@mnemonik/shared 7.97.2 → 7.98.0

package/dist/runtimeReader.js

@@ -0,0 +1,408 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, open, readdir } from 'node:fs/promises';
+import { dirname, join, parse, resolve, sep } from 'node:path';
+import { verifySigner, verifyWindowsPermission, verifyWindowsAcl, prepareWindowsAclDirectory, auditWindowsPermissions, } from './runtimeSigners.js';
+export class RuntimeError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+        this.name = 'RuntimeError';
+    }
+}
+export const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export function safePath(path) {
+    if (typeof path !== 'string' ||
+        !/^[a-zA-Z0-9_@.+/-]+$/.test(path) ||
+        path.split('/').some((p) => !p || p === '.' || p === '..') ||
+        path.includes(':'))
+        throw new RuntimeError('permission');
+    return path;
+}
+export const missing = (e) => e.code === 'ENOENT';
+export const versionName = (v) => {
+    if (!/^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(v))
+        throw new RuntimeError('permission');
+    return v;
+};
+const statIdentity = (stat) => [stat.dev, stat.ino, stat.mode, stat.uid, stat.size, stat.mtimeMs, stat.ctimeMs].join(':');
+/** Only stdlib and the accepted bootstrap's signer adapter may load before verifyRuntime returns. */
+export class RuntimeReader {
+    run;
+    options;
+    now;
+    state;
+    static windowsSignatures = new Map();
+    // Omitted batch verdicts use the per-path fallback before entering the cache.
+    windowsAudit = new Map();
+    windowsStats = new Map();
+    windowsDirectories = new Set();
+    audits = Promise.resolve();
+    auditsInFlight = new Map();
+    activeOperation = false;
+    operations = Promise.resolve();
+    constructor(state, run, options = {}, now = () => performance.now()) {
+        this.run = run;
+        this.options = options;
+        this.now = now;
+        this.state = resolve(state);
+    }
+    pointerPath(artifact) {
+        if (!['cli', 'scanner', 'claude-code', 'codex', 'cursor', 'grok'].includes(artifact))
+            throw new RuntimeError('permission');
+        return join(this.state, 'runtimes', artifact, 'current');
+    }
+    guardedPath(path) {
+        const absolute = resolve(path);
+        if ((absolute !== this.state && !absolute.startsWith(this.state + sep)) ||
+            (process.platform === 'win32' && /[\r\n\t]/.test(absolute)))
+            throw new RuntimeError('permission');
+        return absolute;
+    }
+    auditRoot(path) {
+        const [area, artifact] = path.slice(this.state.length + 1).split(sep);
+        return area === 'runtimes' ? join(this.state, area, ...(artifact ? [artifact] : [])) : path;
+    }
+    traceAudit(event) {
+        const level = process.env.MNEMONIK_AUDIT_TRACE;
+        if (level !== '1' && (level !== 'misses' || event.cache === 'hit'))
+            return;
+        process.stderr.write(JSON.stringify({
+            type: 'runtime-audit',
+            pid: process.pid,
+            module: import.meta.url,
+            activeOperation: this.activeOperation,
+            ...event,
+        }) + '\n');
+    }
+    invalidateAudit(path) {
+        const root = this.auditRoot(path);
+        for (const key of this.windowsAudit.keys())
+            if (key === root ||
+                ((!this.options.cacheDirectories || root.startsWith(join(this.state, 'runtimes') + sep)) &&
+                    key.startsWith(root + sep)))
+                this.windowsAudit.delete(key);
+    }
+    audit(paths) {
+        const root = this.auditRoot(paths.at(-1) ?? this.state);
+        const pending = this.auditsInFlight.get(root);
+        if (pending)
+            return pending;
+        const audit = this.audits
+            .then(() => this.auditPending(paths))
+            .finally(() => this.auditsInFlight.delete(root));
+        this.auditsInFlight.set(root, audit);
+        this.audits = audit.catch(() => { });
+        return audit;
+    }
+    async auditPending(paths) {
+        if (process.platform !== 'win32')
+            return;
+        const pending = new Set();
+        for (const path of paths) {
+            let part = this.guardedPath(path);
+            while (true) {
