agent-hitch 0.2.5 → 0.2.7

package/dist/src/foundation/executable.js

@@ -8,12 +8,14 @@ import { terminateProcess } from "./process.js";
 export function runCommand(executable, args, { cwd, env = process.env, failureCode = "internal_error", failureExitCode = 12, timeoutMs = 30 * 60 * 1_000, signal, } = {}) {
     throwIfAborted(signal);
     return new Promise((resolve, reject) => {
-        const child = spawn(executable, args, {
+        const invocation = prepareSpawnCommand(executable, args);
+        const child = spawn(invocation.executable, invocation.args, {
             cwd,
             env,
             stdio: ["ignore", "pipe", "pipe"],
             windowsHide: true,
             detached: process.platform !== "win32",
+            windowsVerbatimArguments: invocation.windowsVerbatimArguments,
         });
         let stdout = "";
         let stderr = "";
@@ -62,7 +64,9 @@ export function commandExecutable(command, env) {
         bun: "HITCH_BUN_PATH",
         pnpm: "HITCH_PNPM_PATH",
     }[command];
-    return override && env[override]?.trim() ? env[override].trim() : command;
+    if (override && env[override]?.trim())
+        return env[override].trim();
+    return process.platform === "win32" && new Set(["npm", "pnpm"]).has(command) ? `${command}.cmd` : command;
 }
 export async function commandVersion(executable, env, signal) {
     try {
@@ -81,10 +85,13 @@ function throwIfAborted(signal) {
 function cancelledError() {
     return new HitchError("harness preparation cancelled", { code: "cancelled", exitCode: 9 });
 }
-export async function resolveExecutable(command, searchPath) {
-    const candidates = isAbsolute(command) || command.includes("/") || command.includes("\\")
+export async function resolveExecutable(command, searchPath, pathExt = process.env.PATHEXT || ".COM;.EXE;.BAT;.CMD") {
+    const bases = isAbsolute(command) || command.includes("/") || command.includes("\\")
         ? [resolve(command)]
         : searchPath.split(delimiter).filter(Boolean).map((directory) => join(directory, command));
+    const extensions = process.platform === "win32" ? pathExt.split(";").map((entry) => entry.trim()).filter(Boolean) : [];
+    const knownExtension = extensions.some((extension) => command.toLowerCase().endsWith(extension.toLowerCase()));
+    const candidates = bases.flatMap((base) => knownExtension ? [base] : [base, ...extensions.map((extension) => `${base}${extension}`)]);
     for (const candidate of candidates) {
         try {
             await access(candidate, constants.X_OK);
@@ -101,7 +108,12 @@ export async function resolveExecutable(command, searchPath) {
 }
 export async function detectVersion(executable, args, timeoutMs = 5_000) {
     return new Promise((resolveVersion) => {
-        const child = spawn(executable, args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+        const invocation = prepareSpawnCommand(executable, args);
+        const child = spawn(invocation.executable, invocation.args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+            windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+        });
         let stdout = "";
         let stderr = "";
         const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
@@ -117,6 +129,34 @@ export async function detectVersion(executable, args, timeoutMs = 5_000) {
         });
     });
 }
+export function prepareSpawnCommand(executable, args, { platform = process.platform, comspec = process.env.ComSpec || process.env.COMSPEC || "cmd.exe" } = {}) {
+    if (platform !== "win32" || !/\.(?:cmd|bat)$/i.test(executable)) {
+        return { executable, args: [...args], windowsVerbatimArguments: false };
+    }
+    if ([executable, ...args].some((value) => value.includes("\0") || /[\r\n]/.test(value))) {
+        throw new HitchError("Windows batch command contains an unsupported control character", { code: "invalid_input", exitCode: 2 });
+    }
+    const doubleEscape = /node_modules[\\/]+\.bin[\\/]+[^\\/]+\.cmd$/i.test(executable);
+    const commandLine = [escapeWindowsCommand(executable), ...args.map((argument) => escapeWindowsArgument(argument, doubleEscape))].join(" ");
+    return {
+        executable: comspec,
+        args: ["/d", "/s", "/c", `"${commandLine}"`],
+        windowsVerbatimArguments: true,
+    };
+}
+const WINDOWS_CMD_META = /([()\][%!^"`<>&|;,*? ])/g;
+function escapeWindowsCommand(value) {
+    return value.replace(WINDOWS_CMD_META, "^$1");
+}
+function escapeWindowsArgument(value, doubleEscapeMetaCharacters) {
+    let escaped = value.replace(/(\\*)"/g, "$1$1\\\"");
+    escaped = escaped.replace(/(\\*)$/, "$1$1");
+    escaped = `"${escaped}"`;
+    escaped = escaped.replace(WINDOWS_CMD_META, "^$1");
+    if (doubleEscapeMetaCharacters)
+        escaped = escaped.replace(WINDOWS_CMD_META, "^$1");
+    return escaped;
+}
 export async function fingerprintExecutable(executable) {
     const hash = createHash("sha256");
     for await (const chunk of createReadStream(executable))

