caveat-cli 0.21.0 → 0.21.1

package/dist/managed-deployment.js

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+import { createRequire as __caveat_createRequire } from 'node:module';
+const require = __caveat_createRequire(import.meta.url);
+
+// ../../packages/core/src/managedDeploymentRuntime.ts
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
+import { join as join2, resolve, relative, sep } from "node:path";
+import { homedir } from "node:os";
+
+// ../../packages/core/src/platform.ts
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { join, isAbsolute, win32 } from "node:path";
+function isWindows(platform = process.platform) {
+  return platform === "win32";
+}
+
+// ../../packages/core/src/managedDeploymentRuntime.ts
+var sha = (data) => createHash2("sha256").update(data).digest("hex");
+var releasePattern = /^\d+\.\d+\.\d+-[a-f0-9]{20}$/;
+var versionPattern = /^\d+\.\d+\.\d+$/;
+var MAX_FILES = 4096;
+function fail(reason) {
+  throw Error(`managed_deployment_${reason}`);
+}
+function canonicalHome(userHome = homedir()) {
+  const path = resolve(userHome);
+  return existsSync(path) ? realpathSync(path) : path;
+}
+function managedDeploymentPaths(userHome = homedir()) {
+  const root = join2(canonicalHome(userHome), ".local", "share", "caveat", "managed-v1");
+  return {
+    root,
+    releases: join2(root, "releases"),
+    entry: join2(root, "entry"),
+    launcher: join2(root, "entry", "caveat.mjs"),
+    runtime: join2(root, "entry", "managed-deployment.js"),
+    pointer: join2(root, "active.json"),
+    lock: join2(root, "installer.lock")
+  };
+}
+function ownerStat(path, directory, options) {
+  const s = lstatSync(path);
+  if (s.isSymbolicLink() || (directory ? !s.isDirectory() : !s.isFile())) fail("unsafe_path");
+  if (!(options.windows ?? isWindows()) && ((s.mode & 18) !== 0 || typeof process.getuid === "function" && s.uid !== process.getuid())) fail("unsafe_owner_or_mode");
+  return s;
+}
+function assertAncestors(options) {
+  const paths = managedDeploymentPaths(options.userHome);
+  const home = canonicalHome(options.userHome);
+  ownerStat(home, true, options);
+  let path = home;
+  for (const part of relative(home, paths.root).split(sep)) {
+    path = join2(path, part);
+    ownerStat(path, true, options);
+  }
+  if (realpathSync(paths.root) !== paths.root) fail("root_redirected");
+  return paths;
+}
+function checkReleaseMetadata(pointer, options) {
+  const paths = managedDeploymentPaths(options.userHome);
+  if (pointer.schema !== 1 || !releasePattern.test(pointer.release) || !/^[a-f0-9]{64}$/.test(pointer.manifestSha256)) fail("invalid_pointer");
+  const releaseRoot = join2(paths.releases, pointer.release);
+  ownerStat(paths.releases, true, options);
+  ownerStat(releaseRoot, true, options);
+  const manifestPath = join2(releaseRoot, "manifest.json");
+  if (ownerStat(manifestPath, false, options).size > 1024 * 1024) fail("manifest_too_large");
+  const bytes = readFileSync(manifestPath);
+  if (sha(bytes) !== pointer.manifestSha256) fail("manifest_changed");
+  const manifest = JSON.parse(bytes.toString());
+  if (manifest.schema !== 1 || !versionPattern.test(manifest.version) || !pointer.release.startsWith(manifest.version + "-") || !Array.isArray(manifest.files) || manifest.files.length > MAX_FILES) fail("invalid_manifest");
+  const packageRoot = join2(releaseRoot, "package");
+  ownerStat(packageRoot, true, options);
+  ownerStat(join2(packageRoot, "dist"), true, options);
+  const cliScriptPath = join2(packageRoot, "dist", "caveat.js");
+  ownerStat(cliScriptPath, false, options);
+  return { pointer, manifest, packageRoot, cliScriptPath, launcher: paths.launcher };
+}
+function readManagedDeployment(options = {}) {
+  const paths = assertAncestors(options);
+  ownerStat(paths.entry, true, options);
+  ownerStat(paths.launcher, false, options);
+  ownerStat(paths.runtime, false, options);
+  if (ownerStat(paths.pointer, false, options).size > 1024) fail("pointer_too_large");
+  const pointer = JSON.parse(readFileSync(paths.pointer, "utf8"));
+  if (Object.keys(pointer).sort().join(",") !== "manifestSha256,release,schema") fail("invalid_pointer");
+  return checkReleaseMetadata(pointer, options);
+}
+function managedRegistrationPath(cliScriptPath, options = {}) {
+  const paths = managedDeploymentPaths(options.userHome);
+  if (!existsSync(paths.pointer)) return cliScriptPath;
+  const active = readManagedDeployment(options);
+  return active.launcher;
+}
+var managedDeploymentInternal = { sha, fail, canonicalHome, ownerStat, assertAncestors, checkReleaseMetadata, versionPattern, releasePattern };
+export {
+  managedDeploymentInternal,
+  managedDeploymentPaths,
+  managedRegistrationPath,
+  readManagedDeployment
+};
+//# sourceMappingURL=managed-deployment.js.map

package/dist/managed-deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../packages/core/src/managedDeploymentRuntime.ts","../../../packages/core/src/platform.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';\nimport { join, resolve, relative, isAbsolute, sep } from 'node:path';\nimport { homedir } from 'node:os';\nimport { isWindows } from './platform.js';\nimport type { runWindowsAcl } from './privateWindowsAcl.js';\n\nexport type FileRecord = { path: string; sha256: string; bytes: number };\nexport type Manifest = { schema: 1; version: string; files: FileRecord[] };\nexport type Pointer = { schema: 1; release: string; manifestSha256: string };\nexport type ManagedRuntimeOptions = { userHome?: string; windows?: boolean; aclRunner?: typeof runWindowsAcl };\nconst sha = (data: string | Buffer) => createHash('sha256').update(data).digest('hex');\nconst releasePattern = /^\\d+\\.\\d+\\.\\d+-[a-f0-9]{20}$/;\nconst versionPattern = /^\\d+\\.\\d+\\.\\d+$/;\nconst MAX_FILES = 4096;\nfunction fail(reason: string): never { throw Error(`managed_deployment_${reason}`); }\nfunction canonicalHome(userHome = homedir()) {\n  const path=resolve(userHome);\n  // macOS /var -> /private/var and other OS-level aliases may precede the\n  // user profile. Descendants of the canonical home still reject redirects.\n  return existsSync(path) ? realpathSync(path) : path;\n}\nexport function managedDeploymentPaths(userHome = homedir()) {\n  const root = join(canonicalHome(userHome), '.local', 'share', 'caveat', 'managed-v1');\n  return { root, releases: join(root, 'releases'), entry: join(root, 'entry'),\n    launcher: join(root, 'entry', 'caveat.mjs'), runtime: join(root, 'entry', 'managed-deployment.js'),\n    pointer: join(root, 'active.json'), lock: join(root, 'installer.lock') };\n}\nfunction ownerStat(path: string, directory: boolean, options: ManagedRuntimeOptions) {\n  const s = lstatSync(path);\n  if (s.isSymbolicLink() || (directory ? !s.isDirectory() : !s.isFile())) fail('unsafe_path');\n  if (!(options.windows ?? isWindows()) && ((s.mode & 0o022) !== 0 || (typeof process.getuid === 'function' && s.uid !== process.getuid()))) fail('unsafe_owner_or_mode');\n  return s;\n}\nfunction assertAncestors(options: ManagedRuntimeOptions) {\n  const paths = managedDeploymentPaths(options.userHome);\n  const home = canonicalHome(options.userHome);\n  ownerStat(home, true, options);\n  let path = home;\n  for (const part of relative(home, paths.root).split(sep)) {\n    path = join(path, part); ownerStat(path, true, options);\n  }\n  if (realpathSync(paths.root) !