@zq-silk/yui 0.2.0 → 0.4.2

package/dist/executor/codexConfigConflict.js

@@ -0,0 +1,290 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { parse } from "smol-toml";
+/**
+ * Inspects the local, file-backed Codex configuration layers supported by Yui
+ * that can conflict with launch-owned settings. Remote and platform-managed
+ * layers are outside this compatibility boundary. Project files are considered
+ * only when the directory, project root, or project root is trusted.
+ */
+export function inspectCodexDeveloperInstructions(input) {
+    return inspectCodexConfigKeys(input, ["developer_instructions"])
+        .developerInstructions;
+}
+export function inspectCodexLaunchConfig(input) {
+    return inspectCodexConfigKeys(input, ["developer_instructions", "notify"]);
+}
+function inspectCodexConfigKeys(input, keys) {
+    const environment = input.environment ?? process.env;
+    const home = codexHome(environment);
+    const systemPath = checkedAbsolutePath(input.systemConfigPath ?? "/etc/codex/config.toml", "Codex system config path");
+    const managedPath = checkedAbsolutePath(input.managedConfigPath ?? "/etc/codex/managed_config.toml", "Codex managed config path");
+    const userPath = join(home, "config.toml");
+    const profilePath = input.profile === undefined
+        ? undefined
+        : profileConfigPath(home, input.profile);
+    const discoveryPaths = [
+        systemPath,
+        userPath,
+        ...(profilePath === undefined ? [] : [profilePath])
+    ];
+    const basePaths = [...discoveryPaths, managedPath];
+    const contentsByPath = new Map(basePaths.map((path) => [path, readOptionalConfig(path)]));
+    // Managed policy is applied after project configuration by Codex and cannot
+    // decide whether project configuration is discoverable.
+    const discovery = effectiveProjectDiscovery(discoveryPaths.flatMap((path) => {
+        const contents = contentsByPath.get(path);
+        if (contents === null || contents === undefined)
+            return [];
+        try {
+            return [inspectProjectDiscovery(contents)];
+        }
+        catch (error) {
+            throw unreliableInspection(path, error);
+        }
+    }));
+    const projectPaths = projectConfigPaths(input.workspace, input.trustWorkspace === true
+        ? withExactWorkspaceTrust(discovery, input.workspace)
+        : discovery);
+    const candidates = [
+        ...discoveryPaths.map((path) => ({ path, keys })),
+        ...projectPaths.map((path) => ({
+            path,
+            keys: keys.filter((key) => key === "developer_instructions")
+        })),
+        { path: managedPath, keys }
+    ];
+    let developerInstructions = { status: "absent" };
+    let notify = { status: "absent" };
+    for (const candidate of candidates) {
+        const contents = contentsByPath.has(candidate.path)
+            ? contentsByPath.get(candidate.path)
+            : readOptionalConfig(candidate.path);
+        if (contents === null)
+            continue;
+        let configured;
+        try {
+            configured = inspectConfigContents(contents, candidate.keys);
+        }
+        catch (error) {
+            throw unreliableInspection(candidate.path, error);
+        }
+        if (developerInstructions.status === "absent"
+            && configured.has("developer_instructions")) {
+            developerInstructions = { status: "configured", source: candidate.path };
+        }
+        if (notify.status === "absent" && configured.has("notify")) {
+            notify = { status: "configured", source: candidate.path };
+        }
+    }
+    return { developerInstructions, notify };
+}
+function withExactWorkspaceTrust(discovery, workspace) {
+    return {
+        ...discovery,
+        trust: new Map([...discovery.trust, [resolve(workspace), "trusted"]])
+    };
+}
+function effectiveProjectDiscovery(layers) {
+    let rootMarkers;
+    const trust = new Map();
+    for (const layer of layers) {
+        if (layer.rootMarkers !== undefined)
+            rootMarkers = layer.rootMarkers;
+        for (const [path, value] of layer.trust)
+            trust.set(path, value);
+    }
+    return { rootMarkers, trust };
+}
+function projectConfigPaths(workspace, discovery) {
+    const start = resolve(workspace);
+    const projectRoot = findProjectRoot(start, discovery.rootMarkers ?? [".git"]);
+    let repositoryRoot;
+    let repositoryRootResolved = false;
+    const getRepositoryRoot = () => {
+        if (!repositoryRootResolved) {
+            repositoryRoot = resolveRepositoryRootForTrust(start);
+            repositoryRootResolved = true;
+        }
+        return repositoryRoot;
+    };
+    const paths = [];
+    let current = start;
+    while (true) {
+        const configPath = join(current, ".codex", "config.toml");
+        if (existsSync(configPath)
+            &&
+                trustForDirectory(current, projectRoot, getRepositoryRoot, discovery.trust)
+                    === "trusted") {
+            paths.push(configPath);
+        }
+        if (samePath(current, projectRoot))
+            break;
+        const parent = dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return paths.reverse();
+}
+function findProjectRoot(start, markers) {
+    // Native Codex treats an explicitly empty marker list as "current directory".