package/dist/src/foundation/executable.js.map

@@ -1 +1 @@
-{"version":3,"file":"executable.js","sourceRoot":"","sources":["../../../src/foundation/executable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAgBhD,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,IAAc,EAAE,EAC7D,GAAG,EACH,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,WAAW,GAAG,gBAAgB,EAC9B,eAAe,GAAG,EAAE,EACpB,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAC3B,MAAM,MACe,EAAE;IACvB,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACpC,GAAG;YACH,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACvC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAsB,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACnF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,CAAC,QAAoB,EAAE,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACnD,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,OAAO,GAAG,IAAI,CAAC;YACf,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACnC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE;gBACnG,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,eAAe;gBACzB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,aAAoC,EAAE,EAAE;YAChF,IAAI,OAAO;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;YAC3D,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAChC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,qBAAqB,IAAI,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC5I,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,CACjD,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,GAAsB;IACvE,MAAM,QAAQ,GAAG;QACf,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,kBAAkB;QACzB,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,iBAAiB;KACxB,CAAC,OAAO,CAAC,CAAC;IACX,OAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,GAAsB,EAAE,MAA+B;IAC9G,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACrH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAAoB,EAAE,IAAI,KAAK,WAAW;YAAE,MAAM,KAAK,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACrD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,cAAc,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,UAAU,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,UAAkB;IACzE,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvF,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,SAAS;YACjC,OAAO,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,IAAc,EAAE,SAAS,GAAG,KAAK;IACvF,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;IACrF,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,MAAM,cAAc,GAAG,wDAAwD,CAAC;IAChF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"executable.js","sourceRoot":"","sources":["../../../src/foundation/executable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAsBhD,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,IAAc,EAAE,EAC7D,GAAG,EACH,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,WAAW,GAAG,gBAAgB,EAC9B,eAAe,GAAG,EAAE,EACpB,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAC3B,MAAM,MACe,EAAE;IACvB,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;YAC1D,GAAG;YACH,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;SAC9D,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAsB,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACnF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,CAAC,QAAoB,EAAE,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACnD,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,OAAO,GAAG,IAAI,CAAC;YACf,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACnC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE;gBACnG,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,eAAe;gBACzB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,aAAoC,EAAE,EAAE;YAChF,IAAI,OAAO;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;YAC3D,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAChC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,qBAAqB,IAAI,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC5I,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,CACjD,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,GAAsB;IACvE,MAAM,QAAQ,GAAG;QACf,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,kBAAkB;QACzB,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,iBAAiB;KACxB,CAAC,OAAO,CAAC,CAAC;IACX,IAAI,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,GAAsB,EAAE,MAA+B;IAC9G,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACrH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAAoB,EAAE,IAAI,KAAK,WAAW;YAAE,MAAM,KAAK,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACrD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,cAAc,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,UAAU,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,UAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB;IACjI,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClF,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvH,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/G,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACtI,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,SAAS;YACjC,OAAO,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,IAAc,EAAE,SAAS,GAAG,KAAK;IACvF,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;YAC1D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;YACjB,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;SAC9D,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,IAAc,EACd,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,KAAuD,EAAE;IAEzJ,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,UAAU,CAAC,iEAAiE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,MAAM,YAAY,GAAG,6CAA6C,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3I,OAAO;QACL,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,GAAG,CAAC;QAC5C,wBAAwB,EAAE,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,0BAAmC;IAC/E,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACnD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,GAAG,IAAI,OAAO,GAAG,CAAC;IACzB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,0BAA0B;QAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACnF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;IACrF,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,MAAM,cAAc,GAAG,wDAAwD,CAAC;IAChF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/src/foundation/index.js

