apphx 1.1.0 → 2.0.0

package/dist/isolation.js

@@ -0,0 +1,190 @@
+import { canonicalPath, normalizeIsolationPaths } from "./config.js";
+import { accessSync, constants, existsSync, lstatSync, mkdirSync, mkdtempSync, realpathSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+// src/isolation.ts
+function failure(message) {
+	return Object.assign(new Error(message), { code: "SETUP_REQUIRED" });
+}
+function contains(parent, child) {
+	const path = relative(parent, child);
+	return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path);
+}
+function executablePath(command, cwd, env) {
+	const candidates = command.includes("/") ? [resolve(cwd, command)] : (env.PATH ?? "").split(delimiter).filter(Boolean).map((path) => resolve(cwd, path, command));
+	for (const candidate of candidates) try {
+		accessSync(candidate, constants.X_OK);
+		const path = realpathSync(candidate);
+		if (lstatSync(path).isFile()) return path;
+	} catch {}
+	throw failure(`Cannot resolve isolated executable ${command}; select an existing executable in the approved worker PATH`);
+}
+function pathRule(path) {
+	const info = lstatSync(path);
+	if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) throw failure(`Isolation grant requires a regular canonical file or directory: ${path}`);
+	return `(${info.isDirectory() ? "subpath" : "literal"} ${JSON.stringify(path)})`;
+}
+/** Keep deletion authority on the original trusted root, never a re-resolved target or its parent. */
+function removeConfinedPath(path, root) {
+	if (process.platform !== "darwin") throw failure("Confined cleanup requires the selected macOS backend");
+	const boundary = resolve(root), target = resolve(path);
+	if (boundary === "/" || !contains(boundary, target)) throw failure("Cleanup target must stay within its original isolation root");
+	const ancestors = /* @__PURE__ */ new Set([
+		"/",
+		"/bin",
+		"/usr",
+		"/System"
+	]);
+	for (let parent = dirname(boundary); !ancestors.has(parent); parent = dirname(parent)) ancestors.add(parent);
+	const profile = [
+		"(version 1)",
+		"(deny default)",
+		"(allow process-exec)",
+		"(allow sysctl-read)",
+		"(allow file-read* (literal \"/\") (literal \"/bin/rm\") (subpath \"/System/Library\") (subpath \"/usr/lib\") (literal \"/dev/null\"))",
+		`(allow file-read-metadata ${[...ancestors].map((parent) => `(literal ${JSON.stringify(parent)})`).join(" ")})`,
+		`(allow file-read* file-write* (subpath ${JSON.stringify(boundary)}))`,
+		"(allow file-write* (literal \"/dev/null\"))"
+	].join("\n");
+	const result = spawnSync("/usr/bin/sandbox-exec", [
+		"-p",
+		profile,
+		"/bin/rm",
+		"-rf",
+		"--",
+		target
+	], {
+		cwd: "/",
+		env: {
+			PATH: "/usr/bin:/bin",
+			LANG: "C"
+		},
+		encoding: "utf8",
+		timeout: 1e4,
+		maxBuffer: 65536
+	});
+	if (result.error || result.signal || result.status !== 0) throw Object.assign(/* @__PURE__ */ new Error(`Confined cleanup did not complete; outside paths were not granted: ${result.error?.message ?? result.stderr ?? result.signal}`), { code: "PROCESS_CLEANUP_BLOCKED" });
+}
+/** This confines spawned commands, not the host agent, resource consumption or GUI/device services. */
+function prepareIsolatedCommand(argv, context) {
+	if (!context.config.isolation) throw failure("No subprocess isolation mode was selected");
+	if (process.platform !== "darwin") throw failure("macos-sandbox isolation requires macOS; execution was not downgraded to trusted mode");
+	try {
+		accessSync("/usr/bin/sandbox-exec", constants.X_OK);
+	} catch {
+		throw failure("The selected macos-sandbox backend is unavailable; no command was started");
+	}
+	const config = {
+		...context.config,
+		isolation: {
+			...context.config.isolation,
+			readOnlyPaths: [...context.config.isolation.readOnlyPaths]
+		}
+	};
+	normalizeIsolationPaths(config);
+	for (let index = 0; index < config.isolation.readOnlyPaths.length; index++) if (config.isolation.readOnlyPaths[index] !== context.config.isolation.readOnlyPaths[index]) throw failure("An isolation read-only path changed identity; review the owner configuration before retrying");
+	const workspaceInfo = lstatSync(context.workspace);
+	if (!workspaceInfo.isDirectory() || workspaceInfo.isSymbolicLink()) throw failure("Isolation requires a real owned workspace directory");
+	const workspace = realpathSync(context.workspace);
+	const state = canonicalPath(config.stateDir), workspaceRoot = canonicalPath(config.workspaceRoot);
+	if (workspace === workspaceRoot || contains(workspace, state) || contains(state, workspace)) throw failure("Isolation workspace must not expose control state or the whole workspace root");
+	const cwd = realpathSync(context.cwd);
+	if (![workspace, ...config.isolation.readOnlyPaths].some((path) => contains(path, cwd))) throw failure("Isolated command cwd must stay in its workspace or an approved read-only root");
+	const executable = executablePath(argv[0] ?? "", cwd, context.env);
+	if (contains(state, executable) || contains(workspaceRoot, executable) && !contains(workspace, executable)) throw failure("An isolated command cannot execute control state or another task workspace");
+	const readable = [
+		...config.isolation.readOnlyPaths,
+		executable,
+		realpathSync(process.execPath)
+	];
+	for (const file of context.readableFiles ?? []) {
+		if (!lstatSync(file).isFile() || lstatSync(file).isSymbolicLink()) throw failure(`Harness isolation capability requires a regular file: ${file}`);
+		readable.push(realpathSync(file));
+	}
+	const extraWritable = (context.writableDirectories ?? []).map((path) => {
+		if (!lstatSync(path).isDirectory() || lstatSync(path).isSymbolicLink()) throw failure(`Harness isolation capability requires a real directory: ${path}`);
+		return realpathSync(path);
+	});
+	const scratchParent = context.scratchParent ?? state;
+	mkdirSync(scratchParent, {
+		recursive: true,
+		mode: 448
+	});
+	const scratch = realpathSync(mkdtempSync(join(scratchParent, "isolated-command-")));
+	const cleanup = () => removeConfinedPath(scratch, scratch);
+	try {
+		const home = join(scratch, "home"), temporary = join(scratch, "tmp"), cache = join(scratch, "cache");
+		for (const path of [
+			home,
+			temporary,
+			cache
+		]) mkdirSync(path, { mode: 448 });
+		const env = {
+			...context.env,
+			HOME: home,
+			TMPDIR: `${temporary}${sep}`,
+			TMP: temporary,
+			TEMP: temporary,
+			XDG_CACHE_HOME: cache,
+			GRADLE_USER_HOME: join(cache, "gradle"),
+			npm_config_cache: join(cache, "npm")
+		};
+		for (const [name, fallback] of [["GOCACHE", join(cache, "go-build")], ["GOMODCACHE", join(cache, "go-mod")]]) if (!env[name] || contains(state, canonicalPath(resolve(cwd, env[name])))) env[name] = fallback;
+		const systemPaths = ["/System/Library", "/usr/lib"].filter(existsSync);
+		const devices = [
+			"/dev/urandom",
+			"/dev/random",
+			"/dev/null"
+		].filter(existsSync);
+		const readablePaths = [.../* @__PURE__ */ new Set([...systemPaths, ...readable])];
+		const writablePaths = [.../* @__PURE__ */ new Set([
+			workspace,
+			scratch,
+			...extraWritable
+		])];
+		const ancestors = /* @__PURE__ */ new Set(["/"]);
+		for (const path of [
+			...readablePaths,
+			...writablePaths,
+			...devices,
+			cwd
+		]) {
+			let parent = dirname(path);
+			while (true) {
+				ancestors.add(parent);
+				const next = dirname(parent);
+				if (next === parent) break;
+				parent = next;
+			}
+		}
+		return {
+			argv: [
+				"/usr/bin/sandbox-exec",
+				"-p",
+				[
+					"(version 1)",
+					"(deny default)",
+					"(allow process-exec)",
+					"(allow process-fork)",
+					"(allow sysctl-read)",
+					"(allow file-read* (literal \"/\"))",
+					`(allow file-read-metadata ${[...ancestors].map((path) => `(literal ${JSON.stringify(path)})`).join(" ")})`,
+					`(allow file-read* ${readablePaths.map(pathRule).join(" ")} ${devices.map((path) => `(literal ${JSON.stringify(path)})`).join(" ")})`,
+					`(allow file-read* file-write* ${writablePaths.map(pathRule).join(" ")})`,
+					"(allow file-write* (literal \"/dev/null\"))",
+					...config.isolation.network === "allow" ? ["(allow network*)"] : []
+				].join("\n"),
+				executable,
+				...argv.slice(1)
+			],
+			env,
+			cleanup
+		};
+	} catch (cause) {
+		cleanup();
+		throw cause;
+	}
+}
+export { prepareIsolatedCommand, removeConfinedPath };
+
+//# sourceMappingURL=isolation.js.map

