@msn-control/liftoff 0.11.3 → 0.12.0

package/dist/adapters/state/darwin-native-host.js

@@ -0,0 +1,294 @@
+import { readdir, lstat } from 'node:fs/promises';
+import path from 'node:path';
+import { stateAssert, stateObjectDigest } from '../../domain/repair/stateful-invariants.js';
+import { boundedStateOperation } from '../../domain/repair/stateful-bounded.js';
+import { assertPrivateStatePath } from './protected-workspace.js';
+import { readPrivateNativeFile } from './native-files.js';
+import { nativeStateHostId } from './native-system.js';
+import { stopOwnedStateProcessesIn, terminateRegisteredStateProcess } from './owned-process.js';
+function within(root, filename) {
+    const relative = path.relative(root, filename);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+const credentialAttributes = /\b(?:client_id|client_secret|client_certificate(?:_path|_password)?|tenant_id|oidc_token|oidc_request_token|oidc_request_url|use_cli|use_msi|use_oidc|msi_endpoint|metadata_host)\s*=/;
+function withoutHclComments(source) {
+    let result = '';
+    let quoted = false;
+    let escaped = false;
+    for (let index = 0; index < source.length; index++) {
+        const char = source[index];
+        if (quoted) {
+            result += char;
+            if (escaped)
+                escaped = false;
+            else if (char === '\\')
+                escaped = true;
+            else if (char === '"')
+                quoted = false;
+        }
+        else if (char === '"') {
+            quoted = true;
+            result += char;
+        }
+        else if (char === '#' || (char === '/' && source[index + 1] === '/')) {
+            while (index < source.length && source[index] !== '\n')
+                index++;
+            result += '\n';
+        }
+        else if (char === '/' && source[index + 1] === '*') {
+            const end = source.indexOf('*/', index + 2);
+            stateAssert(end >= 0, 'unsafe-planning-contract');
+            result += ' ';
+            index = end + 1;
+        }
+        else {
+            // Complex heredoc/template parsing belongs to the semantic adapter; this
+            // stricter executable profile never guesses across an ambiguous string.
+            stateAssert(!(char === '<' && source[index + 1] === '<'), 'unsafe-planning-contract');
+            result += char;
+        }
+    }
+    stateAssert(!quoted, 'unsafe-planning-contract');
+    return result;
+}
+export async function assertEnvironmentOnlyProviders(directory) {
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+        if (entry.name === '.terraform')
+            continue;
+        stateAssert(!entry.isSymbolicLink(), 'unsafe-path');
+        if (entry.isDirectory()) {
+            await assertEnvironmentOnlyProviders(path.join(directory, entry.name));
+            continue;
+        }
+        if (!entry.name.endsWith('.tf') && !entry.name.endsWith('.tf.json'))
+            continue;
+        stateAssert(entry.isFile() && !/(?:^|_)override\.tf(?:\.json)?$/.test(entry.name), 'unsafe-planning-contract');
+        const bytes = await readPrivateNativeFile(path.join(directory, entry.name), 4 * 1024 * 1024);
+        try {
+            const raw = Buffer.from(bytes).toString('utf8');
+            if (entry.name.endsWith('.json')) {
+                const root = JSON.parse(raw);
+                const inspect = (value) => {
+                    if (!value || typeof value !== 'object')
+                        return;
+                    for (const [key, item] of Object.entries(value)) {
+                        stateAssert(!credentialAttributes.test(`${key} =`), 'unsafe-planning-contract');
+                        if (key === 'resource_provider_registrations')
+                            stateAssert(item === 'none', 'unsafe-planning-contract');
+                        if (key === 'skip_provider_registration')
+                            stateAssert(item === true, 'unsafe-planning-contract');
+                        inspect(item);
+                    }
+                };
+                inspect(root.provider);
+            }
+            else {
+                const text = withoutHclComments(raw);
+                // This is a deny-only guard, not an HCL transformer or ownership parser.
+                // Ambiguous provider syntax remains unsupported by this narrow profile.