+    if (markers.length === 0)
+        return start;
+    let current = start;
+    while (true) {
+        if (markers.some((marker) => existsSync(isAbsolute(marker) ? marker : `${current}${sep}${marker}`))) {
+            return current;
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return start;
+        current = parent;
+    }
+}
+function trustForDirectory(directory, projectRoot, repositoryRoot, configured) {
+    for (const candidate of [directory, projectRoot]) {
+        const value = exactTrust(candidate, configured);
+        if (value !== undefined)
+            return value;
+    }
+    for (const candidate of [repositoryRoot()]) {
+        if (candidate === undefined)
+            continue;
+        const value = exactTrust(candidate, configured);
+        if (value !== undefined)
+            return value;
+    }
+    return undefined;
+}
+function exactTrust(directory, configured) {
+    const lexical = resolve(directory);
+    const canonical = canonicalPath(lexical);
+    for (const [path, value] of configured) {
+        const configuredLexical = resolve(path);
+        if (samePath(configuredLexical, lexical)
+            || samePath(canonicalPath(configuredLexical), canonical)) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function resolveRepositoryRootForTrust(workspace) {
+    const result = spawnSync("git", ["-C", workspace, "rev-parse", "--path-format=absolute", "--git-common-dir"], { encoding: "utf8", timeout: 1_000, windowsHide: true });
+    if (result.status !== 0 || result.error !== undefined)
+        return undefined;
+    const commonDirectory = result.stdout.trim();
+    if (!isAbsolute(commonDirectory) || commonDirectory.includes("\0"))
+        return undefined;
+    const normalized = resolve(commonDirectory);
+    return basename(normalized) === ".git" ? dirname(normalized) : undefined;
+}
+function inspectProjectDiscovery(contents) {
+    const table = parseConfig(contents);
+    const rootMarkers = parseRootMarkers(table.project_root_markers);
+    const trust = new Map();
+    const projects = table.projects;
+    if (projects !== undefined) {
+        if (!isTable(projects)) {
+            throw new Error("projects must be a TOML table");
+        }
+        for (const [path, project] of Object.entries(projects)) {
+            if (!isAbsolute(path) || path.includes("\0")) {
+                throw new Error("project trust path is not absolute");
+            }
+            if (!isTable(project)) {
+                throw new Error("project trust entry must be a TOML table");
+            }
+            const level = project.trust_level;
+            if (level === "trusted" || level === "untrusted")
+                trust.set(path, level);
+            else if (level !== undefined) {
+                throw new Error("project trust_level must be trusted or untrusted");
+            }
+        }
+    }
+    return {
+        ...(rootMarkers === undefined ? {} : { rootMarkers }),
+        trust
+    };
+}
+function parseRootMarkers(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.some((marker) => typeof marker !== "string")) {
+        throw new Error("project_root_markers must be an array of strings");
+    }
+    if (value.some((marker) => marker.includes("\0"))) {
+        throw new Error("project_root_markers cannot contain NUL bytes");
+    }
+    return value;
+}
+function inspectConfigContents(contents, keys) {
+    const table = parseConfig(contents);
+    return new Set(keys.filter((key) => Object.hasOwn(table, key)));
+}
+function parseConfig(contents) {
+    try {
+        return parse(contents);
+    }
+    catch (error) {
+        throw new Error(`ambiguous or invalid TOML: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function isTable(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function checkedAbsolutePath(path, label) {
+    if (path.includes("\0") || resolve(path) !== path) {
