@sortedyuan/maybecode 0.3.2 → 0.5.0

package/dist/team-verification.js

@@ -1,18 +1,18 @@
-import { acquireFileLock, releaseFileLock } from "@sortedyuan/session/file-store";
+import { acquireFileLock, hasErrorCode } from "@sortedyuan/may/storage";
 import { createHash } from "node:crypto";
-import { spawn } from "node:child_process";
 import { constants } from "node:fs";
 import { lstat, mkdir, open, readdir, realpath } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { isDeepStrictEqual } from "node:util";
-import { AsyncStateSerializer } from "@sortedyuan/application";
+import { AsyncStateSerializer } from "@sortedyuan/may/core";
+import { openCodingExecutionEnvironment } from "@sortedyuan/coding-tools";
 const maxJournalBytes = 16_777_216;
 /** Host evidence and deterministic checks; a model report can never grant acceptance. */
 export class TeamVerificationStore {
     file;
     lock;
-    lockPath;
     checks;
+    executionFor;
     serial = new AsyncStateSerializer();
     reports = [];
     results = new Map();
@@ -21,11 +21,11 @@ export class TeamVerificationStore {
     failed = false;
     closing;
     active = new Set();
-    constructor(file, lock, lockPath, checks) {
+    constructor(file, lock, checks, executionFor) {
         this.file = file;
         this.lock = lock;
-        this.lockPath = lockPath;
         this.checks = checks;
+        this.executionFor = executionFor;
     }
     static async open(options) {
         const checks = parseTeamChecks(options.checks ?? []);
@@ -33,12 +33,9 @@ export class TeamVerificationStore {
         if ((await lstat(options.directory)).isSymbolicLink())
             throw new Error("Verification directory must not be a symbolic link");
         const path = join(await realpath(options.directory), "verification.jsonl");
-        const lockPath = `${path}.lock`;
-        const lock = await acquireFileLock(lockPath);
+        const lock = await acquireFileLock(`${path}.lock`);
         let file;
         try {
-            await lock.writeFile(JSON.stringify({ pid: process.pid }));
-            await lock.sync();
             await rejectLinkIfPresent(path);
             file = await open(path, constants.O_CREAT | constants.O_APPEND | constants.O_RDWR | noFollow(), 0o600);
             const { entries, committed, size } = await readJournal(file);
@@ -53,26 +50,38 @@ export class TeamVerificationStore {
                     await repair.close();
                 }
             }
-            const store = new TeamVerificationStore(file, lock, lockPath, checks);
+            const store = new TeamVerificationStore(file, lock, checks, options.executionFor);
             store.size = committed;
             for (const entry of entries) {
                 store.apply(entry.event);
                 store.sequence = entry.sequence;
             }
-            if (entries.length && !isDeepStrictEqual(entries[0].event.checks, checks))
+            if (entries.length &&
+                !isDeepStrictEqual(entries[0].event.checks, checks))
                 throw new Error("Verification checks changed on resume");
             if (!entries.length)
                 await store.append({ type: "config", checks });
             // No command, test, or other effect is replayed during recovery.