+                const starts = [...text.matchAll(/\bprovider\s+"([^"]+)"\s*\{/g)];
+                for (const start of starts) {
+                    stateAssert(start[1] === 'azurerm', 'unsafe-planning-contract');
+                    let depth = 1;
+                    let end = start.index + start[0].length;
+                    let quoted = false;
+                    let escaped = false;
+                    for (; end < text.length && depth; end++) {
+                        const char = text[end];
+                        if (quoted) {
+                            if (escaped)
+                                escaped = false;
+                            else if (char === '\\')
+                                escaped = true;
+                            else if (char === '"')
+                                quoted = false;
+                        }
+                        else if (char === '"')
+                            quoted = true;
+                        else if (char === '{')
+                            depth++;
+                        else if (char === '}')
+                            depth--;
+                    }
+                    stateAssert(depth === 0, 'unsafe-planning-contract');
+                    const block = text.slice(start.index, end);
+                    stateAssert(!credentialAttributes.test(block), 'unsafe-planning-contract');
+                    for (const assignment of block.matchAll(/\bresource_provider_registrations\s*=\s*([^\r\n}]+)/g)) {
+                        stateAssert(/^"none"\s*(?:#.*|\/\/.*)?$/.test(assignment[1].trim()), 'unsafe-planning-contract');
+                    }
+                    for (const assignment of block.matchAll(/\bskip_provider_registration\s*=\s*([^\r\n}]+)/g)) {
+                        stateAssert(/^true\s*(?:#.*|\/\/.*)?$/.test(assignment[1].trim()), 'unsafe-planning-contract');
+                    }
+                }
+            }
+        }
+        finally {
+            bytes.fill(0);
+        }
+    }
+}
+export class DarwinKeychainAzureReader {
+    options;
+    identityDigest;
+    constructor(options) {
+        this.options = options;
+        const ref = options.reference;
+        const uuid = /^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$/;
+        stateAssert([ref.tenantId, ref.subscriptionId, ref.clientId, ref.principalId].every((value) => uuid.test(value))
+            && /^org\.liftoff\.azure-state-reader\.[a-zA-Z0-9_.:-]{1,160}$/.test(ref.service), 'access-denied');
+        this.identityDigest = stateObjectDigest(ref);
+        this.options.reference = Object.freeze(structuredClone(ref));
+    }
+    async json(url, options, signal) {
+        return boundedStateOperation(signal, async () => {
+            const response = await (this.options.fetch ?? globalThis.fetch)(url, { ...options, signal, redirect: 'error' });
+            stateAssert(response.ok, 'access-denied');
+            const reader = response.body?.getReader();
+            stateAssert(reader, 'incomplete-observation');
+            const buffers = [];
+            let bytes = 0;
+            try {
+                while (true) {
+                    const item = await reader.read();
+                    if (item.done)
+                        break;
+                    bytes += item.value.length;
+                    stateAssert(bytes <= 1024 * 1024, 'storage-limit');
+                    buffers.push(item.value);
+                }
+                return JSON.parse(Buffer.concat(buffers).toString('utf8'));
+            }
+            finally {
+                await reader.cancel().catch(() => undefined);
+                for (const buffer of buffers)
+                    buffer.fill(0);
+            }
+        });
+    }
+    async resolve(context, resourceIds, signal) {
+        const ref = this.options.reference;
+        stateAssert(ref.account === context.projectId && ref.principalId === context.principalId, 'ownership-mismatch');
+        stateAssert(resourceIds.length <= 128, 'storage-limit');
+        const bounded = AbortSignal.any([AbortSignal.timeout(60_000), ...(signal ? [signal] : [])]);