== paths.root) fail('root_redirected');\n  return paths;\n}\nfunction checkReleaseMetadata(pointer: Pointer, options: ManagedRuntimeOptions) {\n  const paths = managedDeploymentPaths(options.userHome);\n  if (pointer.schema !== 1 || !releasePattern.test(pointer.release) || !/^[a-f0-9]{64}$/.test(pointer.manifestSha256)) fail('invalid_pointer');\n  const releaseRoot = join(paths.releases, pointer.release);\n  ownerStat(paths.releases, true, options); ownerStat(releaseRoot, true, options);\n  const manifestPath = join(releaseRoot, 'manifest.json');\n  if (ownerStat(manifestPath, false, options).size > 1024 * 1024) fail('manifest_too_large');\n  const bytes = readFileSync(manifestPath);\n  if (sha(bytes) !== pointer.manifestSha256) fail('manifest_changed');\n  const manifest = JSON.parse(bytes.toString()) as Manifest;\n  if (manifest.schema !== 1 || !versionPattern.test(manifest.version) || !pointer.release.startsWith(manifest.version + '-') || !Array.isArray(manifest.files) || manifest.files.length > MAX_FILES) fail('invalid_manifest');\n  const packageRoot = join(releaseRoot, 'package');\n  ownerStat(packageRoot, true, options); ownerStat(join(packageRoot, 'dist'), true, options);\n  const cliScriptPath = join(packageRoot, 'dist', 'caveat.js'); ownerStat(cliScriptPath, false, options);\n  return { pointer, manifest, packageRoot, cliScriptPath, launcher: paths.launcher };\n}\n/** Startup checks only: no process creation or package-wide content scan. */\nexport function readManagedDeployment(options: ManagedRuntimeOptions = {}) {\n  const paths = assertAncestors(options);\n  ownerStat(paths.entry, true, options); ownerStat(paths.launcher, false, options); ownerStat(paths.runtime, false, options);\n  if (ownerStat(paths.pointer, false, options).size > 1024) fail('pointer_too_large');\n  const pointer = JSON.parse(readFileSync(paths.pointer, 'utf8')) as Pointer;\n  if (Object.keys(pointer).sort().join(',') !== 'manifestSha256,release,schema') fail('invalid_pointer');\n  return checkReleaseMetadata(pointer, options);\n}\n/** Direct npm callers register the active stable entry when it owns this package. */\nexport function managedRegistrationPath(cliScriptPath: string, options: ManagedRuntimeOptions = {}) {\n  const paths = managedDeploymentPaths(options.userHome);\n  if (!existsSync(paths.pointer)) return cliScriptPath;\n  const active = readManagedDeployment(options);\n  // A managed installation explicitly selects its active release. An npm-bin\n  // caller must not rewrite registrations back to its own version directory.\n  return active.launcher;\n}\n\nexport const managedDeploymentInternal = { sha, fail, canonicalHome, ownerStat, assertAncestors, checkReleaseMetadata, versionPattern, releasePattern };\n","import type { Stats } from 'node:fs';\nimport { spawnSync } from 'node:child_process';\nimport { XMLParser } from 'fast-xml-parser';\nimport { createHash } from 'node:crypto';\nimport { join, isAbsolute, win32 } from 'node:path';\n\n/**\n * OS 依存の判定はこのモジュールに集約する。他のファイルで\n * `process.platform` / `win32` を直接分岐しない(データとして記録する\n * fingerprint 等は除く)。全関数は platform を引数で受けてテスト可能にする。\n */\n\nexport function isWindows(platform: NodeJS.Platform = process.platform): boolean {\n  return platform === 'win32';\n}\n\n/**\n * env を考慮した Windows 判定。`OS=Windows_NT` は Windows native shell が必ず持つ\n * 環境変数で、テストが env 注入だけで Windows 経路を選べるようにする\n * (runtimeErrors が独自に持っていた判定をここへ集約。v0.17.5)。\n */\nexport function isWindowsEnv(\n  env: NodeJS.ProcessEnv,\n  platform: NodeJS.Platform = process.platform,\n): boolean {\n  return env.OS === 'Windows_NT' || isWindows(platform);\n}\n\n/**\n * owner-only 所有チェック。Node の POSIX mode/uid フィールドは Windows では\n * ACL のビューにならないため、Windows は構造チェック(呼び出し側のマーカー・\n * スキーマ検証や親ディレクトリの ACL)に委ねて素通しする。\n */\nexport function isPrivateOwnerStat(\n  stat: Stats,\n  uid: number | undefined,\n  platform: NodeJS.Platform = process.platform,\n): boolean {\n  return isWindows(platform)\n    || ((stat.mode & 0o077) === 0 && (uid === undefined || stat.uid === uid));\n}\n\n/**\n * Windows native Codex hook command は quoted Node パスを PowerShell で\n * 実行するため call operator `&` が必要(v0.17.1)。POSIX は不要。\n */\nexport function powershellCallPrefix(platform: NodeJS.Platform = process.platform): string {\n  return isWindows(platform) ? '& ' : '';\n}\n\n/** PATH 走査で node 実行ファイルとして探す名前の候補。 */\nexport function nodeExecutableNames(platform: NodeJS.Platform = process.platform): string[] {\n  return isWindows(platform)\n    ? ['node.exe', 'node.cmd', 'node.bat', 'node']\n    : ['node'];\n}\n\n/**\n * ファイルシステムが case-insensitive な Windows ではパス比較用に小文字化する。\n * 呼び出し側で区切り文字の正規化(\\\\ → /)を済ませてから渡す。\n */\nexport function normalizePathCase(\n  normalizedPath: string,\n  platform: NodeJS.Platform = process.platform,\n): string {\n  return isWindows(platform) ? normalizedPath.toLowerCase() : normalizedPath;\n}\n\nexport interface ScheduleCommand { command: string; args: string[] }\n/** Resolve the current token, never a guessed USERDOMAIN/account pair. */\nexport function nativeScheduleUserId(\n  username: string,\n  platform: NodeJS.Platform = process.platform,\n  run: (command: ScheduleCommand) => { status: number; stdout: string } = command => {\n    const result = spawnSync(command.command, command.args, { encoding: 'utf8', timeout: 30_000, windowsHide: true });\n    if (result.error) throw Error('schedule_identity_spawn_failed');\n    return { status: result.status ?? -1, stdout: result.stdout ?? '' };\n  },\n  systemRoot = process.env.SystemRoot,\n): string {\n  if (!isWindows(platform)) return username;\n  let phase: 'root' | 'spawn' | 'exit' | 'output' = 'root';\n  try {\n    if (!systemRoot || !win32.isAbsolute(systemRoot) || /[\\x00-\\x1f]/.test(systemRoot)) throw Error('schedule_system_root_unavailable');\n    phase = 'spawn';\n    const result = run({ command: win32.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'), args: ['-NoProfile', '-NonInteractive', '-Command',\n      \"$ErrorActionPreference='Stop';try{[Console]::Write([System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value);exit 0}catch{exit 1}\"] });\n    phase = 'exit';\n    if (result.status !== 0) throw Error('schedule_identity_exit_failed');\n    phase = 'output';\n    const sid = result.stdout.trim();\n    if (/^S-1-\\d+(?:-\\d+){1,15}$/.test(sid)) return sid;\n  } catch { /* Never fall back to environment/account-name guesses. */ }\n  throw Error(`schedule_user_identity_unavailable_${phase}`);\n}\n\nexport interface NativeSyncSchedule {\n  id: string;\n  kind: 'systemd-user' | 'launchd-user' | 'windows-task';\n  files: { path: string; content: string; encoding?: 'utf16le' }[];\n  query: ScheduleCommand;\n  inspect: ScheduleCommand;\n  install: ScheduleCommand[];\n  remove: ScheduleCommand[];\n  reload: ScheduleCommand[];\n  argv: string[];\n}\n/** Exact persisted bytes; absent encoding preserves legacy UTF-8 ownership. */\nexport function nativeScheduleFileBytes(file: NativeSyncSchedule['files'][number]): Buffer {\n  if (file.encoding === 'utf16le') return Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(file.content, 'utf16le')]);\n  if (file.encoding !