@planu/cli 5.3.27 → 5.3.29

package/dist/engine/execution/native-worker-runtime.js

@@ -1,177 +0,0 @@
-import { randomBytes, randomUUID } from 'node:crypto';
-import { Worker } from 'node:worker_threads';
-import { nativeWorkerSchemaHash, NATIVE_WORKER_OPERATIONS, } from './native-worker-protocol.js';
-import { NATIVE_CAPABILITY_ABI, NATIVE_PROTOCOL_ABI, RUNTIME_STORAGE_SCHEMA, } from '../native-runtime-handshake.js';
-import { getExecutionContext } from './context.js';
-import { redactFailureMessage, reportClassifiedDegradation, } from '../../errors/classified-degradation.js';
-function validateCall(call) {
-    if (call.signal?.aborted) {
-        throw call.signal.reason instanceof Error
-            ? call.signal.reason
-            : new Error('[Planu] Native worker cancelled');
-    }
-    if (!call.projectId.trim() || !Number.isSafeInteger(call.deadlineAt)) {
-        throw new Error('[Planu] Native worker call requires projectId and an absolute deadline');
-    }
-    if (!NATIVE_WORKER_OPERATIONS.includes(call.operation)) {
-        throw new Error('[Planu] Native worker operation is not allowlisted');
-    }
-    if (Date.now() >= call.deadlineAt) {
-        throw new Error('[Planu] Native worker deadline already expired');
-    }
-}
-function validateHandshake(handshake, operation) {
-    const capabilities = new Set(handshake.capabilities);
-    if (handshake.protocolAbi !== NATIVE_PROTOCOL_ABI ||
-        handshake.capabilityAbi !== NATIVE_CAPABILITY_ABI ||
-        handshake.storageSchema !== RUNTIME_STORAGE_SCHEMA ||
-        handshake.schemaHash !== nativeWorkerSchemaHash() ||
-        capabilities.size !== NATIVE_WORKER_OPERATIONS.length ||
-        !NATIVE_WORKER_OPERATIONS.every((capability) => capabilities.has(capability)) ||
-        !capabilities.has(operation) ||
-        typeof handshake.engineVersion !== 'string' ||
-        handshake.engineVersion.trim() === '' ||
-        typeof handshake.target !== 'string' ||
-        handshake.target.trim() === '' ||
-        typeof handshake.artifactHash !== 'string' ||
-        !/^[a-f0-9]{64}$/.test(handshake.artifactHash) ||
-        !handshake.compatible) {
-        throw new Error('[Planu] Native worker handshake is incompatible');
-    }
-}
-// eslint-disable-next-line max-lines-per-function -- worker lifecycle keeps cancellation and identity fencing in one closure
-export async function runNativeWorkerOperation(call, workerFactory = (url, options) => new Worker(url, {
-    ...options,
-    execArgv: process.execArgv.filter((argument) => !argument.startsWith('--input-type')),
-})) {
-    const parent = getExecutionContext();
-    const deadlineAt = Math.min(call.deadlineAt, parent?.deadlineAt ?? Number.POSITIVE_INFINITY);
-    const cancellation = linkCancellation(call.signal, parent?.signal);
-    try {
-        validateCall({ ...call, deadlineAt, signal: cancellation.signal });
-    }
-    catch (error) {
-        cancellation.dispose();
-        throw error;
-    }
-    const secret = randomBytes(32).toString('hex');
-    const requestId = call.requestId ?? randomUUID();
-    const cancellationId = call.cancellationId ?? randomUUID();
-    const worker = workerFactory(new URL('./native-worker-thread.js', import.meta.url), {
-        workerData: { secret },
-    });
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        let requestSent = false;
-        const timeoutMs = Math.max(1, deadlineAt - Date.now());
-        const finish = (error, value) => {
-            if (settled) {
-                return;
-            }
-            settled = true;
-            clearTimeout(timer);
-            cancellation.signal.removeEventListener('abort', abort);
-            cancellation.dispose();
-            void worker.terminate();
-            if (error) {
