@phigon/observer 8.0.1

package/dist/src/guardian-execution-manifest.js

@@ -0,0 +1,95 @@
+import { createHash } from "node:crypto";
+import { constants, createReadStream } from "node:fs";
+import { access, realpath, stat } from "node:fs/promises";
+import { delimiter, isAbsolute, resolve } from "node:path";
+export function executionEnvironment(source) {
+    const result = {};
+    const seen = new Set();
+    for (const key of Object.keys(source).sort()) {
+        const value = source[key];
+        const normalized = process.platform === "win32" ? key.toUpperCase() : key;
+        if (value === undefined || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        // Machine management credentials and runtime injection must never be
+        // inherited by the supervised workload.
+        if (/^PHIGON_/iu.test(key) || /^(NODE_OPTIONS|NODE_PATH|LD_PRELOAD|LD_LIBRARY_PATH|DYLD_.*|PYTHONPATH|PYTHONHOME|RUBYOPT|PERL5OPT|BASH_ENV|ENV)$/iu.test(key))
+            continue;
+        result[key] = value;
+    }
+    return result;
+}
+export async function digestExecutable(path) {
+    const info = await stat(path);
+    if (!info.isFile() || info.size > 1 << 30)
+        throw new Error("Guardian execution input is not a supported regular file.");
+    const hash = createHash("sha256");
+    for await (const chunk of createReadStream(path))
+        hash.update(chunk);
+    return hash.digest("hex");
+}
+async function resolveExecutable(executable, cwd, env) {
+    const explicit = isAbsolute(executable) || /[/\\]/u.test(executable);
+    const pathKey = Object.keys(env).find((key) => key.toUpperCase() === "PATH");
+    const paths = explicit ? [resolve(cwd, executable)] : (env[pathKey ?? "PATH"] ?? "").split(delimiter)
+        .filter((entry) => entry !== "" && isAbsolute(entry)).map((entry) => resolve(entry, executable));
+    for (const path of paths) {
+        const candidates = process.platform === "win32" && !/\.exe$/iu.test(path) ? [path, `${path}.exe`] : [path];
+        for (const candidate of candidates) {
+            try {
+                const resolved = await realpath(candidate);
+                if (process.platform === "win32" && !/\.exe$/iu.test(resolved))
+                    continue;
+                if (!(await stat(resolved)).isFile())
+                    continue;
+                await access(resolved, process.platform === "win32" ? constants.F_OK : constants.X_OK);
+                return resolved;
+            }
+            catch { /* Try the next explicit PATH entry. */ }
+        }
+    }
+    throw new Error("Guardian could not resolve a native executable. For scripts, name the interpreter explicitly.");
+}
+export async function createExecutionManifest(options) {
+    const cwd = await realpath(options.cwd ?? process.cwd());
+    if (options.cgroupRoot && (process.platform !== "linux" || !isAbsolute(options.cgroupRoot)))
+        throw new Error("Guardian cgroup configuration requires an absolute Linux cgroup-v2 root.");
+    const executable = await resolveExecutable(options.executable, cwd, options.environment);
+    const inputs = [];
+    // Bind existing file arguments, including directly named scripts/configs.
+    // Files read indirectly need an OS filesystem policy; they are not guessed.
+    for (const arg of options.arguments) {
+        if (arg.startsWith("-") || arg.includes("\0") || arg.length > 4096)
+            continue;
+        let path;
+        try {
+            path = await realpath(resolve(cwd, arg));
+            if (!(await stat(path)).isFile())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        if (!inputs.some((input) => input.path === path))
+            inputs.push({ path, digest: await digestExecutable(path) });
+        if (inputs.length > 64)
+            throw new Error("Guardian execution has too many file inputs.");
+    }
+    const environmentEntries = Object.entries(options.environment).filter((entry) => entry[1] !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    const manifest = Object.freeze({
+        sandbox: options.sandbox ?? "",
+        executable, executable_digest: await digestExecutable(executable), arguments: Object.freeze([...options.arguments]),
+        working_directory: cwd, environment_digest: createHash("sha256").update(JSON.stringify(environmentEntries)).digest("hex"),
+        inputs: Object.freeze(inputs.map((input) => Object.freeze(input))), agent_id: options.agentId, model: options.model ?? "", cgroup_root: options.cgroupRoot ?? "",
+    });
+    if (Buffer.byteLength(JSON.stringify(manifest)) > 56 << 10)
+        throw new Error("Guardian execution manifest exceeds its bound.");
+    return manifest;
+}
+export async function verifyExecutionManifest(manifest, environment) {
+    const current = await createExecutionManifest({ executable: manifest.executable, arguments: manifest.arguments,
+        agentId: manifest.agent_id, model: manifest.model, cwd: manifest.working_directory, environment, cgroupRoot: manifest.cgroup_root, sandbox: manifest.sandbox });
+    if (JSON.stringify(current) !== JSON.stringify(manifest))
+        throw new Error("Phigon Guardian blocked execution because its executable, inputs, directory, or environment changed after review.");
+}
+//# sourceMappingURL=guardian-execution-manifest.js.map