@@ -1,11 +1,14 @@
-export { DEFAULT_MAX_CONCURRENT, DEFAULT_PORT, SCHEMA_VERSION, defaultRoot, parseDuration, positiveInteger, statePaths } from "./config.js";
+export { DEFAULT_MAX_CONCURRENT, DEFAULT_PORT, SCHEMA_VERSION, defaultRoot, hitchRootId, parseDuration, positiveInteger, statePaths } from "./config.js";
 export { HitchError, invalidInput } from "./errors.js";
 export { appendLine, atomicWriteJSON, ensureDir, readJSON, removeIfExists, writePrivateFile } from "./fs.js";
 export { reclaimStaleLock } from "./locks.js";
 export { withFileLock } from "./locks.js";
+export { captureProcessIdentity, inspectProcessIdentity, validateProcessIdentity } from "./process-identity.js";
+export { beginEvalEnvironmentImagePlanning, readEvalEnvironmentImageReferences, withEnvironmentImageReferenceLock, writeEvalEnvironmentImageReferences } from "./environment-image-references.js";
 export { consumeLines } from "./line-stream.js";
 export { packageRoot, packageVersion } from "./package-root.js";
 export { delay, terminateProcess } from "./process.js";
-export { commandExecutable, commandVersion, detectVersion, fingerprintExecutable, resolveExecutable, runCommand, selectVersionLine } from "./executable.js";
+export { commandExecutable, commandVersion, detectVersion, fingerprintExecutable, prepareSpawnCommand, resolveExecutable, runCommand, selectVersionLine } from "./executable.js";
 export { canonicalJSON, digest, sha256Bytes, sha256JSON } from "./hash.js";
+export { CREDENTIAL_REDACTION_MARKER, PROVIDER_ENVIRONMENT_NAMES, createCredentialRedactionTransform, credentialValuesFromEnv, redactCredentialText, safeDiagnosticMessage } from "./credential-redaction.js";
 //# sourceMappingURL=index.js.map

package/dist/src/foundation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5I,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE5J,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzJ,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhH,OAAO,EAAE,iCAAiC,EAAE,kCAAkC,EAAE,iCAAiC,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAElM,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjL,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/src/foundation/process-identity.js