-                reject(error);
-            }
-            else {
-                resolve(value);
-            }
-        };
-        const abort = () => {
-            const reason = cancellation.signal.reason;
-            finish(reason instanceof Error ? reason : new Error('[Planu] Native worker cancelled'));
-        };
-        const timer = setTimeout(() => {
-            finish(new Error('[Planu] Native worker deadline exceeded'));
-        }, timeoutMs);
-        cancellation.signal.addEventListener('abort', abort, { once: true });
-        if (cancellation.signal.aborted) {
-            abort();
-            return;
-        }
-        worker.once('error', (error) => {
-            finish(error instanceof Error ? error : new Error(String(error)));
-        });
-        worker.once('exit', (code) => {
-            if (!settled && code !== 0) {
-                finish(new Error(`[Planu] Native worker exited with code ${String(code)}`));
-            }
-        });
-        worker.on('message', (value) => {
-            if (!value || typeof value !== 'object' || !('kind' in value)) {
-                finish(new Error('[Planu] Native worker sent a malformed message'));
-                return;
-            }
-            const message = value;
-            if (message.kind === 'handshake') {
-                try {
-                    if (requestSent) {
-                        throw new Error('[Planu] Native worker sent a duplicate handshake');
-                    }
-                    validateHandshake(message, call.operation);
-                    const request = {
-                        kind: 'request',
-                        secret,
-                        requestId,
-                        projectId: call.projectId,
-                        deadlineAt,
-                        cancellationId,
-                        operation: call.operation,
-                        payload: call.payload,
-                    };
-                    requestSent = true;
-                    worker.postMessage(request);
-                }
-                catch (error) {
-                    /* reliability-optional: NATIVE_WORKER_MESSAGE_FAILURE — promise rejects through finish */
-                    reportClassifiedDegradation('NATIVE_WORKER_MESSAGE_FAILURE', error);
-                    finish(new Error(redactFailureMessage(error)));
-                }
-                return;
-            }
-            if (!requestSent || message.requestId !== requestId) {
-                finish(new Error('[Planu] Native worker response identity mismatch'));
-                return;
-            }
-            if (message.kind === 'error') {
-                finish(new Error(message.message));
-            }
-            else {
-                finish(undefined, message.value);
-            }
-        });
-    });
-}
-function linkCancellation(child, parent) {
-    const controller = new AbortController();
-    const signals = [child, parent].filter((signal) => signal !== undefined);
-    const abort = (signal) => {
-        if (!controller.signal.aborted) {
-            controller.abort(signal.reason);
-        }
-    };
-    const listeners = signals.map((signal) => {
-        const listener = () => {
-            abort(signal);
-        };
-        if (signal.aborted) {
-            abort(signal);
-        }
-        else {
-            signal.addEventListener('abort', listener, { once: true });
-        }
-        return { signal, listener };
-    });
-    return {
-        signal: controller.signal,
-        dispose: () => {
-            for (const listener of listeners) {
-                listener.signal.removeEventListener('abort', listener.listener);
-            }
-        },
-    };
-}
-//# sourceMappingURL=native-worker-runtime.js.map