+        throw new Error(`${label} must be an absolute normalized path.`);
+    }
+    return path;
+}
+function codexHome(environment) {
+    const configured = environment.CODEX_HOME?.trim();
+    const launchHome = environment.HOME?.trim();
+    if (configured?.includes("\0"))
+        throw new Error("CODEX_HOME cannot contain NUL bytes.");
+    if (launchHome?.includes("\0"))
+        throw new Error("HOME cannot contain NUL bytes.");
+    return resolve(configured === undefined || configured.length === 0
+        ? join(launchHome === undefined || launchHome.length === 0 ? homedir() : launchHome, ".codex")
+        : configured);
+}
+function profileConfigPath(home, profile) {
+    const name = profile.trim();
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/u.test(name)) {
+        throw new Error(`Codex profile must be a plain name before its config can be inspected: ${profile}.`);
+    }
+    return join(home, `${name}.config.toml`);
+}
+function readOptionalConfig(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return null;
+        throw new Error(`Codex config could not be inspected: ${path}: `
+            + `${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function unreliableInspection(path, error) {
+    return new Error(`Codex launch config could not be inspected reliably: ${path}: `
+        + `${error instanceof Error ? error.message : String(error)}`);
+}
+function canonicalPath(path) {
+    try {
+        return realpathSync.native(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+function samePath(left, right) {
+    return process.platform === "win32"
+        ? left.toLowerCase() === right.toLowerCase()
+        : left === right;
+}

package/dist/executor/effectiveLaunch.js

@@ -0,0 +1,340 @@
+import { isDeepStrictEqual } from "node:util";
+import { resolveAgentAdapter } from "./agentAdapter.js";
+export function resolveEffectiveLaunch(input) {
+    validateDesiredRole(input.role);
+    const binding = input.role.agentBindings[input.role.activeAgentId];
+    const workspace = snapshotWorkspace(input.role.workspace, input.workspace);
+    const writeProjectIds = effectiveWriteProjects(input, workspace);
+    const config = resolveAgentAdapter(binding.adapterId).canonicalizeConfig(clone(binding.config));
+    return snapshotFromConfig({
+        sourceDesiredRevision: input.role.launchRevision,
+        agentId: binding.agentId,
+        config,
+        profileAccess: input.role.defaultAccess,
+        writeProjectIds,
+        workspace,
+        context: snapshotContext(input.role),
+        ...(input.purpose === "review"
+            ? {
+                reviewRoundId: identity(input.reviewRoundId ?? "", "ReviewRound id"),
+                reviewBaseCommit: commit(input.reviewBaseCommit ?? "", "Review base commit")
+            }
+            : {})
+    });
+}
+export function effectiveLaunchConfig(snapshot) {
+    validateEffectiveLaunchSnapshot(snapshot);
+    return effectiveLaunchConfigUnchecked(snapshot);
+}
+function codexConfigFromSnapshot(snapshot) {
+    return {
+        adapterId: "codex",
+        ...(snapshot.model === undefined ? {} : { model: snapshot.model }),
+        ...(snapshot.effort === undefined ? {} : { effort: snapshot.effort }),
+        permission: clone(snapshot.permission),
+        ...(snapshot.additionalDirectories === undefined
+            ? {}
+            : { additionalDirectories: [...snapshot.additionalDirectories] }),
+        ...(snapshot.advanced === undefined
+            ? {}
+            : { advanced: clone(snapshot.advanced) }),
+        ...(snapshot.search ? { search: true } : {}),
+        ...(snapshot.profile === undefined ? {} : { profile: snapshot.profile })
+    };
+}
+function claudeConfigFromSnapshot(snapshot) {
+    return {
+        adapterId: "claude",
+        ...(snapshot.model === undefined ? {} : { model: snapshot.model }),