@@ -0,0 +1,69 @@
+import { spawn } from "node:child_process";
+import { sha256JSON } from "./hash.js";
+export async function captureProcessIdentity(pid) {
+    const snapshot = await processSnapshot(pid);
+    if (!snapshot || terminalState(snapshot.state))
+        return null;
+    return {
+        pid,
+        start_identity: sha256JSON({ pid, started: snapshot.started, command: snapshot.command }),
+        observed_at: new Date().toISOString(),
+    };
+}
+export async function inspectProcessIdentity(identity) {
+    validateProcessIdentity(identity);
+    const snapshot = await processSnapshot(identity.pid);
+    if (!snapshot)
+        return "terminal";
+    const current = sha256JSON({ pid: identity.pid, started: snapshot.started, command: snapshot.command });
+    if (current !== identity.start_identity)
+        return "identity-mismatch";
+    return terminalState(snapshot.state) ? "terminal" : "running";
+}
+export function validateProcessIdentity(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("process identity must be an object");
+    const record = value;
+    if (Object.keys(record).some((key) => !new Set(["pid", "start_identity", "observed_at"]).has(key))
+        || !Number.isSafeInteger(record.pid) || record.pid < 1
+        || typeof record.start_identity !== "string" || !/^sha256:[a-f0-9]{64}$/.test(record.start_identity)
+        || typeof record.observed_at !== "string" || !Number.isFinite(Date.parse(record.observed_at))) {
+        throw new TypeError("process identity is invalid");
+    }
+    return record;
+}
+async function processSnapshot(pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1)
+        throw new TypeError("process pid must be a positive safe integer");
+    if (process.platform === "win32")
+        return null;
+    const output = await runPs(pid);
+    if (output.code === 1 && output.stdout.trim() === "")
+        return null;
+    if (output.code !== 0)
+        return null;
+    const fields = output.stdout.trim().split(/\s+/);
+    if (fields.length < 7)
+        return null;
+    const state = fields.at(-1);
+    const command = fields.at(-2);
+    const started = fields.slice(0, -2).join(" ");
+    return started && command && state ? { started, command, state } : null;
+}
+function runPs(pid) {
+    return new Promise((resolve) => {
+        const child = spawn("/bin/ps", ["-o", "lstart=", "-o", "comm=", "-o", "stat=", "-p", String(pid)], {
+            env: { PATH: "/usr/bin:/bin", LC_ALL: "C" },
+            stdio: ["ignore", "pipe", "ignore"],
+            windowsHide: true,
+        });
+        let stdout = "";
+        child.stdout.on("data", (chunk) => { stdout = `${stdout}${chunk.toString("utf8")}`.slice(-8_192); });
+        child.once("error", () => resolve({ code: null, stdout: "" }));
+        child.once("close", (code) => resolve({ code, stdout }));
+    });
+}
+function terminalState(state) {
+    return state.startsWith("Z") || state.startsWith("X");
+}
+//# sourceMappingURL=process-identity.js.map

package/dist/src/foundation/process-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-identity.js","sourceRoot":"","sources":["../../../src/foundation/process-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAUvC,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAW;IACtD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO;QACL,GAAG;QACH,cAAc,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzF,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAA2B;IACtE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACxG,IAAI,OAAO,KAAK,QAAQ,CAAC,cAAc;QAAE,OAAO,mBAAmB,CAAC;IACpE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IAC3H,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;WAC7F,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAK,MAAM,CAAC,GAAc,GAAG,CAAC;WAC/D,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;WACjG,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAsC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IAC9G,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAW,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAW,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,OAAO,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;YACjG,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE;YAC3C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC"}

package/dist/src/images/context.js

@@ -0,0 +1,47 @@
+import { lstat, readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import { sha256Bytes, sha256JSON } from "../foundation/index.js";
+export async function resolveBuildContext(contextDirectory, dockerfile = "Dockerfile") {
+    const root = path.resolve(contextDirectory);
+    const rootStat = await lstat(root);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+        throw new TypeError("image build context must be a real directory");
+    if (!dockerfile || path.isAbsolute(dockerfile) || dockerfile.includes("\\"))
+        throw new TypeError("image Dockerfile path is invalid");
+    const dockerfileParts = dockerfile.split("/");
+    if (dockerfileParts.some((part) => !part || part === "." || part === ".."))
+        throw new TypeError("image Dockerfile path is invalid");
+    const files = await contextFiles(root);
+    const dockerfileEntry = files.find((entry) => entry.path === dockerfile);
+    if (!dockerfileEntry)
+        throw new TypeError("image Dockerfile is not a regular context file");
+    return {
+        context_directory: root,
+        dockerfile,
+        context_digest: sha256JSON(files),
+        dockerfile_digest: dockerfileEntry.digest,
+    };
+}
+async function contextFiles(root) {
+    const files = [];
+    const visit = async (directory) => {
+        const entries = (await readdir(directory, { withFileTypes: true })).sort((left, right) => Buffer.compare(Buffer.from(left.name), Buffer.from(right.name)));
+        for (const entry of entries) {
+            const absolute = path.join(directory, entry.name);
+            const stat = await lstat(absolute);
+            if (stat.isSymbolicLink() || (!stat.isDirectory() && !stat.isFile()))
+                throw new TypeError(`image build context contains unsupported file: ${entry.name}`);
+            if (stat.isDirectory())
+                await visit(absolute);
+            else
+                files.push({
+                    path: path.relative(root, absolute).split(path.sep).join("/"),
+                    digest: sha256Bytes(await readFile(absolute)),
+                    executable: (stat.mode & 0o111) !== 0,
+                });
+        }
+    };
+    await visit(root);
+    return files;
+}
+//# sourceMappingURL=context.js.map