package/dist/src/guardian-execution-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-execution-manifest.js","sourceRoot":"","sources":["../../src/guardian-execution-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAe3D,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC5D,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1E,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrB,qEAAqE;QACrE,wCAAwC;QACxC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,qHAAqH,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACxK,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACxH,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,UAAkB,EAAE,GAAW,EAAE,GAAsB;IACtF,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;SAClG,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACnG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3G,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACzE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE;oBAAE,SAAS;gBAC/C,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACvF,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAK5C;IACA,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACzL,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACzF,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,0EAA0E;IAC1E,4EAA4E;IAC5E,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI;YAAE,SAAS;QAC7E,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;QAAC,CAAC;QAC7F,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9G,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACnH,iBAAiB,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACzH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;KACjK,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC9H,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAA2B,EAAE,WAA8B;IACvG,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC5G,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAClK,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;AACjM,CAAC"}

package/dist/src/guardian-hosted-client.d.ts

@@ -0,0 +1,10 @@
+export declare class GuardianHostedClient {
+    private readonly options;
+    constructor(options: Readonly<{
+        controlPlaneURL: URL;
+        credential: string;
+        fetcher?: typeof fetch;
+    }>);
+    post(path: string, body: unknown, signal?: AbortSignal, timeoutMs?: number): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=guardian-hosted-client.d.ts.map

package/dist/src/guardian-hosted-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-hosted-client.d.ts","sourceRoot":"","sources":["../../src/guardian-hosted-client.ts"],"names":[],"mappings":"AAEA,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,QAAQ,CAAC;QAAE,eAAe,EAAE,GAAG,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;KAAE,CAAC;IAE9G,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,SAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAqBrH"}

package/dist/src/guardian-hosted-client.js

@@ -0,0 +1,45 @@
+import { GuardianDecisionUnavailableError } from "./agentic-guardian.js";
+export class GuardianHostedClient {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async post(path, body, signal, timeoutMs = 370_000) {
+        try {
+            const timeout = AbortSignal.timeout(timeoutMs);
+            const response = await (this.options.fetcher ?? fetch)(new URL(path, this.options.controlPlaneURL), {
+                method: "POST", redirect: "error", headers: { Authorization: `Bearer ${this.options.credential}`, "Content-Type": "application/json" },
+                body: JSON.stringify(body), signal: signal === undefined ? timeout : AbortSignal.any([timeout, signal]),
+            });
+            const reader = response.body?.getReader();
+            if (!reader)
+                throw new Error("Missing response.");
+            const chunks = [];
+            let size = 0;
+            try {
+                while (true) {
+                    const chunk = await reader.read();
+                    if (chunk.done)
+                        break;
+                    size += chunk.value.byteLength;
+                    if (size > 64 << 10)
+                        throw new Error("Oversized response.");
+                    chunks.push(chunk.value);
+                }
+            }
+            finally {
+                await reader.cancel();
+            }
+            if (!response.ok)
+                throw new Error(`Service returned ${response.status}.`);
+            const value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            if (value === null || typeof value !== "object" || Array.isArray(value))
+                throw new Error("Invalid response.");
+            return value;
+        }
+        catch {
+            throw new GuardianDecisionUnavailableError("Phigon Guardian could not verify hosted enforcement; the action remains blocked.");
+        }
+    }
+}
+//# sourceMappingURL=guardian-hosted-client.js.map