+                const cached = this.windowsAudit.get(part);
+                const expired = !!cached &&
+                    !this.activeOperation &&
+                    !(this.options.cacheDirectories && this.windowsDirectories.has(part)) &&
+                    this.now() - cached.checkedAt >= 2_000;
+                this.traceAudit({
+                    event: 'cache',
+                    requested: path,
+                    path: part,
+                    root: this.auditRoot(path),
+                    cache: !cached ? 'miss' : expired ? 'ttl-expired' : 'hit',
+                });
+                if (!cached || expired)
+                    pending.add(part);
+                if (part === this.state)
+                    break;
+                part = dirname(part);
+            }
+        }
+        if (!pending.size)
+            return;
+        try {
+            const root = this.auditRoot(paths.at(-1) ?? this.state);
+            const ancestors = [...pending].filter((path) => path !== root && !path.startsWith(root + sep));
+            const tree = [...pending].filter((path) => !ancestors.includes(path));
+            for (const part of [...ancestors, ...(tree.length ? [root] : [])]) {
+                const recursive = part === root && root.startsWith(join(this.state, 'runtimes') + sep);
+                this.traceAudit({ event: 'audit', root: part, recursive });
+                const requested = part === root ? tree : [part];
+                if (this.options.cacheDirectories &&
+                    !this.windowsDirectories.has(part) &&
+                    this.windowsAudit.get(part)?.verdict === 'ok') {
+                    await verifyWindowsAcl(part, this.run, this.state);
+                    this.windowsAudit.set(part, { verdict: 'ok', checkedAt: this.now() });
+                    continue;
+                }
+                const verdicts = await auditWindowsPermissions(part, requested, this.run, recursive, this.state);
+                const checkedAt = this.now();
+                for (const path of new Set([...requested, ...verdicts.keys()])) {
+                    let verdict = verdicts.get(path);
+                    if (verdict === undefined) {
+                        await verifyWindowsPermission(path, this.run, this.state);
+                        verdict = 'ok';
+                    }
+                    this.windowsAudit.set(path, { verdict, checkedAt });
+                }
+            }
+        }
+        catch (error) {
+            throw new RuntimeError(error instanceof Error && error.message === 'acl_permissions'
+                ? 'permission'
+                : 'acl_unavailable');
+        }
+    }
+    async inspect(path, directory = false, allowMissing = false, replacing = false) {
+        const absolute = this.guardedPath(path);
+        const windowsPaths = [];
+        let part = parse(absolute).root;
+        for (const name of absolute.slice(part.length).split(sep)) {
+            part = join(part, name);
+            const stat = await lstat(part).catch((e) => {
+                if (allowMissing && missing(e))
+                    return null;
+                throw e;
+            });
+            if (!stat)
+                break;
+            if (stat.isSymbolicLink() ||
+                (part === absolute
+                    ? directory
+                        ? !stat.isDirectory()
+                        : !stat.isFile()
+                    : !stat.isDirectory()))
+                throw new RuntimeError('permission');
+            if (part !== this.state && !part.startsWith(this.state + sep))
+                continue;
+            if (process.platform === 'win32') {
+                if (replacing && part === absolute)
+                    continue;
+                if (part === this.state && !this.windowsStats.has(part)) {
+                    await prepareWindowsAclDirectory(this.state, this.run).catch((error) => {
+                        throw new RuntimeError(error instanceof Error && error.message === 'acl_permissions'
+                            ? 'permission'
+                            : 'acl_unavailable');
+                    });
+                    // Initial creation is our own write, before this directory enters the cache.