+        ...(snapshot.effort === undefined ? {} : { effort: snapshot.effort }),
+        permission: clone(snapshot.permission),
+        ...(snapshot.additionalDirectories === undefined
+            ? {}
+            : { additionalDirectories: [...snapshot.additionalDirectories] }),
+        ...(snapshot.advanced === undefined
+            ? {}
+            : { advanced: clone(snapshot.advanced) }),
+        ...(snapshot.settingsFile === undefined
+            ? {}
+            : { settingsFile: snapshot.settingsFile }),
+        ...(snapshot.settingsSources === undefined
+            ? {}
+            : { settingsSources: [...snapshot.settingsSources] })
+    };
+}
+export function effectiveLaunchSnapshotsCompatible(existing, desired) {
+    validateEffectiveLaunchSnapshot(existing);
+    validateEffectiveLaunchSnapshot(desired);
+    const withoutDesiredRevision = (snapshot) => {
+        const { sourceDesiredRevision: _sourceDesiredRevision, ...actual } = snapshot;
+        return actual;
+    };
+    return isDeepStrictEqual(withoutDesiredRevision(existing), withoutDesiredRevision(desired));
+}
+export function validateEffectiveLaunchSnapshot(snapshot) {
+    if (snapshot.schemaVersion !== 2) {
+        throw new Error("Effective launch snapshot must use schemaVersion 2.");
+    }
+    positiveInteger(snapshot.sourceDesiredRevision, "Source desired revision");
+    identity(snapshot.agentId, "Effective Agent id");
+    if (snapshot.profileAccess !== "read" && snapshot.profileAccess !== "write") {
+        throw new Error(`Effective launch Profile access is invalid: ${String(snapshot.profileAccess)}.`);
+    }
+    if (typeof snapshot.search !== "boolean") {
+        throw new Error("Effective launch search flag must be boolean.");
+    }
+    if (snapshot.adapterId === "claude" && snapshot.search) {
+        throw new Error("Claude effective launch cannot enable Codex search.");
+    }
+    const writeProjectIds = uniqueIdentities(snapshot.writeProjectIds, "Effective writable Project");
+    if (!isDeepStrictEqual(writeProjectIds, snapshot.writeProjectIds)) {
+        throw new Error("Effective writable Projects must be unique and sorted.");
+    }
+    if (snapshot.permission === undefined) {
+        throw new Error("Effective launch requires an explicit permission strategy.");
+    }
+    if ((snapshot.reviewRoundId === undefined) !== (snapshot.reviewBaseCommit === undefined)) {
+        throw new Error("Effective Review base is incomplete.");
+    }
+    if (snapshot.reviewRoundId !== undefined && snapshot.reviewBaseCommit !== undefined) {
+        identity(snapshot.reviewRoundId, "Effective ReviewRound id");
+        commit(snapshot.reviewBaseCommit, "Effective review base commit");
+    }
+    validateWorkspace(snapshot.workspace);
+    cloneContext(snapshot.context);
+    const config = effectiveLaunchConfigUnchecked(snapshot);
+    resolveAgentAdapter(snapshot.adapterId).canonicalizeConfig(config);
+    return snapshot;
+}
+export function effectiveRoleForLaunch(role, snapshot) {
+    validateEffectiveLaunchSnapshot(snapshot);
+    const config = effectiveLaunchConfig(snapshot);
+    const binding = {
+        agentId: snapshot.agentId,
+        adapterId: snapshot.adapterId,
+        config
+    };
+    const result = {
+        ...role,
+        ...cloneContext(snapshot.context),
+        activeAgentId: snapshot.agentId,
+        agentBindings: { ...role.agentBindings, [snapshot.agentId]: binding },
+        launchRevision: snapshot.sourceDesiredRevision,
+        defaultAccess: snapshot.profileAccess,
+        workspace: snapshot.workspace.root
+    };
+    clearMissingContext(result, snapshot.context);
+    return result;
+}
+function snapshotFromConfig(input) {
+    const config = clone(input.config);
+    if (config.permission === undefined) {
+        throw new Error("Effective launch requires an explicit permission strategy.");