package/dist/engine/execution/native-worker-thread.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=native-worker-thread.d.ts.map

package/dist/engine/execution/native-worker-thread.js

@@ -1,66 +0,0 @@
-import { parentPort, workerData } from 'node:worker_threads';
-import { isNativeActive, nativeLoadDiagnostic, NATIVE_CAPABILITY_ABI, NATIVE_PROTOCOL_ABI, RUNTIME_STORAGE_SCHEMA, } from '../core-bridge.js';
-import { PLANU_VERSION } from '../../config/version.js';
-import { redactFailureMessage, reportClassifiedDegradation, } from '../../errors/classified-degradation.js';
-import { isNativeWorkerOperation, nativeWorkerSchemaHash, NATIVE_WORKER_OPERATIONS, } from './native-worker-protocol.js';
-import { dispatchNativeWorkerRequest } from './native-worker-dispatch.js';
-const bootstrap = workerData;
-const bootstrapSecret = bootstrap && typeof bootstrap === 'object' && 'secret' in bootstrap
-    ? bootstrap.secret
-    : undefined;
-if (!parentPort || typeof bootstrapSecret !== 'string' || bootstrapSecret.length < 32) {
-    throw new Error('[Planu] Native worker bootstrap authentication failed');
-}
-const port = parentPort;
-isNativeActive();
-const diagnostic = nativeLoadDiagnostic();
-const nativeHandshake = diagnostic.compatibility?.handshake ?? null;
-port.postMessage({
-    kind: 'handshake',
-    protocolAbi: NATIVE_PROTOCOL_ABI,
-    capabilityAbi: NATIVE_CAPABILITY_ABI,
-    storageSchema: RUNTIME_STORAGE_SCHEMA,
-    schemaHash: nativeWorkerSchemaHash(),
-    capabilities: NATIVE_WORKER_OPERATIONS,
-    engineVersion: nativeHandshake?.engineVersion ?? PLANU_VERSION,
-    target: nativeHandshake?.target ?? null,
-    artifactHash: diagnostic.artifactSha256 ?? null,
-    compatible: diagnostic.compatibility?.compatible === true,
-});
-port.on('message', (value) => {
-    const request = value;
-    const requestId = typeof request.requestId === 'string' ? request.requestId : 'invalid';
-    const respond = (response) => {
-        port.postMessage(response);
-    };
-    try {
-        if (request.kind !== 'request' ||
-            request.secret !== bootstrapSecret ||
-            !isNativeWorkerOperation(request.operation) ||
-            typeof request.projectId !== 'string' ||
-            request.projectId.trim() === '' ||
-            typeof request.cancellationId !== 'string' ||
-            request.cancellationId.trim() === '' ||
-            typeof request.deadlineAt !== 'number' ||
-            Date.now() >= request.deadlineAt ||
-            !request.payload ||
-            typeof request.payload !== 'object') {
-            throw new Error('[Planu] Native worker rejected malformed or expired request');
-        }
-        respond({
-            kind: 'result',
-            requestId,
-            value: dispatchNativeWorkerRequest(request),
-        });
-    }
-    catch (error) {
-        /* reliability-optional: NATIVE_WORKER_OPERATION_FAILURE — typed error response is emitted */
-        reportClassifiedDegradation('NATIVE_WORKER_OPERATION_FAILURE', error);
-        respond({
-            kind: 'error',
-            requestId,
-            message: redactFailureMessage(error),
-        });
-    }
-});
-//# sourceMappingURL=native-worker-thread.js.map

package/dist/engine/macos-keychain-native-port.d.ts

@@ -1,10 +0,0 @@
-import type { NativeRuntimeCompatibility, PlanuCore } from '../types/core-bridge.js';
-import type { MacOSKeychainNativePort } from '../types/security.js';
-export declare class ValidationReceiptSignerUnavailableError extends Error {
-    readonly reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'STALE_ARTIFACT' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE';
-    readonly code: 'VALIDATION_RECEIPT_SIGNER_UNAVAILABLE';
-    constructor(reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'STALE_ARTIFACT' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE', remediation?: string);
-}
-/** Build the privileged main-thread port only from a canonical, verified native module. */
-export declare function createMacOSKeychainNativePort(platform: NodeJS.Platform, overrideDefined: boolean, disabled: boolean, nativeModule: PlanuCore | null, origin: 'override' | 'local' | 'package' | undefined, capabilities: readonly string[] | undefined, compatibility?: NativeRuntimeCompatibility): MacOSKeychainNativePort;
-//# sourceMappingURL=macos-keychain-native-port.d.ts.map