package/dist/src/guardian-hosted-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-hosted-client.js","sourceRoot":"","sources":["../../src/guardian-hosted-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAEzE,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,OAAuF;QAAvF,YAAO,GAAP,OAAO,CAAgF;IAAG,CAAC;IAExH,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa,EAAE,MAAoB,EAAE,SAAS,GAAG,OAAO;QAC/E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;gBAClG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACtI,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;aACxG,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAClD,MAAM,MAAM,GAAiB,EAAE,CAAC;YAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC;gBAAC,OAAO,IAAI,EAAE,CAAC;oBAAC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAAC,IAAI,KAAK,CAAC,IAAI;wBAAE,MAAM;oBAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;oBAC5G,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxF,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC9G,OAAO,KAAgC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gCAAgC,CAAC,kFAAkF,CAAC,CAAC;QACjI,CAAC;IACH,CAAC;CACF"}

package/dist/src/guardian-managed-exec.d.ts

@@ -0,0 +1,21 @@
+import { type ExecutionManifest } from "./guardian-execution-manifest.js";
+export type ManagedExecutionResult = Readonly<{
+    exitCode: number;
+    invocationId: string;
+}>;
+export declare function executeManagedCommand(options: Readonly<{
+    executable: string;
+    arguments: readonly string[];
+    agentId: string;
+    sessionId: string;
+    dataDirectory: string;
+    manifest: ExecutionManifest;
+    environment: NodeJS.ProcessEnv;
+    lease?: Readonly<{
+        origin: string;
+        credential: string;
+        request: Readonly<Record<string, unknown>>;
+    }>;
+    signal?: AbortSignal;
+}>): Promise<ManagedExecutionResult>;
+//# sourceMappingURL=guardian-managed-exec.d.ts.map

package/dist/src/guardian-managed-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-managed-exec.d.ts","sourceRoot":"","sources":["../../src/guardian-managed-exec.ts"],"names":[],"mappings":"AAMA,OAAO,EAA2B,KAAK,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAInG,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAAC;AAEH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,KAAK,CAAC,EAAE,QAAQ,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC;IACrG,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA2InC"}