+        const value = await this.options.bridge.request('keychain-secret', { reference: ref }, bounded);
+        stateAssert(value.uid === process.getuid?.() && typeof value.value === 'string', 'access-denied');
+        const secretBytes = Buffer.from(value.value, 'base64');
+        delete value.value;
+        try {
+            const secret = secretBytes.toString('utf8');
+            stateAssert(secret.length > 0 && secret.length <= 4096 && !/[\x00\r\n]/.test(secret), 'access-denied');
+            const token = await this.json(`https://login.microsoftonline.com/${ref.tenantId}/oauth2/v2.0/token`, {
+                method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    client_id: ref.clientId, client_secret: secret, grant_type: 'client_credentials',
+                    scope: 'https://management.azure.com/.default'
+                }).toString()
+            }, bounded);
+            stateAssert(typeof token.access_token === 'string' && token.expires_in >= 120, 'access-denied');
+            const claims = JSON.parse(Buffer.from(token.access_token.split('.')[1], 'base64url').toString('utf8'));
+            stateAssert(claims.tid === ref.tenantId && claims.oid === ref.principalId
+                && (claims.appid === ref.clientId || claims.azp === ref.clientId)
+                && ['https://management.azure.com', 'https://management.azure.com/', 'https://management.core.windows.net/'].includes(claims.aud)
+                && Number.isFinite(claims.exp) && claims.exp * 1000 > Date.now() + 60_000, 'access-denied');
+            const scopes = [...new Set([`/subscriptions/${ref.subscriptionId}`, ...resourceIds])];
+            for (const scope of scopes) {
+                stateAssert(scope.split('/')[2]?.toLowerCase() === ref.subscriptionId.toLowerCase()
+                    && /^\/[a-zA-Z0-9_./()-]+$/.test(scope) && !scope.split('/').includes('..'), 'invalid-binding');
+                const url = new URL(`https://management.azure.com${scope}/providers/Microsoft.Authorization/permissions?api-version=2022-04-01`);
+                let next = url.href;
+                let pages = 0;
+                let grants = 0;
+                while (next) {
+                    stateAssert(++pages <= 10, 'incomplete-observation');
+                    const parsed = new URL(next);
+                    stateAssert(parsed.origin === url.origin && parsed.pathname === url.pathname && !parsed.username && !parsed.password, 'access-denied');
+                    const result = await this.json(parsed.href, { headers: { authorization: `Bearer ${token.access_token}` } }, bounded);
+                    stateAssert(Array.isArray(result.value), 'incomplete-observation');
+                    for (const permission of result.value) {
+                        stateAssert(Array.isArray(permission.actions) && Array.isArray(permission.dataActions ?? []), 'incomplete-observation');
+                        const actions = [...permission.actions, ...(permission.dataActions ?? [])];
+                        stateAssert(actions.every((action) => typeof action === 'string' && /\/read$/i.test(action)), 'access-denied');
+                        grants += actions.length;
+                    }
+                    stateAssert(result.nextLink === undefined || typeof result.nextLink === 'string', 'incomplete-observation');
+                    next = result.nextLink ?? null;
+                }
+                stateAssert(grants > 0, 'access-denied');
+            }
+            return {
+                ARM_TENANT_ID: ref.tenantId, ARM_SUBSCRIPTION_ID: ref.subscriptionId,
+                ARM_CLIENT_ID: ref.clientId, ARM_CLIENT_SECRET: secret,
+                ARM_USE_OIDC: 'false', ARM_USE_MSI: 'false', ARM_USE_CLI: 'false'
+            };
+        }
+        finally {
+            secretBytes.fill(0);
+        }
+    }
+}
+/**
+ * Observes an encrypted, private staging directory and a genuinely read-only
+ * Azure identity. Isolation here is staging/HOME/config isolation, NOT an OS
+ * sandbox; only the separately inspected fixed provider/module contract may run.