== undefined) throw Error('schedule_definition_encoding_invalid');\n  return Buffer.from(file.content, 'utf8');\n}\n\nexport interface NativeSyncScheduleOptions {\n  caveatHome: string; userHome: string; nodePath: string; cliPath: string;\n  platform?: NodeJS.Platform; uid?: number; userId?: string;\n}\n\nconst xml = (value: string) => value.replace(/[&<>\"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '\"': '&quot;', \"'\": '&apos;' })[c]!);\nconst unitArg = (value: string) => `\"${value.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"').replace(/%/g, '%%').replace(/\\$/g, () => '$$')}\"`;\n/** Standard Windows argv quoting, without invoking cmd.exe or PowerShell. */\nexport function quoteWindowsArgument(value: string): string {\n  return `\"${value.replace(/(\\\\*)\"/g, '$1$1\\\\\"').replace(/(\\\\+)$/g, '$1$1')}\"`;\n}\n\nexport function nativeSyncSchedule(opts: NativeSyncScheduleOptions): NativeSyncSchedule {\n  const platform = opts.platform ?? process.platform;\n  const absolute = platform === 'win32' ? win32.isAbsolute : isAbsolute;\n  for (const value of [opts.caveatHome, opts.userHome, opts.nodePath, opts.cliPath]) {\n    if (!absolute(value) || /[\\x00-\\x1f]/.test(value)) throw Error('schedule_absolute_path_required');\n  }\n  const suffix = createHash('sha256').update(normalizePathCase(opts.caveatHome, platform)).digest('hex').slice(0, 16);\n  const id = `caveat-autosync-${suffix}`;\n  const argv = [opts.nodePath, opts.cliPath, 'autosync', 'run', '--json', '--caveat-home', opts.caveatHome, '--user-home', opts.userHome];\n  const command = (name: string, ...args: string[]): ScheduleCommand => ({ command: name, args });\n  if (platform === 'linux') {\n    const service = join(opts.userHome, '.config', 'systemd', 'user', `${id}.service`);\n    const timer = join(opts.userHome, '.config', 'systemd', 'user', `${id}.timer`);\n    return { id, kind: 'systemd-user', argv, files: [\n      { path: service, content: `[Unit]\\nDescription=Caveat private knowledge reception\\n[Service]\\nType=oneshot\\nTimeoutStartSec=10min\\nExecStart=${argv.map(unitArg).join(' ')}\\nSuccessExitStatus=2\\n` },\n      { path: timer, content: `[Unit]\\nDescription=Caveat reception timer\\n[Timer]\\nOnBootSec=60s\\nOnUnitInactiveSec=60s\\nUnit=${id}.service\\n[Install]\\nWantedBy=timers.target\\n` },\n    ], query: command('systemctl', '--user', 'is-active', `${id}.timer`),\n    inspect: command('systemctl', '--user', 'show', `${id}.timer`, '--property=LoadState', '--value'),\n    install: [command('systemctl', '--user', 'link', service, timer), command('systemctl', '--user', 'daemon-reload'), command('systemctl', '--user', 'enable', '--now', `${id}.timer`)],\n    remove: [command('systemctl', '--user', 'stop', `${id}.timer`, `${id}.service`), command('systemctl', '--user', 'disable', `${id}.timer`, `${id}.service`)],\n    reload: [command('systemctl', '--user', 'daemon-reload')] };\n  }\n  if (platform === 'darwin') {\n    if (!Number.isInteger(opts.uid) || opts.uid! < 0) throw Error('schedule_uid_required');\n    const label = `dev.caveat.${id}`;\n    const file = join(opts.userHome, 'Library', 'LaunchAgents', `${label}.plist`);\n    const domain = `gui/${opts.uid}`;\n    return { id: label, kind: 'launchd-user', argv, files: [{ path: file, content: `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n<plist version=\"1.0\"><dict><key>Label</key><string>${label}</string><key>ProgramArguments</key><array>${argv.map(a => `<string>${xml(a)}</string>`).join('')}</array><key>StartInterval</key><integer>60</integer></dict></plist>\\n` }],\n      query: command('launchctl', 'print', `${domain}/${label}`),\n      inspect: command('launchctl', 'print', `${domain}/${label}`),\n      install: [command('launchctl', 'bootstrap', domain, file)],\n      remove: [command('launchctl', 'bootout', `${domain}/${label}`)], reload: [] };\n  }\n  if (platform === 'win32') {\n    if (!opts.userId || /[\\x00-\\x1f]/.test(opts.userId)) throw Error('schedule_user_id_required');\n    const file = join(opts.caveatHome, 'sync', `${id}.xml`);\n    // schtasks imports a BOM-marked UTF-16LE file, matching its Unicode XML\n    // declaration; BOM-less UTF-8 corrupted non-ASCII paths on Windows.\n    // Daily repetition avoids locale-sensitive date arguments to schtasks.\n    const content = `<?xml version=\"1.0\" encoding=\"UTF-16\"?>\\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\"><RegistrationInfo><Description>Caveat private knowledge reception ${id}</Description></RegistrationInfo><Triggers><CalendarTrigger><Repetition><Interval>PT1M</Interval><Duration>P1D</Duration><StopAtDurationEnd>false</StopAtDurationEnd></Repetition><StartBoundary>2020-01-01T00:00:00</StartBoundary><Enabled>true</Enabled><ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay></CalendarTrigger></Triggers><Principals><Principal id=\"CurrentUser\"><UserId>${xml(opts.userId)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals><Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries><StopIfGoingOnBatteries>false</StopIfGoingOnBatteries><ExecutionTimeLimit>PT10M</ExecutionTimeLimit><Enabled>true</Enabled></Settings><Actions Context=\"CurrentUser\"><Exec><Command>${xml(opts.nodePath)}</Command><Arguments>${xml(argv.slice(1).map(quoteWindowsArgument).join(' '))}</Arguments></Exec></Actions></Task>\\n`;\n    return { id, kind: 'windows-task', argv, files: [{ path: file, content, encoding: 'utf16le' }],\n      query: command('powershell.exe', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(\n        `$ErrorActionPreference = 'Stop'; try { $scheduler = New-Object -ComObject Schedule.Service; $scheduler.Connect(); $task = $scheduler.GetFolder('\\\\').GetTask('${id}'); $bytes = (New-Object System.Text.UTF8Encoding($false)).GetBytes($task.Xml); $stdout = [Console]::OpenStandardOutput(); $stdout.Write($bytes, 0, $bytes.Length); $stdout.Flush(); exit 0 } catch { exit 1 }`, 'utf16le').toString('base64')),\n      inspect: command('powershell.exe', '-NoProfile', '-NonInteractive', '-Command',\n        `try { $scheduler = New-Object -ComObject Schedule.Service; $scheduler.Connect(); $null = $scheduler.GetFolder('\\\\').GetTask('${id}'); exit 0 } catch { $failure = $_.Exception; while ($failure.InnerException) { $failure = $failure.InnerException }; if ($failure.HResult -eq -2147024894) { exit 3 }; exit 1 }`),\n      install: [command('schtasks.exe', '/Create', '/TN', id, '/XML', file)],\n      remove: [command('schtasks.exe', '/Delete', '/TN', id, '/F')], reload: [] };\n  }\n  throw Error('schedule_platform_unsupported');\n}\n\n/** Presence only; command failures are not a successful registration. */\nexport function nativeSchedulePresent(kind: NativeSyncSchedule['kind'], status: number, stdout: string): boolean {\n  if (kind === 'systemd-user') {\n    if (stdout.trim() === 'loaded') return true;\n    if (stdout.trim() === 'not-found') return false;\n    throw Error('schedule_inspection_failed');\n  }\n  if (status === 0) return true;\n  if (kind === 'launchd-user' && status === 113) return false;\n  // The fixed COM probe maps only HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND)\n  // to 3. Access denial/service errors must never mean an absent task.