package/dist/isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation.js","names":[],"sources":["../src/isolation.ts"],"sourcesContent":["import { accessSync, constants, existsSync, lstatSync, mkdirSync, mkdtempSync, realpathSync } from 'node:fs';\nimport { spawnSync } from 'node:child_process';\nimport { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';\nimport { canonicalPath, normalizeIsolationPaths } from './config.js';\nimport type { Config } from './schemas.js';\n\nexport interface IsolationCapabilities {\n  /** Narrow capabilities for trusted harness utilities; never populated from project command data. */\n  readableFiles?: readonly string[];\n  writableDirectories?: readonly string[];\n}\n\nexport interface IsolationContext extends IsolationCapabilities {\n  config: Config;\n  workspace: string;\n  cwd: string;\n  env: NodeJS.ProcessEnv;\n  scratchParent?: string;\n}\n\nexport interface IsolatedCommand {\n  argv: string[];\n  env: NodeJS.ProcessEnv;\n  cleanup(): void;\n}\n\nfunction failure(message: string): Error & { code: string } {\n  return Object.assign(new Error(message), { code: 'SETUP_REQUIRED' });\n}\n\nfunction contains(parent: string, child: string): boolean {\n  const path = relative(parent, child);\n  return path === '' || path !== '..' && !path.startsWith(`..${sep}`) && !isAbsolute(path);\n}\n\nfunction executablePath(command: string, cwd: string, env: NodeJS.ProcessEnv): string {\n  const candidates = command.includes('/') ? [resolve(cwd, command)] : (env.PATH ?? '').split(delimiter).filter(Boolean).map(path => resolve(cwd, path, command));\n  for (const candidate of candidates) {\n    try {\n      accessSync(candidate, constants.X_OK);\n      const path = realpathSync(candidate);\n      if (lstatSync(path).isFile()) return path;\n    } catch {}\n  }\n  throw failure(`Cannot resolve isolated executable ${command}; select an existing executable in the approved worker PATH`);\n}\n\nfunction pathRule(path: string): string {\n  const info = lstatSync(path);\n  if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) throw failure(`Isolation grant requires a regular canonical file or directory: ${path}`);\n  return `(${info.isDirectory() ? 'subpath' : 'literal'} ${JSON.stringify(path)})`;\n}\n\n/** Keep deletion authority on the original trusted root, never a re-resolved target or its parent. */\nexport function removeConfinedPath(path: string, root: string): void {\n  if (process.platform !== 'darwin') throw failure('Confined cleanup requires the selected macOS backend');\n  const boundary = resolve(root), target = resolve(path);\n  if (boundary === '/' || !contains(boundary, target)) throw failure('Cleanup target must stay within its original isolation root');\n  const ancestors = new Set<string>(['/', '/bin', '/usr', '/System']);\n  for (let parent = dirname(boundary); !ancestors.has(parent); parent = dirname(parent)) ancestors.add(parent);\n  const profile = [\n    '(version 1)', '(deny default)', '(allow process-exec)', '(allow sysctl-read)',\n    '(allow file-read* (literal \"/\") (literal \"/bin/rm\") (subpath \"/System/Library\") (subpath \"/usr/lib\") (literal \"/dev/null\"))',\n    `(allow file-read-metadata ${[...ancestors].map(parent => `(literal ${JSON.stringify(parent)})`).join(' ')})`,\n    `(allow file-read* file-write* (subpath ${JSON.stringify(boundary)}))`,\n    '(allow file-write* (literal \"/dev/null\"))',\n  ].join('\\n');\n  const result = spawnSync('/usr/bin/sandbox-exec', ['-p', profile, '/bin/rm', '-rf', '--', target], {\n    cwd: '/', env: { PATH: '/usr/bin:/bin', LANG: 'C' }, encoding: 'utf8', timeout: 10000, maxBuffer: 65536,\n  });\n  if (result.error || result.signal || result.status !== 0) throw Object.assign(new Error(`Confined cleanup did not complete; outside paths were not granted: ${result.error?.message ?? result.stderr ?? result.signal}`), { code: 'PROCESS_CLEANUP_BLOCKED' });\n}\n\n/** This confines spawned commands, not the host agent, resource consumption or GUI/device services. */\nexport function prepareIsolatedCommand(argv: string[], context: IsolationContext): IsolatedCommand {\n  if (!context.config.isolation) throw failure('No subprocess isolation mode was selected');\n  if (process.platform !== 'darwin') throw failure('macos-sandbox isolation requires macOS; execution was not downgraded to trusted mode');\n  try { accessSync('/usr/bin/sandbox-exec', constants.X_OK); }\n  catch { throw failure('The selected macos-sandbox backend is unavailable; no command was started'); }\n  const config = { ...context.config, isolation: { ...context.config.isolation, readOnlyPaths: [...context.config.isolation.readOnlyPaths] } };\n  normalizeIsolationPaths(config);\n  for (let index = 0; index < config.isolation.readOnlyPaths.length; index++) {\n    if (config.isolation.readOnlyPaths[index] !== context.config.isolation.readOnlyPaths[index]) throw failure('An isolation read-only path changed identity; review the owner configuration before retrying');\n  }\n  const workspaceInfo = lstatSync(context.workspace);\n  if (!workspaceInfo.isDirectory() || workspaceInfo.isSymbolicLink()) throw failure('Isolation requires a real owned workspace directory');\n  const workspace = realpathSync(context.workspace);\n  const state = canonicalPath(config.stateDir), workspaceRoot = canonicalPath(config.workspaceRoot);\n  if (workspace === workspaceRoot || contains(workspace, state) || contains(state, workspace)) throw failure('Isolation workspace must not expose control state or the whole workspace root');\n  const cwd = realpathSync(context.cwd);\n  const approved = [workspace, ...config.isolation.readOnlyPaths];\n  if (!approved.some(path => contains(path, cwd))) throw failure('Isolated command cwd must stay in its workspace or an approved read-only root');\n  const executable = executablePath(argv[0] ?? '', cwd, context.env);\n  if (contains(state, executable) || contains(workspaceRoot, executable) && !contains(workspace, executable)) throw failure('An isolated command cannot execute control state or another task workspace');\n  const readable = [...config.isolation.readOnlyPaths, executable, realpathSync(process.execPath)];\n  for (const file of context.readableFiles ?? []) {\n    if (!lstatSync(file).isFile() || lstatSync(file).isSymbolicLink()) throw failure(`Harness isolation capability requires a regular file: ${file}`);\n    readable.push(realpathSync(file));\n  }\n  const extraWritable = (context.writableDirectories ?? []).map(path => {\n    if (!lstatSync(path).isDirectory() || lstatSync(path).isSymbolicLink()) throw failure(`Harness isolation capability requires a real directory: ${path}`);\n    return realpathSync(path);\n  });\n  const scratchParent = context.scratchParent ?? state;\n  mkdirSync(scratchParent, { recursive: true, mode: 0o700 });\n  const scratch = realpathSync(mkdtempSync(join(scratchParent, 'isolated-command-')));\n  const cleanup = () => removeConfinedPath(scratch, scratch);\n  try {\n    const home = join(scratch, 'home'), temporary = join(scratch, 'tmp'), cache = join(scratch, 'cache');\n    for (const