pattern.length)
+                source += ".*";
+            else if (run === 2 && whole) {
+                // `**/**` collapses; otherwise `**/` skips whole segments and whatever
+                // follows must still match at least one character, so `**/*` never
+                // matches a bare directory the way `a/*` does.
+                if (!globstarAt(pattern, rest)) {
+                    source += rest === pattern.length ? "(?:[^/]*/)*" : "(?:[^/]*/)*(?=[\\s\\S])";
+                }
+                run += 1;
+            }
+            else
+                source += "[^/]*";
+            index += run;
+        }
+        else if (value === "?") {
+            source += "[^/]";
+            index += 1;
+        }
+        else {
+            source += literal(value);
+            index += 1;
+        }
+    }
+    // A reversed class range like [z-a] is legal glob text but an invalid
+    // regular expression; it matches nothing, like every other malformed pattern.
+    try {
+        return new RegExp(`${source}$`);
+    }
+    catch {
+        return undefined;
+    }
+};
+export const matchGlob = (pattern) => {
+    const expanded = expand(pattern, 0, 0);
+    const compiled = expanded?.alternatives.map(compile);
+    if (compiled === undefined || compiled.some((item) => item === undefined))
+        return () => false;
+    return (path) => compiled.some((item) => item.test(path));
+};
+//# sourceMappingURL=glob.js.map

package/dist/drivers/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../src/drivers/glob.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yEAAyE;AACzE,sEAAsE;AACtE,8DAA8D;AAC9D,6EAA6E;AAC7E,4DAA4D;AAC5D,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAC7B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAC5G,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;AAC3F,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;AAC5G,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,IAAY,EAAsB,EAAE;IACrE,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,CAAA;IACpB,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,IAAI,CAAC,CAAA;IAChE,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,IAAI,CAAC,CAAA;IACtC,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI;YAAE,KAAK,IAAI,CAAC,CAAA;aAClC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAA;;YACxC,KAAK,IAAI,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AACD,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9C,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAE,CAAA;QAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAE,EAAE,CAAA;YACpC,KAAK,IAAI,CAAC,CAAA;YACV,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QACnD,KAAK,IAAI,CAAC,CAAA;IACZ,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,GAAG,CAAA;AAC3C,CAAC,CAAA;AACD,6EAA6E;AAC7E,gFAAgF;AAChF,kBAAkB;AAClB,MAAM,MAAM,GAAG,CACb,OAAe,EAAE,KAAa,EAAE,KAAa,EACwC,EAAE;IACvF,MAAM,SAAS,GAAkB,EAAE,CAAA;IACnC,IAAI,OAAO,GAA0B,CAAC,EAAE,CAAC,CAAA;IACzC,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,CAAA,CAAC,CAAC,CAAA;IACnF,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,CAAA,CAAC,CAAC,CAAA;IAClE,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAE,CAAA;QAC7B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAA;YACjD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;YACvC,KAAK,IAAI,CAAC,CAAA;QACZ,CAAC;aAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YACpC,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACvC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;YACrC,KAAK,GAAG,GAAG,GAAG,CAAC,CAAA;QACjB,CAAC;aAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACnD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAA;YAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB;gBAAE,OAAO,SAAS,CAAA;YACvD,KAAK,GAAG,KAAK,CAAC,IAAI,CAAA;QACpB,CAAC;aAAM,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACtC,KAAK,EAAE,CAAA;YACP,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAA;QACrD,CAAC;aAAM,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACtC,KAAK,EAAE,CAAA;YACP,KAAK,IAAI,CAAC,CAAA;QACZ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,CAAA;YACb,KAAK,IAAI,CAAC,CAAA;QACZ,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAC/B,KAAK,EAAE,CAAA;IACP,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACjD,CAAC,CAAA;AACD,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,KAAa,EAAW,EAAE,CAC7D,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;IAC/B,CAAC,KAAK,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAA;AAC9D,MAAM,OAAO,GAAG,CAAC,OAAe,EAAsB,EAAE;IACtD,IAAI,MAAM,GAAG,GAAG,CAAA;IAChB,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAE,CAAA;QAC7B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAA;YACjD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAA;YACtC,KAAK,IAAI,CAAC,CAAA;QACZ,CAAC;aAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YACpC,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACvC,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;YACvD,KAAK,GAAG,GAAG,GAAG,CAAC,CAAA;QACjB,CAAC;aAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,GAAG,GAAG,CAAC,CAAA;YACX,OAAO,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,GAAG;gBAAE,GAAG,IAAI,CAAC,CAAA;YAC7C,MAAM,KAAK,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBACvD,CAAC,KAAK,GAAG,GAAG,KAAK,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAA;YAClE,MAAM,IAAI,GAAG,KAAK,GAAG,GAAG,GAAG,CAAC,CAAA;YAC5B,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,KAAK,GAAG,GAAG,KAAK,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,IAAI,CAAA;iBACnE,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC5B,uEAAuE;gBACvE,mEAAmE;gBACnE,+CAA+C;gBAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAA;gBAC/E,CAAC;gBACD,GAAG,IAAI,CAAC,CAAA;YACV,CAAC;;gBAAM,MAAM,IAAI,OAAO,CAAA;YACxB,KAAK,IAAI,GAAG,CAAA;QACd,CAAC;aAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,MAAM,CAAA;YAChB,KAAK,IAAI,CAAC,CAAA;QACZ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAA;YACxB,KAAK,IAAI,CAAC,CAAA;QACZ,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,8EAA8E;IAC9E,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AACD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAe,EAA6B,EAAE;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACpD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC,KAAK,CAAA;IAC7F,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC5D,CAAC,CAAA"}

