@mnemonik/cli 0.0.0 → 7.99.5

package/dist/runtime/signers.js

@@ -0,0 +1,1697 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// packages/shared/dist/runtimeSigners.js
+import { lstatSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { basename, dirname, join, resolve, sep, win32 } from "node:path";
+import { createHash, createPublicKey, randomUUID, timingSafeEqual, verify as verifySignature } from "node:crypto";
+import { execFile, execFileSync } from "node:child_process";
+import { promisify } from "node:util";
+function decodeBase64(text, length) {
+  const bytes = Buffer.from(text, "base64");
+  if (bytes.length !== length || bytes.toString("base64") !== text)
+    throw new Error("unsigned");
+  return bytes;
+}
+async function verifyMinisign(path, signaturePath, identity) {
+  const [message, signatureText] = await Promise.all([
+    readFile(path),
+    readFile(signaturePath, "utf8")
+  ]);
+  const publicPacket = decodeBase64(identity, 42);
+  const lines = signatureText.trimEnd().split(/\r?\n/);
+  const [untrustedComment, encodedSignature, trustedLine, encodedGlobalSignature] = lines;
+  if (publicPacket.subarray(0, 2).toString() !== "Ed" || lines.length !== 4 || !untrustedComment?.startsWith("untrusted comment:") || !encodedSignature || !trustedLine?.startsWith("trusted comment: ") || !encodedGlobalSignature)
+    throw new Error("unsigned");
+  const signaturePacket = decodeBase64(encodedSignature, 74);
+  const globalSignature = decodeBase64(encodedGlobalSignature, 64);
+  const algorithm = signaturePacket.subarray(0, 2).toString();
+  if (algorithm !== "ED" && algorithm !== "Ed" || !timingSafeEqual(publicPacket.subarray(2, 10), signaturePacket.subarray(2, 10)))
+    throw new Error("unsigned");
+  const publicKey = createPublicKey({
+    key: Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), publicPacket.subarray(10)]),
+    format: "der",
+    type: "spki"
+  });
+  const fileSignature = signaturePacket.subarray(10);
+  const signedMessage = algorithm === "ED" ? createHash("blake2b512").update(message).digest() : message;
+  const trustedComment = trustedLine.slice("trusted comment: ".length);
+  if (!verifySignature(null, signedMessage, publicKey, fileSignature) || !verifySignature(null, Buffer.concat([fileSignature, Buffer.from(trustedComment)]), publicKey, globalSignature))
+    throw new Error("unsigned");
+}
+async function verifySigner(path, signer, run = execute) {
+  if (signer.platform === "darwin" && /^[A-Z0-9]{10}$/.test(signer.identity)) {
+    await run("/usr/bin/codesign", [
+      "--verify",
+      "--strict",
+      "-R",
+      `=anchor apple generic and certificate leaf[subject.OU] = "${signer.identity}"`,
+      path
+    ]);
+  } else if (signer.platform === "win32" && /^[A-Fa-f0-9]{40}$/.test(signer.identity)) {
+    await run("powershell.exe", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      `$ErrorActionPreference = 'Stop'; $s = Get-AuthenticodeSignature -LiteralPath ${quote(path)}; if ($s.Status -ne 'Valid' -or $s.SignerCertificate.Thumbprint -ne ${quote(signer.identity)}) { exit 1 }`
+    ]);
+  } else if (signer.platform === "linux") {
+    try {
+      await verifyMinisign(path, signer.signature, signer.identity);
+    } catch {
+      throw new Error("unsigned");
+    }
+  } else
+    throw new Error("unsigned");
+}
+async function verifyWindowsPermission(path, run = hookExecute, state) {
+  const verdicts = await auditWindowsPermissions(path, [path], run, false, state);
+  if (verdicts.get(path) === "acl_unavailable")
+    throw new Error("acl_unavailable");
+  if (verdicts.get(path) !== "ok")
+    throw new Error("acl_permissions");
+}
+function windowsCommand(file) {
+  const root = process.env.SystemRoot;
+  if (!root || !win32.isAbsolute(root))
+    throw new Error("acl_system_root_unavailable");
+  return win32.join(root, "System32", file);
+}
+function readIdentity(stdout2) {
+  const match = /^"([^"\r\n]+)","(S-1-(?:\d+-)+\d+)"$/.exec(stdout2.trim());
+  if (!match?.[1] || !match[2] || stdout2.includes("\uFFFD"))
+    throw new Error("acl_identity_unavailable");
+  return { name: match[1], sid: match[2] };
+}
+function windowsCurrentAccountSync() {
+  return currentIdentity ??= readIdentity(hookExecuteSync(windowsCommand("whoami.exe"), identityArgs));
+}
+async function windowsIdentity(run) {
+  if (currentIdentity)
+    return currentIdentity;
+  identityPending ??= run(windowsCommand("whoami.exe"), identityArgs).then((result) => currentIdentity = readIdentity(stdout(result))).finally(() => {
+    identityPending = void 0;
+  });
+  return identityPending;
+}
+async function verifyWindowsAcl(path, run = hookExecute, state) {
+  const user = await windowsIdentity(run);
+  if (!privateEntries((await drive(saveAcl(path, false, [path], state), run)).get(path), user, false))
+    throw new Error("acl_permissions");
+}
+function hookInvocation(file, args) {
+  if (win32.basename(file) === "whoami.exe") {
+    if ([file, ...args].some((arg) => /[%!"\r\n]/.test(arg)))
+      throw new Error("acl_path_unavailable");
+    const command = args.map((arg) => /^(?:[a-z0-9]+|\/[a-z]+)$/i.test(arg) ? arg : `"${arg}"`).join(" ");
+    return [
+      windowsCommand("cmd.exe"),
+      ["/d", "/v:off", "/s", "/c", `"chcp 65001>nul & "${file}" ${command}"`]
+    ];
+  }
+  if (win32.basename(file) === "cmd.exe")
+    return [file, ["/u", ...args]];
+  return [file, args];
+}
+function hookExecuteSync(file, args, input) {
+  [file, args] = hookInvocation(file, args);
+  return execFileSync(file, args, { ...hookOptions(file, args), input });
+}
+function aclRecords(output, root, paths, onLookup) {
+  const records = /* @__PURE__ */ new Map();
+  const wanted = new Set(paths);
+  const lines = output.replace(/^\uFEFF/, "").trimEnd().split(/\r?\n/);
+  if (lines.length % 2)
+    throw new Error("acl_unavailable");
+  for (let index = 0; index < lines.length; index += 2) {
+    onLookup?.();
+    const relativePath = lines[index];
+    const descriptor = lines[index + 1];
+    if (relativePath === void 0 || descriptor === void 0)
+      throw new Error("acl_unavailable");
+    const path = resolve(dirname(root), relativePath.replaceAll("\\", sep));
+    if (!wanted.has(path))
+      continue;
+    if (records.has(path))
+      throw new Error("acl_unavailable");
+    const dacl = /^D:(?:P|AI|AR)*((?:\([^()]*\))*)$/.exec(descriptor);
+    records.set(path, dacl?.[1]?.match(/\([^()]*\)/g) ?? []);
+  }
+  return records;
+}
+function privateEntries(entries, user, directory) {
+  if (!entries?.length)
+    throw new Error("acl_unavailable");
+  return entries.every((line) => {
+    const ace = /^\(([AD]);((?:OI|CI|NP|IO|ID|SA|FA)*);[A-Za-z0-9]+;;;((?:S-1-(?:\d+-)+\d+)|[A-Z]{2})\)$/.exec(line);
+    if (!ace)
+      throw new Error("acl_unavailable");
+    return (!directory || !ace[2]?.includes("ID")) && (ace[1] === "D" || ace[3] === user.sid);
+  });
+}
+function* prepareAclDirectory(state) {
+  const directory = join(state, "audit-tmp");
+  if (auditDirectories.has(directory)) {
+    const stat2 = lstatSync(directory);
+    if (!stat2.isDirectory() || stat2.isSymbolicLink())
+      throw new Error("acl_permissions");
+    return directory;
+  }
+  let created = false;
+  try {
+    mkdirSync(directory, { mode: 448 });
+    created = true;
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+  }
+  const stat = lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink())
+    throw new Error("acl_permissions");
+  if (!auditDirectories.has(directory)) {
+    currentIdentity ??= readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+    yield [windowsCommand("icacls.exe"), aclArgs(directory, currentIdentity.sid)];
+    if (!created) {
+      const temp = join(directory, `.acl-${randomUUID()}.tmp`);
+      writeFileSync(temp, "", { flag: "wx", mode: 384 });
+      try {
+        yield [windowsCommand("icacls.exe"), [directory, "/save", temp, "/l"]];
+        if (!privateEntries(aclRecords(readFileSync(temp, "utf16le"), directory, [directory]).get(directory), currentIdentity, true))
+          throw new Error("acl_permissions");
+      } finally {
+        unlinkSync(temp);
+      }
+    }
+    auditDirectories.add(directory);
+  }
+  return directory;
+}
+async function prepareWindowsAclDirectory(state, run = hookExecute) {