+    }
+    const review = input.reviewRoundId === undefined
+        ? {}
+        : {
+            reviewRoundId: identity(input.reviewRoundId, "ReviewRound id"),
+            reviewBaseCommit: commit(input.reviewBaseCommit ?? "", "Review base commit")
+        };
+    const common = {
+        schemaVersion: 2,
+        sourceDesiredRevision: positiveInteger(input.sourceDesiredRevision, "Source desired revision"),
+        agentId: identity(input.agentId, "Effective Agent id"),
+        profileAccess: input.profileAccess,
+        ...(config.model === undefined ? {} : { model: config.model }),
+        ...(config.effort === undefined ? {} : { effort: config.effort }),
+        search: config.adapterId === "codex" && config.search === true,
+        ...(config.additionalDirectories === undefined
+            ? {}
+            : { additionalDirectories: [...config.additionalDirectories] }),
+        ...(config.advanced === undefined ? {} : { advanced: clone(config.advanced) }),
+        writeProjectIds: [...input.writeProjectIds],
+        workspace: cloneWorkspace(input.workspace),
+        context: cloneContext(input.context),
+        ...review
+    };
+    const snapshot = config.adapterId === "codex"
+        ? {
+            ...common,
+            adapterId: "codex",
+            permission: clone(config.permission),
+            ...(config.profile === undefined ? {} : { profile: config.profile })
+        }
+        : {
+            ...common,
+            adapterId: "claude",
+            permission: clone(config.permission),
+            ...(config.settingsFile === undefined ? {} : { settingsFile: config.settingsFile }),
+            ...(config.settingsSources === undefined
+                ? {}
+                : { settingsSources: [...config.settingsSources] })
+        };
+    return validateEffectiveLaunchSnapshot(snapshot);
+}
+function effectiveLaunchConfigUnchecked(snapshot) {
+    return snapshot.adapterId === "codex"
+        ? codexConfigFromSnapshot(snapshot)
+        : claudeConfigFromSnapshot(snapshot);
+}
+function effectiveWriteProjects(input, workspace) {
+    if (input.purpose === "review") {
+        if (!("taskId" in input.role)) {
+            throw new Error("Review launch requires a Task Role.");
+        }
+        if (input.reviewRoundId === undefined || input.reviewBaseCommit === undefined) {
+            throw new Error("Review launch requires exact ReviewRound provenance.");
+        }
+        commit(input.reviewBaseCommit, "Review base commit");
+        const reviewWorkspace = input.workspace;
+        if (reviewWorkspace === undefined
+            || (reviewWorkspace.owner.type !== "review-round"
+                && (reviewWorkspace.owner.type !== "execution-lane"
+                    || reviewWorkspace.owner.purpose !== "review"))) {
+            throw new Error("Review launch requires a ReviewRound-owned workspace.");
+        }
+        if (reviewWorkspace.owner.reviewRoundId !== input.reviewRoundId) {
+            throw new Error(`ReviewRound workspace owner does not match ${input.reviewRoundId}.`);
+        }
+        if (reviewWorkspace.entries.length === 0
+            || reviewWorkspace.entries.some(({ access }) => access !== "write")) {
+            throw new Error("Every ReviewRound workspace Project must be an isolated writable entry.");
+        }
+        return uniqueIdentities(reviewWorkspace.entries.map(({ projectId }) => projectId), "Review workspace Project");
+    }
+    const workspaceWrite = uniqueIdentities(workspace.entries
+        .filter(({ access }) => access === "write")
+        .map(({ projectId }) => projectId), "Workspace writable Project");
+    if (!("taskId" in input.role))
+        return [];
+    // A managed workspace describes what exists, not who is authorized to
+    // mutate it. Only an explicit WorkItem write scope can grant Task writes.