package/dist/drivers/process.d.ts

@@ -0,0 +1,48 @@
+import * as Effect from "effect/Effect";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { DriverError } from "./errors.js";
+export interface NetworkIsolationIdentity {
+    readonly protocol: "ts-release-seccomp-network-deny/v1";
+    readonly helperSha256: string;
+    readonly librarySha256: string;
+    readonly bunVersion: string;
+    readonly bunSha256: string;
+    readonly kernel: string;
+    readonly architecture: string;
+    readonly deniedSyscalls: ReadonlyArray<string>;
+}
+export interface ExecutableIdentity {
+    readonly protocol: "ts-release-executable/v1";
+    readonly command: string;
+    readonly sha256: string;
+}
+export interface BunCompileRuntimeIdentity {
+    readonly protocol: "ts-release-bun-compile-runtime/v1";
+    readonly target: "bun-linux-x64" | "bun-linux-arm64" | "bun-darwin-x64" | "bun-darwin-arm64";
+    readonly bunVersion: string;
+    readonly source: "executing-bun" | "host-cache-private-copy";
+    readonly cacheFile: string;
+    readonly sha256: string;
+}
+export type CommandOutcome = {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+    /** Present for the production process driver; protocol doubles may omit it. */
+    readonly tool?: ExecutableIdentity;
+    readonly networkIsolation?: NetworkIsolationIdentity;
+    readonly bunCompileRuntime?: BunCompileRuntimeIdentity;
+};
+export type RunCommand = (command: {
+    readonly argv: ReadonlyArray<string>;
+    readonly cwd: string;
+    readonly environmentNames: ReadonlyArray<string>;
+    /** Complete redacted stdout for an immediate machine-protocol decoder.
+     * The caller must not persist it as diagnostic output. */
+    readonly stdout?: "complete-protocol";
+    /** Generic commands require the fail-closed Linux/libseccomp filter;
+     * certified local-only tools additionally carry their own offline switch. */
+    readonly network: "deny" | "offline-cli";
+}) => Effect.Effect<CommandOutcome, DriverError>;
+export declare const makeRunCommand: Effect.Effect<RunCommand, never, ChildProcessSpawner>;
+//# sourceMappingURL=process.d.ts.map

package/dist/drivers/process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/drivers/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AAuBjF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,oCAAoC,CAAA;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAC/C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAA;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAA;IACtD,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,kBAAkB,CAAA;IAC5F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,yBAAyB,CAAA;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAID,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAC5E,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAA;CACvD,CAAA;AACD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAC3D,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD;8DAC0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC;iFAC6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAAA;CACzC,KAAK,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;AAoJhD,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,CAuH7E,CAAA"}