path of [home, temporary, cache]) mkdirSync(path, { mode: 0o700 });\n    const env: NodeJS.ProcessEnv = { ...context.env, HOME: home, TMPDIR: `${temporary}${sep}`, TMP: temporary, TEMP: temporary, XDG_CACHE_HOME: cache, GRADLE_USER_HOME: join(cache, 'gradle'), npm_config_cache: join(cache, 'npm') };\n    for (const [name, fallback] of [['GOCACHE', join(cache, 'go-build')], ['GOMODCACHE', join(cache, 'go-mod')]] as const) {\n      if (!env[name] || contains(state, canonicalPath(resolve(cwd, env[name]!)))) env[name] = fallback;\n    }\n    const systemPaths = ['/System/Library', '/usr/lib'].filter(existsSync);\n    const devices = ['/dev/urandom', '/dev/random', '/dev/null'].filter(existsSync);\n    const readablePaths = [...new Set([...systemPaths, ...readable])];\n    const writablePaths = [...new Set([workspace, scratch, ...extraWritable])];\n    const ancestors = new Set<string>(['/']);\n    for (const path of [...readablePaths, ...writablePaths, ...devices, cwd]) {\n      let parent = dirname(path);\n      while (true) {\n        ancestors.add(parent);\n        const next = dirname(parent);\n        if (next === parent) break;\n        parent = next;\n      }\n    }\n    const profile = [\n      '(version 1)', '(deny default)', '(allow process-exec)', '(allow process-fork)', '(allow sysctl-read)',\n      '(allow file-read* (literal \"/\"))',\n      `(allow file-read-metadata ${[...ancestors].map(path => `(literal ${JSON.stringify(path)})`).join(' ')})`,\n      `(allow file-read* ${readablePaths.map(pathRule).join(' ')} ${devices.map(path => `(literal ${JSON.stringify(path)})`).join(' ')})`,\n      `(allow file-read* file-write* ${writablePaths.map(pathRule).join(' ')})`,\n      '(allow file-write* (literal \"/dev/null\"))',\n      ...(config.isolation.network === 'allow' ? ['(allow network*)'] : []),\n    ].join('\\n');\n    return { argv: ['/usr/bin/sandbox-exec', '-p', profile, executable, ...argv.slice(1)], env, cleanup };\n  } catch (cause) {\n    cleanup();\n    throw cause;\n  }\n}\n"],"mappings":";;;;;AA0BA,SAAS,QAAQ,SAA2C;CAC1D,OAAO,OAAO,OAAO,IAAI,MAAM,OAAO,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACrE;AAEA,SAAS,SAAS,QAAgB,OAAwB;CACxD,MAAM,OAAO,SAAS,QAAQ,KAAK;CACnC,OAAO,SAAS,MAAM,SAAS,QAAQ,CAAC,KAAK,WAAW,KAAK,KAAK,KAAK,CAAC,WAAW,IAAI;AACzF;AAEA,SAAS,eAAe,SAAiB,KAAa,KAAgC;CACpF,MAAM,aAAa,QAAQ,SAAS,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,KAAK,IAAI,QAAQ,GAAA,CAAI,MAAM,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAI,SAAQ,QAAQ,KAAK,MAAM,OAAO,CAAC;CAC9J,KAAK,MAAM,aAAa,YACtB,IAAI;EACF,WAAW,WAAW,UAAU,IAAI;EACpC,MAAM,OAAO,aAAa,SAAS;EACnC,IAAI,UAAU,IAAI,CAAC,CAAC,OAAO,GAAG,OAAO;CACvC,QAAQ,CAAC;CAEX,MAAM,QAAQ,sCAAsC,QAAQ,4DAA4D;AAC1H;AAEA,SAAS,SAAS,MAAsB;CACtC,MAAM,OAAO,UAAU,IAAI;CAC3B,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,KAAK,YAAY,GAAG,MAAM,QAAQ,mEAAmE,MAAM;CAC3J,OAAO,IAAI,KAAK,YAAY,IAAI,YAAY,UAAU,GAAG,KAAK,UAAU,IAAI,EAAE;AAChF;;AAGA,SAAgB,mBAAmB,MAAc,MAAoB;CACnE,IAAI,QAAQ,aAAa,UAAU,MAAM,QAAQ,sDAAsD;CACvG,MAAM,WAAW,QAAQ,IAAI,GAAG,SAAS,QAAQ,IAAI;CACrD,IAAI,aAAa,OAAO,CAAC,SAAS,UAAU,MAAM,GAAG,MAAM,QAAQ,6DAA6D;CAChI,MAAM,4BAAY,IAAI,IAAY;EAAC;EAAK;EAAQ;EAAQ;CAAS,CAAC;CAClE,KAAK,IAAI,SAAS,QAAQ,QAAQ,GAAG,CAAC,UAAU,IAAI,MAAM,GAAG,SAAS,QAAQ,MAAM,GAAG,UAAU,IAAI,MAAM;CAC3G,MAAM,UAAU;EACd;EAAe;EAAkB;EAAwB;EACzD;EACA,6BAA6B,CAAC,GAAG,SAAS,CAAC,CAAC,KAAI,WAAU,YAAY,KAAK,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;EAC3G,0CAA0C,KAAK,UAAU,QAAQ,EAAE;EACnE;CACF,CAAC,CAAC,KAAK,IAAI;CACX,MAAM,SAAS,UAAU,yBAAyB;EAAC;EAAM;EAAS;EAAW;EAAO;EAAM;CAAM,GAAG;EACjG,KAAK;EAAK,KAAK;GAAE,MAAM;GAAiB,MAAM;EAAI;EAAG,UAAU;EAAQ,SAAS;EAAO,WAAW;CACpG,CAAC;CACD,IAAI,OAAO,SAAS,OAAO,UAAU,OAAO,WAAW,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,sEAAsE,OAAO,OAAO,WAAW,OAAO,UAAU,OAAO,QAAQ,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC/P;;AAGA,SAAgB,uBAAuB,MAAgB,SAA4C;CACjG,IAAI,CAAC,QAAQ,OAAO,WAAW,MAAM,QAAQ,2CAA2C;CACxF,IAAI,QAAQ,aAAa,UAAU,MAAM,QAAQ,sFAAsF;CACvI,IAAI;EAAE,WAAW,yBAAyB,UAAU,IAAI;CAAG,QACrD;EAAE,MAAM,QAAQ,2EAA2E;CAAG;CACpG,MAAM,SAAS;EAAE,GAAG,QAAQ;EAAQ,WAAW;GAAE,GAAG,QAAQ,OAAO;GAAW,eAAe,CAAC,GAAG,QAAQ,OAAO,UAAU,aAAa;EAAE;CAAE;CAC3I,wBAAwB,MAAM;CAC9B,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,UAAU,cAAc,QAAQ,SACjE,IAAI,OAAO,UAAU,cAAc,WAAW,QAAQ,OAAO,UAAU,cAAc,QAAQ,MAAM,QAAQ,8FAA8F;CAE3M,MAAM,gBAAgB,UAAU,QAAQ,SAAS;CACjD,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAAG,MAAM,QAAQ,qDAAqD;CACvI,MAAM,YAAY,aAAa,QAAQ,SAAS;CAChD,MAAM,QAAQ,cAAc,OAAO,QAAQ,GAAG,gBAAgB,cAAc,OAAO,aAAa;CAChG,IAAI,cAAc,iBAAiB,SAAS,WAAW,KAAK,KAAK,SAAS,OAAO,SAAS,GAAG,MAAM,QAAQ,+EAA+E;CAC1L,MAAM,MAAM,aAAa,QAAQ,GAAG;CAEpC,IAAI,CAAC,CADa,WAAW,GAAG,OAAO,UAAU,aACrC,CAAC,CAAC,MAAK,SAAQ,SAAS,MAAM,GAAG,CAAC,GAAG,MAAM,QAAQ,+EAA+E;CAC9I,MAAM,aAAa,eAAe,KAAK,MAAM,IAAI,KAAK,QAAQ,GAAG;CACjE,IAAI,SAAS,OAAO,UAAU,KAAK,SAAS,eAAe,UAAU,KAAK,CAAC,SAAS,WAAW,UAAU,GAAG,MAAM,QAAQ,4EAA4E;CACtM,MAAM,WAAW;EAAC,GAAG,OAAO,UAAU;EAAe;EAAY,aAAa,QAAQ,QAAQ;CAAC;CAC/F,KAAK,MAAM,QAAQ,QAAQ,iBAAiB,CAAC,GAAG;EAC9C,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC,eAAe,GAAG,MAAM,QAAQ,yDAAyD,MAAM;EAChJ,SAAS,KAAK,aAAa,IAAI,CAAC;CAClC;CACA,MAAM,iBAAiB,QAAQ,uBAAuB,CAAC,EAAA,CAAG,KAAI,SAAQ;EACpE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,KAAK,UAAU,IAAI,CAAC,CAAC,eAAe,GAAG,MAAM,QAAQ,2DAA2D,MAAM;EACvJ,OAAO,aAAa,IAAI;CAC1B,CAAC;CACD,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,UAAU,eAAe;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACzD,MAAM,UAAU,aAAa,YAAY,KAAK,eAAe,mBAAmB,CAAC,CAAC;CAClF,MAAM,gBAAgB,mBAAmB,SAAS,OAAO;CACzD,IAAI;EACF,MAAM,OAAO,KAAK,SAAS,MAAM,GAAG,YAAY,KAAK,SAAS,KAAK,GAAG,QAAQ,KAAK,SAAS,OAAO;EACnG,KAAK,MAAM,QAAQ;GAAC;GAAM;GAAW;EAAK,GAAG,UAAU,MAAM,EAAE,MAAM,IAAM,CAAC;EAC5E,MAAM,MAAyB;GAAE,GAAG,QAAQ;GAAK,MAAM;GAAM,QAAQ,GAAG,YAAY;GAAO,KAAK;GAAW,MAAM;GAAW,gBAAgB;GAAO,kBAAkB,KAAK,OAAO,QAAQ;GAAG,kBAAkB,KAAK,OAAO,KAAK;EAAE;EACjO,KAAK,MAAM,CAAC,MAAM,aAAa,CAAC,CAAC,WAAW,KAAK,OAAO,UAAU,CAAC,GAAG,CAAC,cAAc,KAAK,OAAO,QAAQ,CAAC,CAAC,GACzG,IAAI,CAAC,IAAI,SAAS,SAAS,OAAO,cAAc,QAAQ,KAAK,IAAI,KAAM,CAAC,CAAC,GAAG,IAAI,QAAQ;EAE1F,MAAM,cAAc,CAAC,mBAAmB,UAAU,CAAC,CAAC,OAAO,UAAU;EACrE,MAAM,UAAU;GAAC;GAAgB;GAAe;EAAW,CAAC,CAAC,OAAO,UAAU;EAC9E,MAAM,gBAAgB,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,aAAa,GAAG,QAAQ,CAAC,CAAC;EAChE,MAAM,gBAAgB,CAAC,mBAAG,IAAI,IAAI;GAAC;GAAW;GAAS,GAAG;EAAa,CAAC,CAAC;EACzE,MAAM,4BAAY,IAAI,IAAY,CAAC,GAAG,CAAC;EACvC,KAAK,MAAM,QAAQ;GAAC,GAAG;GAAe,GAAG;GAAe,GAAG;GAAS;EAAG,GAAG;GACxE,IAAI,SAAS,QAAQ,IAAI;GACzB,OAAO,MAAM;IACX,UAAU,IAAI,MAAM;IACpB,MAAM,OAAO,QAAQ,MAAM;IAC3B,IAAI,SAAS,QAAQ;IACrB,SAAS;GACX;EACF;EAUA,OAAO;GAAE,MAAM;IAAC;IAAyB;IATzB;KACd;KAAe;KAAkB;KAAwB;KAAwB;KACjF;KACA,6BAA6B,CAAC,GAAG,SAAS,CAAC,CAAC,KAAI,SAAQ,YAAY,KAAK,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;KACvG,qBAAqB,cAAc,IAAI,QAAQ,CAAC,CAAC,KAAK,GAAG,EAAE,GAAG,QAAQ,KAAI,SAAQ,YAAY,KAAK,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;KACjI,iCAAiC,cAAc,IAAI,QAAQ,CAAC,CAAC,KAAK,GAAG,EAAE;KACvE;KACA,GAAI,OAAO,UAAU,YAAY,UAAU,CAAC,kBAAkB,IAAI,CAAC;IACrE,CAAC,CAAC,KAAK,IAC8C;IAAG;IAAY,GAAG,KAAK,MAAM,CAAC;GAAC;GAAG;GAAK;EAAQ;CACtG,SAAS,OAAO;EACd,QAAQ;EACR,MAAM;CACR;AACF"}