             for (const result of store.results.values())
                 if (result.status === "pending") {
-                    await store.append({ type: "check", result: { ...result, status: "unknown", detail: "Interrupted check; inspect effects and reconcile before a new command." } });
+                    await store.append({
+                        type: "check",
+                        result: {
+                            ...result,
+                            status: "unknown",
+                            detail: "Interrupted check; inspect effects and reconcile before a new command.",
+                        },
+                    });
                 }
             return store;
         }
         catch (error) {
-            await file?.close().catch(() => undefined);
-            await releaseFileLock(lock, lockPath);
+            try {
+                await file?.close();
+            }
+            finally {
+                await lock.release();
+            }
             throw error;
         }
     }
@@ -85,7 +94,7 @@ export class TeamVerificationStore {
             file = await open(path, constants.O_RDONLY | noFollow());
         }
         catch (error) {
-            if (isMissing(error))
+            if (hasErrorCode(error, "ENOENT"))
                 return { reports: [], checks: [] };
             throw error;
         }
@@ -105,7 +114,12 @@ export class TeamVerificationStore {
             await file.close();
         }
     }
-    snapshot() { return this.serial.run(() => { this.assertOpen(); return structuredClone({ reports: this.reports, checks: [...this.results.values()] }); }); }
+    snapshot() {
+        return this.serial.run(() => {
+            this.assertOpen();
+            return structuredClone({ reports: this.reports, checks: [...this.results.values()] });
+        });
+    }
     forTask(execution, workspace, options = {}) {
         const identity = taskIdentity(execution);
         const submit = (commandId, report) => this.submit(identity, commandId, report, workspace);
@@ -115,23 +129,75 @@ export class TeamVerificationStore {
                 throw new Error("Check is not configured for this task");
             return this.runCheck(commandId, spec, workspace, { ...options, ...extra, execution });
         };
-        const tools = () => [{
-                name: "submit_report", permissionVersion: "team-verification-v1",
+        const tools = () => [
+            {
+                name: "submit_report",
+                permissionVersion: "team-verification-v1",
                 description: "Store a structured report and file/line evidence. The host validates evidence bytes, not claim correctness. This never grants acceptance.",
-                inputSchema: { type: "object", additionalProperties: false, required: ["summary", "claims"], properties: {
-                        summary: { type: "string" }, claims: { type: "array", items: { type: "object", additionalProperties: false, required: ["text", "kind"], properties: {
-                                    text: { type: "string" }, kind: { type: "string", enum: ["finding", "proposal"] }, evidence: { type: "array", items: { type: "object", additionalProperties: false, required: ["path", "startLine", "endLine"], properties: { path: { type: "string" }, startLine: { type: "integer" }, endLine: { type: "integer" }, quote: { type: "string" } } } },
-                                } } },
-                    } },
+                inputSchema: {
+                    type: "object",
+                    additionalProperties: false,
+                    required: ["summary", "claims"],
+                    properties: {
+                        summary: { type: "string" },
+                        claims: {
+                            type: "array",
+                            items: {
+                                type: "object",
+                                additionalProperties: false,
+                                required: ["text", "kind"],
+                                properties: {
+                                    text: { type: "string" },
+                                    kind: { type: "string", enum: ["finding", "proposal"] },
+                                    evidence: {
+                                        type: "array",
+                                        items: {
+                                            type: "object",
+                                            additionalProperties: false,
+                                            required: ["path", "startLine", "endLine"],
+                                            properties: {
+                                                path: { type: "string" },
+                                                startLine: { type: "integer" },
+                                                endLine: { type: "integer" },
+                                                quote: { type: "string" },
+                                            },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
+                },
                 parse: parseTeamReport,
-                async execute(input, call) { call.signal.throwIfAborted(); return submit(hash(call.idempotencyKey), input); },
-            }, {
-                name: "run_check", permissionVersion: "team-verification-v1",
-                description: `Run one exact host-configured check by id; no model-supplied commands or arguments. Available: ${this.checks.filter((entry) => entry.taskId === identity.taskId).map((entry) => entry.id).join(", ") || "none"}. Command checks require explicit host authorization and are not sandboxed.`,