package/dist/src/images/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/images/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AASjE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,gBAAwB,EAAE,UAAU,GAAG,YAAY;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IAC9H,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACrI,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACpI,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAC5F,OAAO;QACL,iBAAiB,EAAE,IAAI;QACvB,UAAU;QACV,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC;QACjC,iBAAiB,EAAE,eAAe,CAAC,MAAM;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,KAAK,GAAiE,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;QACvD,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3J,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1J,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;;gBACzC,KAAK,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBAC7D,MAAM,EAAE,WAAW,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAC7C,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/images/docker-buildkit.js

@@ -0,0 +1,137 @@
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { HitchError, credentialValuesFromEnv, ensureDir, hitchRootId, redactCredentialText, runCommand, statePaths } from "../foundation/index.js";
+import { ENVIRONMENT_IMAGE_LABELS } from "./ownership.js";
+export class DockerBuildKitBuilder {
+    id;
+    root;
+    docker;
+    env;
+    registryCachePrefix;
+    versionPromise;
+    constructor({ root, dockerExecutable, env = process.env, builderId = "local-docker-buildkit", registryCachePrefix }) {
+        if (!root || !builderId)
+            throw new TypeError("Docker BuildKit builder identity is invalid");
+        this.root = root;
+        this.docker = dockerExecutable || env.HITCH_DOCKER_PATH || "docker";
+        this.env = env;
+        this.id = builderId;
+        this.registryCachePrefix = registryCachePrefix?.replace(/\/+$/, "") || undefined;
+    }
+    async probe(reference, manifestDigest, platform, configDigest) {
+        try {
+            const inspected = await this.inspect(reference);
+            return inspected.platform === platform && (configDigest ? inspected.configDigest === configDigest : inspected.repoDigests.includes(manifestDigest));
+        }
+        catch {
+            return false;
+        }
+    }
+    async build(input) {
+        for (const name of input.secretNames) {
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+                throw new TypeError("BuildKit secret name is invalid");
+            if (this.env[name] === undefined) {
+                throw new HitchError(`BuildKit secret is unavailable: ${name}`, { code: "credential_unavailable", exitCode: 10 });
+            }
+        }
+        const temporary = await mkdtemp(path.join(await ensureDir(statePaths(this.root).temporary), "buildkit-"));
+        const metadataFile = path.join(temporary, "metadata.json");
+        try {
+            const args = ["buildx", "build", "--progress", "plain", "--load", "--metadata-file", metadataFile,
+                "--platform", input.platform, "--file", path.join(input.contextDirectory, input.dockerfile), "--tag", input.outputReference,
+                "--label", `${ENVIRONMENT_IMAGE_LABELS.rootId}=${hitchRootId(this.root)}`,
+                "--label", `${ENVIRONMENT_IMAGE_LABELS.cacheKey}=${input.cacheKey}`];
+            if (input.target)
+                args.push("--target", input.target);
+            for (const [name, value] of Object.entries(input.buildArgs))
+                args.push("--build-arg", `${name}=${value}`);
+            for (const name of input.secretNames)
+                args.push("--secret", `id=${name},env=${name}`);
+            const cacheReference = this.cacheReference(input.cacheKey, input.cacheReference);
+            if (cacheReference)
+                args.push("--cache-from", `type=registry,ref=${cacheReference}`, "--cache-to", `type=registry,ref=${cacheReference},mode=max`);
+            args.push(input.contextDirectory);
+            try {