package/dist/src/guardian-managed-exec.js

@@ -0,0 +1,249 @@
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { chmod, mkdir, open, unlink } from "node:fs/promises";
+import { join, resolve as resolvePath } from "node:path";
+import { guardianRunnerPath } from "./guardian-native.js";
+import { access } from "node:fs/promises";
+import { verifyExecutionManifest } from "./guardian-execution-manifest.js";
+import { StringDecoder } from "node:string_decoder";
+import { spawn } from "node:child_process";
+export async function executeManagedCommand(options) {
+    const runner = guardianRunnerPath();
+    await access(runner, constants.X_OK);
+    await verifyExecutionManifest(options.manifest, options.environment);
+    if (options.signal?.aborted)
+        throw new Error("Guardian execution authorization expired before start.");
+    const invocationId = randomUUID();
+    const journal = new ManagedCommandJournal(options.dataDirectory);
+    await journal.append({
+        invocationId,
+        agentId: options.agentId,
+        sessionId: options.sessionId,
+        phase: "requested",
+        executable: options.executable,
+        arguments: options.arguments,
+    });
+    if (options.signal?.aborted)
+        throw new Error("Guardian execution authorization expired before start.");
+    const leaseFile = options.lease === undefined ? undefined : resolvePath(options.dataDirectory, `guardian-lease-${randomUUID()}.json`);
+    const relays = new Map();
+    let leaseCreated = false;
+    try {
+        if (leaseFile !== undefined) {
+            const bootstrap = JSON.stringify(options.lease);
+            if (Buffer.byteLength(bootstrap) > 128 << 10)
+                throw new Error("Guardian native lease bootstrap exceeds its limit.");
+            const file = await open(leaseFile, "wx", 0o600);
+            leaseCreated = true;
+            try {
+                await file.writeFile(bootstrap);
+            }
+            finally {
+                await file.close();
+            }
+        }
+        return await new Promise((resolve, reject) => {
+            const child = spawn(runner, ["--sha256", options.manifest.executable_digest, "--cwd", options.manifest.working_directory, "--cgroup-root", options.manifest.cgroup_root, "--sandbox", options.manifest.sandbox, "--lease-config", leaseFile ?? "",
+                "--", options.manifest.executable, ...options.manifest.arguments], {
+                shell: false,
+                windowsHide: true,
+                cwd: options.manifest.working_directory,
+                env: options.environment,
+                stdio: ["inherit", "pipe", "pipe"],
+            });
+            const terminate = () => { child.kill("SIGTERM"); };
+            options.signal?.addEventListener("abort", terminate, { once: true });
+            if (options.signal?.aborted)
+                terminate();
+            process.once("SIGINT", terminate);
+            process.once("SIGTERM", terminate);
+            const detach = () => {
+                options.signal?.removeEventListener("abort", terminate);
+                process.removeListener("SIGINT", terminate);
+                process.removeListener("SIGTERM", terminate);
+            };
+            const stdoutDecoder = new StringDecoder("utf8");
+            const stderrDecoder = new StringDecoder("utf8");
+            let writes = Promise.resolve();
+            let closed = false;
+            const mirrorAbort = new AbortController();
+            let mirrorDeadline;
+            child.once("exit", () => {
+                // Preserve normal output, but a stalled terminal cannot prevent final
+                // audit/exit handling after the native process has already stopped.
+                mirrorDeadline = setTimeout(() => mirrorAbort.abort(), 1_000);
+            });
+            const record = (stream, output, raw) => {
+                if (output === "" && raw === undefined)
+                    return;
+                child.stdout?.pause();
+                child.stderr?.pause();
+                const batch = writes.then(async () => {
+                    for (let offset = 0; offset < output.length; offset += 8_192) {
+                        await journal.append({
+                            invocationId,
+                            agentId: options.agentId,
+                            sessionId: options.sessionId,
+                            phase: "running",
+                            executable: options.executable,
+                            arguments: options.arguments,
+                            stream,
+                            output: output.slice(offset, offset + 8_192),
+                        });
+                    }
+                    if (raw !== undefined && !mirrorAbort.signal.aborted) {
+                        let relay = relays.get(stream);
+                        if (!relay) {
+                            relay = outputRelay(runner, stream === "stdout" ? process.stdout.fd : process.stderr.fd, options.dataDirectory, options.environment);
+                            relays.set(stream, relay);
+                        }
+                        await relay.write(raw, mirrorAbort.signal);
+                    }
+                }).then(() => {
+                    // Resume only after the whole current queue, not its first 8 KiB.
+                    if (writes === batch) {
+                        child.stdout?.resume();
+                        child.stderr?.resume();
+                    }
+                });
+                writes = batch;
+                void batch.catch(() => { terminate(); mirrorAbort.abort(); child.stdout?.resume(); child.stderr?.resume(); });
+            };
+            child.stdout?.on("data", (chunk) => {