-                inputSchema: { type: "object", additionalProperties: false, required: ["id"], properties: { id: { type: "string" } } },
-                parse(value) { const input = fields(value, ["id"]); identifier(input.id, "check id"); return { id: input.id }; },
-                async execute(input, call) { call.signal.throwIfAborted(); return runCheck(hash(call.idempotencyKey), input.id, { signal: call.signal }); },
-            }];
+                async execute(input, call) {
+                    call.signal.throwIfAborted();
+                    return submit(hash(call.idempotencyKey), input);
+                },
+            },
+            {
+                name: "run_check",
+                permissionVersion: "team-verification-v1",
+                description: `Run one exact host-configured check by id; no model-supplied commands or arguments. Available: ${this.checks
+                    .filter((entry) => entry.taskId === identity.taskId)
+                    .map((entry) => entry.id)
+                    .join(", ") || "none"}. Command checks require explicit host authorization and are not sandboxed.`,
+                inputSchema: {
+                    type: "object",
+                    additionalProperties: false,
+                    required: ["id"],
+                    properties: { id: { type: "string" } },
+                },
+                parse(value) {
+                    const input = fields(value, ["id"]);
+                    identifier(input.id, "check id");
+                    return { id: input.id };
+                },
+                async execute(input, call) {
+                    call.signal.throwIfAborted();
+                    return runCheck(hash(call.idempotencyKey), input.id, { signal: call.signal });
+                },
+            },
+        ];
         return { submit, runCheck, tools };
     }
     runCheck(commandId, input, workspace, options = {}) {
@@ -166,34 +232,56 @@ export class TeamVerificationStore {
         const fingerprint = await workspaceFingerprint(workspace);
         const state = await this.snapshot();
         const identity = execution ? taskIdentity(execution) : undefined;
-        const report = state.reports.filter((entry) => entry.taskId === taskId && (!identity || sameIdentity(entry, identity))).at(-1);
-        const checks = this.checks.filter((spec) => spec.taskId === taskId).map((spec) => {
-            const result = state.checks.filter((entry) => entry.spec.id === spec.id && (!identity || entry.dispatchId === undefined || sameIdentity(entry, identity))).at(-1);
+        const report = state.reports
+            .filter((entry) => entry.taskId === taskId && (!identity || sameIdentity(entry, identity)))
+            .at(-1);
+        const checks = this.checks
+            .filter((spec) => spec.taskId === taskId)
+            .map((spec) => {
+            const result = state.checks
+                .filter((entry) => entry.spec.id === spec.id &&
+                (!identity || entry.dispatchId === undefined || sameIdentity(entry, identity)))
+                .at(-1);
             if (!result)
                 return { id: spec.id, status: "missing" };
             const stale = result.workspaceFingerprint !== fingerprint || result.afterFingerprint !== fingerprint;
-            return { id: spec.id, status: stale && !["pending", "unknown"].includes(result.status) ? "stale" : result.status, commandId: result.commandId, ...(result.detail ? { detail: result.detail } : {}) };
+            return {
+                id: spec.id,
+                status: stale && !["pending", "unknown"].includes(result.status) ? "stale" : result.status,
+                commandId: result.commandId,
+                ...(result.detail ? { detail: result.detail } : {}),
+            };
         });
         const currentReport = report?.workspaceFingerprint === fingerprint;
         const badEvidence = currentReport && report.evidence.some((item) => !item.valid);
-        const status = badEvidence || checks.some((item) => item.status === "failed" || item.status === "cancelled") ? "failed"
-            : currentReport && checks.length > 0 && checks.every((item) => item.status === "passed") ? "passed" : "unverified";
-        return { status, workspaceFingerprint: fingerprint, checks, ...(report ? { report } : {}),
-            detail: status === "passed" ? "Configured checks passed for these exact workspace bytes. Evidence locations are valid; claim logic and untested behavior remain unverified."
-                : status === "failed" ? "A configured check or submitted evidence failed. Execution completion does not imply acceptance."
-                    : "A current structured report and all configured checks are required. Missing, stale, interrupted, or absent checks cannot grant acceptance." };
+        const status = badEvidence || checks.some((item) => item.status === "failed" || item.status === "cancelled")
+            ? "failed"
+            : currentReport && checks.length > 0 && checks.every((item) => item.status === "passed")
+                ? "passed"
+                : "unverified";
+        return {
+            status,
+            workspaceFingerprint: fingerprint,
+            checks,
+            ...(report ? { report } : {}),
+            detail: status === "passed"
+                ? "Configured checks passed for these exact workspace bytes. Evidence locations are valid; claim logic and untested behavior remain unverified."
+                : status === "failed"
+                    ? "A configured check or submitted evidence failed. Execution completion does not imply acceptance."