package/dist/macos.js

@@ -0,0 +1,57 @@
+import { artifactOutputPath } from "./workspace.js";
+import { closeSync, lstatSync, openSync, readSync } from "node:fs";
+import { basename, join } from "node:path";
+// src/macos.ts
+/** Validate native output with system tooling, not just the file extension. */
+async function validateMacOSArtifact(path, target, exec) {
+	if (target === "dmg") {
+		const result = await exec([
+			"/usr/bin/hdiutil",
+			"verify",
+			path
+		]);
+		if (result.code !== 0) throw new Error(`Invalid macOS disk image: ${result.stderr || result.stdout}`);
+		return;
+	}
+	const info = artifactOutputPath(path, "Contents/Info.plist");
+	if (!lstatSync(info).isFile()) throw new Error("macOS application requires a regular Contents/Info.plist");
+	const result = await exec([
+		"/usr/bin/plutil",
+		"-extract",
+		"CFBundleExecutable",
+		"raw",
+		"-o",
+		"-",
+		info
+	]);
+	const executable = result.stdout.trim();
+	if (result.code !== 0 || !executable || executable === "." || executable === ".." || basename(executable) !== executable || executable.includes("\\")) throw new Error("macOS Info.plist must identify an in-bundle executable by file name");
+	const binary = artifactOutputPath(path, join("Contents", "MacOS", executable));
+	const stat = lstatSync(binary);
+	if (!stat.isFile() || stat.size < 32 || !(stat.mode & 73)) throw new Error("macOS application executable is missing, empty or not executable");
+	const header = Buffer.allocUnsafe(4);
+	const descriptor = openSync(binary, "r");
+	try {
+		if (readSync(descriptor, header, 0, 4, 0) !== 4 || ![
+			"feedfacf",
+			"cffaedfe",
+			"cafebabe",
+			"bebafeca",
+			"cafebabf",
+			"bfbafeca"
+		].includes(header.toString("hex"))) throw new Error("macOS application executable must be a Mach-O binary, not a script or placeholder");
+	} finally {
+		closeSync(descriptor);
+	}
+	const signed = await exec([
+		"/usr/bin/codesign",
+		"--verify",
+		"--deep",
+		"--strict",
+		path
+	]);
+	if (signed.code !== 0) throw new Error(`macOS local application signature is invalid: ${signed.stderr || signed.stdout}`);
+}
+export { validateMacOSArtifact };
+
+//# sourceMappingURL=macos.js.map

package/dist/macos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos.js","names":[],"sources":["../src/macos.ts"],"sourcesContent":["import { basename, join } from 'node:path';\nimport { closeSync, lstatSync, openSync, readSync } from 'node:fs';\nimport { artifactOutputPath } from './workspace.js';\nimport type { Run } from './process.js';\n\n\n/** Validate native output with system tooling, not just the file extension. */\nexport async function validateMacOSArtifact(path: string, target: 'app' | 'dmg', exec: Run): Promise<void> {\n  if (target === 'dmg') {\n    const result = await exec(['/usr/bin/hdiutil', 'verify', path]);\n    if (result.code !== 0) throw new Error(`Invalid macOS disk image: ${result.stderr || result.stdout}`);\n    return;\n  }\n  const info = artifactOutputPath(path, 'Contents/Info.plist');\n  if (!lstatSync(info).isFile()) throw new Error('macOS application requires a regular Contents/Info.plist');\n  const result = await exec(['/usr/bin/plutil', '-extract', 'CFBundleExecutable', 'raw', '-o', '-', info]);\n  const executable = result.stdout.trim();\n  if (result.code !== 0 || !executable || executable === '.' || executable === '..' || basename(executable) !== executable || executable.includes('\\\\')) throw new Error('macOS Info.plist must identify an in-bundle executable by file name');\n  const binary = artifactOutputPath(path, join('Contents', 'MacOS', executable));\n  const stat = lstatSync(binary);\n  if (!stat.isFile() || stat.size < 32 || !(stat.mode & 0o111)) throw new Error('macOS application executable is missing, empty or not executable');\n  const header = Buffer.allocUnsafe(4);\n  const descriptor = openSync(binary, 'r');\n  try {\n    if (readSync(descriptor, header, 0, 4, 0) !== 4 || !['feedfacf', 'cffaedfe', 'cafebabe', 'bebafeca', 'cafebabf', 'bfbafeca'].includes(header.toString('hex'))) throw new Error('macOS application executable must be a Mach-O binary, not a script or placeholder');\n  } finally { closeSync(descriptor); }\n  const signed = await exec(['/usr/bin/codesign', '--verify', '--deep', '--strict', path]);\n  if (signed.code !== 0) throw new Error(`macOS local application signature is invalid: ${signed.stderr || signed.stdout}`);\n}\n"],"mappings":";;;;;AAOA,eAAsB,sBAAsB,MAAc,QAAuB,MAA0B;CACzG,IAAI,WAAW,OAAO;EACpB,MAAM,SAAS,MAAM,KAAK;GAAC;GAAoB;GAAU;EAAI,CAAC;EAC9D,IAAI,OAAO,SAAS,GAAG,MAAM,IAAI,MAAM,6BAA6B,OAAO,UAAU,OAAO,QAAQ;EACpG;CACF;CACA,MAAM,OAAO,mBAAmB,MAAM,qBAAqB;CAC3D,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,0DAA0D;CACzG,MAAM,SAAS,MAAM,KAAK;EAAC;EAAmB;EAAY;EAAsB;EAAO;EAAM;EAAK;CAAI,CAAC;CACvG,MAAM,aAAa,OAAO,OAAO,KAAK;CACtC,IAAI,OAAO,SAAS,KAAK,CAAC,cAAc,eAAe,OAAO,eAAe,QAAQ,SAAS,UAAU,MAAM,cAAc,WAAW,SAAS,IAAI,GAAG,MAAM,IAAI,MAAM,qEAAqE;CAC5O,MAAM,SAAS,mBAAmB,MAAM,KAAK,YAAY,SAAS,UAAU,CAAC;CAC7E,MAAM,OAAO,UAAU,MAAM;CAC7B,IAAI,CAAC,KAAK,OAAO,KAAK,KAAK,OAAO,MAAM,EAAE,KAAK,OAAO,KAAQ,MAAM,IAAI,MAAM,kEAAkE;CAChJ,MAAM,SAAS,OAAO,YAAY,CAAC;CACnC,MAAM,aAAa,SAAS,QAAQ,GAAG;CACvC,IAAI;EACF,IAAI,SAAS,YAAY,QAAQ,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC;GAAC;GAAY;GAAY;GAAY;GAAY;GAAY;EAAU,CAAC,CAAC,SAAS,OAAO,SAAS,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,mFAAmF;CACpQ,UAAU;EAAE,UAAU,UAAU;CAAG;CACnC,MAAM,SAAS,MAAM,KAAK;EAAC;EAAqB;EAAY;EAAU;EAAY;CAAI,CAAC;CACvF,IAAI,OAAO,SAAS,GAAG,MAAM,IAAI,MAAM,iDAAiD,OAAO,UAAU,OAAO,QAAQ;AAC1H"}