+                await runCommand(this.docker, args, { env: this.env, failureCode: "image_build_failed", failureExitCode: 12 });
+            }
+            catch (error) {
+                const detail = redactCredentialText((error?.message || String(error)).slice(0, 64 * 1024), credentialValuesFromEnv(input.secretNames, this.env)).text;
+                throw new HitchError(`BuildKit invocation failed: ${detail}`, {
+                    code: error.code || "image_build_failed", exitCode: 12,
+                });
+            }
+            const metadata = await parseMetadata(metadataFile);
+            const inspected = await this.inspect(input.outputReference);
+            if (inspected.platform !== input.platform)
+                throw new HitchError("built image platform does not match", { code: "image_output_mismatch", exitCode: 12 });
+            return {
+                reference: input.outputReference,
+                manifest_digest: metadata.manifestDigest,
+                config_digest: metadata.configDigest ?? inspected.configDigest,
+                platform: inspected.platform,
+                buildkit_version: await this.version(),
+            };
+        }
+        finally {
+            await rm(temporary, { recursive: true, force: true });
+        }
+    }
+    async inspect(reference) {
+        const result = await runCommand(this.docker, ["image", "inspect", "--format", "{{json .}}", reference], {
+            env: this.env,
+            failureCode: "image_unavailable",
+            failureExitCode: 12,
+            timeoutMs: 30_000,
+        });
+        let value;
+        try {
+            value = JSON.parse(result.stdout);
+        }
+        catch {
+            throw new TypeError("Docker image inspection is invalid");
+        }
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new TypeError("Docker image inspection is invalid");
+        const image = value;
+        if (!digest(image.Id) || typeof image.Os !== "string" || !image.Os || typeof image.Architecture !== "string" || !image.Architecture)
+            throw new TypeError("Docker image identity is invalid");
+        const repoDigests = Array.isArray(image.RepoDigests)
+            ? image.RepoDigests.map((entry) => typeof entry === "string" ? entry.slice(entry.lastIndexOf("@") + 1) : "").filter(digest)
+            : [];
+        const variant = typeof image.Variant === "string" && image.Variant ? `/${image.Variant}` : "";
+        return { configDigest: image.Id, repoDigests, platform: `${image.Os}/${image.Architecture}${variant}` };
+    }
+    version() {
+        this.versionPromise ??= runCommand(this.docker, ["buildx", "version"], { env: this.env, timeoutMs: 10_000, failureCode: "buildkit_unavailable", failureExitCode: 3 })
+            .then((result) => result.stdout.trim().split(/\s+/).slice(0, 3).join(" ") || "unknown")
+            .catch((error) => { throw new HitchError("BuildKit version probe failed", { code: "buildkit_unavailable", exitCode: 3, cause: error }); });
+        return this.versionPromise;
+    }
+    cacheReference(cacheKey, fallback) {
+        if (this.registryCachePrefix)
+            return `${this.registryCachePrefix}/${cacheKey.slice("sha256:".length)}`;
+        return fallback.includes("/") ? fallback : null;
+    }
+}
+async function parseMetadata(file) {
+    let value;
+    try {
+        value = JSON.parse(await readFile(file, "utf8"));
+    }
+    catch {
+        throw new TypeError("BuildKit metadata is invalid");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("BuildKit metadata is invalid");
+    const metadata = value;
+    const manifestDigest = metadata["containerimage.digest"];
+    const configDigest = metadata["containerimage.config.digest"];
+    if (!digest(manifestDigest) || (configDigest !== undefined && !digest(configDigest)))
+        throw new TypeError("BuildKit output digest is invalid");
+    return { manifestDigest, ...(configDigest ? { configDigest } : {}) };
+}
+function digest(value) {
+    return typeof value === "string" && /^sha256:[a-f0-9]{64}$/.test(value);
+}
+//# sourceMappingURL=docker-buildkit.js.map