\n  if (kind === 'windows-task' && status === 3) return false;\n  throw Error('schedule_inspection_failed');\n}\n\n/** Compare the native readback without depending on locale-specific error text. */\nexport function nativeScheduleReadbackMatches(plan: NativeSyncSchedule, stdout: string): boolean {\n  if (plan.kind !== 'windows-task') return true;\n  try {\n    const parser = new XMLParser({ ignoreAttributes: false, removeNSPrefix: true, trimValues: false, parseTagValue: false });\n    const actual = parser.parse(stdout).Task;\n    const expected = parser.parse(plan.files[0]!.content).Task;\n    // Task Scheduler exports omit these schema defaults. Explicit changes still fail.\n    // https://learn.microsoft.com/windows/win32/taskschd/task-scheduler-schema\n    const defaulted = (value: unknown, fallback: string) => value === undefined ? fallback : value;\n    const triggerFields = (task: typeof actual) => {\n      const trigger = task.Triggers.CalendarTrigger;\n      return [trigger.StartBoundary, defaulted(trigger.Enabled, 'true'), trigger.ScheduleByDay.DaysInterval,\n        trigger.Repetition.Interval, trigger.Repetition.Duration, defaulted(trigger.Repetition.StopAtDurationEnd, 'false')];\n    };\n    const values = (task: typeof actual) => [task.Actions.Exec.Command, task.Actions.Exec.Arguments,\n      ...triggerFields(task), task.Principals.Principal.LogonType, defaulted(task.Principals.Principal.RunLevel, 'LeastPrivilege'),\n      task.Settings.MultipleInstancesPolicy, task.Settings.ExecutionTimeLimit, defaulted(task.Settings.Enabled, 'true')];\n    return JSON.stringify(values(actual)) === JSON.stringify(values(expected));\n  } catch { return false; }\n}\n\n/** systemd can load linked units before enabling their timer succeeds. */\nexport function nativeScheduleCanRecover(plan: NativeSyncSchedule, readback: () => boolean): boolean {\n  return plan.kind === 'systemd-user' || readback();\n}\n"],"mappings":";;;;;AAAA,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,YAAY,WAAW,cAAc,oBAAoB;AAClE,SAAS,QAAAC,OAAM,SAAS,UAAsB,WAAW;AACzD,SAAS,eAAe;;;ACFxB,SAAS,iBAAiB;AAE1B,SAAS,kBAAkB;AAC3B,SAAS,MAAM,YAAY,aAAa;AAQjC,SAAS,UAAU,WAA4B,QAAQ,UAAmB;AAC/E,SAAO,aAAa;AACtB;;;ADHA,IAAM,MAAM,CAAC,SAA0BC,YAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AACrF,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AACvB,IAAM,YAAY;AAClB,SAAS,KAAK,QAAuB;AAAE,QAAM,MAAM,sBAAsB,MAAM,EAAE;AAAG;AACpF,SAAS,cAAc,WAAW,QAAQ,GAAG;AAC3C,QAAM,OAAK,QAAQ,QAAQ;AAG3B,SAAO,WAAW,IAAI,IAAI,aAAa,IAAI,IAAI;AACjD;AACO,SAAS,uBAAuB,WAAW,QAAQ,GAAG;AAC3D,QAAM,OAAOC,MAAK,cAAc,QAAQ,GAAG,UAAU,SAAS,UAAU,YAAY;AACpF,SAAO;AAAA,IAAE;AAAA,IAAM,UAAUA,MAAK,MAAM,UAAU;AAAA,IAAG,OAAOA,MAAK,MAAM,OAAO;AAAA,IACxE,UAAUA,MAAK,MAAM,SAAS,YAAY;AAAA,IAAG,SAASA,MAAK,MAAM,SAAS,uBAAuB;AAAA,IACjG,SAASA,MAAK,MAAM,aAAa;AAAA,IAAG,MAAMA,MAAK,MAAM,gBAAgB;AAAA,EAAE;AAC3E;AACA,SAAS,UAAU,MAAc,WAAoB,SAAgC;AACnF,QAAM,IAAI,UAAU,IAAI;AACxB,MAAI,EAAE,eAAe,MAAM,YAAY,CAAC,EAAE,YAAY,IAAI,CAAC,EAAE,OAAO,GAAI,MAAK,aAAa;AAC1F,MAAI,EAAE,QAAQ,WAAW,UAAU,QAAQ,EAAE,OAAO,QAAW,KAAM,OAAO,QAAQ,WAAW,cAAc,EAAE,QAAQ,QAAQ,OAAO,GAAK,MAAK,sBAAsB;AACtK,SAAO;AACT;AACA,SAAS,gBAAgB,SAAgC;AACvD,QAAM,QAAQ,uBAAuB,QAAQ,QAAQ;AACrD,QAAM,OAAO,cAAc,QAAQ,QAAQ;AAC3C,YAAU,MAAM,MAAM,OAAO;AAC7B,MAAI,OAAO;AACX,aAAW,QAAQ,SAAS,MAAM,MAAM,IAAI,EAAE,MAAM,GAAG,GAAG;AACxD,WAAOA,MAAK,MAAM,IAAI;AAAG,cAAU,MAAM,MAAM,OAAO;AAAA,EACxD;AACA,MAAI,aAAa,MAAM,IAAI,MAAM,MAAM,KAAM,MAAK,iBAAiB;AACnE,SAAO;AACT;AACA,SAAS,qBAAqB,SAAkB,SAAgC;AAC9E,QAAM,QAAQ,uBAAuB,QAAQ,QAAQ;AACrD,MAAI,QAAQ,WAAW,KAAK,CAAC,eAAe,KAAK,QAAQ,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,cAAc,EAAG,MAAK,iBAAiB;AAC3I,QAAM,cAAcA,MAAK,MAAM,UAAU,QAAQ,OAAO;AACxD,YAAU,MAAM,UAAU,MAAM,OAAO;AAAG,YAAU,aAAa,MAAM,OAAO;AAC9E,QAAM,eAAeA,MAAK,aAAa,eAAe;AACtD,MAAI,UAAU,cAAc,OAAO,OAAO,EAAE,OAAO,OAAO,KAAM,MAAK,oBAAoB;AACzF,QAAM,QAAQ,aAAa,YAAY;AACvC,MAAI,IAAI,KAAK,MAAM,QAAQ,eAAgB,MAAK,kBAAkB;AAClE,QAAM,WAAW,KAAK,MAAM,MAAM,SAAS,CAAC;AAC5C,MAAI,SAAS,WAAW,KAAK,CAAC,eAAe,KAAK,SAAS,OAAO,KAAK,CAAC,QAAQ,QAAQ,WAAW,SAAS,UAAU,GAAG,KAAK,CAAC,MAAM,QAAQ,SAAS,KAAK,KAAK,SAAS,MAAM,SAAS,UAAW,MAAK,kBAAkB;AAC1N,QAAM,cAAcA,MAAK,aAAa,SAAS;AAC/C,YAAU,aAAa,MAAM,OAAO;AAAG,YAAUA,MAAK,aAAa,MAAM,GAAG,MAAM,OAAO;AACzF,QAAM,gBAAgBA,MAAK,aAAa,QAAQ,WAAW;AAAG,YAAU,eAAe,OAAO,OAAO;AACrG,SAAO,EAAE,SAAS,UAAU,aAAa,eAAe,UAAU,MAAM,SAAS;AACnF;AAEO,SAAS,sBAAsB,UAAiC,CAAC,GAAG;AACzE,QAAM,QAAQ,gBAAgB,OAAO;AACrC,YAAU,MAAM,OAAO,MAAM,OAAO;AAAG,YAAU,MAAM,UAAU,OAAO,OAAO;AAAG,YAAU,MAAM,SAAS,OAAO,OAAO;AACzH,MAAI,UAAU,MAAM,SAAS,OAAO,OAAO,EAAE,OAAO,KAAM,MAAK,mBAAmB;AAClF,QAAM,UAAU,KAAK,MAAM,aAAa,MAAM,SAAS,MAAM,CAAC;AAC9D,MAAI,OAAO,KAAK,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,gCAAiC,MAAK,iBAAiB;AACrG,SAAO,qBAAqB,SAAS,OAAO;AAC9C;AAEO,SAAS,wBAAwB,eAAuB,UAAiC,CAAC,GAAG;AAClG,QAAM,QAAQ,uBAAuB,QAAQ,QAAQ;AACrD,MAAI,CAAC,WAAW,MAAM,OAAO,EAAG,QAAO;AACvC,QAAM,SAAS,sBAAsB,OAAO;AAG5C,SAAO,OAAO;AAChB;AAEO,IAAM,4BAA4B,EAAE,KAAK,MAAM,eAAe,WAAW,iBAAiB,sBAAsB,gBAAgB,eAAe;","names":["createHash","join","createHash","join"]}

package/dist/privateEvidence/candidate.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import { createRequire as __caveat_createRequire } from 'node:module';
 const require = __caveat_createRequire(import.meta.url);
-import "../chunk-TWJDSUZ4.js";
 
 // src/privateEvidence/candidate.ts
 function planOptionalEvidence(enabled, publicBytes, exitCode, prepare) {

package/dist/privateEvidence/candidate.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/privateEvidence/candidate.ts"],"sourcesContent":["/** Isolation-only planning boundary. No CLI import, transport, filesystem or delivery integration. */\nexport function planOptionalEvidence<T>(enabled: boolean, publicBytes: Uint8Array, exitCode: number,\n  prepare: () => T): { publicBytes: Uint8Array; exitCode: number; privateCandidate: T | null; privateStatus: string } {\n  if (enabled !== true) return { publicBytes, exitCode, privateCandidate: null, privateStatus: 'off' };\n  try { return { publicBytes, exitCode, privateCandidate: prepare(), privateStatus: 'prepared' }; }\n  catch { return { publicBytes, exitCode, privateCandidate: null, privateStatus: 'unverified' }; }\n}\n"],"mappings":";;;;;;AACO,SAAS,qBAAwB,SAAkB,aAAyB,UACjF,SAAoH;AACpH,MAAI,YAAY,KAAM,QAAO,EAAE,aAAa,UAAU,kBAAkB,MAAM,eAAe,MAAM;AACnG,MAAI;AAAE,WAAO,EAAE,aAAa,UAAU,kBAAkB,QAAQ,GAAG,eAAe,WAAW;AAAA,EAAG,QAC1F;AAAE,WAAO,EAAE,aAAa,UAAU,kBAAkB,MAAM,eAAe,aAAa;AAAA,EAAG;AACjG;","names":[]}
+{"version":3,"sources":["../../src/privateEvidence/candidate.ts"],"sourcesContent":["/** Isolation-only planning boundary. No CLI import, transport, filesystem or delivery integration. */\nexport function planOptionalEvidence<T>(enabled: boolean, publicBytes: Uint8Array, exitCode: number,\n  prepare: () => T): { publicBytes: Uint8Array; exitCode: number; privateCandidate: T | null; privateStatus: string } {\n  if (enabled !== true) return { publicBytes, exitCode, privateCandidate: null, privateStatus: 'off' };\n  try { return { publicBytes, exitCode, privateCandidate: prepare(), privateStatus: 'prepared' }; }\n  catch { return { publicBytes, exitCode, privateCandidate: null, privateStatus: 'unverified' }; }\n}\n"],"mappings":";;;;;AACO,SAAS,qBAAwB,SAAkB,aAAyB,UACjF,SAAoH;AACpH,MAAI,YAAY,KAAM,QAAO,EAAE,aAAa,UAAU,kBAAkB,MAAM,eAAe,MAAM;AACnG,MAAI;AAAE,WAAO,EAAE,aAAa,UAAU,kBAAkB,QAAQ,GAAG,eAAe,WAAW;AAAA,EAAG,QAC1F;AAAE,WAAO,EAAE,aAAa,UAAU,kBAAkB,MAAM,eAAe,aAAa;AAAA,EAAG;AACjG;","names":[]}