package/dist/mygo-build.js

@@ -0,0 +1,55 @@
+import { basename, posix } from "node:path";
+// src/mygo-build.ts
+/** Accept a direct, local MyGo build, never a wrapper that can add publishing flags. */
+function validateMyGoPackaging(config, screenshotsDir) {
+	const profile = config.packaging;
+	if (!profile || profile.provider !== "local" || profile.commands.length !== 1) throw Object.assign(/* @__PURE__ */ new Error("MyGo requires one direct local build command"), { code: "SETUP_REQUIRED" });
+	const argv = profile.commands[0];
+	let start;
+	if (basename(argv[0]) === "mygo" && argv[1] === "build") start = 2;
+	else if (basename(argv[0]) === "go" && argv[1] === "tool" && argv[2] === "mygo" && argv[3] === "build") start = 4;
+	else if (basename(argv[0]) === "go" && argv[1] === "run" && /^github\.com\/egoist\/mygo\/cmd\/mygo@v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(argv[2] ?? "") && argv[3] === "build") start = 4;
+	else throw Object.assign(/* @__PURE__ */ new Error("MyGo packaging must use a pinned go tool mygo build, installed mygo build, or version-pinned go run command"), { code: "SETUP_REQUIRED" });
+	const flags = /* @__PURE__ */ new Map();
+	for (let index = start; index < argv.length; index++) {
+		const flag = argv[index];
+		if (flags.has(flag)) throw Object.assign(/* @__PURE__ */ new Error(`Duplicate MyGo build flag: ${flag}`), { code: "SETUP_REQUIRED" });
+		if (flag === "-sign" || flag === "-platform" || flag === "-o") {
+			const value = argv[++index];
+			if (!value) throw Object.assign(/* @__PURE__ */ new Error(`Missing MyGo flag value: ${flag}`), { code: "SETUP_REQUIRED" });
+			flags.set(flag, value);
+		} else if (flag === "-skip-notarize" || flag === "-skip-dmg" || flag === "-skip-build-command") flags.set(flag, "true");
+		else throw Object.assign(/* @__PURE__ */ new Error(`MyGo local packaging does not permit ${flag}; upload, notarization and custom wrapper commands are out of scope`), { code: "SETUP_REQUIRED" });
+	}
+	if (flags.get("-sign") !== "-" || !flags.has("-skip-notarize")) throw Object.assign(/* @__PURE__ */ new Error("MyGo local builds require -sign - and -skip-notarize, even when project configuration enables signing/notarization"), { code: "SETUP_REQUIRED" });
+	const platform = flags.get("-platform");
+	if (!platform || !/^darwin\/(?:arm64|amd64|universal)$/.test(platform)) throw Object.assign(/* @__PURE__ */ new Error("MyGo packaging requires one explicit darwin/arm64, darwin/amd64 or darwin/universal target"), { code: "SETUP_REQUIRED" });
+	if (flags.get("-o") !== "build") throw Object.assign(/* @__PURE__ */ new Error("MyGo packaging requires -o build so output cannot replace project source"), { code: "SETUP_REQUIRED" });
+	const prefix = `build/${platform.replace("/", "-")}/`;
+	if (!profile.artifactPath.startsWith(prefix)) throw Object.assign(/* @__PURE__ */ new Error(`MyGo artifactPath must be inside ${prefix}`), { code: "SETUP_REQUIRED" });
+	if (screenshotsDir !== void 0) {
+		const screenshot = posix.normalize(screenshotsDir);
+		if (posix.isAbsolute(screenshot) || screenshot === ".." || screenshot.startsWith("../") || screenshot.includes("\\")) throw Object.assign(/* @__PURE__ */ new Error("MyGo screenshotsDir must stay within the selected project"), { code: "SETUP_REQUIRED" });
+		const outputDirectory = prefix.slice(0, -1);
+		if ([posix.relative(outputDirectory, screenshot), posix.relative(screenshot, outputDirectory)].some((path) => path === "" || path !== ".." && !path.startsWith("../") && !posix.isAbsolute(path))) throw Object.assign(/* @__PURE__ */ new Error("MyGo screenshotsDir must not overlap the platform output directory replaced during packaging"), { code: "SETUP_REQUIRED" });
+	}
+	if (config.packageTarget === "app" ? !flags.has("-skip-dmg") : flags.has("-skip-dmg")) throw Object.assign(/* @__PURE__ */ new Error("MyGo app builds require -skip-dmg; dmg builds must create the disk image"), { code: "SETUP_REQUIRED" });
+}
+/** Doctor and tracked execution share the same gate for every recognizable direct build. */
+function validateMyGoCommand(config, argv) {
+	const tool = basename(argv[0] ?? "");
+	const buildIndex = argv.indexOf("build");
+	if (buildIndex <= 0) return;
+	if (!(tool === "mygo" || tool === "go" && argv.slice(1, buildIndex).some((value) => value === "mygo" || value === "github.com/egoist/mygo/cmd/mygo" || value.startsWith("github.com/egoist/mygo/cmd/mygo@")))) return;
+	validateMyGoPackaging({
+		...config,
+		packageTarget: argv.includes("-skip-dmg") ? "app" : "dmg",
+		packaging: config.packaging ? {
+			...config.packaging,
+			commands: [argv]
+		} : void 0
+	});
+}
+export { validateMyGoCommand, validateMyGoPackaging };
+
+//# sourceMappingURL=mygo-build.js.map