+ */
+export class DarwinObservedStateHost {
+    options;
+    #environments = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async verify(directory) {
+        stateAssert(process.platform === 'darwin' && this.options.context.hostId === nativeStateHostId()
+            && within(this.options.root, directory), 'unsupported-native-platform');
+        await assertPrivateStatePath(directory, this.options.context, this.options.volume, true);
+        await assertEnvironmentOnlyProviders(this.options.root);
+        const backendBytes = await readPrivateNativeFile(path.join(directory, 'liftoff-state-backend.tf.json'), 16_384);
+        let statePath;
+        try {
+            const backend = JSON.parse(Buffer.from(backendBytes).toString('utf8'));
+            statePath = backend.terraform?.backend?.local?.path;
+            stateAssert(typeof statePath === 'string' && within(this.options.root, statePath), 'unsafe-path');
+        }
+        finally {
+            backendBytes.fill(0);
+        }
+        const existing = await lstat(statePath).catch(() => null);
+        const resourceIds = [];
+        if (existing?.isFile() && existing.size > 0) {
+            const stateBytes = await readPrivateNativeFile(statePath, 32 * 1024 * 1024);
+            try {
+                const state = JSON.parse(Buffer.from(stateBytes).toString('utf8'));
+                stateAssert(state.version === 4 && Array.isArray(state.resources), 'unsupported-state');
+                for (const resource of state.resources) {
+                    for (const instance of resource.instances ?? []) {
+                        const id = instance.attributes?.id;
+                        if (resource.mode === 'data' && resource.type === 'azurerm_client_config')
+                            continue;
+                        stateAssert(typeof id === 'string' && id.startsWith('/subscriptions/'), 'unsupported-state');
+                        resourceIds.push(id);
+                    }
+                }
+            }
+            finally {
+                stateBytes.fill(0);
+            }
+        }
+        const environment = await this.options.reader.resolve(this.options.context, resourceIds);
+        this.#environments.set(directory, { environment, expiresAt: Date.now() + 30_000 });
+        return { directory, encryptedVolume: true, isolated: true, providerIdentityReadOnly: true, providerRegistrationDisabled: true };
+    }
+    async privateEnvironment(directory) {
+        const verified = this.#environments.get(directory);
+        stateAssert(verified && verified.expiresAt > Date.now(), 'access-denied');
+        this.#environments.delete(directory);
+        return verified.environment;
+    }
+    async terminateProcessTree(pid) {
+        await terminateRegisteredStateProcess(pid);
+    }
+    async quiesce() {
+        await stopOwnedStateProcessesIn(this.options.root);
+        this.#environments.clear();
+    }
+}
+//# sourceMappingURL=darwin-native-host.js.map

package/dist/adapters/state/darwin-native-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin-native-host.js","sourceRoot":"","sources":["../../../src/adapters/state/darwin-native-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAEhG,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,oBAAoB,GAAG,uLAAuL,CAAC;AAErN,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAClC,IAAI,IAAI,KAAK,GAAG;gBAAE,MAAM,GAAG,KAAK,CAAC;QACxC,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACvE,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,KAAK,EAAE,CAAC;YAChE,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5C,WAAW,CAAC,GAAG,IAAI,CAAC,EAAE,0BAA0B,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,CAAC;YACd,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,wEAAwE;YACxE,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,0BAA0B,CAAC,CAAC;YACtF,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,WAAW,CAAC,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,SAAiB;IACpE,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,SAAS;QAC1C,WAAW,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,aAAa,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QAC9E,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC7F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC7B,MAAM,OAAO,GAAG,CAAC,KAAc,EAAQ,EAAE;oBACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,OAAO;oBAChD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBAChD,WAAW,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,0BAA0B,CAAC,CAAC;wBAChF,IAAI,GAAG,KAAK,iCAAiC;4BAAE,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,0BAA0B,CAAC,CAAC;wBACxG,IAAI,GAAG,KAAK,4BAA4B;4BAAE,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE,0BAA0B,CAAC,CAAC;wBACjG,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACrC,yEAAyE;gBACzE,wEAAwE;gBACxE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBAClE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,0BAA0B,CAAC,CAAC;oBAChE,IAAI,KAAK,GAAG,CAAC,CAAC;oBACd,IAAI,GAAG,GAAG,KAAK,CAAC,KAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;oBACzC,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,IAAI,OAAO,GAAG,KAAK,CAAC;oBACpB,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;wBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;wBACvB,IAAI,MAAM,EAAE,CAAC;4BACX,IAAI,OAAO;gCAAE,OAAO,GAAG,KAAK,CAAC;iCACxB,IAAI,IAAI,KAAK,IAAI;gCAAE,OAAO,GAAG,IAAI,CAAC;iCAClC,IAAI,IAAI,KAAK,GAAG;gCAAE,MAAM,GAAG,KAAK,CAAC;wBACxC,CAAC;6BAAM,IAAI,IAAI,KAAK,GAAG;4BAAE,MAAM,GAAG,IAAI,CAAC;6BAClC,IAAI,IAAI,KAAK,GAAG;4BAAE,KAAK,EAAE,CAAC;6BAC1B,IAAI,IAAI,KAAK,GAAG;4BAAE,KAAK,EAAE,CAAC;oBACjC,CAAC;oBACD,WAAW,CAAC,KAAK,KAAK,CAAC,EAAE,0BAA0B,CAAC,CAAC;oBACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAM,EAAE,GAAG,CAAC,CAAC;oBAC5C,WAAW,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,0BAA0B,CAAC,CAAC;oBAC3E,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,sDAAsD,CAAC,EAAE,CAAC;wBAChG,WAAW,