package/dist/engine/macos-keychain-native-port.js

@@ -1,64 +0,0 @@
-import { PLANU_VERSION } from '../config/version.js';
-const DEFAULT_REMEDIATION = 'Restart the MCP host and retry.';
-/** Recover the native target triple from a buildId shaped `<epoch>-<engineVersion>-<triple>`. */
-function deriveNativeTargetTriple(buildId, engineVersion) {
-    const separator = `-${engineVersion}-`;
-    const index = buildId.indexOf(separator);
-    if (index === -1) {
-        return null;
-    }
-    const triple = buildId.slice(index + separator.length);
-    return triple.length > 0 ? triple : null;
-}
-function staleArtifactRemediation(artifactVersion, buildId) {
-    const triple = buildId ? deriveNativeTargetTriple(buildId, artifactVersion) : null;
-    if (!triple) {
-        return (`Native artifact reports engineVersion ${artifactVersion}, expected ${PLANU_VERSION}. ` +
-            'Could not determine the native target triple from the artifact build id; run: ' +
-            'bash scripts/build-rust-local.sh --host after manually removing the stale native artifact for your platform.');
-    }
-    return (`Native artifact reports engineVersion ${artifactVersion}, expected ${PLANU_VERSION}. Run: ` +
-        `cargo clean -p planu-core --release --target ${triple} --manifest-path rust/planu-core/Cargo.toml && bash scripts/build-rust-local.sh --host`);
-}
-export class ValidationReceiptSignerUnavailableError extends Error {
-    reason;
-    code = 'VALIDATION_RECEIPT_SIGNER_UNAVAILABLE';
-    constructor(reason, remediation = DEFAULT_REMEDIATION) {
-        super(`[Planu] VALIDATION_RECEIPT_SIGNER_UNAVAILABLE:${reason} ${remediation}`);
-        this.reason = reason;
-        this.name = 'ValidationReceiptSignerUnavailableError';
-    }
-}
-/** Build the privileged main-thread port only from a canonical, verified native module. */
-export function createMacOSKeychainNativePort(platform, overrideDefined, disabled, nativeModule, origin, capabilities, compatibility) {
-    if (platform !== 'darwin') {
-        throw new ValidationReceiptSignerUnavailableError('PLATFORM_UNSUPPORTED');
-    }
-    if (overrideDefined || origin === 'override') {
-        throw new ValidationReceiptSignerUnavailableError('OVERRIDE_REJECTED');
-    }
-    if (disabled) {
-        throw new ValidationReceiptSignerUnavailableError('NATIVE_DISABLED');
-    }
-    if (!nativeModule) {
-        if (compatibility && !compatibility.compatible) {
-            const artifactVersion = compatibility.handshake?.engineVersion ?? 'unknown';
-            throw new ValidationReceiptSignerUnavailableError('STALE_ARTIFACT', staleArtifactRemediation(artifactVersion, compatibility.handshake?.buildId));
-        }
-        throw new ValidationReceiptSignerUnavailableError('ARTIFACT_MISSING');
-    }
-    if (origin !== 'local' && origin !== 'package') {
-        throw new ValidationReceiptSignerUnavailableError('NONCANONICAL_ORIGIN');
-    }
-    if (!capabilities?.includes('macos-keychain-v1')) {
-        throw new ValidationReceiptSignerUnavailableError('CAPABILITY_MISSING');
-    }
-    const set = nativeModule.macosKeychainSet?.bind(nativeModule);
-    const get = nativeModule.macosKeychainGet?.bind(nativeModule);
-    const remove = nativeModule.macosKeychainDelete?.bind(nativeModule);
-    if (!set || !get || !remove) {
-        throw new ValidationReceiptSignerUnavailableError('PORT_INCOMPLETE');
-    }
-    return { set, get, delete: remove };
-}
-//# sourceMappingURL=macos-keychain-native-port.js.map

package/dist/engine/native-capability-policy.d.ts

@@ -1,4 +0,0 @@
-import type { NativeCapabilityPolicy, NativeFallbackMode } from '../types/core-bridge.js';
-export declare const NATIVE_CAPABILITY_POLICIES: readonly NativeCapabilityPolicy[];
-export declare function nativeFallbackMode(capability: string): NativeFallbackMode | null;
-//# sourceMappingURL=native-capability-policy.d.ts.map

package/dist/engine/native-capability-policy.js

@@ -1,24 +0,0 @@
-export const NATIVE_CAPABILITY_POLICIES = [
-    {
-        capability: 'core-acceleration-v1',
-        classification: 'optimization',
-        fallback: 'typescript-visible-degradation',
-        parityContract: 'tests/integration/native-platform-matrix.test.ts',
-    },
-    {
-        capability: 'project-graph-v1',
-        classification: 'optimization',
-        fallback: 'typescript-visible-degradation',
-        parityContract: 'tests/integration/native-project-graph-e2e.test.ts',
-    },
-    {
-        capability: 'macos-keychain-v1',
-        classification: 'correctness-critical',
-        fallback: 'fail-closed',
-        parityContract: 'tests/security/macos-keychain.integration.test.ts',
-    },
-];
-export function nativeFallbackMode(capability) {
-    return (NATIVE_CAPABILITY_POLICIES.find((policy) => policy.capability === capability)?.fallback ?? null);
-}
-//# sourceMappingURL=native-capability-policy.js.map