package/dist/privateEvidence/origin.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import { createRequire as __caveat_createRequire } from 'node:module';
 const require = __caveat_createRequire(import.meta.url);
-import "../chunk-TWJDSUZ4.js";
 
 // src/privateEvidence/origin.ts
 import { createHash } from "node:crypto";

package/dist/privateEvidence/origin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/privateEvidence/origin.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nexport const ORIGIN_ALGORITHM = 'origin-descriptor-sha256-v1';\nexport type OriginIdentity = {\n  status: 'available' | 'not_observed' | 'unverified';\n  algorithm: typeof ORIGIN_ALGORITHM | null;\n  digest: string | null;\n  reason: string;\n};\nexport type AcquiredValue = {\n  run_id: string;\n  status: 'observed' | 'not_observed' | 'unverified';\n  value: string | null;\n  complete: boolean;\n};\nconst missing = (status: 'not_observed' | 'unverified', reason: string): OriginIdentity =>\n  ({ status, algorithm: null, digest: null, reason });\n\nfunction hasKnownCaptureState(input: AcquiredValue): boolean {\n  return input.complete === true &&\n    (input.status === 'observed' || input.status === 'not_observed' || input.status === 'unverified');\n}\n\n/** Input is an already acquired value; never queries Git, config, DNS, files or state. */\nexport function projectOrigin(runId: string, input: AcquiredValue): OriginIdentity {\n  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(runId) || input.run_id !== runId || !hasKnownCaptureState(input) || input.status === 'unverified')\n    return missing('unverified', 'origin_capture_unverified');\n  if (input.status === 'not_observed') return missing('not_observed', 'origin_not_reached');\n  if (typeof input.value !== 'string') return missing('unverified', 'origin_capture_unverified');\n  const text = input.value.replace(/\\r?\\n$/, '');\n  const unsupported = () => missing('unverified', 'origin_syntax_unsupported');\n  if (!text || text.length > 4096 || /[^\\x21-\\x7e]|[%\\\\?#]/.test(text)) return unsupported();\n  let form: 'url' | 'scp';\n  let scheme: string | null = null;\n  let host: string;\n  let port: string | null = null;\n  let path: string;\n  if (text.includes('://')) {\n    const parsed = /^(https?|ssh|git):\\/\\/(?:[A-Za-z0-9._-]+@)?([^/:@]+)(?::([1-9][0-9]{0,4}))?(\\/.*)$/i.exec(text);\n    if (!parsed) return unsupported();\n    form = 'url'; scheme = parsed[1]!.toLowerCase(); host = parsed[2]!; port = parsed[3] ?? null; path = parsed[4]!;\n    if (port !== null && Number(port) > 65535) return unsupported();\n  } else {\n    const parsed = /^(?:[A-Za-z0-9._-]+@)?([^/:@]+):(.*)$/.exec(text);\n    if (!parsed) return unsupported();\n    if (!parsed[2]!.startsWith('/')) return missing('unverified', 'origin_semantics_ambiguous');\n    form = 'scp'; host = parsed[1]!; path = parsed[2]!;\n  }\n  const labels = host.split('.');\n  if (host.length > 253 || labels.every(label => /^[0-9]+$/.test(label)) ||\n      labels.some(label => !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(label))) return unsupported();\n  if (!/^\\/[A-Za-z0-9._-]+(?:\\/[A-Za-z0-9._-]+)*\\/?$/.test(path) ||\n      path.split('/').some(segment => segment === '.' || segment === '..')) return unsupported();\n  const tuple = ['caveat.origin-descriptor.v1', form, scheme, host.toLowerCase(), port, 'absolute', path];\n  return { status: 'available', algorithm: ORIGIN_ALGORITHM,\n    digest: createHash('sha256').update(JSON.stringify(tuple), 'utf8').digest('hex'), reason: 'origin_descriptor_observed' };\n}\n\nexport function projectHead(runId: string, input: AcquiredValue) {\n  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(runId) || input.run_id !== runId || !hasKnownCaptureState(input) || input.status === 'unverified')\n    return { status: 'unverified', value: null, reason: 'head_capture_unverified' } as const;\n  if (input.status === 'not_observed') return { status: 'not_observed', value: null, reason: 'head_not_reached' } as const;\n  if (typeof input.value !== 'string' || !/^[0-9a-f]{40}$/.test(input.value))\n    return { status: 'unverified', value: null, reason: 'head_format_unsupported' } as const;\n  return { status: 'observed', value: input.value, reason: 'head_observed' } as const;\n}\n\nexport function projectSync(runId: string, acquired: {\n  origin: AcquiredValue; local: AcquiredValue; remote: AcquiredValue;\n}, publicSync: { status: 'ready' | 'not_ready' | 'unverified'; reason_code: string }) {\n  const local = projectHead(runId, acquired.local), remote = projectHead(runId, acquired.remote);\n  return { ...publicSync, repo_identity: projectOrigin(runId, acquired.origin), local_head: local, remote_head: remote,\n    comparison: local.status === 'observed' && remote.status === 'observed'\n      ? local.value === remote.value ? 'equal' : 'different' : 'not_evaluated',\n    relation_counts: { status: 'not_supported', behind: null, ahead: null } };\n}\n"],"mappings":";;;;;;AAAA,SAAS,kBAAkB;AAEpB,IAAM,mBAAmB;AAahC,IAAM,UAAU,CAAC,QAAuC,YACrD,EAAE,QAAQ,WAAW,MAAM,QAAQ,MAAM,OAAO;AAEnD,SAAS,qBAAqB,OAA+B;AAC3D,SAAO,MAAM,aAAa,SACvB,MAAM,WAAW,cAAc,MAAM,WAAW,kBAAkB,MAAM,WAAW;AACxF;AAGO,SAAS,cAAc,OAAe,OAAsC;AACjF,MAAI,CAAC,iEAAiE,KAAK,KAAK,KAAK,MAAM,WAAW,SAAS,CAAC,qBAAqB,KAAK,KAAK,MAAM,WAAW;AAC9J,WAAO,QAAQ,cAAc,2BAA2B;AAC1D,MAAI,MAAM,WAAW,eAAgB,QAAO,QAAQ,gBAAgB,oBAAoB;AACxF,MAAI,OAAO,MAAM,UAAU,SAAU,QAAO,QAAQ,cAAc,2BAA2B;AAC7F,QAAM,OAAO,MAAM,MAAM,QAAQ,UAAU,EAAE;AAC7C,QAAM,cAAc,MAAM,QAAQ,cAAc,2BAA2B;AAC3E,MAAI,CAAC,QAAQ,KAAK,SAAS,QAAQ,uBAAuB,KAAK,IAAI,EAAG,QAAO,YAAY;AACzF,MAAI;AACJ,MAAI,SAAwB;AAC5B,MAAI;AACJ,MAAI,OAAsB;AAC1B,MAAI;AACJ,MAAI,KAAK,SAAS,KAAK,GAAG;AACxB,UAAM,SAAS,sFAAsF,KAAK,IAAI;AAC9G,QAAI,CAAC,OAAQ,QAAO,YAAY;AAChC,WAAO;AAAO,aAAS,OAAO,CAAC,EAAG,YAAY;AAAG,WAAO,OAAO,CAAC;AAAI,WAAO,OAAO,CAAC,KAAK;AAAM,WAAO,OAAO,CAAC;AAC7G,QAAI,SAAS,QAAQ,OAAO,IAAI,IAAI,MAAO,QAAO,YAAY;AAAA,EAChE,OAAO;AACL,UAAM,SAAS,wCAAwC,KAAK,IAAI;AAChE,QAAI,CAAC,OAAQ,QAAO,YAAY;AAChC,QAAI,CAAC,OAAO,CAAC,EAAG,WAAW,GAAG,EAAG,QAAO,QAAQ,cAAc,4BAA4B;AAC1F,WAAO;AAAO,WAAO,OAAO,CAAC;AAAI,WAAO,OAAO,CAAC;AAAA,EAClD;AACA,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,KAAK,SAAS,OAAO,OAAO,MAAM,WAAS,WAAW,KAAK,KAAK,CAAC,KACjE,OAAO,KAAK,WAAS,CAAC,kDAAkD,KAAK,KAAK,CAAC,EAAG,QAAO,YAAY;AAC7G,MAAI,CAAC,+CAA+C,KAAK,IAAI,KACzD,KAAK,MAAM,GAAG,EAAE,KAAK,aAAW,YAAY,OAAO,YAAY,IAAI,EAAG,QAAO,YAAY;AAC7F,QAAM,QAAQ,CAAC,+BAA+B,MAAM,QAAQ,KAAK,YAAY,GAAG,MAAM,YAAY,IAAI;AACtG,SAAO;AAAA,IAAE,QAAQ;AAAA,IAAa,WAAW;AAAA,IACvC,QAAQ,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,KAAK,GAAG,MAAM,EAAE,OAAO,KAAK;AAAA,IAAG,QAAQ;AAAA,EAA6B;AAC3H;AAEO,SAAS,YAAY,OAAe,OAAsB;AAC/D,MAAI,CAAC,iEAAiE,KAAK,KAAK,KAAK,MAAM,WAAW,SAAS,CAAC,qBAAqB,KAAK,KAAK,MAAM,WAAW;AAC9J,WAAO,EAAE,QAAQ,cAAc,OAAO,MAAM,QAAQ,0BAA0B;AAChF,MAAI,MAAM,WAAW,eAAgB,QAAO,EAAE,QAAQ,gBAAgB,OAAO,MAAM,QAAQ,mBAAmB;AAC9G,MAAI,OAAO,MAAM,UAAU,YAAY,CAAC,iBAAiB,KAAK,MAAM,KAAK;AACvE,WAAO,EAAE,QAAQ,cAAc,OAAO,MAAM,QAAQ,0BAA0B;AAChF,SAAO,EAAE,QAAQ,YAAY,OAAO,MAAM,OAAO,QAAQ,gBAAgB;AAC3E;AAEO,SAAS,YAAY,OAAe,UAExC,YAAmF;AACpF,QAAM,QAAQ,YAAY,OAAO,SAAS,KAAK,GAAG,SAAS,YAAY,OAAO,SAAS,MAAM;AAC7F,SAAO;AAAA,IAAE,GAAG;AAAA,IAAY,eAAe,cAAc,OAAO,SAAS,MAAM;AAAA,IAAG,YAAY;AAAA,IAAO,aAAa;AAAA,IAC5G,YAAY,MAAM,WAAW,cAAc,OAAO,WAAW,aACzD,MAAM,UAAU,OAAO,QAAQ,UAAU,cAAc;AAAA,IAC3D,iBAAiB,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,OAAO,KAAK;AAAA,EAAE;AAC5E;","names":[]}