+                record("stdout", stdoutDecoder.write(chunk), chunk);
+            });
+            child.stderr?.on("data", (chunk) => {
+                record("stderr", stderrDecoder.write(chunk), chunk);
+            });
+            child.once("error", (error) => {
+                if (closed)
+                    return;
+                closed = true;
+                detach();
+                mirrorAbort.abort();
+                writes.then(() => journal.append({
+                    invocationId,
+                    agentId: options.agentId,
+                    sessionId: options.sessionId,
+                    phase: "failed",
+                    executable: options.executable,
+                    arguments: options.arguments,
+                    output: safeExecutionError(error),
+                    exitCode: 1,
+                })).then(() => reject(error), reject).finally(() => clearTimeout(mirrorDeadline));
+            });
+            child.once("close", (code, signal) => {
+                if (closed)
+                    return;
+                closed = true;
+                detach();
+                record("stdout", stdoutDecoder.end());
+                record("stderr", stderrDecoder.end());
+                const exitCode = options.signal?.aborted ? 77 : code ?? 1;
+                writes.then(() => journal.append({
+                    invocationId,
+                    agentId: options.agentId,
+                    sessionId: options.sessionId,
+                    phase: exitCode === 0 ? "succeeded" : "failed",
+                    executable: options.executable,
+                    arguments: options.arguments,
+                    ...(signal === null ? {} : { output: `Process exited after ${signal}.` }),
+                    exitCode,
+                })).then(() => resolve({ exitCode, invocationId }), reject).finally(() => clearTimeout(mirrorDeadline));
+            });
+        });
+    }
+    finally {
+        for (const relay of relays.values())
+            relay.process.stdin?.end();
+        const deadline = setTimeout(() => { for (const relay of relays.values())
+            relay.process.kill("SIGKILL"); }, 1_000);
+        try {
+            await Promise.all([...relays.values()].map((relay) => relay.closed));
+        }
+        finally {
+            clearTimeout(deadline);
+        }
+        if (leaseFile !== undefined && leaseCreated) {
+            await unlink(leaseFile).catch((error) => { if (error.code !== "ENOENT")
+                throw error; });
+        }
+    }
+}
+// Native relays isolate blocking console IO. Child stdin is an asynchronous
+// IPC stream, so its backpressure can be cancelled without blocking Node or
+// occupying its shared filesystem/DNS thread pool.
+function outputRelay(runner, fd, cwd, environment) {
+    const child = spawn(runner, ["__relay"], { cwd, env: environment, windowsHide: true, stdio: ["pipe", fd, "ignore"] });
+    child.stdin?.on("error", () => { });
+    const closed = new Promise((resolve) => { child.once("exit", () => resolve()); child.once("error", () => resolve()); });
+    return { process: child, closed, write: async (data, signal) => {
+            if (signal.aborted)
+                return;
+            const pending = new Promise((resolve, reject) => {
+                if (!child.stdin) {
+                    reject(new Error("Guardian output relay unavailable."));
+                    return;
+                }
+                child.stdin.write(data, (error) => error ? reject(error) : resolve());
+            });
+            await waitForTerminal(pending, signal);
+        } };
+}
+async function waitForTerminal(pending, signal) {
+    if (signal.aborted)
+        return;
+    let abort = () => { };
+    const cancelled = new Promise((resolve) => { abort = resolve; signal.addEventListener("abort", abort, { once: true }); });
+    try {
+        await Promise.race([pending, cancelled]);
+    }
+    finally {
+        signal.removeEventListener("abort", abort);
+    }
+}
+class ManagedCommandJournal {
+    #dataDirectory;
+    constructor(dataDirectory) {
+        this.#dataDirectory = dataDirectory;
+    }
+    async append(record) {
+        const directory = join(this.#dataDirectory, "bridges", "generic");
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        await chmod(this.#dataDirectory, 0o700);
+        await chmod(join(this.#dataDirectory, "bridges"), 0o700);
+        await chmod(directory, 0o700);
+        const path = join(directory, "guardian-managed-commands.jsonl");
+        const encoded = JSON.stringify({
+            type: "phigon_managed_command",
+            timestamp: new Date().toISOString(),
+            session_id: record.sessionId,
+            agent_id: record.agentId,
+            invocation_id: record.invocationId,
+            phase: record.phase,
+            executable: record.executable,
+            arguments: record.arguments,
+            stream: record.stream ?? "",
+            output: record.output ?? "",
+            exit_code: record.exitCode ?? null,
+        });
+        if (Buffer.byteLength(encoded, "utf8") > 96 << 10) {
+            throw new Error("Managed command telemetry chunk exceeded 96 KiB.");
+        }
+        const handle = await open(path, "a", 0o600);
+        try {
+            await handle.write(`${encoded}\n`);
+        }
+        finally {
+            await handle.close();
+        }
+        await chmod(path, 0o600);
+    }
+}
+function safeExecutionError(error) {
+    const code = error instanceof Error && "code" in error
+        ? String(error.code ?? "unknown")
+        : "unknown";
+    return `Managed executable could not start (${code.slice(0, 32)}).`;
+}
+//# sourceMappingURL=guardian-managed-exec.js.map