package/dist/engine/native-platform.d.ts

@@ -1,3 +0,0 @@
-/** Detects musl through independent local signals and reports failed probes. */
-export declare function detectMusl(): boolean;
-//# sourceMappingURL=native-platform.d.ts.map

package/dist/engine/native-platform.js

@@ -1,44 +0,0 @@
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
-let cachedMusl;
-function probeMuslSignal(code, probe) {
-    try {
-        return probe();
-    }
-    catch (error) {
-        void error;
-        /* reliability-optional: NATIVE_LIBC_PROBE_FAILED */
-        reportClassifiedDegradation(code, new Error('Native libc probe unavailable'));
-        return false;
-    }
-}
-/** Detects musl through independent local signals and reports failed probes. */
-export function detectMusl() {
-    if (cachedMusl !== undefined) {
-        return cachedMusl;
-    }
-    if (process.platform !== 'linux') {
-        cachedMusl = false;
-        return cachedMusl;
-    }
-    if (probeMuslSignal('NATIVE_LIBC_ALPINE_PROBE_FAILED', () => existsSync('/etc/alpine-release'))) {
-        cachedMusl = true;
-        return cachedMusl;
-    }
-    if (probeMuslSignal('NATIVE_LIBC_REPORT_PROBE_FAILED', () => {
-        const reportApi = process.report;
-        const report = reportApi?.getReport();
-        return (report !== undefined &&
-            /musl/iu.test(typeof report === 'string' ? report : JSON.stringify(report)));
-    })) {
-        cachedMusl = true;
-        return cachedMusl;
-    }
-    if (probeMuslSignal('NATIVE_LIBC_LDD_PROBE_FAILED', () => existsSync('/usr/bin/ldd') && /musl/iu.test(readFileSync('/usr/bin/ldd', 'utf8')))) {
-        cachedMusl = true;
-        return cachedMusl;
-    }
-    cachedMusl = probeMuslSignal('NATIVE_LIBC_LINKER_PROBE_FAILED', () => readdirSync('/lib').some((entry) => entry.startsWith('ld-musl-')));
-    return cachedMusl;
-}
-//# sourceMappingURL=native-platform.js.map

package/dist/engine/native-runtime-handshake.d.ts

@@ -1,20 +0,0 @@
-import type { NativeArtifactManifest, NativeRuntimeCompatibility, NativeRuntimeHandshake } from '../types/core-bridge.js';
-export declare const NATIVE_PROTOCOL_ABI = 1;
-export declare const NATIVE_CAPABILITY_ABI = 2;
-export declare const NATIVE_NODE_API_ABI = 4;
-/** Must match RuntimeDatabase.schemaVersion and the Rust/native release contract. */
-export declare const RUNTIME_STORAGE_SCHEMA = 4;
-export declare function inspectNativeArtifact(artifactPath: string, trustedPublicKeyInput?: string | Buffer): {
-    artifactSha256: string;
-    manifest: NativeArtifactManifest | null;
-};
-export declare function negotiateNativeRuntime(handshake: NativeRuntimeHandshake | null, manifest: NativeArtifactManifest | null, expected: {
-    cliVersion: string;
-    target: string;
-    artifactSha256: string;
-    protocolAbi?: number;
-    capabilityAbi?: number;
-    nodeApiAbi?: number;
-    storageSchema?: number;
-}): NativeRuntimeCompatibility;
-//# sourceMappingURL=native-runtime-handshake.d.ts.map