+{"version":3,"sources":["../../src/privateEvidence/origin.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nexport const ORIGIN_ALGORITHM = 'origin-descriptor-sha256-v1';\nexport type OriginIdentity = {\n  status: 'available' | 'not_observed' | 'unverified';\n  algorithm: typeof ORIGIN_ALGORITHM | null;\n  digest: string | null;\n  reason: string;\n};\nexport type AcquiredValue = {\n  run_id: string;\n  status: 'observed' | 'not_observed' | 'unverified';\n  value: string | null;\n  complete: boolean;\n};\nconst missing = (status: 'not_observed' | 'unverified', reason: string): OriginIdentity =>\n  ({ status, algorithm: null, digest: null, reason });\n\nfunction hasKnownCaptureState(input: AcquiredValue): boolean {\n  return input.complete === true &&\n    (input.status === 'observed' || input.status === 'not_observed' || input.status === 'unverified');\n}\n\n/** Input is an already acquired value; never queries Git, config, DNS, files or state. */\nexport function projectOrigin(runId: string, input: AcquiredValue): OriginIdentity {\n  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(runId) || input.run_id !== runId || !hasKnownCaptureState(input) || input.status === 'unverified')\n    return missing('unverified', 'origin_capture_unverified');\n  if (input.status === 'not_observed') return missing('not_observed', 'origin_not_reached');\n  if (typeof input.value !== 'string') return missing('unverified', 'origin_capture_unverified');\n  const text = input.value.replace(/\\r?\\n$/, '');\n  const unsupported = () => missing('unverified', 'origin_syntax_unsupported');\n  if (!text || text.length > 4096 || /[^\\x21-\\x7e]|[%\\\\?#]/.test(text)) return unsupported();\n  let form: 'url' | 'scp';\n  let scheme: string | null = null;\n  let host: string;\n  let port: string | null = null;\n  let path: string;\n  if (text.includes('://')) {\n    const parsed = /^(https?|ssh|git):\\/\\/(?:[A-Za-z0-9._-]+@)?([^/:@]+)(?::([1-9][0-9]{0,4}))?(\\/.*)$/i.exec(text);\n    if (!parsed) return unsupported();\n    form = 'url'; scheme = parsed[1]!.toLowerCase(); host = parsed[2]!; port = parsed[3] ?? null; path = parsed[4]!;\n    if (port !== null && Number(port) > 65535) return unsupported();\n  } else {\n    const parsed = /^(?:[A-Za-z0-9._-]+@)?([^/:@]+):(.*)$/.exec(text);\n    if (!parsed) return unsupported();\n    if (!parsed[2]!.startsWith('/')) return missing('unverified', 'origin_semantics_ambiguous');\n    form = 'scp'; host = parsed[1]!; path = parsed[2]!;\n  }\n  const labels = host.split('.');\n  if (host.length > 253 || labels.every(label => /^[0-9]+$/.test(label)) ||\n      labels.some(label => !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(label))) return unsupported();\n  if (!/^\\/[A-Za-z0-9._-]+(?:\\/[A-Za-z0-9._-]+)*\\/?$/.test(path) ||\n      path.split('/').some(segment => segment === '.' || segment === '..')) return unsupported();\n  const tuple = ['caveat.origin-descriptor.v1', form, scheme, host.toLowerCase(), port, 'absolute', path];\n  return { status: 'available', algorithm: ORIGIN_ALGORITHM,\n    digest: createHash('sha256').update(JSON.stringify(tuple), 'utf8').digest('hex'), reason: 'origin_descriptor_observed' };\n}\n\nexport function projectHead(runId: string, input: AcquiredValue) {\n  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(runId) || input.run_id !== runId || !hasKnownCaptureState(input) || input.status === 'unverified')\n    return { status: 'unverified', value: null, reason: 'head_capture_unverified' } as const;\n  if (input.status === 'not_observed') return { status: 'not_observed', value: null, reason: 'head_not_reached' } as const;\n  if (typeof input.value !== 'string' || !/^[0-9a-f]{40}$/.test(input.value))\n    return { status: 'unverified', value: null, reason: 'head_format_unsupported' } as const;\n  return { status: 'observed', value: input.value, reason: 'head_observed' } as const;\n}\n\nexport function projectSync(runId: string, acquired: {\n  origin: AcquiredValue; local: AcquiredValue; remote: AcquiredValue;\n}, publicSync: { status: 'ready' | 'not_ready' | 'unverified'; reason_code: string }) {\n  const local = projectHead(runId, acquired.local), remote = projectHead(runId, acquired.remote);\n  return { ...publicSync, repo_identity: projectOrigin(runId, acquired.origin), local_head: local, remote_head: remote,\n    comparison: local.status === 'observed' && remote.status === 'observed'\n      ? local.value === remote.value ? 'equal' : 'different' : 'not_evaluated',\n    relation_counts: { status: 'not_supported', behind: null, ahead: null } };\n}\n"],"mappings":";;;;;AAAA,SAAS,kBAAkB;AAEpB,IAAM,mBAAmB;AAahC,IAAM,UAAU,CAAC,QAAuC,YACrD,EAAE,QAAQ,WAAW,MAAM,QAAQ,MAAM,OAAO;AAEnD,SAAS,qBAAqB,OAA+B;AAC3D,SAAO,MAAM,aAAa,SACvB,MAAM,WAAW,cAAc,MAAM,WAAW,kBAAkB,MAAM,WAAW;AACxF;AAGO,SAAS,cAAc,OAAe,OAAsC;AACjF,MAAI,CAAC,iEAAiE,KAAK,KAAK,KAAK,MAAM,WAAW,SAAS,CAAC,qBAAqB,KAAK,KAAK,MAAM,WAAW;AAC9J,WAAO,QAAQ,cAAc,2BAA2B;AAC1D,MAAI,MAAM,WAAW,eAAgB,QAAO,QAAQ,gBAAgB,oBAAoB;AACxF,MAAI,OAAO,MAAM,UAAU,SAAU,QAAO,QAAQ,cAAc,2BAA2B;AAC7F,QAAM,OAAO,MAAM,MAAM,QAAQ,UAAU,EAAE;AAC7C,QAAM,cAAc,MAAM,QAAQ,cAAc,2BAA2B;AAC3E,MAAI,CAAC,QAAQ,KAAK,SAAS,QAAQ,uBAAuB,KAAK,IAAI,EAAG,QAAO,YAAY;AACzF,MAAI;AACJ,MAAI,SAAwB;AAC5B,MAAI;AACJ,MAAI,OAAsB;AAC1B,MAAI;AACJ,MAAI,KAAK,SAAS,KAAK,GAAG;AACxB,UAAM,SAAS,sFAAsF,KAAK,IAAI;AAC9G,QAAI,CAAC,OAAQ,QAAO,YAAY;AAChC,WAAO;AAAO,aAAS,OAAO,CAAC,EAAG,YAAY;AAAG,WAAO,OAAO,CAAC;AAAI,WAAO,OAAO,CAAC,KAAK;AAAM,WAAO,OAAO,CAAC;AAC7G,QAAI,SAAS,QAAQ,OAAO,IAAI,IAAI,MAAO,QAAO,YAAY;AAAA,EAChE,OAAO;AACL,UAAM,SAAS,wCAAwC,KAAK,IAAI;AAChE,QAAI,CAAC,OAAQ,QAAO,YAAY;AAChC,QAAI,CAAC,OAAO,CAAC,EAAG,WAAW,GAAG,EAAG,QAAO,QAAQ,cAAc,4BAA4B;AAC1F,WAAO;AAAO,WAAO,OAAO,CAAC;AAAI,WAAO,OAAO,CAAC;AAAA,EAClD;AACA,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,KAAK,SAAS,OAAO,OAAO,MAAM,WAAS,WAAW,KAAK,KAAK,CAAC,KACjE,OAAO,KAAK,WAAS,CAAC,kDAAkD,KAAK,KAAK,CAAC,EAAG,QAAO,YAAY;AAC7G,MAAI,CAAC,+CAA+C,KAAK,IAAI,KACzD,KAAK,MAAM,GAAG,EAAE,KAAK,aAAW,YAAY,OAAO,YAAY,IAAI,EAAG,QAAO,YAAY;AAC7F,QAAM,QAAQ,CAAC,+BAA+B,MAAM,QAAQ,KAAK,YAAY,GAAG,MAAM,YAAY,IAAI;AACtG,SAAO;AAAA,IAAE,QAAQ;AAAA,IAAa,WAAW;AAAA,IACvC,QAAQ,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,KAAK,GAAG,MAAM,EAAE,OAAO,KAAK;AAAA,IAAG,QAAQ;AAAA,EAA6B;AAC3H;AAEO,SAAS,YAAY,OAAe,OAAsB;AAC/D,MAAI,CAAC,iEAAiE,KAAK,KAAK,KAAK,MAAM,WAAW,SAAS,CAAC,qBAAqB,KAAK,KAAK,MAAM,WAAW;AAC9J,WAAO,EAAE,QAAQ,cAAc,OAAO,MAAM,QAAQ,0BAA0B;AAChF,MAAI,MAAM,WAAW,eAAgB,QAAO,EAAE,QAAQ,gBAAgB,OAAO,MAAM,QAAQ,mBAAmB;AAC9G,MAAI,OAAO,MAAM,UAAU,YAAY,CAAC,iBAAiB,KAAK,MAAM,KAAK;AACvE,WAAO,EAAE,QAAQ,cAAc,OAAO,MAAM,QAAQ,0BAA0B;AAChF,SAAO,EAAE,QAAQ,YAAY,OAAO,MAAM,OAAO,QAAQ,gBAAgB;AAC3E;AAEO,SAAS,YAAY,OAAe,UAExC,YAAmF;AACpF,QAAM,QAAQ,YAAY,OAAO,SAAS,KAAK,GAAG,SAAS,YAAY,OAAO,SAAS,MAAM;AAC7F,SAAO;AAAA,IAAE,GAAG;AAAA,IAAY,eAAe,cAAc,OAAO,SAAS,MAAM;AAAA,IAAG,YAAY;AAAA,IAAO,aAAa;AAAA,IAC5G,YAAY,MAAM,WAAW,cAAc,OAAO,WAAW,aACzD,MAAM,UAAU,OAAO,QAAQ,UAAU,cAAc;AAAA,IAC3D,iBAAiB,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,OAAO,KAAK;AAAA,EAAE;AAC5E;","names":[]}