package/dist/drivers/process.js

@@ -0,0 +1,257 @@
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { createHash } from "node:crypto";
+import { accessSync, chmodSync, constants, copyFileSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { delimiter, isAbsolute, join, resolve } from "node:path";
+import { readEnvironment, readOptionalEnv } from "./environment.js";
+import { redactOutput, redactProtocolOutput } from "./redact.js";
+import { networkIsolationHelperSource } from "./seccomp-helper-source.js";
+import { failure } from "./utils.js";
+import { DriverError } from "./errors.js";
+const helperDigest = createHash("sha256").update(networkIsolationHelperSource).digest("hex");
+const collect = (stream) => Stream.mkString(Stream.decodeText(stream));
+const executableIdentity = (command, cwd, path) => {
+    const candidates = command.includes("/")
+        ? [isAbsolute(command) ? command : resolve(cwd, command)]
+        : (path ?? "").split(delimiter).filter((entry) => entry.length > 0).map((entry) => resolve(entry, command));
+    const executable = candidates.find((candidate) => {
+        try {
+            accessSync(candidate, constants.X_OK);
+            return statSync(candidate).isFile();
+        }
+        catch {
+            return false;
+        }
+    });
+    if (executable === undefined)
+        throw new Error(`Executable ${command} is unavailable in the closed PATH.`);
+    const canonical = realpathSync(executable);
+    return {
+        protocol: "ts-release-executable/v1",
+        command,
+        sha256: createHash("sha256").update(readFileSync(canonical)).digest("hex")
+    };
+};
+const isDigest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/u.test(value);
+const offlineBunInstallArgv = [
+    "bun",
+    "install",
+    "--offline",
+    "--frozen-lockfile",
+    "--ignore-scripts",
+    "--no-save",
+    "--linker=hoisted"
+];
+const isOfflineBunInstall = (command) => command.network === "offline-cli" && command.argv.length === offlineBunInstallArgv.length &&
+    command.argv.every((value, index) => value === offlineBunInstallArgv[index]);
+const readBunCacheDirectory = Effect.fn("readBunCacheDirectory")(function* () {
+    const configured = yield* readOptionalEnv("BUN_INSTALL_CACHE_DIR");
+    const home = configured === undefined ? yield* readOptionalEnv("HOME") : undefined;
+    const candidate = configured ?? (home === undefined ? undefined : join(home, ".bun", "install", "cache"));
+    if (candidate === undefined || candidate.length === 0) {
+        return yield* Effect.fail(failure("Certified Bun cache access requires BUN_INSTALL_CACHE_DIR or HOME so the host cache can be located."));
+    }
+    return yield* Effect.try({
+        try: () => {
+            if (!isAbsolute(candidate))
+                throw new Error("the cache path is not absolute");
+            const canonical = realpathSync(candidate);
+            if (!statSync(canonical).isDirectory())
+                throw new Error("the cache path is not a directory");
+            return canonical;
+        },
+        catch: (cause) => failure(`The offline Bun install cache is unavailable: ${String(cause)}`)
+    });
+});
+const compileRuntimeFiles = {
+    "bun-linux-arm64": (version) => `bun-linux-aarch64-v${version}`,
+    "bun-darwin-x64": (version) => `bun-darwin-x64-v${version}`,
+    "bun-darwin-arm64": (version) => `bun-darwin-aarch64-v${version}`
+};
+const certifiedBunCompileTargets = new Set([
+    "bun-linux-x64",
+    "bun-linux-arm64",
+    "bun-darwin-x64",
+    "bun-darwin-arm64"
+]);
+const certifiedBunCompileTarget = (command) => {
+    const argv = command.argv;
+    if (command.network !== "deny" || (argv.length !== 8 && argv.length !== 9) ||
+        argv[0] !== "bun" || argv[1] !== "build" || argv[2]?.startsWith("-") !== false ||
+        argv[3] !== "--compile" || argv[4] !== "--target" || argv[6] !== "--outfile" ||
+        argv[7]?.startsWith("-") !== false || (argv.length === 9 && argv[8] !== "--minify"))
+        return undefined;
+    return certifiedBunCompileTargets.has(argv[5])
+        ? argv[5]
+        : undefined;
+};
+const resolveBunCompileRuntime = Effect.fn("resolveBunCompileRuntime")(function* (target, tool) {
+    const bunVersion = process.versions.bun;
+    if (bunVersion === undefined || bunVersion.length === 0) {
+        return yield* Effect.fail(failure("Certified Bun compilation requires a Bun parent runtime."));