+  let pending = directoryPending.get(state);
+  if (!pending) {
+    pending = drive(prepareAclDirectory(state), run).then(() => {
+    }).finally(() => directoryPending.delete(state));
+    directoryPending.set(state, pending);
+  }
+  await pending;
+}
+function* saveAcl(path, recursive, paths = [path], state = lstatSync(path).isDirectory() ? path : dirname(path)) {
+  const directory = yield* prepareAclDirectory(state);
+  const temp = join(directory, `.acl-${randomUUID()}.tmp`);
+  writeFileSync(temp, "", { flag: "wx", mode: 384 });
+  try {
+    yield [windowsCommand("icacls.exe"), [path, "/save", temp, ...recursive ? ["/t"] : [], "/l"]];
+    return aclRecords(readFileSync(temp, "utf16le"), path, paths.filter((item) => item !== directory && !item.startsWith(directory + sep)));
+  } finally {
+    unlinkSync(temp);
+  }
+}
+async function drive(commands, run) {
+  try {
+    let step = commands.next();
+    while (!step.done)
+      step = commands.next(stdout(await run(...step.value)));
+    return step.value;
+  } finally {
+    commands.return(void 0);
+  }
+}
+function dirEntry(line) {
+  const metadata = /^\S+\s+\S+(?:\s+\S+)?\s+(?:<DIR>|\d[\d,.\s]*)\s+/.exec(line)?.[0];
+  if (!metadata)
+    return void 0;
+  const ownerColumn = metadata.length;
+  const owner = line.slice(ownerColumn, ownerColumn + ownerWidth).trim().toLowerCase();
+  const name = line.slice(ownerColumn + ownerWidth);
+  return owner && name ? { owner, name } : void 0;
+}
+function ownerLookup(paths) {
+  if (paths.some((path) => /[\t\r\n]/.test(path)))
+    throw new Error("acl_path_unavailable");
+  const script = `$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = [System.Text.UTF8Encoding]::new($false)
+[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+while ($null -ne ($path = [Console]::ReadLine())) {
+  $owner = (Get-Acl -LiteralPath $path).GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+  [Console]::WriteLine($path + "\`t" + $owner)
+}`;
+  return [
+    windowsCommand("WindowsPowerShell\\v1.0\\powershell.exe"),
+    ["-NoProfile", "-NonInteractive", "-Command", script],
+    paths.join("\n") + "\n"
+  ];
+}
+function ownerSids(output) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const line of output.split(/\r?\n/)) {
+    const [path, sid] = line.split("	");
+    if (path && sid && /^S-1-(?:\d+-)+\d+$/.test(sid))
+      owners.set(path, sid.toLowerCase());
+  }
+  return owners;
+}
+function* hookPermission(path, created, session, directory = true) {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile()))
+    throw new Error("cache unavailable");
+  const marker = join(session, ".windows-acl.json");
+  let receipt = receipts.get(session);
+  if (!receipt) {
+    try {
+      if (lstatSync(session).isSymbolicLink() || !lstatSync(marker).isFile() || lstatSync(marker).isSymbolicLink())
+        throw new Error("cache unavailable");
+      receipt = JSON.parse(readFileSync(marker, "utf8"));
+      if (!receipt || !receipt.paths || !receipt.identity || !/^S-1-(?:\d+-)+\d+$/.test(receipt.identity.sid) || typeof receipt.identity.name !== "string")
+        receipt = void 0;
+    } catch {
+    }
+  }
+  if (receipt && currentIdentity && receipt.identity.sid !== currentIdentity.sid)
+    receipt = void 0;
+  if (!created && receipt && Object.hasOwn(receipt.paths, path) && fresh(receipt.paths[path])) {
+    currentIdentity ??= receipt.identity;
+    receipts.set(session, receipt);
+    return;
+  }
+  currentIdentity ??= readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+  const user = currentIdentity;
+  if (receipt && receipt.identity.sid !== user.sid)
+    receipt = void 0;
+  const parent = dirname(path);
+  if (/[%!"\r\n]/.test(parent))
+    throw new Error("acl_path_unavailable");
+  const listing = yield [
+    windowsCommand("cmd.exe"),
+    ["/d", "/v:off", "/s", "/c", `dir /q ${directory ? "/a:d" : "/a"} "${parent}"`]
+  ];
+  const owners = listing.split(/\r?\n/).flatMap((line) => {
+    const entry = dirEntry(line);
+    return entry?.name.toLowerCase() === basename(path).toLowerCase() ? [entry.owner] : [];
+  });
+  let owner = owners[0];
+  if (owners.length === 1 && owner && unknownOwner(owner, user))
+    owner = ownerSids(yield ownerLookup([path])).get(path);
+  if (owners.length !== 1 || ![user.name.toLowerCase(), user.sid.toLowerCase()].includes(owner ?? ""))
+    throw new Error("acl_owner");
+  const icacls = windowsCommand("icacls.exe");
+  if (created)
+    yield [icacls, aclArgs(path, user.sid)];
+  let valid = privateEntries((yield* saveAcl(path, false)).get(path), user, directory);
+  if (!valid && !created && directory) {
+    yield [icacls, aclArgs(path, user.sid)];
+    valid = privateEntries((yield* saveAcl(path, false)).get(path), user, directory);
+  }
+  if (!valid)
+    throw new Error("acl_permissions");
+  receipt ??= { identity: user, paths: {} };
+  receipt.paths[path] = Date.now();
+  receipts.set(session, receipt);
+  try {
+    const temp = `${marker}.${randomUUID()}`;
+    writeFileSync(temp, JSON.stringify(receipt), { flag: "wx", mode: 384 });
+    renameSync(temp, marker);
+  } catch {
+  }
+}
+async function windowsCurrentUserDirectoryAcl(path, run = hookExecute) {
+  currentIdentity ??= readIdentity(stdout(await run(windowsCommand("whoami.exe"), identityArgs)));
+  await run(windowsCommand("icacls.exe"), aclArgs(path, currentIdentity.sid));
+}
+async function protectWindowsDirectory(path, created, run = hookExecute, session = path) {
+  await drive(hookPermission(path, created, session), run);
+}
+function protectSync(path, created, session, directory = true) {
+  const audit = hookPermission(path, created, session, directory);
+  try {
+    let step = audit.next();
+    while (!step.done)
+      step = audit.next(hookExecuteSync(...step.value));
+  } finally {
+    audit.return();
+  }
+}
+function verifyWindowsPermissionSync(path) {
+  protectSync(path, false, dirname(path), false);
+}
+function ensureWindowsPrivateDirectorySync(path, session = path) {
+  if (process.platform !== "win32")
+    return;
+  const created = mkdirSync(path, { recursive: true, mode: 448 });
+  protectSync(path, created !== void 0, session);
+}
+async function auditWindowsPermissions(state, paths, run = hookExecute, recursive = true, tempState = lstatSync(state).isDirectory() ? state : dirname(state)) {
+  const user = await windowsIdentity(run);
+  const root = resolve(state);
+  for (const path of paths)
+    if (resolve(path) !== root && !resolve(path).startsWith(root + sep))
+      throw new Error("acl_path_unavailable");
+  if (/[%!"\r\n]/.test(root))
+    throw new Error("acl_path_unavailable");
+  const owners = /* @__PURE__ */ new Map();
+  for (const [directory, descend] of [
+    [dirname(root), false],
+    ...recursive ? [[root, true]] : []
+  ]) {
+    if (/[%!"\r\n]/.test(directory))
+      throw new Error("acl_path_unavailable");
+    const output = stdout(await run(windowsCommand("cmd.exe"), [
+      "/d",
+      "/v:off",
+      "/s",
+      "/c",
+      `dir /q /a ${descend ? "/s " : ""}"${directory}"`
+    ]));
+    let current = directory;
+    for (const line of output.split(/\r?\n/)) {
+      const entry = dirEntry(line);
+      if (entry) {
+        if (entry.name !== "..")
+          owners.set(join(current, entry.name), unknownOwner(entry.owner, user) ? "..." : entry.owner);
+      } else {
+        const header = /(?:^|\s)((?:[A-Za-z]:\\|\\\\|\/).*)$/.exec(line.trim());
+        if (header?.[1])
+          current = header[1];
+      }
+    }
+  }
+  const verdicts = /* @__PURE__ */ new Map();
+  const ownerPaths = [...owners.keys()].filter((path) => path === root || path.startsWith(root + sep));
+  const truncated = new Set(ownerPaths.filter((path) => owners.get(path)?.includes("...")));
+  if (truncated.size) {
+    const result = await run(...ownerLookup([...truncated])).catch(() => ({ stdout: "" }));
+    for (const [path, sid] of ownerSids(stdout(result)))
+      if (truncated.has(path))
+        owners.set(path, sid);
+  }
+  for (const [path, entries] of await drive(saveAcl(root, recursive, ownerPaths, tempState), run)) {
+    const owner = owners.get(path) ?? "...";
+    const owned = owner === user.name.toLowerCase() || owner === user.sid.toLowerCase();
+    try {
+      if (!entries.length || owner.includes("..."))