package/dist/mygo-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mygo-build.js","names":[],"sources":["../src/mygo-build.ts"],"sourcesContent":["import { basename, posix } from 'node:path';\nimport type { Config } from './schemas.js';\n\n/** Accept a direct, local MyGo build, never a wrapper that can add publishing flags. */\nexport function validateMyGoPackaging(config: Config, screenshotsDir?: string): void {\n  const profile = config.packaging;\n  if (!profile || profile.provider !== 'local' || profile.commands.length !== 1) throw Object.assign(new Error('MyGo requires one direct local build command'), { code: 'SETUP_REQUIRED' });\n  const argv = profile.commands[0]!;\n  let start: number;\n  if (basename(argv[0]!) === 'mygo' && argv[1] === 'build') start = 2;\n  else if (basename(argv[0]!) === 'go' && argv[1] === 'tool' && argv[2] === 'mygo' && argv[3] === 'build') start = 4;\n  else if (basename(argv[0]!) === 'go' && argv[1] === 'run' && /^github\\.com\\/egoist\\/mygo\\/cmd\\/mygo@v\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(argv[2] ?? '') && argv[3] === 'build') start = 4;\n  else throw Object.assign(new Error('MyGo packaging must use a pinned go tool mygo build, installed mygo build, or version-pinned go run command'), { code: 'SETUP_REQUIRED' });\n  const flags = new Map<string, string>();\n  for (let index = start; index < argv.length; index++) {\n    const flag = argv[index]!;\n    if (flags.has(flag)) throw Object.assign(new Error(`Duplicate MyGo build flag: ${flag}`), { code: 'SETUP_REQUIRED' });\n    if (flag === '-sign' || flag === '-platform' || flag === '-o') {\n      const value = argv[++index];\n      if (!value) throw Object.assign(new Error(`Missing MyGo flag value: ${flag}`), { code: 'SETUP_REQUIRED' });\n      flags.set(flag, value);\n    } else if (flag === '-skip-notarize' || flag === '-skip-dmg' || flag === '-skip-build-command') flags.set(flag, 'true');\n    else throw Object.assign(new Error(`MyGo local packaging does not permit ${flag}; upload, notarization and custom wrapper commands are out of scope`), { code: 'SETUP_REQUIRED' });\n  }\n  if (flags.get('-sign') !== '-' || !flags.has('-skip-notarize')) throw Object.assign(new Error('MyGo local builds require -sign - and -skip-notarize, even when project configuration enables signing/notarization'), { code: 'SETUP_REQUIRED' });\n  const platform = flags.get('-platform');\n  if (!platform || !/^darwin\\/(?:arm64|amd64|universal)$/.test(platform)) throw Object.assign(new Error('MyGo packaging requires one explicit darwin/arm64, darwin/amd64 or darwin/universal target'), { code: 'SETUP_REQUIRED' });\n  if (flags.get('-o') !== 'build') throw Object.assign(new Error('MyGo packaging requires -o build so output cannot replace project source'), { code: 'SETUP_REQUIRED' });\n  const prefix = `build/${platform.replace('/', '-')}/`;\n  if (!profile.artifactPath.startsWith(prefix)) throw Object.assign(new Error(`MyGo artifactPath must be inside ${prefix}`), { code: 'SETUP_REQUIRED' });\n  if (screenshotsDir !== undefined) {\n    const screenshot = posix.normalize(screenshotsDir);\n    if (posix.isAbsolute(screenshot) || screenshot === '..' || screenshot.startsWith('../') || screenshot.includes('\\\\')) throw Object.assign(new Error('MyGo screenshotsDir must stay within the selected project'), { code: 'SETUP_REQUIRED' });\n    const outputDirectory = prefix.slice(0, -1);\n    if ([posix.relative(outputDirectory, screenshot), posix.relative(screenshot, outputDirectory)].some(path => path === '' || path !== '..' && !path.startsWith('../') && !posix.isAbsolute(path))) throw Object.assign(new Error('MyGo screenshotsDir must not overlap the platform output directory replaced during packaging'), { code: 'SETUP_REQUIRED' });\n  }\n  if (config.packageTarget === 'app' ? !flags.has('-skip-dmg') : flags.has('-skip-dmg')) throw Object.assign(new Error('MyGo app builds require -skip-dmg; dmg builds must create the disk image'), { code: 'SETUP_REQUIRED' });\n}\n\n/** Doctor and tracked execution share the same gate for every recognizable direct build. */\nexport function validateMyGoCommand(config: Config, argv: string[]): void {\n  const tool = basename(argv[0] ?? '');\n  const buildIndex = argv.indexOf('build');\n  if (buildIndex <= 0) return;\n  const direct = tool === 'mygo' || tool === 'go' && argv.slice(1, buildIndex).some(value => value === 'mygo' || value === 'github.com/egoist/mygo/cmd/mygo' || value.startsWith('github.com/egoist/mygo/cmd/mygo@'));\n  if (!direct) return;\n  validateMyGoPackaging({ ...config, packageTarget: argv.includes('-skip-dmg') ? 'app' : 'dmg', packaging: config.packaging ? { ...config.packaging, commands: [argv] } : undefined });\n}\n"],"mappings":";;;AAIA,SAAgB,sBAAsB,QAAgB,gBAA+B;CACnF,MAAM,UAAU,OAAO;CACvB,IAAI,CAAC,WAAW,QAAQ,aAAa,WAAW,QAAQ,SAAS,WAAW,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,8CAA8C,GAAG,EAAE,MAAM,iBAAiB,CAAC;CACxL,MAAM,OAAO,QAAQ,SAAS;CAC9B,IAAI;CACJ,IAAI,SAAS,KAAK,EAAG,MAAM,UAAU,KAAK,OAAO,SAAS,QAAQ;MAC7D,IAAI,SAAS,KAAK,EAAG,MAAM,QAAQ,KAAK,OAAO,UAAU,KAAK,OAAO,UAAU,KAAK,OAAO,SAAS,QAAQ;MAC5G,IAAI,SAAS,KAAK,EAAG,MAAM,QAAQ,KAAK,OAAO,SAAS,4EAA4E,KAAK,KAAK,MAAM,EAAE,KAAK,KAAK,OAAO,SAAS,QAAQ;MACxL,MAAM,OAAO,uBAAO,IAAI,MAAM,6GAA6G,GAAG,EAAE,MAAM,iBAAiB,CAAC;CAC7K,MAAM,wBAAQ,IAAI,IAAoB;CACtC,KAAK,IAAI,QAAQ,OAAO,QAAQ,KAAK,QAAQ,SAAS;EACpD,MAAM,OAAO,KAAK;EAClB,IAAI,MAAM,IAAI,IAAI,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,8BAA8B,MAAM,GAAG,EAAE,MAAM,iBAAiB,CAAC;EACpH,IAAI,SAAS,WAAW,SAAS,eAAe,SAAS,MAAM;GAC7D,MAAM,QAAQ,KAAK,EAAE;GACrB,IAAI,CAAC,OAAO,MAAM,OAAO,uBAAO,IAAI,MAAM,4BAA4B,MAAM,GAAG,EAAE,MAAM,iBAAiB,CAAC;GACzG,MAAM,IAAI,MAAM,KAAK;EACvB,OAAO,IAAI,SAAS,oBAAoB,SAAS,eAAe,SAAS,uBAAuB,MAAM,IAAI,MAAM,MAAM;OACjH,MAAM,OAAO,uBAAO,IAAI,MAAM,wCAAwC,KAAK,oEAAoE,GAAG,EAAE,MAAM,iBAAiB,CAAC;CACnL;CACA,IAAI,MAAM,IAAI,OAAO,MAAM,OAAO,CAAC,MAAM,IAAI,gBAAgB,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,oHAAoH,GAAG,EAAE,MAAM,iBAAiB,CAAC;CAC/O,MAAM,WAAW,MAAM,IAAI,WAAW;CACtC,IAAI,CAAC,YAAY,CAAC,sCAAsC,KAAK,QAAQ,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,4FAA4F,GAAG,EAAE,MAAM,iBAAiB,CAAC;CAC/N,IAAI,MAAM,IAAI,IAAI,MAAM,SAAS,MAAM,OAAO,uBAAO,IAAI,MAAM,0EAA0E,GAAG,EAAE,MAAM,iBAAiB,CAAC;CACtK,MAAM,SAAS,SAAS,SAAS,QAAQ,KAAK,GAAG,EAAE;CACnD,IAAI,CAAC,QAAQ,aAAa,WAAW,MAAM,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,oCAAoC,QAAQ,GAAG,EAAE,MAAM,iBAAiB,CAAC;CACrJ,IAAI,mBAAmB,KAAA,GAAW;EAChC,MAAM,aAAa,MAAM,UAAU,cAAc;EACjD,IAAI,MAAM,WAAW,UAAU,KAAK,eAAe,QAAQ,WAAW,WAAW,KAAK,KAAK,WAAW,SAAS,IAAI,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,2DAA2D,GAAG,EAAE,MAAM,iBAAiB,CAAC;EAC5O,MAAM,kBAAkB,OAAO,MAAM,GAAG,EAAE;EAC1C,IAAI,CAAC,MAAM,SAAS,iBAAiB,UAAU,GAAG,MAAM,SAAS,YAAY,eAAe,CAAC,CAAC,CAAC,MAAK,SAAQ,SAAS,MAAM,SAAS,QAAQ,CAAC,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,WAAW,IAAI,CAAC,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,8FAA8F,GAAG,EAAE,MAAM,iBAAiB,CAAC;CAC5V;CACA,IAAI,OAAO,kBAAkB,QAAQ,CAAC,MAAM,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,0EAA0E,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAC9N;;AAGA,SAAgB,oBAAoB,QAAgB,MAAsB;CACxE,MAAM,OAAO,SAAS,KAAK,MAAM,EAAE;CACnC,MAAM,aAAa,KAAK,QAAQ,OAAO;CACvC,IAAI,cAAc,GAAG;CAErB,IAAI,EADW,SAAS,UAAU,SAAS,QAAQ,KAAK,MAAM,GAAG,UAAU,CAAC,CAAC,MAAK,UAAS,UAAU,UAAU,UAAU,qCAAqC,MAAM,WAAW,kCAAkC,CAAC,IACrM;CACb,sBAAsB;EAAE,GAAG;EAAQ,eAAe,KAAK,SAAS,WAAW,IAAI,QAAQ;EAAO,WAAW,OAAO,YAAY;GAAE,GAAG,OAAO;GAAW,UAAU,CAAC,IAAI;EAAE,IAAI,KAAA;CAAU,CAAC;AACrL"}