package/dist/privateEvidence/validation.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import { createRequire as __caveat_createRequire } from 'node:module';
 const require = __caveat_createRequire(import.meta.url);
-import "../chunk-TWJDSUZ4.js";
 
 // src/privateEvidence/validation.ts
 import { createHash } from "node:crypto";

package/dist/privateEvidence/validation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/privateEvidence/validation.ts","../../src/contracts/factory-private-evidence/capability.v1.schema.json","../../src/contracts/factory-private-evidence/private-frame.v1.schema.json","../../src/contracts/factory-private-evidence/windows-channel.v1.schema.json"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { TextDecoder, isDeepStrictEqual } from 'node:util';\nimport { Ajv2020 } from 'ajv/dist/2020.js';\nimport { visit } from 'jsonc-parser';\nimport capabilitySchema from '../contracts/factory-private-evidence/capability.v1.schema.json' with { type: 'json' };\nimport frameSchema from '../contracts/factory-private-evidence/private-frame.v1.schema.json' with { type: 'json' };\nimport windowsSchema from '../contracts/factory-private-evidence/windows-channel.v1.schema.json' with { type: 'json' };\n\nconst ajv = new Ajv2020({ strict: true, strictRequired: false });\nexport const validateCapability = ajv.compile(capabilitySchema);\nexport const validateFrame = ajv.compile(frameSchema);\nexport const validateWindowsDescriptor = ajv.compile(windowsSchema);\nexport const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;\nconst NONCE = /^[0-9a-f]{64}$/;\nexport const MAX_CHANNEL_BYTES = 16384;\n\n/** Strict, bounded JSON. The parser library supplies tokenization and nesting events. */\nexport function strictJson(bytes: Uint8Array, limit = MAX_CHANNEL_BYTES): unknown {\n  if (bytes.byteLength === 0 || bytes.byteLength > limit) throw new Error('json_budget');\n  const text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);\n  const objects: Set<string>[] = [];\n  let depth = 0, invalid = false;\n  visit(text, {\n    onObjectBegin() { if (++depth > 32) throw new Error('json_depth'); objects.push(new Set()); },\n    onObjectProperty(key) { const keys = objects.at(-1)!; if (keys.has(key)) invalid = true; keys.add(key); },\n    onObjectEnd() { objects.pop(); depth--; },\n    onArrayBegin() { if (++depth > 32) throw new Error('json_depth'); },\n    onArrayEnd() { depth--; },\n    onError() { invalid = true; },\n  }, { disallowComments: true, allowTrailingComma: false, allowEmptyContent: false });\n  if (invalid || depth !== 0 || objects.length !== 0) throw new Error('json_invalid');\n  return JSON.parse(text);\n}\n\ntype Dict = Record<string, any>; // Schema checks narrow every use below; values never enter logs.\nexport function validateRequest(env: Readonly<Record<string, string | undefined>>) {\n  if (env.CAVEAT_FACTORY_PRIVATE_EVIDENCE !== 'v1') return { status: 'off' } as const;\n  const collection = env.CAVEAT_FACTORY_PRIVATE_COLLECTION_ID;\n  const nonce = env.CAVEAT_FACTORY_PRIVATE_NONCE;\n  const channel = env.CAVEAT_FACTORY_PRIVATE_CHANNEL;\n  if (!collection || !UUID.test(collection) || !nonce || !NONCE.test(nonce) || !channel || channel.length > MAX_CHANNEL_BYTES)\n    return { status: 'unverified', reason: 'request_invalid' } as const;\n  if (channel === 'fd:3') return { status: 'valid', collection_id: collection, nonce, transport: 'posix-fd-v1' } as const;\n  try {\n    const descriptor = strictJson(Buffer.from(channel));\n    if (validateWindowsDescriptor(descriptor))\n      return { status: 'valid', collection_id: collection, nonce, transport: 'windows-named-pipe-v1' } as const;\n  } catch { /* A fixed reason only; never propagate an input or parser error. */ }\n  return { status: 'unverified', reason: 'request_invalid' } as const;\n}\n\nexport function selectCapability(request: ReturnType<typeof validateRequest>, capability: unknown,\n  expectedVersion: string, platform: string, launchPath: string) {\n  if (request.status === 'off') return { status: 'off' } as const;\n  if (request.status !== 'valid') return { status: 'unverified', reason: 'request_invalid' } as const;\n  if (capability == null) return { status: 'not_supported', reason: 'capability_absent' } as const;\n  if (!validateCapability(capability) || (capability as Dict).package_version !== expectedVersion)\n    return { status: 'unverified', reason: 'capability_invalid' } as const;\n  const common = (capability as Dict).transports.some((t: Dict) =>\n    t.id === request.transport && t.platforms.includes(platform) && t.launch_paths.includes(launchPath));\n  // This pure selection is NOT permission to open a channel. OS safety must be separately established.\n  return common ? { status: 'candidate_requires_os_verification' } as const\n    : { status: 'not_supported', reason: 'transport_unsupported' } as const;\n}\n\n/** Validates a synthetic or already received complete channel. Does not read/send a real channel. */\nexport function validateExchange(input: {\n  channelBytes: Uint8Array; eof: boolean; publicBytes: Uint8Array;\n  request: ReturnType<typeof validateRequest>; capability: unknown; expectedVersion: string;\n  peerVerified: boolean; expectedProcess: unknown; platform: string; launchPath: string;\n}): { status: 'valid' | 'unverified'; reason: string } {\n  const bad = (reason: string) => ({ status: 'unverified', reason } as const);\n  try {\n    if (input.request.status !== 'valid' || input.eof !== true || input.peerVerified !== true) return bad('channel_incomplete');\n    if (!validateCapability(input.capability) || (input.capability as Dict).package_version !== input.expectedVersion)\n      return bad('capability_invalid');\n    if (input.channelBytes.byteLength > MAX_CHANNEL_BYTES) return bad('channel_budget');\n    const bytes = Buffer.from(input.channelBytes);\n    if (bytes.at(-1) !== 10) return bad('frame_framing');\n    const lines = bytes.toString('latin1').split('\\n');\n    if (lines.length !== 3 || lines[2] !== '') return bad('frame_framing');\n    const frames = lines.slice(0, 2).map(line => strictJson(Buffer.from(line, 'latin1')) as Dict);\n    if (frames.some(frame => !validateFrame(frame))) return bad('frame_schema');\n    const [hello, result] = frames as [Dict, Dict];\n    if (hello.type !== 'hello' || result.type !== 'diagnostic_result') return bad('frame_order');\n    if (!UUID.test(hello.execution_id)) return bad('frame_identity');\n    for (const key of ['schema', 'collection_id', 'nonce', 'execution_id'])\n      if (hello[key] !== result[key]) return bad('frame_identity');\n    if (hello.collection_id !== input.request.collection_id || hello.nonce !== input.request.nonce ||\n        hello.product_version !== input.expectedVersion || hello.process.package_version !== input.expectedVersion ||\n        hello.transport !== input.request.transport) return bad('frame_identity');\n    if (selectCapability(input.request, input.capability, input.expectedVersion, input.platform, input.launchPath).status !