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,0BAA0B,CAAC,CAAC;oBACnG,CAAC;oBACD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,iDAAiD,CAAC,EAAE,CAAC;wBAC3F,WAAW,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,0BAA0B,CAAC,CAAC;oBACjG,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,OAAO,yBAAyB;IAEP,OAAO;IAD3B,cAAc,CAAS;IAChC,YAA6B,OAI5B;uBAJ4B,OAAO;QAKlC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAG,+EAA+E,CAAC;QAC7F,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;eAC3G,4DAA4D,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;QACtG,IAAI,CAAC,cAAc,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,OAAoB,EAAE,MAAmB;QACvE,OAAO,qBAAqB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAChH,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YAC1C,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAiB,EAAE,CAAC;YACjC,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBACjC,IAAI,IAAI,CAAC,IAAI;wBAAE,MAAM;oBACrB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAC3B,WAAW,CAAC,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,eAAe,CAAC,CAAC;oBACnD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,KAAK,MAAM,MAAM,IAAI,OAAO;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAC3G,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAA8B,EAAE,WAA8B,EAAE,MAAoB;QAChG,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACnC,WAAW,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAChH,WAAW,CAAC,WAAW,CAAC,MAAM,IAAI,GAAG,EAAE,eAAe,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;QAChG,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,eAAe,CAAC,CAAC;QAClG,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5C,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;YACvG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qCAAqC,GAAG,CAAC,QAAQ,oBAAoB,EAAE;gBACnG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChF,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB;oBAChF,KAAK,EAAE,uCAAuC;iBAC/C,CAAC,CAAC,QAAQ,EAAE;aACd,EAAE,OAAO,CAAC,CAAC;YACZ,WAAW,CAAC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,eAAe,CAAC,CAAC;YAChG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACvG,WAAW,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,WAAW;mBACpE,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,CAAC;mBAC9D,CAAC,8BAA8B,EAAE,+BAA+B,EAAE,sCAAsC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;mBAC9H,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YACtF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE;uBAC9E,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;gBAClG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,+BAA+B,KAAK,uEAAuE,CAAC,CAAC;gBACjI,IAAI,IAAI,GAAkB,GAAG,CAAC,IAAI,CAAC;gBACnC,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,OAAO,IAAI,EAAE,CAAC;oBACZ,WAAW,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;oBACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC7B,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;oBACvI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;oBACrH,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,CAAC;oBACnE,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;wBACtC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC;wBACxH,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;wBAC3E,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAe,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;wBACxH,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;oBAC3B,CAAC;oBACD,WAAW,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,wBAAwB,CAAC,CAAC;oBAC5G,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;gBACjC,CAAC;gBACD,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO;gBACL,aAAa,EAAE,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,GAAG,CAAC,cAAc;gBACpE,aAAa,EAAE,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM;gBACtD,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO;aAClE,CAAC;QACJ,CAAC;gBAAS,CAAC;YAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IAEL,OAAO;IADpC,aAAa,GAAG,IAAI,GAAG,EAAgF,CAAC;IACxG,YAA6B,OAK5B;uBAL4B,OAAO;IAKhC,CAAC;IAEL,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,WAAW,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,iBAAiB,EAAE;eAC3F,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,6BAA6B,CAAC,CAAC;QAC1E,MAAM,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzF,MAAM,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,+BAA+B,CAAC,EAAE,MAAM,CAAC,CAAC;QAChH,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACvE,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YACpD,WAAW,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;QACpG,CAAC;gBAAS,CAAC;YAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,IAAI,QAAQ,EAAE,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnE,WAAW,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC;gBACxF,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;oBACvC,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;wBAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC;wBACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,uBAAuB;4BAAE,SAAS;wBACpF,WAAW,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,mBAAmB,CAAC,CAAC;wBAC7F,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACnC,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAClI,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAAiB;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,WAAW,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;QAC1E,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC,WAAW,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,MAAM,+BAA+B,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/adapters/state/darwin-profile.d.ts

@@ -0,0 +1,6 @@
+import { type DarwinLocalStateExecutionProfile, type DarwinLocalStateExecutionProfileOptions } from '../../domain/repair/stateful.js';
+/**
+ * Real macOS/APFS implementation, with account/key setup and independent live
+ * qualification left as explicit prerequisites, not fabricated readiness.