package/dist/engine/native-runtime-handshake.js

@@ -1,230 +0,0 @@
-/* eslint-disable complexity -- the fail-closed manifest boundary validates every signed field */
-/* eslint-disable @typescript-eslint/no-unnecessary-condition -- Partial models untrusted JSON at runtime */
-import { createHash, createPublicKey, verify as verifySignature } from 'node:crypto';
-import { lstatSync, readFileSync } from 'node:fs';
-import { basename, dirname, join } from 'node:path';
-import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
-export const NATIVE_PROTOCOL_ABI = 1;
-export const NATIVE_CAPABILITY_ABI = 2;
-export const NATIVE_NODE_API_ABI = 4;
-/** Must match RuntimeDatabase.schemaVersion and the Rust/native release contract. */
-export const RUNTIME_STORAGE_SCHEMA = 4;
-export function inspectNativeArtifact(artifactPath, trustedPublicKeyInput) {
-    const hash = (value) => createHash('sha256').update(value).digest('hex');
-    let artifactSha256 = '';
-    const manifestPath = `${artifactPath}.manifest.json`;
-    try {
-        const currentUid = process.getuid?.();
-        for (const path of [artifactPath, manifestPath]) {
-            const stat = lstatSync(path);
-            if (stat.isSymbolicLink() ||
-                (process.platform !== 'win32' &&
-                    ((currentUid !== undefined && stat.uid !== currentUid) || (stat.mode & 0o022) !== 0))) {
-                return { artifactSha256, manifest: null };
-            }
-        }
-        artifactSha256 = hash(readFileSync(artifactPath));
-        const parsed = JSON.parse(readFileSync(manifestPath, 'utf8'));
-        if (typeof parsed !== 'object' ||
-            parsed === null ||
-            !('schemaVersion' in parsed) ||
-            parsed.schemaVersion !== 2 ||
-            !('artifactSha256' in parsed) ||
-            typeof parsed.artifactSha256 !== 'string' ||
-            !('capabilities' in parsed) ||
-            !Array.isArray(parsed.capabilities) ||
-            !parsed.capabilities.every((capability) => typeof capability === 'string')) {
-            return { artifactSha256, manifest: null };
-        }
-        const candidate = parsed;
-        const expectedSbomName = `${basename(artifactPath)}.sbom.json`;
-        const exactSemver = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u;
-        const expectedCapabilities = [
-            'core-acceleration-v1',
-            'project-graph-v1',
-            ...(candidate.platform === 'darwin' ? ['macos-keychain-v1'] : []),
-        ];
-        if (!exactSemver.test(candidate.cliVersion ?? '') ||
-            !exactSemver.test(candidate.engineVersion ?? '') ||
-            !/^[A-Za-z0-9._:-]{1,200}$/u.test(candidate.buildId ?? '') ||
-            candidate.protocolAbi !== NATIVE_PROTOCOL_ABI ||
-            candidate.capabilityAbi !== NATIVE_CAPABILITY_ABI ||
-            candidate.nodeApiAbi !== NATIVE_NODE_API_ABI ||
-            !Number.isSafeInteger(candidate.storageSchemaMin) ||
-            !Number.isSafeInteger(candidate.storageSchemaMax) ||
-            (candidate.storageSchemaMin ?? 0) < 1 ||
-            (candidate.storageSchemaMax ?? 0) < (candidate.storageSchemaMin ?? 0) ||
-            !['darwin', 'linux', 'win32'].includes(candidate.platform ?? '') ||
-            !['arm64', 'x64'].includes(candidate.arch ?? '') ||
-            (candidate.platform === 'linux'
-                ? !['glibc', 'musl'].includes(candidate.libc ?? '')
-                : candidate.libc !== null) ||
-            candidate.target !==
-                [candidate.platform, candidate.arch, candidate.libc].filter(Boolean).join('-') ||
-            JSON.stringify(candidate.capabilities) !== JSON.stringify(expectedCapabilities) ||
-            !/^[a-f0-9]{64}$/u.test(candidate.artifactSha256 ?? '') ||
-            candidate.sbom?.format !== 'CycloneDX-1.5' ||
-            candidate.sbom.path !== expectedSbomName ||
-            !/^[a-f0-9]{64}$/u.test(candidate.sbom.sha256 ?? '') ||
-            !/^[a-f0-9]{40}$/u.test(candidate.provenance?.sourceCommit ?? '') ||
-            typeof candidate.provenance?.sourceTreeDirty !== 'boolean' ||