+                    : "A current structured report and all configured checks are required. Missing, stale, interrupted, or absent checks cannot grant acceptance.",
+        };
     }
     close() {
-        return this.closing ??= (async () => {
+        return (this.closing ??= (async () => {
             await Promise.allSettled([...this.active]);
             await this.serial.close();
             try {
                 await this.file.close();
             }
             finally {
-                await releaseFileLock(this.lock, this.lockPath);
+                await this.lock.release();
             }
-        })();
+        })());
     }
     async submit(identity, commandId, input, workspace) {
         identifier(commandId, "report command id");
@@ -218,15 +306,28 @@ export class TeamVerificationStore {
                         if (lines.at(-1) === "")
                             lines.pop();
                         const excerpt = lines.slice(item.startLine - 1, item.endLine).join("\n");
-                        const valid = item.endLine <= lines.length && (item.quote === undefined || excerpt.includes(item.quote.replace(/\r\n/gu, "\n")));
-                        evidence.push({ path: item.path, startLine: item.startLine, endLine: item.endLine, sha256: hash(bytes), valid,
-                            ...(!valid ? { detail: "Line range or quote does not match the file" } : {}) });
+                        const valid = item.endLine <= lines.length &&
+                            (item.quote === undefined || excerpt.includes(item.quote.replace(/\r\n/gu, "\n")));
+                        evidence.push({
+                            path: item.path,
+                            startLine: item.startLine,
+                            endLine: item.endLine,
+                            sha256: hash(bytes),
+                            valid,
+                            ...(!valid ? { detail: "Line range or quote does not match the file" } : {}),
+                        });
                     }
                     catch (error) {
-                        evidence.push({ path: item.path, startLine: item.startLine, endLine: item.endLine, valid: false, detail: message(error) });
+                        evidence.push({
+                            path: item.path,
+                            startLine: item.startLine,
+                            endLine: item.endLine,
+                            valid: false,
+                            detail: message(error),
+                        });
                     }
                 }
-            if (await workspaceFingerprint(workspace) !== fingerprint)
+            if ((await workspaceFingerprint(workspace)) !== fingerprint)
                 throw new Error("Workspace changed while validating report evidence");
             const stored = { ...identity, commandId, report, workspaceFingerprint: fingerprint, evidence };
             await this.write({ type: "report", report: stored });
@@ -258,7 +359,13 @@ export class TeamVerificationStore {
             if (spec.type === "command" && options.allowCommands !== true)
                 throw new Error("Command checks require explicit --allow-checks authorization");
             options.signal?.throwIfAborted();
-            const result = { ...identity, commandId, spec, workspaceFingerprint: await workspaceFingerprint(workspace), status: "pending" };
+            const result = {
+                ...identity,
+                commandId,
+                spec,
+                workspaceFingerprint: await workspaceFingerprint(workspace),
+                status: "pending",
+            };
             await this.write({ type: "check", result });
             fresh = true;
             return result;
@@ -268,12 +375,15 @@ export class TeamVerificationStore {
         let outcome;
         try {
             if (spec.type === "command")
-                outcome = await runCommand(spec, workspace, options.signal);
+                outcome = await runCommand(spec, workspace, options.signal, this.executionFor);
             else {
                 options.signal?.throwIfAborted();
                 const bytes = await readWorkspaceFile(workspace, spec.path);
                 const passed = spec.type === "file-sha256" ? hash(bytes) === spec.sha256 : bytes.toString("utf8").includes(spec.text);
-                outcome = { status: passed ? "passed" : "failed", detail: passed ? "Exact configured file check passed" : "Configured file predicate did not match" };