+ */
+export declare function createDarwinLocalStateExecutionProfile(options: DarwinLocalStateExecutionProfileOptions): Promise<DarwinLocalStateExecutionProfile>;

package/dist/adapters/state/darwin-profile.js

@@ -0,0 +1,56 @@
+import { freezeStateValue, stateAssert } from '../../domain/repair/stateful-invariants.js';
+import { createStateMigrationService } from '../../application/state-migration/service.js';
+import { createDarwinStateStorageProfile, PythonDarwinStateSystemBridge } from './darwin-capabilities.js';
+import { DarwinKeychainAzureReader, DarwinObservedStateHost } from './darwin-native-host.js';
+import { isActualNativeLocalQualification } from './local-qualification.js';
+import { LocalStateBackend } from './local.js';
+import { SpawnPrivateStateCommandRunner } from './native-command.js';
+import { OpenTofuStateDriver } from './opentofu.js';
+import { nativeStateHostId, verifyStateExecutable } from './native-system.js';
+/**
+ * Real macOS/APFS implementation, with account/key setup and independent live
+ * qualification left as explicit prerequisites, not fabricated readiness.
+ */
+export async function createDarwinLocalStateExecutionProfile(options) {
+    stateAssert(isActualNativeLocalQualification(options.nativeQualification, options.tools), 'unqualified-combination');
+    stateAssert(options.context.hostId === nativeStateHostId() && options.context.projectId === options.projectId, 'ownership-mismatch');
+    await verifyStateExecutable(options.tools.tofu);
+    await verifyStateExecutable(options.tools.python);
+    const storage = await createDarwinStateStorageProfile(options);
+    const context = freezeStateValue(structuredClone(options.context));
+    const bridge = new PythonDarwinStateSystemBridge(options.tools.python, options.workspaceRoot);
+    const reader = new DarwinKeychainAzureReader({ reference: options.readerReference, bridge });
+    const host = new DarwinObservedStateHost({
+        root: options.workspaceRoot, context, volume: storage.volume, reader
+    });
+    const runner = new SpawnPrivateStateCommandRunner({
+        executable: options.tools.tofu.path, executableDigest: options.tools.tofu.sha256, host
+    });
+    const qualification = {
+        async assertQualified(request) {
+            stateAssert(request.recipe === 'address-refactor' && request.source === 'local'
+                && request.destinations.length === 1 && request.destinations[0] === 'local', 'unsupported-local-state-operation');
+            stateAssert(request.hostId === options.tools.hostId && request.executableDigest === options.tools.tofu.sha256
+                && isActualNativeLocalQualification(options.nativeQualification, options.tools), 'unqualified-combination');
+            await verifyStateExecutable(options.tools.tofu);
+            await verifyStateExecutable(options.tools.python);
+            stateAssert(options.liveQualification, 'unqualified-combination');
+            await options.liveQualification.assertQualified(request);
+        }
+    };
+    const native = new OpenTofuStateDriver({
+        workspace: storage.workspace, runner, configurations: options.configurations, qualification
+    });
+    const service = createStateMigrationService({
+        workspace: storage.workspace, native, writers: options.writers,
+        backend(binding) {
+            stateAssert(binding.kind === 'local', 'unsupported-local-state-operation');
+            return new LocalStateBackend(binding, { volume: storage.volume, locks: storage.locks });
+        }
+    });
+    return {
+        ...storage, service, qualification, nativeQualification: options.nativeQualification,
+        liveQualification: options.liveQualification ? 'supplied' : 'required'
+    };
+}
+//# sourceMappingURL=darwin-profile.js.map