+        throw new Error("acl_unavailable");
+      verdicts.set(path, !owned ? "owner" : privateEntries(entries, user, false) ? "ok" : "ace");
+    } catch {
+      verdicts.set(path, "acl_unavailable");
+    }
+  }
+  return verdicts;
+}
+var execute, quote, identityArgs, currentIdentity, receipts, ttl, fresh, identityPending, aclArgs, hookOptions, hookExecute, stdout, auditDirectories, directoryPending, ownerWidth, unknownOwner;
+var init_runtimeSigners = __esm({
+  "packages/shared/dist/runtimeSigners.js"() {
+    "use strict";
+    execute = (file, args, input) => {
+      const result = promisify(execFile)(file, args);
+      if (input === void 0)
+        return result;
+      return new Promise((resolve4, reject2) => {
+        void result.then(resolve4, reject2);
+        result.child.stdin?.on("error", reject2);
+        result.child.stdin?.end(input);
+      });
+    };
+    quote = (text) => `'${text.replaceAll("'", "''")}'`;
+    identityArgs = ["/user", "/fo", "csv", "/nh"];
+    receipts = /* @__PURE__ */ new Map();
+    ttl = 10 * 6e4;
+    fresh = (time) => time !== void 0 && Date.now() >= time && Date.now() - time < ttl;
+    aclArgs = (path, sid) => [
+      path,
+      "/inheritance:r",
+      "/grant:r",
+      `*${sid}:(OI)(CI)F`
+    ];
+    hookOptions = (file, args) => ({
+      encoding: args.includes("/u") ? "utf16le" : "utf8",
+      timeout: win32.basename(file) === "powershell.exe" ? 3e4 : 5e3,
+      windowsHide: true,
+      maxBuffer: 16 * 1024 * 1024,
+      windowsVerbatimArguments: win32.basename(file) === "cmd.exe"
+    });
+    hookExecute = (file, args, input) => {
+      const treeListing = win32.basename(file) === "icacls.exe" && args.includes("/t") || win32.basename(file) === "cmd.exe" && args.some((arg) => arg.startsWith("dir /q /a /s "));
+      [file, args] = hookInvocation(file, args);
+      const options = hookOptions(file, args);
+      if (treeListing)
+        options.timeout = 3e4;
+      return new Promise((resolve4, reject2) => {
+        const child = execFile(file, args, options, (error, stdout2) => error ? reject2(error) : resolve4({ stdout: stdout2 }));
+        if (input !== void 0) {
+          child.stdin?.on("error", reject2);
+          child.stdin?.end(input);
+        }
+      });
+    };
+    stdout = (value) => value.stdout;
+    auditDirectories = /* @__PURE__ */ new Set();
+    directoryPending = /* @__PURE__ */ new Map();
+    ownerWidth = 23;
+    unknownOwner = (owner, user) => user.name.length >= ownerWidth || owner.length >= ownerWidth || owner.includes("...");
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+import { lstat, readFile as readFile2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+function parseIdentityFile(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { kind: "malformed", detail: "identity file must contain a JSON object" };
+  }
+  const record2 = value;
+  if (record2.schemaVersion !== 1) {
+    return { kind: "unknown_version", version: record2.schemaVersion };
+  }
+  const unknownKey = Object.keys(record2).find((key) => !IDENTITY_KEYS.has(key));
+  if (unknownKey)
+    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
+  if (!isCanonicalUuid(record2.projectId)) {
+    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
+  }
+  if ("projectName" in record2 && typeof record2.projectName !== "string") {
+    return { kind: "malformed", detail: '"projectName" must be a string when present' };
+  }
+  if ("repositoryFingerprint" in record2 && (!record2.repositoryFingerprint || typeof record2.repositoryFingerprint !== "object" || Array.isArray(record2.repositoryFingerprint))) {
+    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
+  }
+  const fingerprint = record2.repositoryFingerprint;
+  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
+  if (unknownFingerprintKey) {
+    return {
+      kind: "malformed",
+      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
+    };
+  }
+  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
+    return {
+      kind: "malformed",
+      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
+    };
+  }
+  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
+  return {
+    kind: "ok",
+    identity: {
+      schemaVersion: 1,
+      projectId: record2.projectId,
+      ...record2.projectName === void 0 ? {} : { projectName: record2.projectName },
+      ...repositoryFingerprint ? { repositoryFingerprint } : {}
+    }
+  };
+}
+async function readIdentityFile(dir) {
+  const path = join2(dir, ".mnemonik.json");
+  try {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink())
+      return { kind: "malformed", detail: "symlink" };
+    if (!stat.isFile())
+      return { kind: "malformed", detail: "identity path is not a regular file" };
+    return parseIdentityFile(await readFile2(path, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { kind: "absent" };
+    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
+  }
+}
+var CANONICAL_UUID, isCanonicalUuid, IDENTITY_KEYS, FINGERPRINT_KEYS;
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+    CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+    isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
+    IDENTITY_KEYS = /* @__PURE__ */ new Set([
+      "schemaVersion",
+      "projectId",
+      "projectName",
+      "repositoryFingerprint"
+    ]);
+    FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
+  }
+});
+
+// packages/shared/dist/repositoryRoot.js
+import { lstat as lstat2, readFile as readFile3 } from "node:fs/promises";
+import { execFile as execFile2 } from "node:child_process";
+import { homedir } from "node:os";
+import { dirname as dirname2, join as join3, resolve as resolve2 } from "node:path";
+function gitEnvironment() {
+  const env = {};
+  for (const key of GIT_ENV_KEYS) {
+    if (process.env[key] !== void 0)
+      env[key] = process.env[key];
+  }
+  env.LC_ALL = "C";
+  return env;
+}
+function runGit(cwd, args) {
+  return new Promise((resolvePromise, reject2) => {
+    execFile2("git", args, { cwd, timeout: GIT_TIMEOUT_MS, encoding: "utf8", env: gitEnvironment() }, (error, stdout2, stderr2) => {
+      if (error)
+        reject2(Object.assign(error, { stdout: stdout2, stderr: stderr2 }));
+      else
+        resolvePromise({ stdout: stdout2, stderr: stderr2 });
+    });
+  });
+}
+async function boundaryAt(path) {
+  try {
+    const stat = await lstat2(join3(path, ".git"));
+    if (stat.isDirectory())
+      return { path, kind: "directory" };
+    if (stat.isFile())
+      return { path, kind: "file" };
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR")
+      throw error;
+  }
+  return void 0;
+}
+async function confirmedBoundaryAt(path) {
+  const boundary = await boundaryAt(path);
+  if (!boundary)
+    return void 0;
+  try {
+    const { stdout: stdout2 } = await runGit(path, ["rev-parse", "--git-dir"]);
+    return stdout2.trim() ? boundary : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function boundariesBetween(cwd, root) {
+  const boundaries = [];
+  let directory = cwd;
+  while (directory !== root) {
+    const boundary = await confirmedBoundaryAt(directory);
+    if (boundary)
+      boundaries.push(boundary);
+    const parent = dirname2(directory);
+    if (parent === directory)
+      break;
+    directory = parent;
+  }
+  return boundaries;
+}
+async function containingRepository(root) {
+  let directory = dirname2(root);
+  while (true) {
+    const boundary = await confirmedBoundaryAt(directory);
+    if (boundary)
+      return boundary;
+    const parent = dirname2(directory);
+    if (parent === directory)
+      return void 0;
+    directory = parent;
+  }
+}
+async function canonicalBoundaryRoot(boundary) {
+  if (boundary.kind === "directory")
+    return boundary.path;
+  const pointer = /^gitdir:\s*(.+)\s*$/im.exec(await readFile3(join3(boundary.path, ".git"), "utf8"))?.[1];
+  if (!pointer)
+    return boundary.path;
+  const gitDir = resolve2(boundary.path, pointer);
+  try {
+    const commonDir = resolve2(gitDir, (await readFile3(join3(gitDir, "commondir"), "utf8")).trim());
+    return dirname2(commonDir);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return boundary.path;
+    throw error;
+  }
+}
+async function resolveRepositoryRoot(cwd) {
+  const absoluteCwd = resolve2(cwd);
+  try {
+    const { stdout: stdout2 } = await runGit(absoluteCwd, [
+      "rev-parse",
+      "--show-toplevel",
+      "--git-common-dir"
+    ]);
+    const [rootLine, commonLine, ...extra] = stdout2.trim().split(/\r?\n/);
+    if (!rootLine || !commonLine || extra.length) {