package/dist/src/guardian-managed-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-managed-exec.js","sourceRoot":"","sources":["../../src/guardian-managed-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAA0B,MAAM,kCAAkC,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAO9D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAU1C;IACA,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,uBAAuB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACvG,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,WAAW;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAEvG,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,kBAAkB,UAAU,EAAE,OAAO,CAAC,CAAC;IACtI,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG,IAAI,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACpH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAChD,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QAC1E,CAAC;QACD,OAAO,MAAM,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,IAAI,EAAE;gBAC/O,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;gBACnE,KAAK,EAAE,KAAK;gBACZ,WAAW,EAAE,IAAI;gBACjB,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBACvC,GAAG,EAAE,OAAO,CAAC,WAAW;gBACxB,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;aACnC,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;gBAAE,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBACxD,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC5C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC/C,CAAC,CAAC;YACF,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;YAC1C,IAAI,cAA0C,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,sEAAsE;gBACtE,oEAAoE;gBACpE,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAA2B,EAAE,MAAc,EAAE,GAAY,EAAE,EAAE;gBAC3E,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO;gBAC/C,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC7C,MAAM,KAAK,GAAkB,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAClD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,KAAK,EAAE,CAAC;wBAC7D,MAAM,OAAO,CAAC,MAAM,CAAC;4BACnB,YAAY;4BACZ,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,KAAK,EAAE,SAAS;4BAChB,UAAU,EAAE,OAAO,CAAC,UAAU;4BAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,MAAM;4BACN,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;yBAC7C,CAAC,CAAC;oBACL,CAAC;oBACD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACrD,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;4BACX,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;4BACrI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;wBAC5B,CAAC;wBACD,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;oBAC7C,CAAC;gBACH,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;oBACX,kEAAkE;oBAClE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;wBAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;oBAAC,CAAC;gBAC3E,CAAC,CAAC,CAAC;gBACH,MAAM,GAAG,KAAK,CAAC;gBACf,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAChH,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,MAAM;oBAAE,OAAO;gBACnB,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,EAAE,CAAC;gBACT,WAAW,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC/B,YAAY;oBACZ,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,QAAQ;oBACf,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC;oBACjC,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBACnC,IAAI,MAAM;oBAAE,OAAO;gBACnB,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC;gBACtC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC;gBACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC/B,YAAY;oBACZ,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;oBAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,wBAAwB,MAAM,GAAG,EAAE,CAAC;oBACzE,QAAQ;iBACT,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;YAC1G,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClH,IAAI,CAAC;YAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;gBACrE,CAAC;YAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS,IAAI,YAAY,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;AACH,CAAC;AAID,4EAA4E;AAC5E,4EAA4E;AAC5E,mDAAmD;AACnD,SAAS,WAAW,CAAC,MAAc,EAAE,EAAU,EAAE,GAAW,EAAE,WAA8B;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtH,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAoD,CAAC,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9H,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YAC7D,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO;YAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACtF,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;YACH,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC,EAAE,CAAC;AACN,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAsB,EAAE,MAAmB;IACxE,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,IAAI,KAAK,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACrB,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChI,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAAC,CAAC;YACzC,CAAC;QAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;AACzD,CAAC;AAcD,MAAM,qBAAqB;IAChB,cAAc,CAAS;IAEhC,YAAY,aAAqB;QAC/B,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA4B;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK;QACpD,CAAC,CAAC,MAAM,CAAE,KAA+B,CAAC,IAAI,IAAI,SAAS,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,uCAAuC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;AACtE,CAAC"}