package/dist/src/images/docker-buildkit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-buildkit.js","sourceRoot":"","sources":["../../../src/images/docker-buildkit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,SAAS,EAAE,WAAW,EAAE,oBAAoB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEnJ,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAU1D,MAAM,OAAO,qBAAqB;IACvB,EAAE,CAAS;IACH,IAAI,CAAS;IACb,MAAM,CAAS;IACf,GAAG,CAAoB;IACvB,mBAAmB,CAAqB;IACjD,cAAc,CAA8B;IAEpD,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,uBAAuB,EAAE,mBAAmB,EAAgC;QAC/I,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,gBAAgB,IAAI,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;QACpE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,cAAsB,EAAE,QAAgB,EAAE,YAAqB;QAC5F,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChD,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACtJ,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAUX;QACC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;YACnG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,UAAU,CAAC,mCAAmC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACpH,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1G,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,YAAY;gBAC/F,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,eAAe;gBAC3H,SAAS,EAAE,GAAG,wBAAwB,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACzE,SAAS,EAAE,GAAG,wBAAwB,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvE,IAAI,KAAK,CAAC,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACtD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;YAC1G,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,QAAQ,IAAI,EAAE,CAAC,CAAC;YACtF,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YACjF,IAAI,cAAc;gBAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,qBAAqB,cAAc,EAAE,EAAE,YAAY,EAAE,qBAAqB,cAAc,WAAW,CAAC,CAAC;YACnJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;YACjH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,oBAAoB,CACjC,CAAE,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,uBAAuB,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CACvH,CAAC,IAAI,CAAC;gBACP,MAAM,IAAI,UAAU,CAAC,+BAA+B,MAAM,EAAE,EAAE;oBAC5D,IAAI,EAAG,KAA2B,CAAC,IAAI,IAAI,oBAAoB,EAAE,QAAQ,EAAE,EAAE;iBAC9E,CAAC,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC5D,IAAI,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBAAE,MAAM,IAAI,UAAU,CAAC,qCAAqC,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACxJ,OAAO;gBACL,SAAS,EAAE,KAAK,CAAC,eAAe;gBAChC,eAAe,EAAE,QAAQ,CAAC,cAAc;gBACxC,aAAa,EAAE,QAAQ,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY;gBAC9D,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,gBAAgB,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE;aACvC,CAAC;QACJ,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,SAAiB;QACrC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE;YACtG,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,mBAAmB;YAChC,eAAe,EAAE,EAAE;YACnB,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAAC,CAAC;QAC/G,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC3H,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC7L,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;YAClD,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YAC3H,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,YAAY,GAAG,OAAO,EAAE,EAAE,CAAC;IAC1G,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,cAAc,KAAK,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;aAClK,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;aACtF,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,UAAU,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7I,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEO,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACvD,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO,GAAG,IAAI,CAAC,mBAAmB,IAAI,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACvG,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;CACF;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAAC,CAAC;IACxH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACrH,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,MAAM,cAAc,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,8BAA8B,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC/I,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC"}