-            !Number.isSafeInteger(candidate.provenance?.sourceDateEpoch) ||
-            (candidate.provenance?.sourceDateEpoch ?? -1) < 0 ||
-            !candidate.provenance?.builder ||
-            candidate.provenance.builder.length > 256 ||
-            !candidate.provenance.rustToolchain ||
-            (candidate.provenance.zigVersion !== null &&
-                typeof candidate.provenance.zigVersion !== 'string') ||
-            candidate.signature?.algorithm !== 'Ed25519' ||
-            !/^[a-f0-9]{64}$/u.test(candidate.signature.keyId ?? '') ||
-            !/^[A-Za-z0-9+/]{86}==$/u.test(candidate.signature.value ?? '')) {
-            return { artifactSha256, manifest: null };
-        }
-        const sbomPath = join(dirname(artifactPath), expectedSbomName);
-        const sbomStat = lstatSync(sbomPath);
-        if (sbomStat.isSymbolicLink() ||
-            (process.platform !== 'win32' &&
-                ((process.getuid?.() !== undefined && sbomStat.uid !== process.getuid?.()) ||
-                    (sbomStat.mode & 0o022) !== 0)) ||
-            hash(readFileSync(sbomPath)) !== candidate.sbom.sha256) {
-            return { artifactSha256, manifest: null };
-        }
-        const sbomValue = JSON.parse(readFileSync(sbomPath, 'utf8'));
-        if (!isValidSbom(sbomValue, candidate.engineVersion, artifactSha256)) {
-            return { artifactSha256, manifest: null };
-        }
-        const { signature, ...unsigned } = candidate;
-        const publicKey = createPublicKey(trustedPublicKeyInput ??
-            readFileSync(join(import.meta.dirname, '..', 'config', 'native-release-public-key.pem')));
-        const publicDer = publicKey.export({ type: 'spki', format: 'der' });
-        if (hash(publicDer) !== signature.keyId ||
-            !verifySignature(null, Buffer.from(JSON.stringify(unsigned)), publicKey, Buffer.from(signature.value, 'base64'))) {
-            return { artifactSha256, manifest: null };
-        }
-        return { artifactSha256, manifest: candidate };
-    }
-    catch (error) {
-        void error;
-        /* reliability-optional: NATIVE_ARTIFACT_INSPECTION_FAILED */
-        reportClassifiedDegradation('NATIVE_ARTIFACT_INSPECTION_FAILED', new Error('Native artifact inspection failed closed'));
-        return { artifactSha256, manifest: null };
-    }
-}
-function isValidSbom(value, engineVersion, artifactSha256) {
-    if (typeof value !== 'object' || value === null) {
-        return false;
-    }
-    const sbom = value;
-    const componentsValid = Array.isArray(sbom.components) &&
-        sbom.components.length > 0 &&
-        sbom.components.every((component) => typeof component === 'object' &&
-            component !== null &&
-            typeof component['bom-ref'] === 'string' &&
-            typeof component.name === 'string' &&
-            typeof component.version === 'string');
-    const dependenciesValid = Array.isArray(sbom.dependencies) &&
-        sbom.dependencies.some((dependency) => typeof dependency === 'object' &&
-            dependency !== null &&
-            Array.isArray(dependency.dependsOn));
-    const hashes = sbom.metadata?.component?.hashes;
-    const artifactBound = Array.isArray(hashes) &&
-        hashes.some((entry) => typeof entry === 'object' &&
-            entry !== null &&
-            entry.alg === 'SHA-256' &&
-            entry.content === artifactSha256);
-    return (sbom.bomFormat === 'CycloneDX' &&
-        sbom.specVersion === '1.5' &&
-        sbom.version === 1 &&
-        sbom.metadata?.component?.name === 'planu-core' &&
-        sbom.metadata.component.version === engineVersion &&
-        componentsValid &&
-        dependenciesValid &&
-        artifactBound);
-}
-export function negotiateNativeRuntime(handshake, manifest, expected) {
-    if (!handshake) {
-        return {
-            compatible: false,
-            reasons: ['native runtime does not expose planuRuntimeHandshake'],
-            handshake: null,
-        };
-    }
-    if (!manifest) {
-        return {