package/dist/src/guardian-model-bridge.d.ts

@@ -0,0 +1,13 @@
+export declare function startGuardianModelBridge(options: Readonly<{
+    controlPlaneURL: URL;
+    credential: string;
+    agentId: string;
+    provider: string;
+    fetcher?: typeof fetch;
+    maxConcurrentRequests?: number;
+}>): Promise<Readonly<{
+    baseURL: string;
+    token: string;
+    close: () => Promise<void>;
+}>>;
+//# sourceMappingURL=guardian-model-bridge.d.ts.map

package/dist/src/guardian-model-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-model-bridge.d.ts","sourceRoot":"","sources":["../../src/guardian-model-bridge.ts"],"names":[],"mappings":"AAIA,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC;IAC/D,eAAe,EAAE,GAAG,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAC5E,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAAC,CAyDrF"}

package/dist/src/guardian-model-bridge.js

@@ -0,0 +1,87 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { once } from "node:events";
+export async function startGuardianModelBridge(options) {
+    const token = randomBytes(32).toString("hex");
+    const maximum = options.maxConcurrentRequests ?? 8;
+    if (!Number.isInteger(maximum) || maximum < 1 || maximum > 64)
+        throw new Error("Invalid model bridge concurrency limit.");
+    const requests = new Set();
+    const server = createServer({ connectionsCheckingInterval: 1_000 }, (request, response) => {
+        void (async () => {
+            const presented = request.headers.authorization?.replace(/^Bearer /u, "") ?? request.headers["x-api-key"];
+            const supplied = typeof presented === "string" ? Buffer.from(presented) : Buffer.alloc(0);
+            if (request.method !== "POST" || request.headers.origin !== undefined || supplied.length !== token.length || !timingSafeEqual(supplied, Buffer.from(token)) ||
+                !["/v1/chat/completions", "/v1/responses", "/v1/embeddings", "/v1/messages"].includes(request.url ?? "")) {
+                response.writeHead(403, { Connection: "close" });
+                response.end("Phigon Guardian: model gateway access denied.");
+                return;
+            }
+            // Admission starts before body buffering. Slow uploads consume a slot too.
+            if (requests.size >= maximum) {
+                response.writeHead(429, { "Content-Type": "application/json", "Retry-After": "1", Connection: "close" });
+                response.end(JSON.stringify({ error: { code: "phigon_guardian_capacity", message: "Phigon Guardian model bridge is busy. Try again shortly." } }));
+                return;
+            }
+            const controller = new AbortController();
+            requests.add(controller);
+            response.once("close", () => controller.abort());
+            try {
+                const chunks = [];
+                let size = 0;
+                for await (const chunk of request) {
+                    const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                    size += data.length;
+                    if (size > 1 << 20) {
+                        response.writeHead(413, { Connection: "close" });
+                        response.end();
+                        return;
+                    }
+                    chunks.push(data);
+                }
+                if (controller.signal.aborted)
+                    return;
+                const upstream = await (options.fetcher ?? fetch)(new URL(`/v1/machine/guardian/models/${options.provider}${request.url}`, options.controlPlaneURL), {
+                    method: "POST", redirect: "error", headers: { Authorization: `Bearer ${options.credential}`, "Content-Type": "application/json", "X-Phigon-Agent-ID": options.agentId },
+                    body: Buffer.concat(chunks), signal: AbortSignal.any([controller.signal, AbortSignal.timeout(370_000)]),
+                });
+                response.writeHead(upstream.status, { "Content-Type": upstream.headers.get("content-type") ?? "application/json", "Cache-Control": "no-store" });
+                if (upstream.body)
+                    for await (const chunk of upstream.body) {
+                        if (!response.write(chunk))
+                            await once(response, "drain", { signal: controller.signal });
+                    }
+                response.end();
+            }
+            finally {
+                requests.delete(controller);
+                controller.abort();
+            }
+        })().catch(() => {
+            if (response.headersSent) {
+                response.destroy();
+                return;
+            }
+            response.writeHead(503, { "Content-Type": "application/json", Connection: "close" });
+            response.end(JSON.stringify({ error: { code: "phigon_guardian_unavailable", message: "Phigon Guardian blocked the model request because enforcement is unavailable." } }));
+        });
+    });
+    server.requestTimeout = 15_000;
+    server.headersTimeout = 10_000;
+    server.maxConnections = maximum * 4;
+    let closing;
+    await new Promise((resolve, reject) => { server.once("error", reject); server.listen(0, "127.0.0.1", resolve); });
+    const address = server.address();
+    if (address === null || typeof address === "string")
+        throw new Error("Guardian model bridge did not bind.");
+    return { baseURL: `http://127.0.0.1:${address.port}/v1`, token, close: () => {
+            if (closing)
+                return closing;
+            for (const controller of requests)
+                controller.abort();
+            server.closeAllConnections();
+            closing = new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            return closing;
+        } };
+}
+//# sourceMappingURL=guardian-model-bridge.js.map