+    }
+    if (target === "bun-linux-x64") {
+        return {
+            sourcePath: undefined,
+            identity: {
+                protocol: "ts-release-bun-compile-runtime/v1",
+                target,
+                bunVersion,
+                source: "executing-bun",
+                cacheFile: "executing-bun",
+                sha256: tool.sha256
+            }
+        };
+    }
+    const cache = yield* readBunCacheDirectory();
+    const cacheFile = compileRuntimeFiles[target](bunVersion);
+    return yield* Effect.try({
+        try: () => {
+            const sourcePath = join(cache, cacheFile);
+            if (lstatSync(sourcePath).isSymbolicLink() || !lstatSync(sourcePath).isFile() ||
+                realpathSync(sourcePath) !== sourcePath) {
+                throw new Error("the target runtime is not a canonical regular file");
+            }
+            return {
+                sourcePath,
+                identity: {
+                    protocol: "ts-release-bun-compile-runtime/v1",
+                    target,
+                    bunVersion,
+                    source: "host-cache-private-copy",
+                    cacheFile,
+                    sha256: createHash("sha256").update(readFileSync(sourcePath)).digest("hex")
+                }
+            };
+        },
+        catch: (cause) => failure(`The certified Bun compile runtime is unavailable: ${String(cause)}`)
+    });
+});
+const parseIsolationIdentity = (path) => {
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new Error("isolation identity is not an object");
+    const item = value;
+    if (item.protocol !== "ts-release-seccomp-network-deny/v1" || item.helperSha256 !== helperDigest ||
+        !isDigest(item.helperSha256) || !isDigest(item.librarySha256) || !isDigest(item.bunSha256) ||
+        typeof item.bunVersion !== "string" || item.bunVersion.length === 0 || typeof item.kernel !== "string" ||
+        item.kernel.length === 0 || typeof item.architecture !== "string" || item.architecture.length === 0 ||
+        !Array.isArray(item.deniedSyscalls) || item.deniedSyscalls.some((name) => typeof name !== "string")) {
+        throw new Error("isolation identity is malformed or disagrees with the embedded helper");
+    }
+    return item;
+};
+// Spawning is the capability that differs across hosts, so it arrives as a
+// service. The runner is built once per live layer and closes over the
+// spawner, keeping DriverCatalog method requirements at never.
+export const makeRunCommand = Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner;
+    return (command) => Effect.gen(function* () {
+        const baseEnvironment = yield* readEnvironment(command.environmentNames);
+        const env = isOfflineBunInstall(command)
+            ? {
+                ...Object.fromEntries(Object.entries(baseEnvironment).filter(([name]) => name !== "HOME")),
+                BUN_INSTALL_CACHE_DIR: yield* readBunCacheDirectory()
+            }
+            : baseEnvironment;
+        const executable = command.network === "deny" ? "bun" : command.argv[0];
+        const tool = yield* Effect.try({
+            try: () => executableIdentity(executable, command.cwd, env.PATH),
+            catch: (cause) => failure(String(cause))
+        });
+        const compileTarget = certifiedBunCompileTarget(command);
+        const compileRuntime = compileTarget === undefined
+            ? undefined
+            : yield* resolveBunCompileRuntime(compileTarget, tool);
+        const compileResources = compileRuntime === undefined
+            ? undefined
+            : yield* Effect.acquireRelease(Effect.sync(() => {
+                const directory = mkdtempSync(join(tmpdir(), "ts-release-bun-runtime-"));
+                const cache = join(directory, "cache");
+                mkdirSync(cache, { mode: 0o700 });
+                if (compileRuntime.sourcePath !== undefined) {
+                    copyFileSync(compileRuntime.sourcePath, join(cache, compileRuntime.identity.cacheFile));
+                    chmodSync(join(cache, compileRuntime.identity.cacheFile), 0o500);
+                }
+                chmodSync(cache, 0o500);
+                return { directory, cache };
+            }), ({ cache, directory }) => Effect.sync(() => {
+                chmodSync(cache, 0o700);
+                rmSync(directory, { recursive: true, force: true });