+                    Object.assign(stat, await lstat(part));
+                }
+                if (stat.isDirectory())
+                    this.windowsDirectories.add(part);
+                const identity = statIdentity(stat);
+                const previous = this.windowsStats.get(part);
+                if (previous !== undefined && previous !== identity) {
+                    this.traceAudit({
+                        event: 'invalidate',
+                        requested: absolute,
+                        path: part,
+                        root: this.auditRoot(part),
+                        reason: 'stat-identity',
+                        previous,
+                        current: identity,
+                    });
+                    this.invalidateAudit(part);
+                }
+                this.windowsStats.set(part, identity);
+                windowsPaths.push(part);
+            }
+            else if (stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0)
+                throw new RuntimeError('permission');
+        }
+        await this.audit(windowsPaths);
+        for (const part of windowsPaths) {
+            const verdict = this.windowsAudit.get(part)?.verdict;
+            if (verdict !== 'ok')
+                throw new RuntimeError(verdict === undefined || verdict === 'acl_unavailable' ? 'acl_unavailable' : 'permission');
+        }
+    }
+    /** Call only after an owned atomic replacement: its parent ctime is our own write. */
+    async recordReplacement(path) {
+        if (process.platform !== 'win32' || !this.options.cacheDirectories)
+            return;
+        const absolute = this.guardedPath(path);
+        const parent = dirname(absolute);
+        const stat = await lstat(parent);
+        if (!stat.isDirectory() ||
+            stat.isSymbolicLink() ||
+            !this.windowsStats.get(parent)?.startsWith(`${stat.dev}:${stat.ino}:`))
+            throw new RuntimeError('permission');
+        this.windowsStats.set(parent, statIdentity(stat));
+        this.windowsAudit.delete(absolute);
+        this.windowsStats.delete(absolute);
+    }
+    async bytes(path) {
+        await this.inspect(path);
+        const fd = await open(path, constants.O_RDONLY | (process.platform === 'win32' ? 0 : constants.O_NOFOLLOW));
+        try {
+            return await fd.readFile();
+        }
+        finally {
+            await fd.close();
+        }
+    }
+    /** An owned inheritable ACL update can change every cached descendant's ctime. */
+    async recordAclWrite(path) {
+        const root = this.guardedPath(path);
+        for (const known of this.windowsStats.keys())
+            if (known === root || known.startsWith(root + sep))
+                this.windowsStats.set(known, statIdentity(await lstat(known)));
+        this.invalidateAudit(root);
+    }
+    async pointer(artifact) {
+        try {
+            const p = JSON.parse((await this.bytes(this.pointerPath(artifact))).toString());
+            for (const ref of [p.current, ...(p.previous ? [p.previous] : [])]) {
+                versionName(ref.version);
+                if (!/^[a-f0-9]{64}$/.test(ref.manifestSha256))
+                    throw new RuntimeError('digest_mismatch');
+            }
+            return p;
+        }
+        catch (e) {
+            if (missing(e))
+                return undefined;
+            throw e instanceof RuntimeError ? e : new RuntimeError('digest_mismatch');
+        }
+    }
+    async operation(work) {
+        const operation = this.operations.then(async () => {
+            // Reuse this process's audit across inspect/install/verify; stat drift invalidates it.