package/dist/src/guardian-model-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-model-bridge.js","sourceRoot":"","sources":["../../src/guardian-model-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAI7C;IACA,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC1H,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxF,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC1G,MAAM,QAAQ,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvJ,CAAC,CAAC,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC7G,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBAAC,QAAQ,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;gBAAC,OAAO;YAC1H,CAAC;YACD,2EAA2E;YAC3E,IAAI,QAAQ,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC7B,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,0DAA0D,EAAE,EAAE,CAAC,CAAC,CAAC;gBACnJ,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACnE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAa,EAAE,CAAC;gBAAC,IAAI,IAAI,GAAG,CAAC,CAAC;gBAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;oBAC3E,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC;oBACpB,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;wBAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;wBAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBACjG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;gBACD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO;gBACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,+BAA+B,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,eAAe,CAAC,EAAE;oBACnJ,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,OAAO,CAAC,OAAO,EAAE;oBACvK,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;iBACxG,CAAC,CAAC;gBACH,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;gBACjJ,IAAI,QAAQ,CAAC,IAAI;oBAAE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;wBAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;4BAAE,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3F,CAAC;gBACD,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;oBAAS,CAAC;gBAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QAChE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YACzD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACrF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,+EAA+E,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7K,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/D,MAAM,CAAC,cAAc,GAAG,OAAO,GAAG,CAAC,CAAC;IACpC,IAAI,OAAkC,CAAC;IACvC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAAC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC9I,OAAO,EAAE,OAAO,EAAE,oBAAoB,OAAO,CAAC,IAAI,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;YAC1E,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,KAAK,MAAM,UAAU,IAAI,QAAQ;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YACtD,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3I,OAAO,OAAO,CAAC;QACjB,CAAC,EAAE,CAAC;AACN,CAAC"}

package/dist/src/guardian-native.d.ts

@@ -0,0 +1,3 @@
+export declare function guardianRunnerPath(): string;
+export declare function killVerifiedWindowsProcess(processId: number, startedAt: string): Promise<void>;
+//# sourceMappingURL=guardian-native.d.ts.map

package/dist/src/guardian-native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-native.d.ts","sourceRoot":"","sources":["../../src/guardian-native.ts"],"names":[],"mappings":"AAGA,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AACD,wBAAsB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIpG"}

package/dist/src/guardian-native.js

@@ -0,0 +1,13 @@
+import { execFile } from "node:child_process";
+import { fileURLToPath } from "node:url";
+export function guardianRunnerPath() {
+    const os = process.platform === "win32" ? "windows" : process.platform;
+    const arch = process.arch === "x64" ? "amd64" : process.arch;
+    return fileURLToPath(new URL(`../bin/guardian-runner-${os}-${arch}${os === "windows" ? ".exe" : ""}`, import.meta.url));
+}
+export async function killVerifiedWindowsProcess(processId, startedAt) {
+    await new Promise((resolve, reject) => execFile(guardianRunnerPath(), ["--kill-pid", String(processId), "--started-at", startedAt], {
+        windowsHide: true, timeout: 8_000, maxBuffer: 4096,
+    }, (error) => error ? reject(error) : resolve()));
+}
+//# sourceMappingURL=guardian-native.js.map

package/dist/src/guardian-native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-native.js","sourceRoot":"","sources":["../../src/guardian-native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,kBAAkB;IAChC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7D,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,IAAI,IAAI,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1H,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,SAAiB,EAAE,SAAiB;IACnF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE;QACxI,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI;KACnD,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC"}