+      return { kind: "git_unavailable", detail: "git rev-parse returned an unexpected response" };
+    }
+    const root = resolve2(rootLine);
+    const commonDir = resolve2(root, commonLine);
+    const isLinkedWorktree = commonDir !== join3(root, ".git");
+    const nested = await boundariesBetween(absoluteCwd, root);
+    if (!isLinkedWorktree && await containingRepository(root)) {
+      const boundary = await boundaryAt(root);
+      if (boundary)
+        nested.push(boundary);
+    }
+    return {
+      kind: "git",
+      root,
+      commonDir,
+      isLinkedWorktree,
+      nested
+    };
+  } catch (error) {
+    const failure = error;
+    if (failure.code === 128 && /not a git repository/i.test(failure.stderr ?? failure.message)) {
+      return { kind: "plain", root: absoluteCwd };
+    }
+    return { kind: "git_unavailable", detail: failure.message };
+  }
+}
+async function readPlainIdentity(start) {
+  const home = resolve2(homedir());
+  let directory = start;
+  while (true) {
+    const result = await readIdentityFile(directory);
+    if (result.kind !== "absent")
+      return { root: directory, result };
+    if (directory === home)
+      break;
+    const parent = dirname2(directory);
+    if (parent === directory)
+      break;
+    directory = parent;
+  }
+  return { root: start, result: { kind: "absent" } };
+}
+function withBase(repository, root, nested) {
+  return { root, repository, nested };
+}
+async function resolveProjectIdentity(cwd, options = {}) {
+  const repository = await resolveRepositoryRoot(cwd);
+  if (repository.kind === "git_unavailable")
+    return repository;
+  if (repository.kind === "plain") {
+    const { root, result } = await readPlainIdentity(repository.root);
+    const base2 = withBase(repository, root, []);
+    if (result.kind === "ok")
+      return { ...base2, ...result };
+    if (result.kind === "unknown_version")
+      return { ...base2, ...result, path: root };
+    if (result.kind === "malformed")
+      return { ...base2, ...result, path: root };
+    return { ...base2, kind: "absent" };
+  }
+  const ownRoot = repository.isLinkedWorktree ? dirname2(repository.commonDir) : repository.root;
+  const outer = repository.isLinkedWorktree ? void 0 : await containingRepository(repository.root);
+  const own = await readIdentityFile(ownRoot);
+  if (!outer) {
+    const base2 = withBase(repository, ownRoot, repository.nested);
+    if (own.kind === "ok")
+      return { ...base2, ...own };
+    if (own.kind === "unknown_version")
+      return { ...base2, ...own, path: ownRoot };
+    if (own.kind === "malformed")
+      return { ...base2, ...own, path: ownRoot };
+    return { ...base2, kind: "absent" };
+  }
+  const nested = repository.nested;
+  const parentRoot = await canonicalBoundaryRoot(outer);
+  const parent = await readIdentityFile(parentRoot);
+  const base = withBase(repository, parentRoot, nested);
+  if (own.kind === "unknown_version")
+    return { ...base, ...own, path: ownRoot };
+  if (own.kind === "malformed")
+    return { ...base, ...own, path: ownRoot };
+  if (parent.kind === "unknown_version")
+    return { ...base, ...parent, path: parentRoot };
+  if (parent.kind === "malformed")
+    return { ...base, ...parent, path: parentRoot };
+  if (own.kind === "ok" && parent.kind === "ok") {
+    return {
+      ...base,
+      kind: "conflict",
+      rootIdentity: parent.identity,
+      nestedIdentity: own.identity
+    };
+  }
+  if (own.kind === "ok") {
+    return { ...withBase(repository, ownRoot, nested), kind: "ok", identity: own.identity };
+  }
+  if (!options.allowNestedInherit) {
+    return {
+      ...base,
+      kind: "nested",
+      ...parent.kind === "ok" ? { parentIdentity: parent.identity } : {}
+    };
+  }
+  if (parent.kind === "ok")
+    return { ...base, kind: "ok", identity: parent.identity };
+  return { ...base, kind: "absent" };
+}
+var GIT_TIMEOUT_MS, GIT_ENV_KEYS;
+var init_repositoryRoot = __esm({
+  "packages/shared/dist/repositoryRoot.js"() {
+    "use strict";
+    init_projectIdentityFile();
+    GIT_TIMEOUT_MS = 2e3;
+    GIT_ENV_KEYS = [
+      "PATH",
+      "HOME",
+      "LANG",
+      "LC_ALL",
+      "SYSTEMROOT",
+      "TEMP",
+      "TMP",
+      "USERPROFILE"
+    ];
+  }
+});
+
+// packages/shared/dist/runtimeReader.js
+import { createHash as createHash2 } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat as lstat3, open, readdir } from "node:fs/promises";
+import { dirname as dirname3, join as join4, parse, resolve as resolve3, sep as sep2 } from "node:path";
+function safePath(path) {
+  if (typeof path !== "string" || !/^[a-zA-Z0-9_@.+/-]+$/.test(path) || path.split("/").some((p) => !p || p === "." || p === "..") || path.includes(":"))
+    throw new RuntimeError("permission");
+  return path;
+}
+var RuntimeError, hash, missing, versionName, statIdentity, RuntimeReader;
+var init_runtimeReader = __esm({
+  "packages/shared/dist/runtimeReader.js"() {
+    "use strict";
+    init_runtimeSigners();
+    init_runtimeSigners();
+    RuntimeError = class extends Error {
+      reason;
+      constructor(reason) {
+        super(reason);
+        this.reason = reason;
+        this.name = "RuntimeError";
+      }
+    };
+    hash = (bytes) => createHash2("sha256").update(bytes).digest("hex");
+    missing = (e) => e.code === "ENOENT";
+    versionName = (v) => {
+      if (!/^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(v))
+        throw new RuntimeError("permission");
+      return v;
+    };
+    statIdentity = (stat) => [stat.dev, stat.ino, stat.mode, stat.uid, stat.size, stat.mtimeMs, stat.ctimeMs].join(":");
+    RuntimeReader = class _RuntimeReader {
+      run;
+      options;
+      now;
+      state;
+      static windowsSignatures = /* @__PURE__ */ new Map();
+      // Omitted batch verdicts use the per-path fallback before entering the cache.
+      windowsAudit = /* @__PURE__ */ new Map();
+      windowsStats = /* @__PURE__ */ new Map();
+      windowsDirectories = /* @__PURE__ */ new Set();
+      audits = Promise.resolve();
+      auditsInFlight = /* @__PURE__ */ new Map();
+      activeOperation = false;
+      operations = Promise.resolve();
+      constructor(state, run, options = {}, now = () => performance.now()) {
+        this.run = run;
+        this.options = options;
+        this.now = now;
+        this.state = resolve3(state);
+      }
+      pointerPath(artifact) {
+        if (!["cli", "scanner", "claude-code", "codex", "cursor", "grok"].includes(artifact))
+          throw new RuntimeError("permission");
+        return join4(this.state, "runtimes", artifact, "current");
+      }
+      guardedPath(path) {
+        const absolute = resolve3(path);
+        if (absolute !== this.state && !absolute.startsWith(this.state + sep2) || process.platform === "win32" && /[\r\n\t]/.test(absolute))
+          throw new RuntimeError("permission");
+        return absolute;
+      }
+      auditRoot(path) {
+        const [area, artifact] = path.slice(this.state.length + 1).split(sep2);
+        return area === "runtimes" ? join4(this.state, area, ...artifact ? [artifact] : []) : path;
+      }
+      traceAudit(event) {
+        const level = process.env.MNEMONIK_AUDIT_TRACE;
+        if (level !== "1" && (level !== "misses" || event.cache === "hit"))
+          return;
+        process.stderr.write(JSON.stringify({
+          type: "runtime-audit",
+          pid: process.pid,
+          module: import.meta.url,
+          activeOperation: this.activeOperation,
+          ...event
+        }) + "\n");
+      }
+      invalidateAudit(path) {
+        const root = this.auditRoot(path);
+        for (const key of this.windowsAudit.keys())
+          if (key === root || (!this.options.cacheDirectories || root.startsWith(join4(this.state, "runtimes") + sep2)) && key.startsWith(root + sep2))
+            this.windowsAudit.delete(key);
+      }
+      audit(paths) {
+        const root = this.auditRoot(paths.at(-1) ?? this.state);
+        const pending = this.auditsInFlight.get(root);
+        if (pending)
+          return pending;
+        const audit = this.audits.then(() => this.auditPending(paths)).finally(() => this.auditsInFlight.delete(root));
+        this.auditsInFlight.set(root, audit);
+        this.audits = audit.catch(() => {
+        });
+        return audit;
+      }
+      async auditPending(paths) {
+        if (process.platform !== "win32")
+          return;
+        const pending = /* @__PURE__ */ new Set();
+        for (const path of paths) {