package/dist/adapters/state/darwin-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin-profile.js","sourceRoot":"","sources":["../../../src/adapters/state/darwin-profile.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAC1G,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAgD;IAEhD,WAAW,CAAC,gCAAgC,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACrH,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,iBAAiB,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACrI,MAAM,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,6BAA6B,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAI,yBAAyB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,IAAI,uBAAuB,CAAC;QACvC,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM;KACrE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,8BAA8B,CAAC;QAChD,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI;KACvF,CAAC,CAAC;IACH,MAAM,aAAa,GAA6B;QAC9C,KAAK,CAAC,eAAe,CAAC,OAAO;YAC3B,WAAW,CAAC,OAAO,CAAC,MAAM,KAAK,kBAAkB,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;mBAC1E,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,mCAAmC,CAAC,CAAC;YACpH,WAAW,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM;mBACxG,gCAAgC,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,yBAAyB,CAAC,CAAC;YAC9G,MAAM,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClD,WAAW,CAAC,OAAO,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;YAClE,MAAM,OAAO,CAAC,iBAAiB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC;QACrC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,aAAa;KAC5F,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,2BAA2B,CAAC;QAC1C,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;QAC9D,OAAO,CAAC,OAAO;YACb,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,mCAAmC,CAAC,CAAC;YAC3E,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC,CAAC;IACH,OAAO;QACL,GAAG,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QACpF,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;KACvE,CAAC;AACJ,CAAC"}

package/dist/adapters/state/darwin-system-program.d.ts

@@ -0,0 +1 @@
+export declare const darwinStateSystemProgram: string;

package/dist/adapters/state/darwin-system-program.js

@@ -0,0 +1,94 @@
+export const darwinStateSystemProgram = String.raw `
+import base64, ctypes, json, os, platform, plistlib, re, stat, subprocess, sys
+
+def response(value):
+    sys.stdout.write(json.dumps(value, separators=(",", ":")) + "\n")
+
+def keychain(reference, secret):
+    filename = reference["keychainPath"]
+    entry = os.lstat(filename)
+    if not stat.S_ISREG(entry.st_mode) or entry.st_uid != os.getuid() or entry.st_mode & 0o077:
+        raise ValueError("private keychain required")
+    if os.path.realpath(filename) != filename:
+        raise ValueError("canonical keychain required")
+    security = ctypes.CDLL("/System/Library/Frameworks/Security.framework/Security")
+    core = ctypes.CDLL("/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation")
+    security.SecKeychainSetUserInteractionAllowed.argtypes = [ctypes.c_ubyte]
+    security.SecKeychainSetUserInteractionAllowed.restype = ctypes.c_int32
+    security.SecKeychainOpen.argtypes = [ctypes.c_char_p, ctypes.POINTER(ctypes.c_void_p)]
+    security.SecKeychainOpen.restype = ctypes.c_int32
+    security.SecKeychainFindGenericPassword.argtypes = [
+        ctypes.c_void_p, ctypes.c_uint32, ctypes.c_char_p, ctypes.c_uint32, ctypes.c_char_p,
+        ctypes.POINTER(ctypes.c_uint32), ctypes.POINTER(ctypes.c_void_p), ctypes.POINTER(ctypes.c_void_p)]
+    security.SecKeychainFindGenericPassword.restype = ctypes.c_int32
+    security.SecKeychainItemFreeContent.argtypes = [ctypes.c_void_p, ctypes.c_void_p]
+    security.SecKeychainItemFreeContent.restype = ctypes.c_int32
+    core.CFRelease.argtypes = [ctypes.c_void_p]
+    if security.SecKeychainSetUserInteractionAllowed(0) != 0:
+        raise ValueError("noninteractive access unavailable")
+    chain = ctypes.c_void_p()
+    item = ctypes.c_void_p()
+    data = ctypes.c_void_p()
+    length = ctypes.c_uint32()
+    if security.SecKeychainOpen(os.fsencode(filename), ctypes.byref(chain)) != 0:
+        raise ValueError("keychain unavailable")
+    service, account = reference["service"].encode(), reference["account"].encode()
+    try:
+        result = security.SecKeychainFindGenericPassword(chain, len(service), service, len(account), account,
+            ctypes.byref(length) if secret else None, ctypes.byref(data) if secret else None, ctypes.byref(item))
+        if result != 0:
+            raise ValueError("item unavailable")
+        if not secret:
+            return {"ok": True, "present": True, "uid": os.getuid()}