+            }));
+        const isolationResources = command.network === "deny"
+            ? yield* Effect.acquireRelease(Effect.sync(() => {
+                const directory = mkdtempSync(join(tmpdir(), "ts-release-seccomp-"));
+                const helper = join(directory, "network-deny.mjs");
+                const identity = join(directory, "identity.json");
+                writeFileSync(helper, networkIsolationHelperSource, { mode: 0o500 });
+                return { directory, helper, identity };
+            }), ({ directory }) => Effect.sync(() => rmSync(directory, { recursive: true, force: true })))
+            : undefined;
+        const argv = command.network === "deny"
+            ? ["--no-env-file", "--no-install", isolationResources.helper, ...command.argv]
+            : [...command.argv.slice(1)];
+        const commandEnvironment = compileResources === undefined
+            ? env
+            : { ...env, BUN_INSTALL_CACHE_DIR: compileResources.cache };
+        const handle = yield* spawner.spawn(ChildProcess.make(executable, argv, {
+            cwd: command.cwd,
+            env: isolationResources === undefined ? commandEnvironment : {
+                ...commandEnvironment,
+                TS_RELEASE_NETWORK_IDENTITY_FILE: isolationResources.identity,
+                TS_RELEASE_NETWORK_HELPER_SHA256: helperDigest,
+                TS_RELEASE_NETWORK_LIBRARY: "libseccomp.so.2"
+            },
+            stdin: "ignore", stdout: "pipe", stderr: "pipe"
+        }));
+        const output = yield* Effect.all({
+            stdout: collect(handle.stdout),
+            stderr: collect(handle.stderr),
+            exitCode: handle.exitCode
+        }, { concurrency: "unbounded" });
+        // Redaction lives here, where the env values are in hand: every
+        // consumer of child output (Exec failures, publisher stdout/stderr)
+        // is covered at the source and no driver can forget.
+        const networkIsolation = isolationResources === undefined
+            ? undefined
+            : yield* Effect.try({
+                try: () => parseIsolationIdentity(isolationResources.identity),
+                catch: (cause) => failure(String(cause))
+            });
+        if (networkIsolation !== undefined && networkIsolation.bunSha256 !== tool.sha256) {
+            return yield* Effect.fail(failure("The Bun executable changed between parent resolution and the isolation helper."));
+        }
+        if (compileResources !== undefined && compileRuntime !== undefined)
+            yield* Effect.try({
+                try: () => {
+                    const entries = readdirSync(compileResources.cache);
+                    const expected = compileRuntime.sourcePath === undefined ? [] : [compileRuntime.identity.cacheFile];
+                    if (entries.length !== expected.length || entries.some((entry, index) => entry !== expected[index])) {
+                        throw new Error("the private runtime cache changed shape");
+                    }
+                    if (expected[0] !== undefined) {
+                        const runtime = join(compileResources.cache, expected[0]);
+                        if (lstatSync(runtime).isSymbolicLink() || !lstatSync(runtime).isFile() ||
+                            createHash("sha256").update(readFileSync(runtime)).digest("hex") !== compileRuntime.identity.sha256) {
+                            throw new Error("the private runtime cache changed bytes or type");
+                        }
+                    }
+                },
+                catch: (cause) => failure(`Certified Bun compilation did not preserve its private runtime cache: ${String(cause)}`)
+            });
+        return {
+            stdout: command.stdout === "complete-protocol"
+                ? redactProtocolOutput(output.stdout, commandEnvironment)
+                : redactOutput(output.stdout, commandEnvironment),
+            stderr: redactOutput(output.stderr, commandEnvironment),
+            exitCode: Number(output.exitCode),
+            tool,
+            ...(networkIsolation === undefined ? {} : { networkIsolation }),
+            ...(compileRuntime === undefined ? {} : { bunCompileRuntime: compileRuntime.identity })
+        };
+    }).pipe(Effect.scoped, Effect.mapError((cause) => cause instanceof DriverError ? cause : failure(String(cause))));
+});
+//# sourceMappingURL=process.js.map