+            this.activeOperation = true;
+            try {
+                return await work();
+            }
+            finally {
+                this.activeOperation = false;
+            }
+        });
+        this.operations = operation.catch(() => undefined);
+        return operation;
+    }
+    verifyAt(artifact, ref, directory) {
+        return this.operation(() => this.verifyOpen(artifact, ref, directory));
+    }
+    async verifyOpen(artifact, ref, directory) {
+        let bytes;
+        try {
+            bytes = await this.bytes(join(directory, 'manifest.json'));
+        }
+        catch (e) {
+            if (missing(e))
+                throw new RuntimeError('manifest_missing');
+            throw e;
+        }
+        if (hash(bytes) !== ref.manifestSha256)
+            throw new RuntimeError('digest_mismatch');
+        let m;
+        try {
+            m = JSON.parse(bytes.toString());
+        }
+        catch {
+            throw new RuntimeError('digest_mismatch');
+        }
+        if (!m ||
+            m.schemaVersion !== 1 ||
+            !m.source ||
+            m.artifact !== artifact ||
+            m.version !== ref.version ||
+            !m.files ||
+            !m.files[safePath(m.entry)])
+            throw new RuntimeError('digest_mismatch');
+        if (artifact === 'scanner' &&
+            (m.source.kind !== 'release' ||
+                typeof m.source.url !== 'string' ||
+                !m.source.url.startsWith('https://') ||
+                ((!m.signer || m.signer.platform !== process.platform) &&
+                    !(this.options.allowUnsigned && !m.signer && m.signingStatus === 'unsigned'))))
+            throw new RuntimeError('unsigned');
+        if (artifact === 'cli' &&
+            (m.source.kind !== 'npm' ||
+                !Array.isArray(m.source.packages) ||
+                !m.source.packages.some((p) => p.name === '@mnemonik/cli' && p.version === m.version)))
+            throw new RuntimeError('unsigned');
+        if (process.platform === 'win32')
+            await this.audit(Object.keys(m.files).map((name) => join(directory, safePath(name))));
+        const actual = [];
+        const walk = async (dir, prefix = '') => {
+            await this.inspect(dir, true);
+            for (const name of await readdir(dir)) {
+                const key = prefix + name;
+                if (!prefix && name === 'manifest.json')
+                    continue;
+                const path = join(dir, name);
+                if ((await lstat(path)).isDirectory())
+                    await walk(path, key + '/');
+                else {
+                    await this.inspect(path);
+                    actual.push(key);
+                }
+            }
+        };
+        await walk(directory);
+        if (actual.sort().join('\n') !== Object.keys(m.files).sort().join('\n'))
+            throw new RuntimeError('digest_mismatch');
+        let total = 0;
+        for (const [name, expected] of Object.entries(m.files)) {
+            if (!expected ||
+                !/^[a-f0-9]{64}$/.test(expected.sha256) ||
+                !Number.isSafeInteger(expected.size) ||
+                expected.size < 0 ||
+                typeof expected.executable !== 'boolean')
+                throw new RuntimeError('digest_mismatch');
+            const path = join(directory, safePath(name));
+            const contents = await this.bytes(path);
+            if (hash(contents) !== expected.sha256 || contents.length !== expected.size)
+                throw new RuntimeError('digest_mismatch');
+            if (process.platform !== 'win32' &&
+                ((await lstat(path)).mode & 0o777) !== (expected.executable ? 0o700 : 0o600))
+                throw new RuntimeError('permission');
+            total += contents.length;
+        }
+        if (total !== m.totalSize)
+            throw new RuntimeError('digest_mismatch');
+        if (m.signer) {
+            const signer = m.signer.platform === 'linux'
+                ? { ...m.signer, signature: join(directory, safePath(m.signer.signature)) }
+                : m.signer;
+            if (m.signer.platform === 'linux' && !m.files[m.signer.signature])
+                throw new RuntimeError('unsigned');
+            try {
+                const entry = join(directory, m.entry);
+                if (signer.platform === 'win32') {
+                    const key = JSON.stringify([entry, m.files[m.entry]?.sha256, signer.identity]);
+                    let verification = RuntimeReader.windowsSignatures.get(key);
+                    if (!verification) {
+                        verification = verifySigner(entry, signer, this.run).catch((error) => {
+                            RuntimeReader.windowsSignatures.delete(key);
+                            throw error;
+                        });
+                        RuntimeReader.windowsSignatures.set(key, verification);
+                    }
+                    await verification;
+                }
+                else
+                    await verifySigner(entry, signer, this.run);
+            }
+            catch {
+                throw new RuntimeError('unsigned');
+            }
+        }
+        return { directory, manifest: m, entry: join(directory, m.entry), reference: ref };
+    }
+    async verifyRuntime(artifact) {
+        return this.operation(async () => {
+            const p = await this.pointer(artifact);
+            if (!p)
+                throw new RuntimeError('manifest_missing');
+            // Reading the pointer is not permission to import its target. Only return a verified path.