+                outcome = {
+                    status: passed ? "passed" : "failed",
+                    detail: passed ? "Exact configured file check passed" : "Configured file predicate did not match",
+                };
             }
         }
         catch (error) {
@@ -284,13 +394,19 @@ export class TeamVerificationStore {
             afterFingerprint = await workspaceFingerprint(workspace);
         }
         catch (error) {
-            outcome = { ...outcome, status: spec.type === "command" ? "unknown" : "failed", detail: `Cannot inspect workspace after check: ${message(error)}` };
+            outcome = {
+                ...outcome,
+                status: spec.type === "command" ? "unknown" : "failed",
+                detail: `Cannot inspect workspace after check: ${message(error)}`,
+            };
         }
         const result = { ...pending, ...outcome, ...(afterFingerprint ? { afterFingerprint } : {}) };
         await this.append({ type: "check", result });
         return structuredClone(result);
     }
-    append(event) { return this.serial.run(() => this.write(event)); }
+    append(event) {
+        return this.serial.run(() => this.write(event));
+    }
     async write(event) {
         this.assertOpen();
         const line = `${JSON.stringify({ sequence: this.sequence + 1, event })}\n`;
@@ -315,11 +431,24 @@ export class TeamVerificationStore {
         if (event.type === "check")
             this.results.set(event.result.commandId, event.result);
     }
-    assertOpen() { if (this.failed)
-        throw new Error("Verification write outcome unknown; close and inspect before continuing"); }
+    assertOpen() {
+        if (this.failed)
+            throw new Error("Verification write outcome unknown; close and inspect before continuing");
+    }
 }
 export function parseTeamCheck(value) {
-    const raw = fields(value, ["id", "taskId", "type", "path", "text", "sha256", "command", "args", "timeoutMs", "maxOutputBytes"]);
+    const raw = fields(value, [
+        "id",
+        "taskId",
+        "type",
+        "path",
+        "text",
+        "sha256",
+        "command",
+        "args",
+        "timeoutMs",
+        "maxOutputBytes",
+    ]);
     identifier(raw.id, "check id");
     identifier(raw.taskId, "check taskId");
     if (raw.type === "file-contains") {
@@ -336,7 +465,10 @@ export function parseTeamCheck(value) {
     else if (raw.type === "command") {
         fields(raw, ["id", "taskId", "type", "command", "args", "timeoutMs", "maxOutputBytes"]);
         boundedString(raw.command, "check command", 4096);
-        if (/[\u0000\r\n]/u.test(raw.command) || !Array.isArray(raw.args) || raw.args.length > 64 || raw.args.some((arg) => typeof arg !== "string" || arg.length > 8192 || arg.includes("\0")))
+        if (/[\u0000\r\n]/u.test(raw.command) ||
+            !Array.isArray(raw.args) ||
+            raw.args.length > 64 ||
+            raw.args.some((arg) => typeof arg !== "string" || arg.length > 8192 || arg.includes("\0")))
             throw new Error("Invalid check command arguments");
         if (raw.timeoutMs !== undefined)
             integer(raw.timeoutMs, 1, 120000, "check timeoutMs");
@@ -455,39 +587,78 @@ async function readWorkspaceFile(directory, path) {
         await file.close();
     }
 }
-async function runCommand(spec, workspace, signal) {
+async function runCommand(spec, workspace, signal, executionFor) {
+    const environment = executionFor
+        ? await executionFor(workspace)
+        : await openCodingExecutionEnvironment({ workspace, isolation: { mode: "host" } });
+    try {
+        return await runEnvironmentCommand(spec, workspace, environment, signal);
+    }
+    finally {
+        if (!executionFor)
+            await environment.close();
+    }
+}
+async function runEnvironmentCommand(spec, workspace, environment, signal) {
     signal?.throwIfAborted();
     if (process.platform === "win32" && /\.(?:cmd|bat)$/iu.test(spec.command))
-        return { status: "failed", detail: "Command checks execute native programs directly. Use node.exe with the package manager JavaScript entry point, not .cmd/.bat." };
+        return {
+            status: "failed",
+            detail: "Command checks execute native programs directly. Use node.exe with the package manager JavaScript entry point, not .cmd/.bat.",
+        };
     const cwd = await realpath(workspace);
     const env = {};
     // No inherited API keys, proxy tokens, NODE_OPTIONS, package hooks, or user home config.