package/dist/drivers/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/drivers/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,EACd,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA4BzC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAoB5F,MAAM,OAAO,GAAG,CAAC,MAA0C,EAAE,EAAE,CAC7D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AAE5C,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAE,GAAW,EAAE,IAAwB,EAAsB,EAAE;IACxG,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;IAC7G,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACrC,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAA;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,OAAO,qCAAqC,CAAC,CAAA;IACzG,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;IAC1C,OAAO;QACL,QAAQ,EAAE,0BAA0B;QACpC,OAAO;QACP,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC3E,CAAA;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAChH,MAAM,qBAAqB,GAAG;IAC5B,KAAK;IACL,SAAS;IACT,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,WAAW;IACX,kBAAkB;CACV,CAAA;AACV,MAAM,mBAAmB,GAAG,CAAC,OAAkC,EAAW,EAAE,CAC1E,OAAO,CAAC,OAAO,KAAK,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,qBAAqB,CAAC,MAAM;IACzF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAA;AAE9E,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAA;IAClE,MAAM,IAAI,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClF,MAAM,SAAS,GAAG,UAAU,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IACzG,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAC/B,qGAAqG,CACtG,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACvB,GAAG,EAAE,GAAG,EAAE;YACR,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YAC7E,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;YACzC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YAC5F,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,iDAAiD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;KAC5F,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG;IAC1B,iBAAiB,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,sBAAsB,OAAO,EAAE;IACvE,gBAAgB,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,mBAAmB,OAAO,EAAE;IACnE,kBAAkB,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,uBAAuB,OAAO,EAAE;CACjE,CAAA;AAGV,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAA4B;IACpE,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;CACnB,CAAC,CAAA;AAEF,MAAM,yBAAyB,GAAG,CAAC,OAAkC,EAAyC,EAAE;IAC9G,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,KAAK;QAC9E,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW;QAC5E,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IACzG,OAAO,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAA8B,CAAC;QACzE,CAAC,CAAC,IAAI,CAAC,CAAC,CAA8B;QACtC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED,MAAM,wBAAwB,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAC9E,MAAiC,EACjC,IAAwB;IAExB,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAA;IACvC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,OAAO;YACL,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE;gBACR,QAAQ,EAAE,mCAAmC;gBAC7C,MAAM;gBACN,UAAU;gBACV,MAAM,EAAE,eAAe;gBACvB,SAAS,EAAE,eAAe;gBAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;aACgB;SACtC,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAA;IAC5C,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAA;IACzD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACvB,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YACzC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE;gBACzE,YAAY,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;YACvE,CAAC;YACD,OAAO;gBACL,UAAU;gBACV,QAAQ,EAAE;oBACR,QAAQ,EAAE,mCAAmC;oBAC7C,MAAM;oBACN,UAAU;oBACV,MAAM,EAAE,yBAAyB;oBACjC,SAAS;oBACT,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBACxC;aACtC,CAAA;QACH,CAAC;QACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,qDAAqD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;KAChG,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAA4B,EAAE;IACxE,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC/H,MAAM,IAAI,GAAG,KAAgC,CAAA;IAC7C,IAAI,IAAI,CAAC,QAAQ,KAAK,oCAAoC,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY;QAC5F,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAC1F,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QACtG,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QACnG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,IAA2C,CAAA;AACpD,CAAC,CAAA;AAED,2EAA2E;AAC3E,uEAAuE;AACvE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACtC,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;QACxE,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC;YACtC,CAAC,CAAC;gBACA,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;gBAC1F,qBAAqB,EAAE,KAAK,CAAC,CAAC,qBAAqB,EAAE;aACtD;YACD,CAAC,CAAC,eAAe,CAAA;QACnB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAA;QACxE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC;YAChE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACzC,CAAC,CAAA;QACF,MAAM,aAAa,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,cAAc,GAAG,aAAa,KAAK,SAAS;YAChD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;QACxD,MAAM,gBAAgB,GAAG,cAAc,KAAK,SAAS;YACnD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACf,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAA;gBACxE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;gBACtC,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACjC,IAAI,cAAc,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC5C,YAAY,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;oBACvF,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAA;gBAClE,CAAC;gBACD,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBACvB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;YAC7B,CAAC,CAAC,EACF,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACzC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBACvB,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACrD,CAAC,CAAC,CACH,CAAA;QACH,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,KAAK,MAAM;YACnD,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACf,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAA;gBACpE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;gBAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;gBACjD,aAAa,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACpE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;YACxC,CAAC,CAAC,EACF,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAC1F;YACD,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,KAAK,MAAM;YACrC,CAAC,CAAC,CAAC,eAAe,EAAE,cAAc,EAAE,kBAAmB,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAChF,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,kBAAkB,GAAG,gBAAgB,KAAK,SAAS;YACvD,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,KAAK,EAAE,CAAA;QAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CACnD,UAAU,EACV,IAAI,EACJ;YACE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBAC3D,GAAG,kBAAkB;gBACrB,gCAAgC,EAAE,kBAAkB,CAAC,QAAQ;gBAC7D,gCAAgC,EAAE,YAAY;gBAC9C,0BAA0B,EAAE,iBAAiB;aAC9C;YACD,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;SAChD,CACF,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAA;QAChC,gEAAgE;QAChE,oEAAoE;QACpE,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,kBAAkB,KAAK,SAAS;YACvD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAClB,GAAG,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,QAAQ,CAAC;gBAC9D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aACzC,CAAC,CAAA;QACJ,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACjF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gFAAgF,CAAC,CAAC,CAAA;QACtH,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;YAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACpF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;oBACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;oBACnG,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;wBACpG,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;oBAC5D,CAAC;oBACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;wBAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;wBACzD,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE;4BACnE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;4BACxG,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;wBACpE,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,yEAAyE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;aACpH,CAAC,CAAA;QACF,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,mBAAmB;gBAC5C,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBACzD,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;YACnD,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;YACvD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjC,IAAI;YACJ,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;YAC/D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC;SACxF,CAAA;IACH,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC1F,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/drivers/redact.d.ts