+          let part = this.guardedPath(path);
+          while (true) {
+            const cached = this.windowsAudit.get(part);
+            const expired = !!cached && !this.activeOperation && !(this.options.cacheDirectories && this.windowsDirectories.has(part)) && this.now() - cached.checkedAt >= 2e3;
+            this.traceAudit({
+              event: "cache",
+              requested: path,
+              path: part,
+              root: this.auditRoot(path),
+              cache: !cached ? "miss" : expired ? "ttl-expired" : "hit"
+            });
+            if (!cached || expired)
+              pending.add(part);
+            if (part === this.state)
+              break;
+            part = dirname3(part);
+          }
+        }
+        if (!pending.size)
+          return;
+        try {
+          const root = this.auditRoot(paths.at(-1) ?? this.state);
+          const ancestors = [...pending].filter((path) => path !== root && !path.startsWith(root + sep2));
+          const tree = [...pending].filter((path) => !ancestors.includes(path));
+          for (const part of [...ancestors, ...tree.length ? [root] : []]) {
+            const recursive = part === root && root.startsWith(join4(this.state, "runtimes") + sep2);
+            this.traceAudit({ event: "audit", root: part, recursive });
+            const requested = part === root ? tree : [part];
+            if (this.options.cacheDirectories && !this.windowsDirectories.has(part) && this.windowsAudit.get(part)?.verdict === "ok") {
+              await verifyWindowsAcl(part, this.run, this.state);
+              this.windowsAudit.set(part, { verdict: "ok", checkedAt: this.now() });
+              continue;
+            }
+            const verdicts = await auditWindowsPermissions(part, requested, this.run, recursive, this.state);
+            const checkedAt = this.now();
+            for (const path of /* @__PURE__ */ new Set([...requested, ...verdicts.keys()])) {
+              let verdict = verdicts.get(path);
+              if (verdict === void 0) {
+                await verifyWindowsPermission(path, this.run, this.state);
+                verdict = "ok";
+              }
+              this.windowsAudit.set(path, { verdict, checkedAt });
+            }
+          }
+        } catch (error) {
+          throw new RuntimeError(error instanceof Error && error.message === "acl_permissions" ? "permission" : "acl_unavailable");
+        }
+      }
+      async inspect(path, directory = false, allowMissing = false, replacing = false) {
+        const absolute = this.guardedPath(path);
+        const windowsPaths = [];
+        let part = parse(absolute).root;
+        for (const name of absolute.slice(part.length).split(sep2)) {
+          part = join4(part, name);
+          const stat = await lstat3(part).catch((e) => {
+            if (allowMissing && missing(e))
+              return null;
+            throw e;
+          });
+          if (!stat)
+            break;
+          if (stat.isSymbolicLink() || (part === absolute ? directory ? !stat.isDirectory() : !stat.isFile() : !stat.isDirectory()))
+            throw new RuntimeError("permission");
+          if (part !== this.state && !part.startsWith(this.state + sep2))
+            continue;
+          if (process.platform === "win32") {
+            if (replacing && part === absolute)
+              continue;
+            if (part === this.state && !this.windowsStats.has(part)) {
+              await prepareWindowsAclDirectory(this.state, this.run).catch((error) => {
+                throw new RuntimeError(error instanceof Error && error.message === "acl_permissions" ? "permission" : "acl_unavailable");
+              });
+              Object.assign(stat, await lstat3(part));
+            }
+            if (stat.isDirectory())
+              this.windowsDirectories.add(part);
+            const identity = statIdentity(stat);
+            const previous = this.windowsStats.get(part);
+            if (previous !== void 0 && previous !== identity) {
+              this.traceAudit({
+                event: "invalidate",
+                requested: absolute,
+                path: part,
+                root: this.auditRoot(part),
+                reason: "stat-identity",
+                previous,
+                current: identity
+              });
+              this.invalidateAudit(part);
+            }
+            this.windowsStats.set(part, identity);
+            windowsPaths.push(part);
+          } else if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
+            throw new RuntimeError("permission");
+        }
+        await this.audit(windowsPaths);
+        for (const part2 of windowsPaths) {
+          const verdict = this.windowsAudit.get(part2)?.verdict;
+          if (verdict !== "ok")
+            throw new RuntimeError(verdict === void 0 || verdict === "acl_unavailable" ? "acl_unavailable" : "permission");
+        }
+      }
+      /** Call only after an owned atomic replacement: its parent ctime is our own write. */
+      async recordReplacement(path) {
+        if (process.platform !== "win32" || !this.options.cacheDirectories)
+          return;
+        const absolute = this.guardedPath(path);
+        const parent = dirname3(absolute);
+        const stat = await lstat3(parent);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || !this.windowsStats.get(parent)?.startsWith(`${stat.dev}:${stat.ino}:`))
+          throw new RuntimeError("permission");
+        this.windowsStats.set(parent, statIdentity(stat));
+        this.windowsAudit.delete(absolute);
+        this.windowsStats.delete(absolute);
+      }
+      async bytes(path) {
+        await this.inspect(path);
+        const fd = await open(path, constants.O_RDONLY | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW));
+        try {
+          return await fd.readFile();
+        } finally {
+          await fd.close();
+        }
+      }
+      /** An owned inheritable ACL update can change every cached descendant's ctime. */
+      async recordAclWrite(path) {
+        const root = this.guardedPath(path);
+        for (const known of this.windowsStats.keys())
+          if (known === root || known.startsWith(root + sep2))
+            this.windowsStats.set(known, statIdentity(await lstat3(known)));
+        this.invalidateAudit(root);
+      }
+      async pointer(artifact) {
+        try {
+          const p = JSON.parse((await this.bytes(this.pointerPath(artifact))).toString());
+          for (const ref of [p.current, ...p.previous ? [p.previous] : []]) {
+            versionName(ref.version);
+            if (!/^[a-f0-9]{64}$/.test(ref.manifestSha256))
+              throw new RuntimeError("digest_mismatch");
+          }
+          return p;
+        } catch (e) {
+          if (missing(e))
+            return void 0;
+          throw e instanceof RuntimeError ? e : new RuntimeError("digest_mismatch");
+        }
+      }
+      async operation(work) {
+        const operation = this.operations.then(async () => {
+          this.activeOperation = true;
+          try {
+            return await work();
+          } finally {
+            this.activeOperation = false;
+          }
+        });
+        this.operations = operation.catch(() => void 0);
+        return operation;
+      }
+      verifyAt(artifact, ref, directory) {
+        return this.operation(() => this.verifyOpen(artifact, ref, directory));
+      }
+      async verifyOpen(artifact, ref, directory) {
+        let bytes;
+        try {
+          bytes = await this.bytes(join4(directory, "manifest.json"));
+        } catch (e) {
+          if (missing(e))
+            throw new RuntimeError("manifest_missing");
+          throw e;
+        }
+        if (hash(bytes) !== ref.manifestSha256)
+          throw new RuntimeError("digest_mismatch");
+        let m;
+        try {
+          m = JSON.parse(bytes.toString());
+        } catch {
+          throw new RuntimeError("digest_mismatch");
+        }
+        if (!m || m.schemaVersion !== 1 || !m.source || m.artifact !== artifact || m.version !== ref.version || !m.files || !m.files[safePath(m.entry)])
+          throw new RuntimeError("digest_mismatch");
+        if (artifact === "scanner" && (m.source.kind !== "release" || typeof m.source.url !== "string" || !m.source.url.startsWith("https://") || (!m.signer || m.signer.platform !== process.platform) && !(this.options.allowUnsigned && !m.signer && m.signingStatus === "unsigned")))
+          throw new RuntimeError("unsigned");