+            return this.verifyOpen(artifact, p.current, join(dirname(this.pointerPath(artifact)), p.current.version));
+        });
+    }
+}
+export * from './runtimeSigners.js';
+//# sourceMappingURL=runtimeReader.js.map

package/dist/runtimeReader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeReader.js","sourceRoot":"","sources":["../src/runtimeReader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,GAIxB,MAAM,qBAAqB,CAAC;AAW7B,MAAM,OAAO,YAAa,SAAQ,KAAK;IACT,MAAM;IAAlC,YAA4B,MAAc;QACxC,KAAK,CAAC,MAAM,CAAC,CAAC;sBADY,MAAM;QAEhC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AACD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAU,EAAE,CACrD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnD,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAElB,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAwCD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAU,EAAW,EAAE,CAAE,CAA2B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC/F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAS,EAAU,EAAE;IAC/C,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;IAClF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,IAAW,EAAU,EAAE,CAC3C,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE7F,qGAAqG;AACrG,MAAM,OAAO,aAAa;IAgBb,GAAG;IACH,OAAO;IACC,GAAG;IAjBb,KAAK,CAAS;IACf,MAAM,CAAU,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7E,8EAA8E;IAC7D,YAAY,GAAG,IAAI,GAAG,EAGpC,CAAC;IACa,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAChD,MAAM,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjC,cAAc,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC3D,eAAe,GAAG,KAAK,CAAC;IACxB,UAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACzD,YACE,KAAa,EACJ,GAAa,EACb,OAAO,GAA4D,EAAE,EAC7D,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;mBAFrC,GAAG;uBACH,OAAO;mBACC,GAAG;QAEpB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,WAAW,CAAC,QAAkB;QAC5B,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAClF,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IACO,WAAW,CAAC,IAAY;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IACE,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACnE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE3D,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACO,SAAS,CAAC,IAAY;QAC5B,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtE,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,CAAC;IACO,UAAU,CAAC,KAA8B;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC/C,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC;YAAE,OAAO;QAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,eAAe;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EAAE,OAAO,IAAI,CAAC,GAAG;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,GAAG,KAAK;SACT,CAAC,GAAG,IAAI,CACV,CAAC;IACJ,CAAC;IACO,eAAe,CAAC,IAAY;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;YACxC,IACE,GAAG,KAAK,IAAI;gBACZ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;oBACtF,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;gBAE7B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACO,KAAK,CAAC,KAAe;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM;aACtB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;aACpC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACO,KAAK,CAAC,YAAY,CAAC,KAAe;QACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO;QACzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,OAAO,GACX,CAAC,CAAC,MAAM;oBACR,CAAC,IAAI,CAAC,eAAe;oBACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACrE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;gBACzC,IAAI,CAAC,UAAU,CAAC;oBACd,KAAK,EAAE,OAAO;oBACd,SAAS,EAAE,IAAI;oBACf,IAAI,EAAE,IAAI;oBACV,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK;iBAC1D,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,IAAI,OAAO;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK;oBAAE,MAAM;gBAC/B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CACxD,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACtE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAClE,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;gBACvF,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC3D,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChD,IACE,IAAI,CAAC,OAAO,CAAC,gBAAgB;oBAC7B,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAClC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,EAC7C,CAAC;oBACD,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACtE,SAAS;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,IAAI,EACJ,SAAS,EACT,IAAI,CAAC,GAAG,EACR,SAAS,EACT,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC/D,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBAC1B,MAAM,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;wBAC1D,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;oBACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,YAAY,CACpB,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,iBAAiB;gBAC3D,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,iBAAiB,CACtB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,SAAS,GAAG,KAAK,EACjB,YAAY,GAAG,KAAK,EACpB,SAAS,GAAG,KAAK;