@@ -0,0 +1,4 @@
+export declare const redactOutput: (text: string, env: Readonly<Record<string, string>>) => string;
+/** Complete redacted machine-protocol output for immediate decoding only. */
+export declare const redactProtocolOutput: (text: string, env: Readonly<Record<string, string>>) => string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/drivers/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/drivers/redact.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,YAAY,GACvB,MAAM,MAAM,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAClD,MAGF,CAAA;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,GAC/B,MAAM,MAAM,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAClD,MAA2B,CAAA"}

package/dist/drivers/redact.js

@@ -0,0 +1,24 @@
+import { secretPatterns } from "../model/secret-patterns.js";
+const EXCERPT_LIMIT = 2000;
+const redact = (text, env) => {
+    let out = text;
+    for (const [name, value] of Object.entries(env)
+        .filter(([name, value]) => name !== "PATH" && value.length >= 6)
+        .sort((left, right) => right[1].length - left[1].length)) {
+        out = out.split(value).join(`[redacted:${name}]`);
+    }
+    for (const pattern of secretPatterns) {
+        out = out.replace(new RegExp(pattern.source, `${pattern.flags.replace("u", "")}gu`), "[redacted:token]");
+    }
+    return out;
+};
+// Redacts KNOWN values (the exact env values the child received, longest
+// first, except PATH) and known token shapes, then bounds the excerpt. Child
+// output enters a durable diagnostic ledger only through this bounded form.
+export const redactOutput = (text, env) => {
+    const out = redact(text, env);
+    return out.length > EXCERPT_LIMIT ? `${out.slice(0, EXCERPT_LIMIT)}…[truncated]` : out;
+};
+/** Complete redacted machine-protocol output for immediate decoding only. */
+export const redactProtocolOutput = (text, env) => redact(text, env);
+//# sourceMappingURL=redact.js.map

package/dist/drivers/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/drivers/redact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE5D,MAAM,aAAa,GAAG,IAAI,CAAA;AAE1B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAqC,EAAU,EAAE;IAC7E,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;SAC/D,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,CAAA;IACnD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAA;IAC1G,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,IAAY,EAAE,GAAqC,EAC3C,EAAE;IACV,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC7B,OAAO,GAAG,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAA;AACxF,CAAC,CAAA;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAY,EAAE,GAAqC,EAC3C,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA"}

package/dist/drivers/seccomp-helper-source.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Embedded so source, built JS, npm consumers, and standalone CLI bundles all
+ * execute the same audited helper bytes through the pinned Bun runtime.
+ */
+export declare const makeNetworkIsolationHelperSource: (requiredLibrary?: string) => string;
+export declare const networkIsolationHelperSource: string;
+//# sourceMappingURL=seccomp-helper-source.d.ts.map

package/dist/drivers/seccomp-helper-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seccomp-helper-source.d.ts","sourceRoot":"","sources":["../../src/drivers/seccomp-helper-source.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,gCAAgC,GAAI,wBAAmC,KAAG,MAkHtF,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAqC,CAAA"}