+        if (artifact === "cli" && (m.source.kind !== "npm" || !Array.isArray(m.source.packages) || !m.source.packages.some((p) => p.name === "@mnemonik/cli" && p.version === m.version)))
+          throw new RuntimeError("unsigned");
+        if (process.platform === "win32")
+          await this.audit(Object.keys(m.files).map((name) => join4(directory, safePath(name))));
+        const actual = [];
+        const walk = async (dir, prefix = "") => {
+          await this.inspect(dir, true);
+          for (const name of await readdir(dir)) {
+            const key = prefix + name;
+            if (!prefix && name === "manifest.json")
+              continue;
+            const path = join4(dir, name);
+            if ((await lstat3(path)).isDirectory())
+              await walk(path, key + "/");
+            else {
+              await this.inspect(path);
+              actual.push(key);
+            }
+          }
+        };
+        await walk(directory);
+        if (actual.sort().join("\n") !== Object.keys(m.files).sort().join("\n"))
+          throw new RuntimeError("digest_mismatch");
+        let total = 0;
+        for (const [name, expected] of Object.entries(m.files)) {
+          if (!expected || !/^[a-f0-9]{64}$/.test(expected.sha256) || !Number.isSafeInteger(expected.size) || expected.size < 0 || typeof expected.executable !== "boolean")
+            throw new RuntimeError("digest_mismatch");
+          const path = join4(directory, safePath(name));
+          const contents = await this.bytes(path);
+          if (hash(contents) !== expected.sha256 || contents.length !== expected.size)
+            throw new RuntimeError("digest_mismatch");
+          if (process.platform !== "win32" && ((await lstat3(path)).mode & 511) !== (expected.executable ? 448 : 384))
+            throw new RuntimeError("permission");
+          total += contents.length;
+        }
+        if (total !== m.totalSize)
+          throw new RuntimeError("digest_mismatch");
+        if (m.signer) {
+          const signer = m.signer.platform === "linux" ? { ...m.signer, signature: join4(directory, safePath(m.signer.signature)) } : m.signer;
+          if (m.signer.platform === "linux" && !m.files[m.signer.signature])
+            throw new RuntimeError("unsigned");
+          try {
+            const entry = join4(directory, m.entry);
+            if (signer.platform === "win32") {
+              const key = JSON.stringify([entry, m.files[m.entry]?.sha256, signer.identity]);
+              let verification = _RuntimeReader.windowsSignatures.get(key);
+              if (!verification) {
+                verification = verifySigner(entry, signer, this.run).catch((error) => {
+                  _RuntimeReader.windowsSignatures.delete(key);
+                  throw error;
+                });
+                _RuntimeReader.windowsSignatures.set(key, verification);
+              }
+              await verification;
+            } else
+              await verifySigner(entry, signer, this.run);
+          } catch {
+            throw new RuntimeError("unsigned");
+          }
+        }
+        return { directory, manifest: m, entry: join4(directory, m.entry), reference: ref };
+      }
+      async verifyRuntime(artifact) {
+        return this.operation(async () => {
+          const p = await this.pointer(artifact);
+          if (!p)
+            throw new RuntimeError("manifest_missing");
+          return this.verifyOpen(artifact, p.current, join4(dirname3(this.pointerPath(artifact)), p.current.version));
+        });
+      }
+    };
+  }
+});
+
+// packages/shared/dist/projectSetupHandoff.js
+import { execFile as execFile3 } from "node:child_process";
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat4, mkdir, open as open2, readdir as readdir2, realpath, rename, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname as dirname4, join as join5, relative } from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
+function projectSetupActions(value) {
+  return Array.isArray(value) ? value.slice(0, 20).map(words).join(", ") : "retry, cancel";
+}
+function setupResponse(value) {
+  if (typeof value === "string") {
+    if (value.length > 64 * 1024)
+      return;
+    try {
+      value = JSON.parse(value);
+    } catch {
+      return;
+    }
+  }
+  if (!record(value))
+    return;
+  if (record(value.structuredContent))
+    value = value.structuredContent;
+  else {
+    const keys = ["status", "state", "allowedActions", "requestId", "expiresAt"];
+    const envelope = value;
+    if (!keys.every((key) => Object.hasOwn(envelope, key)) || Object.keys(value).some((key) => ![...keys, "manualAction"].includes(key)) || typeof value.state !== "string" || !Array.isArray(value.allowedActions) || !value.allowedActions.every((action) => typeof action === "string") || typeof value.requestId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value.requestId) || typeof value.expiresAt !== "string" || !Number.isFinite(Date.parse(value.expiresAt)) || Object.hasOwn(value, "manualAction") && typeof value.manualAction !== "string")
+      return;
+  }
+  if (record(value) && value.status === "project_setup_required")
+    return value;
+  return;
+}
+async function privateDirectory(path, session) {
+  const created = await mkdir(path, { recursive: true, mode: 448 });
+  const st = await lstat4(path);
+  if (!st.isDirectory() || st.isSymbolicLink() || process.getuid && (st.uid !== process.getuid() || st.mode & 63))
+    throw new Error("diagnostic_unavailable");
+  if (process.platform === "win32") {
+    await protectWindowsDirectory(path, created !== void 0, void 0, session);
+  }
+}
+async function readPrivate(path) {
+  const file = await open2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+  try {
+    const st = await file.stat();
+    if (!st.isFile() || st.size > 64 * 1024 || process.getuid && (st.uid !== process.getuid() || st.mode & 63))
+      throw new Error("diagnostic_unavailable");
+    return await file.readFile("utf8");
+  } finally {
+    await file.close();
+  }
+}
+async function writeDiagnostic(path, value) {
+  await privateDirectory(dirname4(dirname4(path)), dirname4(path));
+  await privateDirectory(dirname4(path), dirname4(path));
+  const temp = `${path}.${randomUUID2()}`;
+  try {
+    const file = await open2(temp, "wx", 384);
+    try {
+      await file.writeFile(JSON.stringify(value) + "\n");
+    } finally {
+      await file.close();
+    }
+    await rename(temp, path);
+  } finally {
+    await rm(temp, { force: true });
+  }
+}
+async function handoffProjectSetup(input) {
+  const response = setupResponse(input.response);
+  if (!response)
+    return;
+  let root;
+  let action = PROJECT_SETUP_MANUAL;
+  let outcome = "failed";
+  let reason = "manual_setup_required";
+  const requestId = typeof response.requestId === "string" && response.requestId.length <= 4096 ? response.requestId : void 0;
+  try {
+    if (!input.cwd)
+      throw new Error("safe_cwd_unavailable");
+    const cache = JSON.parse(await readPrivate(join5(dirname4(input.stateFile), "bound-context.json")));
+    const [, family, body] = JSON.parse(cache.key);
+    if (!input.familyId || family !== input.familyId || body.host !== input.host || body.hostSessionId !== input.hostSessionId || cache.expiresAt <= Date.now() || !cache.canonicalRoot)
+      throw new Error("bound_context_unavailable");
+    root = await realpath(cache.canonicalRoot);
+    const { findProjectIdentityDetailed: findProjectIdentityDetailed2 } = await Promise.resolve().then(() => (init_hookRuntime(), hookRuntime_exports));
+    const identity = await findProjectIdentityDetailed2(await realpath(input.cwd));
+    if (identity.kind === "git_unavailable" || root !== await realpath(identity.root))
+      throw new Error("bound_root_changed");
+    if (!requestId)
+      throw new Error("manual_setup_required");
+    const runtime = await new RuntimeReader(input.stateDir).verifyRuntime("cli").catch(() => {
+      throw new Error("verified_cli_runtime_unavailable");
+    });
+    const bin = join5(dirname4(runtime.entry), "bin.js");
+    if (!runtime.manifest.files[relative(runtime.directory, bin).replaceAll("\\", "/")])
+      throw new Error("verified_cli_bin_missing");
+    const result = await new Promise((resolve4, reject2) => {
+      const child = execFile3(process.execPath, [bin, "project", "ensure", "--agent", "--json"], {
+        cwd: root,
+        shell: false,
+        timeout: 3e4,
+        killSignal: "SIGKILL",
+        maxBuffer: 64 * 1024,
+        // Runtime injection variables and repository/PATH executables are not inherited.