-            compatible: false,
-            reasons: ['native artifact manifest is missing, unsafe or invalid'],
-            handshake,
-        };
-    }
-    const reasons = [];
-    const protocolAbi = expected.protocolAbi ?? NATIVE_PROTOCOL_ABI;
-    const capabilityAbi = expected.capabilityAbi ?? NATIVE_CAPABILITY_ABI;
-    const nodeApiAbi = expected.nodeApiAbi ?? NATIVE_NODE_API_ABI;
-    const storageSchema = expected.storageSchema ?? RUNTIME_STORAGE_SCHEMA;
-    const handshakeCapabilitiesValid = Array.isArray(handshake.capabilities) &&
-        handshake.capabilities.every((capability) => typeof capability === 'string');
-    const manifestCapabilitiesValid = Array.isArray(manifest.capabilities) &&
-        manifest.capabilities.every((capability) => typeof capability === 'string');
-    if (manifest.cliVersion !== expected.cliVersion) {
-        reasons.push(`CLI version mismatch: expected ${expected.cliVersion}, got ${manifest.cliVersion}`);
-    }
-    if (handshake.engineVersion !== expected.cliVersion) {
-        reasons.push(`engine version mismatch: expected ${expected.cliVersion}, got ${handshake.engineVersion}`);
-    }
-    if (handshake.engineVersion !== manifest.engineVersion) {
-        reasons.push('native engine version does not match artifact manifest');
-    }
-    if (handshake.buildId !== manifest.buildId) {
-        reasons.push('native build identity does not match artifact manifest');
-    }
-    if (handshake.protocolAbi !== protocolAbi) {
-        reasons.push(`protocol ABI mismatch: expected ${protocolAbi}, got ${handshake.protocolAbi}`);
-    }
-    if (handshake.protocolAbi !== manifest.protocolAbi) {
-        reasons.push('native protocol ABI does not match artifact manifest');
-    }
-    if (handshake.capabilityAbi !== capabilityAbi) {
-        reasons.push(`capability ABI mismatch: expected ${capabilityAbi}, got ${handshake.capabilityAbi}`);
-    }
-    if (handshake.capabilityAbi !== manifest.capabilityAbi) {
-        reasons.push('native capability ABI does not match artifact manifest');
-    }
-    if (handshake.nodeApiAbi !== nodeApiAbi) {
-        reasons.push(`Node-API ABI mismatch: expected ${nodeApiAbi}, got ${handshake.nodeApiAbi}`);
-    }
-    if (handshake.nodeApiAbi !== manifest.nodeApiAbi) {
-        reasons.push('native Node-API ABI does not match artifact manifest');
-    }
-    if (!handshakeCapabilitiesValid) {
-        reasons.push('native runtime capabilities are malformed');
-    }
-    if (!manifestCapabilitiesValid) {
-        reasons.push('native artifact manifest capabilities are malformed');
-    }
-    if (handshakeCapabilitiesValid &&
-        manifestCapabilitiesValid &&
-        JSON.stringify(handshake.capabilities) !== JSON.stringify(manifest.capabilities)) {
-        reasons.push('native capabilities do not match artifact manifest');
-    }
-    if (storageSchema < handshake.storageSchemaMin || storageSchema > handshake.storageSchemaMax) {
-        reasons.push(`storage schema ${storageSchema} is outside native range ${handshake.storageSchemaMin}-${handshake.storageSchemaMax}`);
-    }
-    if (handshake.storageSchemaMin !== manifest.storageSchemaMin ||
-        handshake.storageSchemaMax !== manifest.storageSchemaMax) {
-        reasons.push('native storage schema range does not match artifact manifest');
-    }
-    if (handshake.target !== expected.target) {
-        reasons.push(`target mismatch: expected ${expected.target}, got ${handshake.target}`);
-    }
-    if (handshake.target !== manifest.target) {
-        reasons.push('native target does not match artifact manifest');
-    }
-    if (manifest.target !== [manifest.platform, manifest.arch, manifest.libc].filter(Boolean).join('-')) {
-        reasons.push('native manifest target does not match platform/arch/libc dimensions');
-    }
-    if (manifest.artifactSha256 !== expected.artifactSha256) {
-        reasons.push('native artifact SHA-256 mismatch');
-    }
-    return { compatible: reasons.length === 0, reasons, handshake };
-}
-//# sourceMappingURL=native-runtime-handshake.js.map