+        if length.value > 16384:
+            raise ValueError("item exceeds bound")
+        raw = ctypes.string_at(data, length.value)
+        return {"ok": True, "value": base64.b64encode(raw).decode("ascii"), "uid": os.getuid()}
+    finally:
+        if data.value:
+            ctypes.memset(data, 0, length.value)
+            security.SecKeychainItemFreeContent(None, data)
+        if item.value:
+            core.CFRelease(item)
+        if chain.value:
+            core.CFRelease(chain)
+
+try:
+    if sys.platform != "darwin":
+        raise ValueError("unsupported platform")
+    request = json.loads(sys.stdin.buffer.read(16385))
+    if request["operation"] == "volume":
+        directory = request["directory"]
+        entry = os.lstat(directory)
+        if not stat.S_ISDIR(entry.st_mode) or os.path.realpath(directory) != directory:
+            raise ValueError("canonical directory required")
+        output = subprocess.run(["/bin/df", "-P", directory], check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=10).stdout
+        lines = output.decode("utf8").strip().splitlines()
+        if len(lines) != 2:
+            raise ValueError("ambiguous mount")
+        device = lines[1].split()[0]
+        if not re.fullmatch(r"/dev/disk[0-9]+(?:s[0-9]+)*", device):
+            raise ValueError("unsupported filesystem")
+        raw = subprocess.run(["/usr/sbin/diskutil", "info", "-plist", device], check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=10).stdout
+        if len(raw) > 1048576:
+            raise ValueError("metadata bound")
+        volume = plistlib.loads(raw)
+        if volume.get("DeviceNode") != device or os.stat(directory).st_dev != entry.st_dev:
+            raise ValueError("mount changed")
+        acl = subprocess.run(["/bin/ls", "-lde", directory], check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=10).stdout.decode("utf8")
+        acl_entries = sum(1 for line in acl.splitlines()[1:] if re.match(r"\s*\d+:", line))
+        progress = [v for k,v in volume.items() if "progress" in k.lower() and ("encrypt" in k.lower() or "decrypt" in k.lower())]
+        response({"ok": True, "canonicalDirectory": directory, "deviceNode": device,
+            "volumeId": volume.get("VolumeUUID"), "filesystem": volume.get("FilesystemType"),
+            "fileVault": volume.get("FileVault") is True,
+            "encrypted": volume.get("Encryption") is True and volume.get("EncryptionThisVolumeProper") is True and not progress,
+            "locked": volume.get("Locked") is not False, "ownerUid": entry.st_uid,
+            "mode": stat.S_IMODE(entry.st_mode), "aclEntries": acl_entries})
+    elif request["operation"] in ("keychain-metadata", "keychain-secret"):
+        response(keychain(request["reference"], request["operation"] == "keychain-secret"))
+    else:
+        raise ValueError("unsupported operation")
+except Exception:
+    response({"ok": False, "code": "key-unavailable" if "keychain" in locals().get("request", {}).get("operation", "") else "protected-workspace-required"})
+`;
+//# sourceMappingURL=darwin-system-program.js.map

package/dist/adapters/state/darwin-system-program.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin-system-program.js","sourceRoot":"","sources":["../../../src/adapters/state/darwin-system-program.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4FjD,CAAC"}

package/dist/adapters/state/local-qualification.d.ts

@@ -0,0 +1,16 @@
+import { type NativeLocalQualificationResult, type NativeLocalStateTools } from '../../domain/repair/stateful.js';
+export declare function isActualNativeLocalQualification(result: NativeLocalQualificationResult, tools: NativeLocalStateTools): boolean;
+/**
+ * Explicit, opt-in qualification. It creates only a fixed terraform_data
+ * fixture in a fresh directory, with no cloud/provider credentials or downloads.
+ * This is native/backend qualification, never Azure live-resource evidence.
+ */
+export declare function qualifyNativeLocalState(request: {
+    pythonPath: string;
+    tofuPath: string;
+    scratchParent: string;
+    signal?: AbortSignal;
+}): Promise<{
+    tools: NativeLocalStateTools;
+    result: NativeLocalQualificationResult;
+}>;