+        env: Object.fromEntries([
+          "HOME",
+          "USERPROFILE",
+          "LOCALAPPDATA",
+          "XDG_STATE_HOME",
+          "MNEMONIK_STATE_DIR",
+          "MNEMONIK_SERVER",
+          "MNEMONIK_API_RESOURCE",
+          "MNEMONIK_OAUTH_ISSUER",
+          "SYSTEMROOT",
+          "TEMP",
+          "TMP",
+          "TMPDIR"
+        ].flatMap((key) => process.env[key] === void 0 ? [] : [[key, process.env[key]]]))
+      }, (error, stdout2) => {
+        if (error && (error.killed || error.code !== 3))
+          return reject2(new Error("helper_failed"));
+        try {
+          resolve4(JSON.parse(stdout2));
+        } catch {
+          reject2(new Error("helper_invalid_json"));
+        }
+      });
+      child.stdin?.on("error", () => {
+      });
+      child.stdin?.end(JSON.stringify({ requestId }));
+    });
+    if (!record(result))
+      throw new Error("helper_invalid_json");
+    if (result.status === "done") {
+      outcome = "done";
+      reason = "complete";
+      action = "Mnemonik project setup is complete; call session_bootstrap again.";
+    } else if (["ACTION_REQUIRED", "action_required", "project_setup_required"].includes(String(result.status))) {
+      outcome = "ACTION_REQUIRED";
+      reason = "choice_required";
+      action = result.action === "mnemonik auth renew" || Array.isArray(result.allowedActions) && result.allowedActions.includes("mnemonik auth renew") ? "mnemonik auth renew" : result.allowedActions ? `Mnemonik project setup needs attention; allowed actions: ${projectSetupActions(result.allowedActions)}.` : PROJECT_SETUP_MANUAL;
+    } else
+      throw new Error("helper_invalid_json");
+  } catch (error) {
+    const code = error instanceof Error ? error.message : "";
+    reason = /^[a-z_]+$/.test(code) ? code : "helper_unavailable";
+    process.stderr.write(`mnemonik-hook: project setup ${reason}; manual action required
+`);
+  }
+  try {
+    await writeDiagnostic(input.stateFile, {
+      requestId,
+      outcome,
+      time: (/* @__PURE__ */ new Date()).toISOString(),
+      rootHash: root ? hash(root) : input.cwd ? hash(await realpath(input.cwd)) : null,
+      action,
+      reason
+    });
+  } catch {
+    process.stderr.write("mnemonik-hook: project setup diagnostic unavailable\n");
+  }
+  return action;
+}
+async function pendingProjectSetup(root) {
+  const rootHash = hash(await realpath(root));
+  const results = [];
+  const uid = process.getuid?.() ?? "user";
+  for (const host of ["credit", "cursor", "grok"]) {
+    const directory = join5(tmpdir(), `mnemonik-${host}-${uid}`);
+    try {
+      const stat = await lstat4(directory);
+      if (stat.isSymbolicLink() || !stat.isDirectory())
+        continue;
+      for (const name of await readdir2(directory)) {
+        if (!/^[a-f0-9]{64}$/.test(name))
+          continue;
+        try {
+          if ((await lstat4(join5(directory, name))).isSymbolicLink())
+            continue;
+          const diagnostic = JSON.parse(await readPrivate(join5(directory, name, "project-setup.json")));
+          if ((diagnostic.rootHash === rootHash || diagnostic.rootHash === null) && ["done", "ACTION_REQUIRED", "failed"].includes(diagnostic.outcome) && typeof diagnostic.action === "string" && diagnostic.action.length < 2e3 && Date.now() - Date.parse(diagnostic.time) < 24 * 60 * 60 * 1e3)
+            results.push(diagnostic);
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
+  results.sort((a, b) => Date.parse(b.time) - Date.parse(a.time));
+  return results[0]?.outcome === "done" ? [] : results.slice(0, 1);
+}
+var PROJECT_SETUP_MANUAL, words, record;
+var init_projectSetupHandoff = __esm({
+  "packages/shared/dist/projectSetupHandoff.js"() {
+    "use strict";
+    init_runtimeSigners();
+    init_runtimeReader();
+    PROJECT_SETUP_MANUAL = "Mnemonik project setup needs attention; ask the person to run `mnemonik project init` in this folder.";
+    words = (value) => typeof value === "string" && /^[a-z][a-z0-9_]{0,79}$/.test(value) ? value.replaceAll("_", " ") : "needs attention";
+    record = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+  }
+});
+
+// packages/shared/dist/repositoryFingerprint.js
+var repositoryFingerprint_exports = {};
+__export(repositoryFingerprint_exports, {
+  REPOSITORY_PROVIDER_RULES: () => REPOSITORY_PROVIDER_RULES,
+  canonicalizeRemote: () => canonicalizeRemote,
+  selectRemote: () => selectRemote
+});
+import { createHash as createHash3 } from "node:crypto";
+import { domainToASCII } from "node:url";
+function canonicalizeRemote(url, { providerRules = REPOSITORY_PROVIDER_RULES } = {}) {
+  if (controls.test(url))
+    return reject("control_character");
+  if (url.includes("\\"))
+    return reject("backslash");
+  if (/^file:/i.test(url))
+    return reject("local_remote");
+  const input = url.split(/[?#]/, 1)[0] ?? "";
+  const scheme = /^([a-z][a-z0-9+.-]*):\/\//i.exec(input);
+  let transport;
+  let authority;
+  let path;
+  if (scheme) {
+    const protocol = (scheme[1] ?? "").toLowerCase();
+    if (protocol !== "https" && protocol !== "ssh")
+      return reject("unsupported_transport");
+    transport = protocol;
+    const parts = /^([^/]*)(?:\/(.*))?$/.exec(input.slice(scheme[0].length));
+    if (!parts)
+      return reject("invalid_remote");
+    authority = parts[1] ?? "";
+    path = parts[2] ?? "";
+  } else {
+    const scp = /^((?:[^@/:]+@)?(?:\[[^\]]+\]|[^/:]+)):(.*)$/.exec(input);
+    if (!scp)
+      return reject("invalid_remote");
+    transport = "ssh";
+    authority = scp[1] ?? "";
+    path = scp[2] ?? "";
+  }
+  const at = authority.lastIndexOf("@");
+  let user = "";
+  if (at >= 0) {
+    if (transport === "https")
+      return reject("https_userinfo");
+    user = authority.slice(0, at);
+    if (user.includes(":"))
+      return reject("ssh_password");
+    if (!/^[A-Za-z0-9._~!$&'()*+,;=-]+$/.test(user))
+      return reject("invalid_ssh_user");
+    authority = authority.slice(at + 1);
+  }
+  if (transport === "ssh" && !user)
+    return reject("ssh_user_required");
+  const hostPort = /^(\[[^\]]+\]|[^:[\]]+)(?::([0-9]+))?$/.exec(authority);
+  if (!hostPort)
+    return reject(authority.includes(":") ? "invalid_port" : "invalid_host");
+  let host = hostPort[1] ?? "";
+  let port = hostPort[2] ?? "";
+  if (port && (Number(port) < 1 || Number(port) > 65535))
+    return reject("invalid_port");
+  if (port)
+    port = String(Number(port));
+  if (port === (transport === "https" ? "443" : "22"))
+    port = "";
+  if (/[\s%/@?#]/u.test(host))
+    return reject("invalid_host");
+  try {
+    host = host.startsWith("[") ? new URL(`https://${host}/`).hostname : domainToASCII(host).toLowerCase();
+    if (!host)
+      return reject("invalid_host");
+  } catch {
+    return reject("invalid_host");
+  }
+  const rule = providerRules.find((rule2) => rule2.host === host && !port && (transport === "https" || user === rule2.sshUser));
+  if (!scheme && !rule)
+    return reject("scp_unreviewed_remote");
+  if (!scheme && path.startsWith("/"))
+    path = path.slice(1);
+  if (path.endsWith("/"))
+    path = path.slice(0, -1);
+  const segments = [];
+  for (const raw of path.split("/")) {
+    if (/%(?:2f|5c)/i.test(raw))
+      return reject("escaped_separator");
+    let segment;
+    try {
+      segment = decodeURIComponent(raw).normalize("NFC");
+    } catch {
+      return reject("invalid_encoding");
+    }
+    if (controls.test(segment))
+      return reject("control_character");
+    if (segment.includes("\\"))
+      return reject("backslash");
+    if (!segment)
+      return reject("empty_segment");
+    if (segment === "." || segment === "..")
+      return reject("dot_segment");
+    try {
+      segments.push(encodeSegment(segment));
+    } catch {
+      return reject("invalid_encoding");
+    }
+  }
+  const parsed = { transport, host, user, port, path: segments.join("/") };
+  if (rule?.removeTerminalDotGit) {
+    parsed.path = parsed.path.replace(/\.git$/, "");
+    const last = parsed.path.split("/").at(-1);
+    if (!last)
+      return reject("empty_segment");
+    if (last === "." || last === "..")