package/dist/policy.js

@@ -0,0 +1,35 @@
+import { ResearchSchema } from "./schemas.js";
+// src/policy.ts
+function parseResearch(text, channel) {
+	const content = text.trim().replace(/^```(?:json)?\s*\n?/, "").replace(/\n?```$/, "");
+	let value;
+	try {
+		value = JSON.parse(content);
+	} catch {
+		throw new Error("Host did not return a JSON verdict; no approval was inferred from text or an exit code");
+	}
+	return ResearchSchema.parse(value);
+}
+/** Honest pre-delivery differentiation and quality checklist. Store submission and review stay manual. */
+function internalQaChecklist() {
+	return [
+		"Internal QA checklist for a normal, honest local package handoff. Store submission, account setup and platform review are manual human work outside this tool; nothing here bypasses, influences or pre-approves a store reviewer.",
+		"Real value: each package has its own genuine purpose, audience and functional behavior. Identical functionality with only renamed labels is not meaningful differentiation.",
+		"Visual identity: themes, layouts, colors and interaction flows are real product choices for this app, not templated reskins produced to look different.",
+		"Developer and identity metadata: app name, title, icon, bundle/package id, keywords and description truthfully describe this app and its actual developer. Never forge identities, accounts, locations or submission sources.",
+		"Functionality: every advertised feature works and is exercised by the frozen runtime acceptance; no hidden functionality for any audience and no fabricated screenshots or evidence.",
+		"Metadata: price, region, category and description reflect the actual product. Design rationale notes, if any, are the owner's honest answers, not scripted reply templates.",
+		"Code identity: project, folder, class, function and resource names follow this project's real conventions. Do not mutate hashes, names or resource bytes solely to defeat similarity checks; that would be deceptive.",
+		"Quality gate: source, dependency and runtime proofs must be current; independent review must cover every frozen acceptance requirement with observed evidence. Only then may the artifact be handed off to a human for store submission."
+	].join("\n");
+}
+function researchPrompt(job, portfolio) {
+	const siblings = `Other same-channel products ${JSON.stringify(portfolio)}; earlier versions of this same app are its source baseline, not competing products.`;
+	return `Research only with your own host tools. Preserve the requested ${job.spec.framework} ${job.spec.platform} project and its existing architecture. ${internalQaChecklist()} ${siblings} Assess technical feasibility, dependencies, licensing, privacy and real acceptance for this local package. Return typed JSON {"viable":boolean,"distinctness":"specific honest differentiation","risks":["..."],"plan":["concrete implementation and device acceptance step"]}. Do not promise store approval and do not add unrequested features.`;
+}
+function reviewInstructions(job) {
+	return `Use an independent reviewer with fresh context when supported; otherwise disclose the limitation. Review actual source and acceptance read-only. Verified source: ${job.verifiedDigest}; dependency resolution: ${job.verifiedDependencyDigest}; actual checks: ${JSON.stringify(job.config.verification)}. ${internalQaChecklist()} Reject incomplete requirements, data loss, fake screenshots, accessibility failures, placeholders, weak tests and hidden features. Return typed JSON {"approved":boolean,"findings":["blocking issue"],"acceptanceEvidence":[{"requirement":"exact acceptance string","evidence":"file/symbol + observed command or device scenario"}]}. Cover every acceptance requirement. Reviewer identity is advisory; the Harness gates typed results and unchanged execution evidence.`;
+}
+export { internalQaChecklist, parseResearch, researchPrompt, reviewInstructions };
+
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","names":[],"sources":["../src/policy.ts"],"sourcesContent":["import { ResearchSchema } from './schemas.js';\nimport type { Job, Spec } from './schemas.js';\n\nexport function parseResearch(text: string, channel: Spec['channel']) {\n  const content = text.trim().replace(/^```(?:json)?\\s*\\n?/, '').replace(/\\n?```$/, '');\n  let value: unknown;\n  try { value = JSON.parse(content); }\n  catch { throw new Error('Host did not return a JSON verdict; no approval was inferred from text or an exit code'); }\n  return ResearchSchema.parse(value);\n}\n\n/** Honest pre-delivery differentiation and quality checklist. Store submission and review stay manual. */\nexport function internalQaChecklist(): string {\n  return [\n    'Internal QA checklist for a normal, honest local package handoff. Store submission, account setup and platform review are manual human work outside this tool; nothing here bypasses, influences or pre-approves a store reviewer.',\n    'Real value: each package has its own genuine purpose, audience and functional behavior. Identical functionality with only renamed labels is not meaningful differentiation.',\n    'Visual identity: themes, layouts, colors and interaction flows are real product choices for this app, not templated reskins produced to look different.',\n    'Developer and identity metadata: app name, title, icon, bundle/package id, keywords and description truthfully describe this app and its actual developer. Never forge identities, accounts, locations or submission sources.',\n    'Functionality: every advertised feature works and is exercised by the frozen runtime acceptance; no hidden functionality for any audience and no fabricated screenshots or evidence.',\n    'Metadata: price, region, category and description reflect the actual product. Design rationale notes, if any, are the owner\\'s honest answers, not scripted reply templates.',\n    'Code identity: project, folder, class, function and resource names follow this project\\'s real conventions. Do not mutate hashes, names or resource bytes solely to defeat similarity checks; that would be deceptive.',\n    'Quality gate: source, dependency and runtime proofs must be current; independent review must cover every frozen acceptance requirement with observed evidence. Only then may the artifact be handed off to a human for store submission.',\n  ].join('\\n');\n}\n\nexport function researchPrompt(job: Job, portfolio: Array<Pick<Spec, 'id' | 'purpose' | 'audience' | 'differentiators'>>): string {\n  const siblings = `Other same-channel products ${JSON.stringify(portfolio)}; earlier versions of this same app are its source baseline, not competing products.`;\n  return `Research only with your own host tools. Preserve the requested ${job.spec.framework} ${job.spec.platform} project and its existing architecture. ${internalQaChecklist()} ${siblings} Assess technical feasibility, dependencies, licensing, privacy and real acceptance for this local package. Return typed JSON {\"viable\":boolean,\"distinctness\":\"specific honest differentiation\",\"risks\":[\"...\"],\"plan\":[\"concrete implementation and device acceptance step\"]}. Do not promise store approval and do not add unrequested features.`;\n}\n\nexport function reviewInstructions(job: Job): string {\n  return `Use an independent reviewer with fresh context when supported; otherwise disclose the limitation. Review actual source and acceptance read-only. Verified source: ${job.verifiedDigest}; dependency resolution: ${job.verifiedDependencyDigest}; actual checks: ${JSON.stringify(job.config.verification)}. ${internalQaChecklist()} Reject incomplete requirements, data loss, fake screenshots, accessibility failures, placeholders, weak tests and hidden features. Return typed JSON {\"approved\":boolean,\"findings\":[\"blocking issue\"],\"acceptanceEvidence\":[{\"requirement\":\"exact acceptance string\",\"evidence\":\"file/symbol + observed command or device scenario\"}]}. Cover every acceptance requirement. Reviewer identity is advisory; the Harness gates typed results and unchanged execution evidence.`;\n}\n"],"mappings":";;AAGA,SAAgB,cAAc,MAAc,SAA0B;CACpE,MAAM,UAAU,KAAK,KAAK,CAAC,CAAC,QAAQ,uBAAuB,EAAE,CAAC,CAAC,QAAQ,WAAW,EAAE;CACpF,IAAI;CACJ,IAAI;EAAE,QAAQ,KAAK,MAAM,OAAO;CAAG,QAC7B;EAAE,MAAM,IAAI,MAAM,wFAAwF;CAAG;CACnH,OAAO,eAAe,MAAM,KAAK;AACnC;;AAGA,SAAgB,sBAA8B;CAC5C,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAgB,eAAe,KAAU,WAAyF;CAChI,MAAM,WAAW,+BAA+B,KAAK,UAAU,SAAS,EAAE;CAC1E,OAAO,kEAAkE,IAAI,KAAK,UAAU,GAAG,IAAI,KAAK,SAAS,0CAA0C,oBAAoB,EAAE,GAAG,SAAS;AAC/L;AAEA,SAAgB,mBAAmB,KAAkB;CACnD,OAAO,qKAAqK,IAAI,eAAe,2BAA2B,IAAI,yBAAyB,mBAAmB,KAAK,UAAU,IAAI,OAAO,YAAY,EAAE,IAAI,oBAAoB,EAAE;AAC9U"}

package/dist/preflight.js

@@ -1,6 +1,6 @@
 import { toError } from "./schemas.js";
-import { run } from "./process.js";
 import { expandArgv } from "./config.js";
+import { run } from "./process.js";
 // src/preflight.ts
 function prerequisiteFailure(argv, reason, detail, cause) {
 	return Object.assign(new Error(`Prerequisite ${JSON.stringify(argv)} ${detail}. Restore the configured worker environment before retrying.`, { cause }), {

package/dist/process.js

@@ -1,8 +1,8 @@
 import { toError } from "./schemas.js";
-import { randomUUID } from "node:crypto";
-import { dirname } from "node:path";
-import { spawn, spawnSync } from "node:child_process";
 import { closeSync, mkdirSync, openSync, readFileSync, writeSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
+import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 // src/process.ts
 const COMMAND_TOKEN = "APPLE_APP_FACTORY_COMMAND_TOKEN";