-    for (const key of ["PATH", "Path", "PATHEXT", "SystemRoot", "WINDIR", "COMSPEC", "TEMP", "TMP", "TMPDIR", "LANG", "LC_ALL"])
-        if (process.env[key] !== undefined)
+    for (const key of [
+        "PATH",
+        "Path",
+        "PATHEXT",
+        "SystemRoot",
+        "WINDIR",
+        "COMSPEC",
+        "TEMP",
+        "TMP",
+        "TMPDIR",
+        "LANG",
+        "LC_ALL",
+    ])
+        if (environment.isolation.mode === "host" && process.env[key] !== undefined)
             env[key] = process.env[key];
     env.CI = "1";
-    return new Promise((resolveResult) => {
+    return new Promise((resolveResult, rejectResult) => {
+        const cancellation = new AbortController();
         let output = Buffer.alloc(0);
         let reason;
         let settled = false;
-        const child = spawn(spec.command, [...spec.args], { cwd, env, shell: false, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+        const child = environment.spawn(spec.command, spec.args, {
+            cwd,
+            env,
+            signal: cancellation.signal,
+        });
+        const stdout = child.stdout;
+        const stderr = child.stderr;
+        if (!stdout || !stderr) {
+            rejectResult(new Error("Execution environment must provide command output pipes"));
+            return;
+        }
         const finish = (status, exitCode, detail) => {
             if (settled)
                 return;
             settled = true;
             clearTimeout(timer);
-            clearTimeout(killWait);
             signal?.removeEventListener("abort", abort);
-            resolveResult({ status, ...(exitCode !== undefined ? { exitCode } : {}), ...(detail ? { detail } : {}), output: boundedOutput(output, spec.maxOutputBytes ?? 65536) });
+            resolveResult({
+                status,
+                ...(exitCode !== undefined ? { exitCode } : {}),
+                ...(detail ? { detail } : {}),
+                output: boundedOutput(output, spec.maxOutputBytes ?? 65536),
+            });
         };
-        let killWait;
         const stop = (detail) => {
             if (reason)
                 return;
             reason = detail;
-            child.kill("SIGKILL");
-            // A descendant may retain inherited pipes. No process-tree or OS isolation guarantee.
-            killWait = setTimeout(() => { child.stdout.destroy(); child.stderr.destroy(); finish("unknown", undefined, `${detail}; child effects require inspection`); }, 1000);
+            cancellation.abort();
         };
         const abort = () => stop("Check interrupted");
         const timer = setTimeout(() => stop("Check timed out"), spec.timeoutMs ?? 30000);
@@ -500,8 +671,8 @@ async function runCommand(spec, workspace, signal) {
             else
                 output = Buffer.concat([output, chunk]);
         };
-        child.stdout.on("data", collect);
-        child.stderr.on("data", collect);
+        stdout.on("data", collect);
+        stderr.on("data", collect);
         child.on("error", (error) => finish(child.pid === undefined ? "failed" : "unknown", undefined, message(error)));
         child.on("close", (code, terminationSignal) => {
             if (reason || terminationSignal || code === null)
@@ -561,7 +732,8 @@ async function readJournal(file) {
             const result = event.result;
             parseTeamCheck(result.spec);
             validateStored(result);
-            if (!isDeepStrictEqual(specs.find((entry) => entry.id === result.spec.id), result.spec) || result.taskId !== result.spec.taskId ||
+            if (!isDeepStrictEqual(specs.find((entry) => entry.id === result.spec.id), result.spec) ||
+                result.taskId !== result.spec.taskId ||
                 !["pending", "passed", "failed", "unknown", "cancelled"].includes(result.status) ||
                 (result.afterFingerprint !== undefined && !/^[a-f0-9]{64}$/u.test(result.afterFingerprint)))
                 throw new Error("Invalid check record");
@@ -571,8 +743,11 @@ async function readJournal(file) {
                     throw new Error("Check result has no pending intent");
             }
             else {
-                if (!sameIdentity(old, result) || !isDeepStrictEqual(old.spec, result.spec) || old.workspaceFingerprint !== result.workspaceFingerprint ||
-                    (old.status !== "pending" && old.status !== "unknown") || result.status === "pending" ||
+                if (!sameIdentity(old, result) ||
+                    !isDeepStrictEqual(old.spec, result.spec) ||