+    if (input.workItemWriteProjectIds === undefined)
+        return [];
+    const requested = uniqueIdentities(input.workItemWriteProjectIds, "WorkItem writable Project");
+    if (requested.length === 0)
+        return [];
+    if (!isDeepStrictEqual(requested, workspaceWrite)) {
+        throw new Error("WorkItem write scope does not match the managed workspace write scope.");
+    }
+    return requested;
+}
+function snapshotWorkspace(roleWorkspace, workspace) {
+    if (workspace === undefined)
+        return { root: text(roleWorkspace, "Role workspace"), entries: [] };
+    return {
+        root: text(workspace.root, "Effective workspace root"),
+        entries: workspace.entries.map((entry) => ({ ...entry }))
+    };
+}
+function snapshotContext(role) {
+    return cloneContext(role);
+}
+function cloneContext(context) {
+    return {
+        ...(context.description === undefined ? {} : { description: text(context.description, "Role description") }),
+        ...(context.responsibilities === undefined
+            ? {}
+            : { responsibilities: context.responsibilities.map((value) => text(value, "Role responsibility")) }),
+        ...(context.constraints === undefined
+            ? {}
+            : { constraints: context.constraints.map((value) => text(value, "Role constraint")) }),
+        ...(context.expectedOutput === undefined
+            ? {}
+            : { expectedOutput: text(context.expectedOutput, "Role expected output") }),
+        ...(context.systemPrompt === undefined
+            ? {}
+            : { systemPrompt: text(context.systemPrompt, "Role system prompt") }),
+        ...(context.skills === undefined
+            ? {}
+            : { skills: context.skills.map((value) => identity(value, "Role Skill id")) })
+    };
+}
+function clearMissingContext(role, context) {
+    for (const key of [
+        "description",
+        "responsibilities",
+        "constraints",
+        "expectedOutput",
+        "systemPrompt",
+        "skills"
+    ]) {
+        if (!Object.hasOwn(context, key))
+            delete role[key];
+    }
+}
+function cloneWorkspace(workspace) {
+    validateWorkspace(workspace);
+    return {
+        root: workspace.root,
+        entries: workspace.entries.map((entry) => ({ ...entry }))
+    };
+}
+function validateWorkspace(workspace) {
+    text(workspace.root, "Effective workspace root");
+    if (!Array.isArray(workspace.entries))
+        throw new Error("Effective workspace entries are invalid.");
+    uniqueIdentities(workspace.entries.map(({ projectId }) => projectId), "Effective workspace Project");
+    for (const entry of workspace.entries) {
+        identity(entry.projectId, "Effective workspace Project id");
+        identity(entry.directory, "Effective workspace Project directory");
+        if (entry.access !== "read" && entry.access !== "write") {
+            throw new Error("Effective workspace Project access is invalid.");
+        }
+        text(entry.path, "Effective workspace Project path");
+        text(entry.branch, "Effective workspace Project branch");
+        text(entry.baseRef, "Effective workspace Project base ref");
+        if (!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(entry.baseCommit)) {
+            throw new Error("Effective workspace base commit is invalid.");
+        }
+    }
+}
+function validateDesiredRole(role) {
+    positiveInteger(role.launchRevision, "Role desired revision");
+    if (role.defaultAccess !== "read" && role.defaultAccess !== "write") {
+        throw new Error("Role default access is invalid.");
+    }
+    const binding = role.agentBindings[role.activeAgentId];
+    if (binding === undefined)
+        throw new Error("Role active Agent binding is missing.");
+    if (binding.adapterId !== "codex" && binding.adapterId !== "claude") {
+        throw new Error(`Role Agent adapter is unsupported: ${binding.adapterId}.`);
+    }
+}
+function uniqueIdentities(values, label) {
+    if (!Array.isArray(values))
+        throw new Error(`${label} list is invalid.`);
+    const result = [...new Set(values.map((value) => identity(value, label)))].sort();
+    if (result.length !== values.length)
+        throw new Error(`${label} list contains duplicates.`);
+    return result;
+}
+function positiveInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new Error(`${label} must be positive.`);
+    return value;
+}
+function identity(value, label) {
+    const result = text(value, label);
+    if (["__proto__", "prototype", "constructor", ".", ".."].includes(result)
+        || /[/\\\0]/u.test(result)) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return result;
+}
+function commit(value, label) {
+    const result = text(value, label).toLowerCase();
+    if (!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u.test(result)) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return result;
+}
+function text(value, label) {
+    if (typeof value !== "string" || value.includes("\0") || value.trim().length === 0) {
+        throw new Error(`${label} is required.`);
+    }
+    return value.trim();
+}
+function clone(value) {
+    return JSON.parse(JSON.stringify(value));
+}