+      return reject("dot_segment");
+  }
+  const prefix = rule ? `${rule.name}:${host}` : `${transport}:${transport === "ssh" ? `${user}@` : ""}${host}${port ? `:${port}` : ""}`;
+  const canonical = `repo-v1:${prefix}/${parsed.path}`;
+  return {
+    canonical,
+    hash: createHash3("sha256").update(canonical, "utf8").digest("hex"),
+    algorithmVersion: 1
+  };
+}
+function selectRemote(remotes) {
+  if (!remotes.length)
+    return { status: "none", reason: "no_remote" };
+  const origins = remotes.filter((remote) => remote.name === "origin");
+  const selected = origins.length === 1 ? origins[0] : remotes.length === 1 ? remotes[0] : void 0;
+  if (!selected)
+    return {
+      status: "choice_required",
+      reason: "multiple_remotes",
+      remotes: remotes.map((r) => r.name)
+    };
+  if (!selected.fetchUrls.length)
+    return { status: "none", reason: "no_fetch_url" };
+  const results = [...selected.fetchUrls, ...selected.pushUrls ?? []].map((url) => canonicalizeRemote(url));
+  const first = results[0];
+  if (!first)
+    return { status: "none", reason: "no_fetch_url" };
+  if (results.length === 1 && "reason" in first)
+    return { status: "rejected", remote: selected.name, reason: first.reason };
+  if ("reason" in first || results.some((result) => "reason" in result || result.canonical !== first.canonical)) {
+    return { status: "choice_required", reason: "different_urls", remotes: [selected.name] };
+  }
+  return { status: "fingerprint", remote: selected.name, fingerprint: first };
+}
+var REPOSITORY_PROVIDER_RULES, controls, reject, encodeSegment;
+var init_repositoryFingerprint = __esm({
+  "packages/shared/dist/repositoryFingerprint.js"() {
+    "use strict";
+    REPOSITORY_PROVIDER_RULES = Object.freeze([
+      Object.freeze({ name: "github", host: "github.com", sshUser: "git", removeTerminalDotGit: true })
+    ]);
+    controls = new RegExp("\\p{Cc}", "u");
+    reject = (reason) => ({ status: "rejected", reason });
+    encodeSegment = (segment) => encodeURIComponent(segment).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+  }
+});
+
+// packages/shared/dist/hookRuntime.js
+var hookRuntime_exports = {};
+__export(hookRuntime_exports, {
+  PROJECT_SETUP_MANUAL: () => PROJECT_SETUP_MANUAL,
+  RuntimeError: () => RuntimeError,
+  RuntimeReader: () => RuntimeReader,
+  aclRecords: () => aclRecords,
+  auditWindowsPermissions: () => auditWindowsPermissions,
+  bindHookContext: () => bindHookContext,
+  ensureWindowsPrivateDirectorySync: () => ensureWindowsPrivateDirectorySync,
+  execute: () => execute,
+  findProjectIdentity: () => findProjectIdentity,
+  findProjectIdentityDetailed: () => findProjectIdentityDetailed,
+  handoffProjectSetup: () => handoffProjectSetup,
+  hash: () => hash,
+  missing: () => missing,
+  parseHookResponse: () => parseHookResponse,
+  pendingProjectSetup: () => pendingProjectSetup,
+  postHookBoundJson: () => postHookBoundJson,
+  prepareWindowsAclDirectory: () => prepareWindowsAclDirectory,
+  projectSetupActions: () => projectSetupActions,
+  protectWindowsDirectory: () => protectWindowsDirectory,
+  safePath: () => safePath,
+  setupResponse: () => setupResponse,
+  validHookSessionId: () => validHookSessionId,
+  verifySigner: () => verifySigner,
+  verifyWindowsAcl: () => verifyWindowsAcl,
+  verifyWindowsPermission: () => verifyWindowsPermission,
+  verifyWindowsPermissionSync: () => verifyWindowsPermissionSync,
+  versionName: () => versionName,
+  windowsCurrentAccountSync: () => windowsCurrentAccountSync,
+  windowsCurrentUserDirectoryAcl: () => windowsCurrentUserDirectoryAcl
+});
+import { stderr } from "node:process";
+async function findProjectIdentity(startCwd, options = {}) {
+  if (!startCwd)
+    return null;
+  const result = await findProjectIdentityDetailed(startCwd, options);
+  if (result.kind !== "ok")
+    return null;
+  return {
+    projectId: result.identity.projectId,
+    projectName: result.identity.projectName,
+    projectRoot: result.root
+  };
+}
+async function findProjectIdentityDetailed(startCwd, options = {}) {
+  return resolveProjectIdentity(startCwd, options);
+}
+async function parseHookResponse(response) {
+  const body = await response.json();
+  const result = body;
+  if (!mismatchEmitted && result?.ok === false && result.reason === "identity_mismatch") {
+    stderr.write("mnemonik-hook: project identity mismatch - .mnemonik.json points to one project, but this directory is registered to a different one on the server. Fix .mnemonik.json (delete it and let session_bootstrap rewrite it) or cd to the correct project root.\n");
+    mismatchEmitted = true;
+  }
+  return body;
+}
+function validHookSessionId(value) {
+  return typeof value === "string" && /^[a-zA-Z0-9@._+:-]{1,255}$/.test(value) && !["cursor-unknown-session", "codex-unknown-session"].includes(value);
+}
+async function postHookBoundJson(server, path, token, body) {
+  const response = await fetch(`${server.replace(/\/$/, "")}${path}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(2e3)
+  });
+  return { status: response.status, body: await response.json() };
+}
+async function bindHookContext(input, familyId, hmac, post, options = {}) {
+  const { execFile: execFile4 } = await import("node:child_process");
+  const { constants: constants3 } = await import("node:fs");
+  const { lstat: lstat5, mkdir: mkdir2, open: open3, realpath: realpath2 } = await import("node:fs/promises");
+  const { dirname: dirname5 } = await import("node:path");
+  const { selectRemote: selectRemote2 } = await Promise.resolve().then(() => (init_repositoryFingerprint(), repositoryFingerprint_exports));
+  const identity = await findProjectIdentityDetailed(await realpath2(input.cwd));
+  if (identity.kind === "git_unavailable")
+    throw new Error("context unavailable");
+  const root = await realpath2(identity.root);
+  const binding = await hmac(root);
+  const gitEnv = { LC_ALL: "C" };
+  for (const key2 of ["PATH", "HOME", "LANG", "SYSTEMROOT", "TEMP", "TMP", "USERPROFILE"])
+    if (process.env[key2] !== void 0)
+      gitEnv[key2] = process.env[key2];
+  const git = (args) => new Promise((resolve4) => {
+    execFile4("git", args, { cwd: root, env: gitEnv, timeout: 2e3, encoding: "utf8" }, (error, stdout2) => resolve4(error ? [] : stdout2.trim().split(/\r?\n/).filter(Boolean)));
+  });
+  const remotes = identity.repository.kind === "git" ? await git(["remote"]) : [];
+  const selection = selectRemote2(await Promise.all(remotes.map(async (name) => ({
+    name,
+    fetchUrls: await git(["remote", "get-url", "--all", name]),
+    pushUrls: await git(["remote", "get-url", "--push", "--all", name])
+  }))));
+  const body = {
+    host: input.host,
+    hostSessionId: input.hostSessionId,
+    deviceRootContext: {
+      algorithmVersion: binding.version,
+      hash: Buffer.from(binding.hmac, "base64url").toString("hex")
+    },
+    repositoryFingerprint: selection.status === "fingerprint" ? {
+      algorithmVersion: selection.fingerprint.algorithmVersion,
+      hash: selection.fingerprint.hash
+    } : null,
+    // Automatic hooks never select a non-git root for the user.
+    rootKind: identity.repository.kind === "git" ? "git" : "ineligible",
+    identityState: identity.kind === "ok" ? "valid" : identity.kind === "absent" ? "absent" : "invalid",
+    ...identity.kind === "ok" ? { projectId: identity.identity.projectId } : {}
+  };
+  const key = JSON.stringify([input.server, familyId, body]);
+  const directory = dirname5(input.stateFile);
+  for (const path of [dirname5(directory), directory]) {
+    const created = await mkdir2(path, { recursive: true, mode: 448 });
+    const stat = await lstat5(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (options.platform ?? process.platform) !== "win32" && (process.getuid && stat.uid !== process.getuid() || stat.mode & 63))
+      throw new Error("cache unavailable");
+    if ((options.platform ?? process.platform) === "win32") {
+      await protectWindowsDirectory(path, created !== void 0, options.run, directory);
+    }
+  }
+  const file = await open3(input.stateFile, constants3.O_CREAT | constants3.O_RDWR | constants3.O_NOFOLLOW, 384);
+  try {
+    let cache;
+    try {
+      cache = JSON.parse(await file.readFile("utf8"));
+    } catch {
+    }
+    const now = Date.now();
+    if (cache && cache.expiresAt > now && (cache.key === key || cache.retryKey === key))
+      return;
+    const status = await post(body);
+    if (status === 200)
+      cache = { key, expiresAt: Date.now() + 12e4, canonicalRoot: root };
+    else {
+      stderr.write(`mnemonik-hook: bound-context post failed (${status})
+`);
+      if (status !== 409)
+        return;
+      cache = {
+        key: cache?.key ?? "",
+        expiresAt: cache && cache.expiresAt > now ? cache.expiresAt : now + 12e4,
+        retryKey: key
+      };
+    }
+    await file.truncate(0);
+    await file.write(JSON.stringify(cache), 0, "utf8");
+  } finally {
+    await file.close();
+  }
+}
+var mismatchEmitted;
+var init_hookRuntime = __esm({
+  "packages/shared/dist/hookRuntime.js"() {
+    "use strict";
+    init_runtimeSigners();
+    init_repositoryRoot();
+    init_runtimeReader();
+    init_runtimeSigners();
+    init_projectSetupHandoff();
+    mismatchEmitted = false;
+  }
+});
+
+// packages/cli/src/runtime/signers.ts
+init_hookRuntime();
+export {
+  PROJECT_SETUP_MANUAL,
+  RuntimeError,
+  RuntimeReader,
+  aclRecords,
+  auditWindowsPermissions,
+  bindHookContext,
+  ensureWindowsPrivateDirectorySync,
+  execute,
+  findProjectIdentity,
+  findProjectIdentityDetailed,
+  handoffProjectSetup,
+  hash,
+  missing,
+  parseHookResponse,
+  pendingProjectSetup,
+  postHookBoundJson,
+  prepareWindowsAclDirectory,
+  projectSetupActions,
+  protectWindowsDirectory,
+  safePath,
+  setupResponse,
+  validHookSessionId,
+  verifySigner,
+  verifyWindowsAcl,
+  verifyWindowsPermission,
+  verifyWindowsPermissionSync,
+  versionName,
+  windowsCurrentAccountSync,
+  windowsCurrentUserDirectoryAcl
+};