+                    old.workspaceFingerprint !== result.workspaceFingerprint ||
+                    (old.status !== "pending" && old.status !== "unknown") ||
+                    result.status === "pending" ||
                     (old.status === "unknown" && (!["failed", "cancelled"].includes(result.status) || !result.reconciliation)))
                     throw new Error("Invalid check history transition");
             }
@@ -591,37 +766,65 @@ function validateStored(value) {
         throw new Error("Invalid stored workspace fingerprint");
 }
 function taskIdentity(execution) {
-    return { taskId: execution.task.id, coordinationId: execution.coordinationId, dispatchId: execution.task.dispatchId, turn: execution.task.turn ?? 0 };
+    return {
+        taskId: execution.task.id,
+        coordinationId: execution.coordinationId,
+        dispatchId: execution.task.dispatchId,
+        turn: execution.task.turn ?? 0,
+    };
+}
+function sameIdentity(a, b) {
+    return (a.taskId === b.taskId && a.coordinationId === b.coordinationId && a.dispatchId === b.dispatchId && a.turn === b.turn);
 }
-function sameIdentity(a, b) { return a.taskId === b.taskId && a.coordinationId === b.coordinationId && a.dispatchId === b.dispatchId && a.turn === b.turn; }
 function fields(value, allowed) {
-    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !allowed.includes(key)))
+    if (!value ||
+        typeof value !== "object" ||
+        Array.isArray(value) ||
+        Object.keys(value).some((key) => !allowed.includes(key)))
         throw new Error("Invalid verification fields");
     return value;
 }
-function identifier(value, label) { if (typeof value !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,255}$/u.test(value))
-    throw new Error(`Invalid ${label}`); }
-function boundedString(value, label, max) { if (typeof value !== "string" || value.length < 1 || Buffer.byteLength(value) > max || value.includes("\0"))
-    throw new Error(`Invalid ${label}`); }
-function integer(value, min, max, label) { if (!Number.isSafeInteger(value) || value < min || value > max)
-    throw new Error(`Invalid ${label}`); }
+function identifier(value, label) {
+    if (typeof value !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,255}$/u.test(value))
+        throw new Error(`Invalid ${label}`);
+}
+function boundedString(value, label, max) {
+    if (typeof value !== "string" || value.length < 1 || Buffer.byteLength(value) > max || value.includes("\0"))
+        throw new Error(`Invalid ${label}`);
+}
+function integer(value, min, max, label) {
+    if (!Number.isSafeInteger(value) || value < min || value > max)
+        throw new Error(`Invalid ${label}`);
+}
 function safeRelative(value) {
     boundedString(value, "workspace relative path", 2048);
-    if (isAbsolute(value) || /[:\u0000-\u001f]/u.test(value) || value.replace(/\\/gu, "/").split("/").some((part) => !part || part === "." || part === ".."))
+    if (isAbsolute(value) ||
+        /[:\u0000-\u001f]/u.test(value) ||
+        value
+            .replace(/\\/gu, "/")
+            .split("/")
+            .some((part) => !part || part === "." || part === ".."))
         throw new Error("Unsafe workspace relative path");
 }
-async function rejectLinkIfPresent(path) { try {
-    if ((await lstat(path)).isSymbolicLink())
-        throw new Error("Verification file must not be a symbolic link");
+async function rejectLinkIfPresent(path) {
+    try {
+        if ((await lstat(path)).isSymbolicLink())
+            throw new Error("Verification file must not be a symbolic link");
+    }
+    catch (error) {
+        if (!hasErrorCode(error, "ENOENT"))
+            throw error;
+    }
+}
+function noFollow() {
+    return process.platform === "win32" ? 0 : constants.O_NOFOLLOW;
+}
+function hash(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function message(error) {
+    return (error instanceof Error ? error.message : String(error)).slice(0, 2048);
 }
-catch (error) {
-    if (!isMissing(error))
-        throw error;
-} }
-function isMissing(error) { return error instanceof Error && "code" in error && error.code === "ENOENT"; }
-function noFollow() { return process.platform === "win32" ? 0 : constants.O_NOFOLLOW; }
-function hash(value) { return createHash("sha256").update(value).digest("hex"); }
-function message(error) { return (error instanceof Error ? error.message : String(error)).slice(0, 2048); }
 function boundedOutput(bytes, limit) {
     const text = bytes.toString("utf8");
     if (Buffer.byteLength(text) <= limit)