package/dist/project-profiles.js

@@ -0,0 +1,163 @@
+import { inside } from "./config.js";
+import { parseGoManifest } from "./go-dependencies.js";
+import { generatedModulePaths, isGeneratedPath } from "./dependencies.js";
+import { lstatSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { parseDocument } from "yaml";
+// src/project-profiles.ts
+function file(root, path) {
+	const absolute = inside(root, path);
+	const stat = lstatSync(absolute, { throwIfNoEntry: false });
+	if (!stat) return void 0;
+	if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`Project manifest must be a regular source file: ${path}`);
+	return readFileSync(absolute, "utf8");
+}
+function json(root, path, comments = false) {
+	let text = file(root, path);
+	if (text === void 0) return void 0;
+	if (comments) text = text.replace(/"(?:\\.|[^"\\])*"|\/\*[\s\S]*?\*\/|\/\/[^\r\n]*/g, (token) => token.startsWith("/") ? "" : token);
+	const value = JSON.parse(text);
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`Expected a project manifest object: ${path}`);
+	return value;
+}
+function directories(root, framework, current = "", moduleOutputs = [...generatedModulePaths(root, framework)]) {
+	const result = [current];
+	for (const entry of readdirSync(join(root, current), { withFileTypes: true })) {
+		const path = current ? `${current}/${entry.name}` : entry.name;
+		if (isGeneratedPath(path, framework) || moduleOutputs.some((output) => path === output || path.startsWith(`${output}/`))) continue;
+		const stat = lstatSync(join(root, path));
+		if (stat.isSymbolicLink()) throw new Error(`Project source symlinks are not trusted: ${path}`);
+		if (stat.isDirectory()) result.push(...directories(root, framework, path, moduleOutputs));
+	}
+	return result;
+}
+/** The caller resolves project.directory; this function never generates or ejects a project. */
+function assertProject(root, spec) {
+	const fail = (manifest) => {
+		throw new Error(`${spec.framework} build completion requires ${manifest} in the project directory`);
+	};
+	if (spec.platform === "macos" && spec.framework !== "mygo") fail("an existing supported iOS or Android platform; macOS is supported only for MyGo");
+	if (spec.framework === "mygo") {
+		if (spec.platform !== "macos") fail("the macOS platform");
+		const mod = file(root, "go.mod");
+		if (mod === void 0 || !parseGoManifest(mod).requires.has("github.com/egoist/mygo")) fail("a go.mod requiring github.com/egoist/mygo");
+		const native = json(root, "mygo.json");
+		const web = file(root, "mygo.config.ts");
+		if (native === void 0 === (web === void 0)) fail("exactly one mygo.json or mygo.config.ts");
+		if (web !== void 0 && !json(root, "package.json") && !json(root, "frontend/package.json")) fail("the original package.json or frontend/package.json for mygo.config.ts");
+		return;
+	}
+	if (spec.framework === "flutter") {
+		const text = file(root, "pubspec.yaml");
+		if (!text) fail("a Flutter pubspec.yaml");
+		const document = parseDocument(text);
+		if (document.errors.length) throw new Error(`Invalid pubspec.yaml: ${document.errors.map((error) => error.message).join("; ")}`);
+		const value = document.toJS();
+		if (!value || typeof value.name !== "string" || value.dependencies?.flutter?.sdk !== "flutter") fail("a named pubspec.yaml with dependencies.flutter.sdk: flutter");
+		return;
+	}
+	if (spec.framework === "android-java") {
+		if (spec.platform !== "android") fail("the Android platform");
+		const settings = file(root, "settings.gradle") ?? file(root, "settings.gradle.kts");
+		const application = directories(root, spec.framework).some((directory) => {
+			const prefix = directory ? `${directory}/` : "";
+			if ((file(root, `${prefix}build.gradle`) ?? file(root, `${prefix}build.gradle.kts`)) === void 0) return false;
+			const manifest = file(root, `${prefix}src/main/AndroidManifest.xml`)?.replace(/<!--[\s\S]*?-->/g, "");
+			return !!manifest && /<manifest\b/.test(manifest) && /<application\b/.test(manifest) && /<\/manifest\s*>/.test(manifest);
+		});
+		if (settings === void 0 || !application) fail("Gradle settings/build files and an application module src/main/AndroidManifest.xml");
+		return;
+	}
+	if (spec.framework === "swift") {
+		if (spec.platform !== "ios") fail("the iOS platform");
+		const swift = file(root, "Package.swift");
+		if (swift && /swift-tools-version\s*:/.test(swift) && /\bPackage\s*\(/.test(swift)) return;
+		for (const directory of directories(root, spec.framework)) if (directory.endsWith(".xcodeproj")) {
+			const project = file(root, `${directory}/project.pbxproj`);
+			if (project && /\bPBXProject\b/.test(project)) return;
+		}
+		fail("a Swift Package.swift or an Xcode .xcodeproj/project.pbxproj");
+	}
+	const pkg = json(root, "package.json");
+	const dependencies = {
+		...pkg?.dependencies,
+		...pkg?.devDependencies
+	};
+	if (spec.framework === "uni-app") {
+		const source = json(root, "src/manifest.json", true) ? "src/" : "";
+		const manifest = json(root, `${source}manifest.json`, true);
+		const pages = json(root, `${source}pages.json`, true);
+		if (!manifest || !Array.isArray(pages?.pages) || !pages.pages.length) fail("manifest.json and nonempty pages.json at the root or under src/");
+		const cli = typeof dependencies["@dcloudio/uni-app"] === "string" && !!dependencies["@dcloudio/uni-app"];
+		const classic = !!file(root, `${source}App.vue`) && !!(file(root, `${source}main.js`) ?? file(root, `${source}main.ts`));
+		if (!cli && !classic) fail("a uni-app CLI package.json or HBuilderX App.vue and main.js/main.ts");
+		return;
+	}
+	const required = spec.framework === "react-native" ? "react-native" : "expo";
+	if (!pkg || typeof dependencies[required] !== "string" || !dependencies[required]) fail(`package.json declaring ${required}`);
+}
+function buildInstructions(spec) {
+	return `${`Build the ${spec.platform} application using the ${spec.framework} stack. ${spec.project?.sourceDir ? "Preserve the imported project and its existing native structure." : "Preserve any existing project, including a prepared predecessor; generate a real runnable project only when none exists in the designated project directory."}`}\n${{
+		flutter: "Use a Flutter pubspec.yaml, Dart sources and the selected platform runner. Resolve dependencies with flutter pub get; keep pubspec.lock. Do not modify the Flutter SDK.",
+		"android-java": "Use a Java Android application with Gradle settings/build files and AndroidManifest.xml. Keep the Gradle wrapper and dependency locks; use the existing application module rather than rewriting it.",
+		swift: "Use the existing Xcode project or Swift package, Swift sources and iOS application configuration. Keep Package.resolved and Podfile.lock when used. Do not replace an existing Xcode project with a package.",
+		"react-native": "Use package.json with react-native and the existing iOS/Android native projects. Keep the package-manager lockfile and native dependency locks. Do not migrate to Expo or regenerate native projects.",
+		expo: "Use package.json with expo and the existing Expo application configuration. Preserve managed or prebuilt structure; do not force expo prebuild or eject. Cloud builds require the owner-configured permission and packaging commands.",
+		"uni-app": "Preserve either the existing CLI package.json with @dcloudio/uni-app or the classic HBuilderX App.vue/main.js/main.ts project without requiring npm. Keep manifest.json/pages.json (root or src) and existing native structure; use the owner-configured HBuilderX/CLI Android/iOS packager, not a fabricated artifact.",
+		mygo: "Preserve native-UI Go-only projects with go.mod and mygo.json, or existing web projects with go.mod, mygo.config.ts and their original package.json (at the root or under frontend/) and package manager; keep exactly one MyGo config and require github.com/egoist/mygo in go.mod. Native projects need neither package.json nor Bun nor Xcode. Do not rewrite a web project or require Bun solely because its config is TypeScript; preserve its existing runtime and frontend scripts. Preserve the pinned MyGo tool/module version in go.mod; do not use @latest or install tools automatically. Prepare go.sum, any go.work/go.work.sum, frontend dependency locks and generated frontend bindings before proof, preserving the original frontend build process. Use Go vet/tests plus an owner-implemented real macOS desktop acceptance harness that launches and drives the actual app; go test or a headless view test alone is not desktop acceptance, and no iOS simulator is involved. Never generate a stub acceptance command. Packaging stays local-only through the frozen direct go tool mygo build command (or owner-configured pinned direct MyGo invocation), with -sign - and -skip-notarize; never upload, notarize or access signing keychains. Use the frozen output path, architecture and app/dmg target; do not replace the owner packaging profile."
+	}[spec.framework]}\nImplement the acceptance criteria, run the configured checks and runtime evidence commands, and leave packaging to the frozen owner command profile. Never replace checks with no-ops or claim unobserved SDK/build results.`;
+}
+function doctorCommands(framework, platform) {
+	const commands = [];
+	if (framework === "mygo") {
+		if (platform !== "macos") throw new Error("MyGo doctor supports only macOS");
+		return [
+			{
+				name: "Go",
+				argv: ["go", "version"]
+			},
+			{
+				name: "macOS code signing",
+				argv: ["/usr/bin/which", "codesign"]
+			},
+			{
+				name: "macOS disk images",
+				argv: ["hdiutil", "help"]
+			}
+		];
+	}
+	if (platform === "macos") throw new Error("macOS doctor supports only MyGo");
+	if (framework === "flutter") commands.push({
+		name: "Flutter",
+		argv: ["flutter", "--version"]
+	});
+	else if (framework === "swift") commands.push({
+		name: "Swift",
+		argv: ["swift", "--version"]
+	});
+	else if (framework === "react-native" || framework === "expo") commands.push({
+		name: "Node.js",
+		argv: ["node", "--version"]
+	}, {
+		name: "npm",
+		argv: ["npm", "--version"]
+	});
+	if (platform === "ios") commands.push({
+		name: "Xcode",
+		argv: ["xcodebuild", "-version"]
+	}, {
+		name: "Xcode tools",
+		argv: ["xcrun", "--version"]
+	});
+	else commands.push({
+		name: "Java",
+		argv: ["java", "-version"]
+	}, {
+		name: "Android platform tools",
+		argv: ["adb", "version"]
+	});
+	return commands;
+}
+export { assertProject, buildInstructions, doctorCommands };
+
+//# sourceMappingURL=project-profiles.js.map