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACzC,IAAI,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC5C,MAAM,CAAC,CAAC;YACV,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI;gBAAE,MAAM;YACjB,IACE,IAAI,CAAC,cAAc,EAAE;gBACrB,CAAC,IAAI,KAAK,QAAQ;oBAChB,CAAC,CAAC,SAAS;wBACT,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;wBACrB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBAClB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAExB,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;gBAAE,SAAS;YACxE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,SAAS,IAAI,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAC7C,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;wBAC9E,MAAM,IAAI,YAAY,CACpB,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,iBAAiB;4BAC3D,CAAC,CAAC,YAAY;4BACd,CAAC,CAAC,iBAAiB,CACtB,CAAC;oBACJ,CAAC,CAAC,CAAC;oBACH,6EAA6E;oBAC7E,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzC,CAAC;gBACD,IAAI,IAAI,CAAC,WAAW,EAAE;oBAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACpD,IAAI,CAAC,UAAU,CAAC;wBACd,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,QAAQ;wBACnB,IAAI,EAAE,IAAI;wBACV,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;wBAC1B,MAAM,EAAE,eAAe;wBACvB,QAAQ;wBACR,OAAO,EAAE,QAAQ;qBAClB,CAAC,CAAC;oBACH,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;gBACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACtC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;iBAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;gBACrE,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;YACrD,IAAI,OAAO,KAAK,IAAI;gBAClB,MAAM,IAAI,YAAY,CACpB,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAC1F,CAAC;QACN,CAAC;IACH,CAAC;IACD,sFAAsF;IACtF,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAAE,OAAO;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IACE,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC;YAEtE,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,IAAI,CACnB,IAAI,EACJ,SAAS,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAC/E,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IACD,kFAAkF;IACxE,KAAK,CAAC,cAAc,CAAC,IAAY;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;YAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;gBAChD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACS,KAAK,CAAC,OAAO,CAAC,QAAkB;QACxC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAY,CAAC;YAC3F,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACnE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACzB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;oBAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;YAC5F,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjC,MAAM,CAAC,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACO,KAAK,CAAC,SAAS,CAAI,IAAsB;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAChD,uFAAuF;YACvF,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IACS,QAAQ,CAAC,QAAkB,EAAE,GAAc,EAAE,SAAiB;QACtE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC;IACO,KAAK,CAAC,UAAU,CACtB,QAAkB,EAClB,GAAc,EACd,SAAiB;QAEjB,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,OAAO,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,cAAc;YAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAClF,IAAI,CAAW,CAAC;QAChB,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAa,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC5C,CAAC;QACD,IACE,CAAC,CAAC;YACF,CAAC,CAAC,aAAa,KAAK,CAAC;YACrB,CAAC,CAAC,CAAC,MAAM;YACT,CAAC,CAAC,QAAQ,KAAK,QAAQ;YACvB,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;YACzB,CAAC,CAAC,CAAC,KAAK;YACR,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAE3B,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IACE,QAAQ,KAAK,SAAS;YACtB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;gBAC1B,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAChC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;gBACpC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC;oBACpD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC;YAElF,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;QACrC,IACE,QAAQ,KAAK,KAAK;YAClB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;gBACtB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACjC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YAExF,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAE,MAAM,GAAG,EAAE,EAAiB,EAAE;YAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC;gBAC1B,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,eAAe;oBAAE,SAAS;gBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;oBAAE,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;qBAC9D,CAAC;oBACJ,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YACrE,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,IACE,CAAC,QAAQ;gBACT,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACvC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpC,QAAQ,CAAC,IAAI,GAAG,CAAC;gBACjB,OAAO,QAAQ,CAAC,UAAU,KAAK,SAAS;gBAExC,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;gBACzE,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;YAC5C,IACE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC5B,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;gBAE5E,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;YACvC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,IAAI,KAAK,KAAK,CAAC,CAAC,SAAS;YAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACrE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,MAAM,GACV,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE;gBAC3E,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACf,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC/D,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC/E,IAAI,YAAY,GAAG,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;4BACnE,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;4BAC5C,MAAM,KAAK,CAAC;wBACd,CAAC,CAAC,CAAC;wBACH,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;oBACzD,CAAC;oBACD,MAAM,YAAY,CAAC;gBACrB,CAAC;;oBAAM,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACrF,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,QAAkB;QACpC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,CAAC,CAAC;YACnD,2FAA2F;YAC3F,OAAO,IAAI,CAAC,UAAU,CACpB,QAAQ,EACR,CAAC,CAAC,OAAO,EACT,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,cAAc,qBAAqB,CAAC"}

package/dist/runtimeSigners.d.ts

@@ -0,0 +1,37 @@
+export type Signer = {
+    platform: 'darwin';
+    identity: string;
+} | {
+    platform: 'win32';
+    identity: string;
+} | {
+    platform: 'linux';
+    identity: string;
+    signature: string;
+};
+export type Execute = (file: string, args: string[], input?: string) => Promise<unknown>;
+export declare const execute: Execute;
+/** Release tooling supplies the real identity and artifacts. These checks do not sign anything. */
+export declare function verifySigner(path: string, signer: Signer, run?: Execute): Promise<void>;
+/** Windows stat mode/uid are not ACL evidence. */
+export declare function verifyWindowsPermission(path: string, run?: Execute, state?: string): Promise<void>;
+type HookIdentity = {
+    name: string;
+    sid: string;
+};
+export declare function windowsCurrentAccountSync(): HookIdentity;
+/** Frequent config polling checks fresh ACEs; stat changes trigger a full owner audit. */
+export declare function verifyWindowsAcl(path: string, run?: Execute, state?: string): Promise<void>;
+/** icacls /save writes alternating relative paths and SDDL in UTF-16LE. */
+export declare function aclRecords(output: string, root: string, paths: string[], onLookup?: () => void): Map<string, string[]>;
+export declare function prepareWindowsAclDirectory(state: string, run?: Execute): Promise<void>;
+export declare function windowsCurrentUserDirectoryAcl(path: string, run?: Execute): Promise<void>;
+export declare function protectWindowsDirectory(path: string, created: boolean, run?: Execute, session?: string): Promise<void>;
+/** File ACEs may inherit from their already-private parent. */
+export declare function verifyWindowsPermissionSync(path: string): void;
+export declare function ensureWindowsPrivateDirectorySync(path: string, session?: string): void;
+export type WindowsPermission = 'ok' | 'owner' | 'ace' | 'acl_unavailable';
+/** Recursive native listings are attributed by absolute path; missing entries fall back. */
+export declare function auditWindowsPermissions(state: string, paths: string[], run?: Execute, recursive?: boolean, tempState?: string): Promise<Map<string, WindowsPermission>>;
+export {};
+//# sourceMappingURL=runtimeSigners.d.ts.map

package/dist/runtimeSigners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeSigners.d.ts","sourceRoot":"","sources":["../src/runtimeSigners.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,MAAM,GACd;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/D,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AACzF,eAAO,MAAM,OAAO,EAAE,OAQrB,CAAC;AAuDF,mGAAmG;AACnG,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB7F;AAED,kDAAkD;AAClD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,GAAG,UAAc,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAIf;AAQD,KAAK,YAAY,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAYlD,wBAAgB,yBAAyB,IAAI,YAAY,CAIxD;AAWD,0FAA0F;AAC1F,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,GAAG,UAAc,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAMf;AAsDD,2EAA2E;AAC3E,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAoBvB;AA2DD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,UAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAShG;AAkKD,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,GAAG,UAAc,GAChB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,GAAG,UAAc,EACjB,OAAO,SAAO,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAUD,+DAA+D;AAC/D,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAE9D;AACD,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAO,GAAG,IAAI,CAIpF;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,OAAO,GAAG,KAAK,GAAG,iBAAiB,CAAC;AAC3E,4FAA4F;AAC5F,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EAAE,EACf,GAAG,UAAc,EACjB,SAAS,UAAO,EAChB,SAAS,SAA0D,GAClE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CA4DzC"}