package/dist/src/images/dockerfile.js

@@ -0,0 +1,67 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+const MAX_DOCKERFILE_BYTES = 1024 * 1024;
+const PINNED_IMAGE = /^([^\s@]+)@(sha256:[a-f0-9]{64})$/;
+export async function inspectPinnedDockerfileBases(contextDirectory, dockerfile = "Dockerfile") {
+    const contents = await readFile(path.join(contextDirectory, dockerfile));
+    if (contents.byteLength > MAX_DOCKERFILE_BYTES || contents.includes(0))
+        throw unsupported("Dockerfile size or encoding is unsupported");
+    const text = contents.toString("utf8");
+    if (Buffer.from(text, "utf8").compare(contents) !== 0)
+        throw unsupported("Dockerfile must be UTF-8");
+    const aliases = new Set();
+    const bases = new Map();
+    let stages = 0;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#")) {
+            if (/^#\s*escape\s*=/i.test(line))
+                throw unsupported("Dockerfile escape directives are unsupported");
+            continue;
+        }
+        if (line.endsWith("\\"))
+            throw unsupported("Dockerfile continuation lines are unsupported");
+        if (/^ARG\s/i.test(line) && stages === 0)
+            throw unsupported("Dockerfile ARG before FROM is unsupported");
+        if (/^FROM\s/i.test(line)) {
+            const match = line.match(/^FROM(?:\s+--platform=\S+)?\s+(\S+?)(?:\s+AS\s+([A-Za-z0-9_.-]+))?$/i);
+            if (!match)
+                throw unsupported("Dockerfile FROM syntax is unsupported");
+            const source = match[1];
+            if (source.toLowerCase() !== "scratch" && !aliases.has(source) && !/^\d+$/.test(source))
+                addPinnedBase(source, bases);
+            if (match[2])
+                aliases.add(match[2]);
+            stages += 1;
+            continue;
+        }
+        if (/^(COPY|ADD)\s/i.test(line)) {
+            const external = line.match(/(?:^|\s)--from=(\S+)/i)?.[1];
+            if (external && !aliases.has(external) && !/^\d+$/.test(external))
+                addPinnedBase(external, bases);
+        }
+        if (/^RUN\s/i.test(line) && /--mount=[^\s]*\bfrom=/i.test(line))
+            throw unsupported("Dockerfile external RUN mounts are unsupported");
+    }
+    if (stages === 0)
+        throw unsupported("Dockerfile has no FROM instruction");
+    return [...bases.entries()].map(([reference, digest]) => ({ reference, digest })).sort((left, right) => Buffer.compare(Buffer.from(left.reference), Buffer.from(right.reference)));
+}
+function addPinnedBase(value, bases) {
+    const match = value.match(PINNED_IMAGE);
+    if (!match)
+        throw unsupported(`Dockerfile base image is not digest-pinned: ${bounded(value)}`);
+    const reference = match[1];
+    const digest = match[2];
+    const previous = bases.get(reference);
+    if (previous && previous !== digest)
+        throw unsupported(`Dockerfile base image has conflicting digests: ${bounded(reference)}`);
+    bases.set(reference, digest);
+}
+function unsupported(message) {
+    return Object.assign(new TypeError(message), { code: "environment_build_context_unsupported" });
+}
+function bounded(value) {
+    return value.replace(/[\0\r\n]/g, " ").slice(0, 256);
+}
+//# sourceMappingURL=dockerfile.js.map

package/dist/src/images/dockerfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerfile.js","sourceRoot":"","sources":["../../../src/images/dockerfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAEzD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,gBAAwB,EAAE,UAAU,GAAG,YAAY;IACpG,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,UAAU,GAAG,oBAAoB,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,MAAM,WAAW,CAAC,4CAA4C,CAAC,CAAC;IACxI,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,0BAA0B,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,WAAW,CAAC,8CAA8C,CAAC,CAAC;YACrG,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,WAAW,CAAC,+CAA+C,CAAC,CAAC;QAC5F,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,CAAC;YAAE,MAAM,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACzG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;YACjG,IAAI,CAAC,KAAK;gBAAE,MAAM,WAAW,CAAC,uCAAuC,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;YAClC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtH,IAAI,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAE,KAAK,CAAC,CAAC,CAAY,CAAC,CAAC;YAChD,MAAM,IAAI,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,WAAW,CAAC,gDAAgD,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,MAAM,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACrL,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAA0B;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,MAAM,WAAW,CAAC,+CAA+C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM;QAAE,MAAM,WAAW,CAAC,kDAAkD,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC/H,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC"}