==\n        'candidate_requires_os_verification') return bad('transport_unsupported');\n    const p = hello.process;\n    if (!input.expectedProcess || !isDeepStrictEqual(p, input.expectedProcess)) return bad('peer_identity');\n    const needed: string[] = [];\n    for (const [key, reason] of [['parent_pid', 'parent_identity_unavailable'], ['exec_path', 'exec_path_unavailable'],\n      ['entry_realpath', 'entry_path_unavailable'], ['build_id', 'build_id_unavailable']])\n      if (p[key!] === null) needed.push(reason!);\n    if (p.start_identity.source === 'unavailable') needed.push('start_identity_unavailable');\n    if (p.identity.kind === 'unknown') needed.push('actor_identity_unavailable');\n    if (!isDeepStrictEqual([...needed].sort(), [...p.missing_reasons].sort())) return bad('process_missing_reason');\n    if (input.publicBytes.at(-1) !== 10 || input.publicBytes.subarray(0, -1).includes(10)) return bad('public_framing');\n    const pub = strictJson(input.publicBytes, 65536) as Dict;\n    if (pub.schema !== hello.public_diagnostic_schema || pub.product !== 'caveat' || pub.version !== input.expectedVersion ||\n        pub.overall?.status !== result.public_result.overall_status || pub.sync?.status !== result.sync_observation.status ||\n        pub.sync?.reason_code !== result.sync_observation.reason_code) return bad('public_mismatch');\n    if (result.public_output.bytes !== input.publicBytes.byteLength || result.public_output.sha256 !==\n        createHash('sha256').update(input.publicBytes).digest('hex')) return bad('public_bytes_mismatch');\n    const sync = result.sync_observation;\n    const both = sync.local_head.status === 'observed' && sync.remote_head.status === 'observed';\n    const comparison = both ? sync.local_head.value === sync.remote_head.value ? 'equal' : 'different' : 'not_evaluated';\n    if (sync.comparison !== comparison) return bad('head_comparison');\n    const repo = sync.repo_identity;\n    const allowed = repo.status === 'available' ? ['origin_descriptor_observed'] : repo.status === 'not_observed'\n      ? ['origin_not_reached'] : ['origin_capture_unverified', 'origin_syntax_unsupported', 'origin_semantics_ambiguous'];\n    if (!allowed.includes(repo.reason)) return bad('origin_reason');\n    return { status: 'valid', reason: 'complete_synthetic_exchange' };\n  } catch { return bad('exchange_invalid'); }\n}\n","{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"urn:caveat:factory-private-evidence-capability:v1\",\n  \"title\": \"Draft: Caveat official private evidence capability v1\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"schema\",\n    \"product\",\n    \"package_version\",\n    \"public_diagnostic_schema\",\n    \"private_protocol\",\n    \"transports\",\n    \"max_channel_bytes\",\n    \"operation_receipt\"\n  ],\n  \"properties\": {\n    \"schema\": {\n      \"const\": \"caveat.factory_private_evidence_capability.v1\"\n    },\n    \"product\": {\n      \"const\": \"caveat\"\n    },\n    \"package_version\": {\n      \"type\": \"string\",\n      \"pattern\": \"^(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\\\+[0-9A-Za-z-]+(?:\\\\.[0-9A-Za-z-]+)*)?$\",\n      \"maxLength\": 128\n    },\n    \"public_diagnostic_schema\": {\n      \"const\": \"caveat.native_factory_diagnostics.v1\"\n    },\n    \"private_protocol\": {\n      \"const\": \"caveat.factory_private_evidence.v1\"\n    },\n    \"transports\": {\n      \"type\": \"array\",\n      \"maxItems\": 2,\n      \"uniqueItems\": true,\n      \"items\": {\n        \"oneOf\": [\n          {\n            \"type\": \"object\",\n            \"additionalProperties\": false,\n            \"required\": [\n              \"id\",\n              \"platforms\",\n              \"launch_paths\"\n            ],\n            \"properties\": {\n              \"id\": {\n                \"const\": \"posix-fd-v1\"\n              },\n              \"platforms\": {\n                \"type\": \"array\",\n                \"minItems\": 1,\n                \"maxItems\": 2,\n                \"uniqueItems\": true,\n                \"items\": {\n                  \"enum\": [\n                    \"linux\",\n                    \"darwin\"\n                  ]\n                }\n              },\n              \"launch_paths\": {\n                \"type\": \"array\",\n                \"minItems\": 1,\n                \"maxItems\": 1,\n                \"uniqueItems\": true,\n                \"items\": {\n                  \"enum\": [\n                    \"direct_node_entry\"\n                  ]\n                }\n              }\n            }\n          },\n          {\n            \"type\": \"object\",\n            \"additionalProperties\": false,\n            \"required\": [\n              \"id\",\n              \"platforms\",\n              \"launch_paths\"\n            ],\n            \"properties\": {\n              \"id\": {\n                \"const\": \"windows-named-pipe-v1\"\n              },\n              \"platforms\": {\n                \"type\": \"array\",\n                \"minItems\": 1,\n                \"maxItems\": 1,\n                \"uniqueItems\": true,\n                \"items\": {\n                  \"enum\": [\n                    \"win32\"\n                  ]\n                }\n              },\n              \"launch_paths\": {\n                \"type\": \"array\",\n                \"minItems\": 1,\n                \"maxItems\": 2,\n                \"uniqueItems\": true,\n                \"items\": {\n                  \"enum\": [\n                    \"native_exe\",\n                    \"powershell_standard_shim\"\n                  ]\n                }\n              }\n            }\n          }\n        ]\n      },\n      \"allOf\": [\n        {\n          \"contains\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"id\"\n            ],\n            \"properties\": {\n              \"id\": {\n                \"const\": \"posix-fd-v1\"\n              }\n            }\n          },\n          \"minContains\": 0,\n          \"maxContains\": 1\n        },\n        {\n          \"contains\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"id\"\n            ],\n            \"properties\": {\n              \"id\": {\n                \"const\": \"windows-named-pipe-v1\"\n              }\n            }\n          },\n          \"minContains\": 0,\n          \"maxContains\": 1\n        }\n      ]\n    },\n    \"max_channel_bytes\": {\n      \"const\": 16384\n    },\n    \"operation_receipt\": {\n      \"const\": \"not_supported\"\n    }\n  }\n}\n","{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"urn:caveat:factory-private-evidence:v1\",\n  \"title\": \"Draft: Caveat official private evidence NDJSON frame v1\",\n  \"oneOf\": [\n    {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"schema\",\n        \"collection_id\",\n        \"nonce\",\n        \"execution_id\",\n        \"type\",\n        \"product\",\n        \"product_version\",\n        \"public_diagnostic_schema\",\n        \"transport\",\n        \"process\"\n      ],\n      \"properties\": {\n        \"schema\": {\n          \"const\": \"caveat.factory_private_evidence.v1\"\n        },\n        \"collection_id\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n        },\n        \"nonce\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{64}$\"\n        },\n        \"execution_id\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n        },\n        \"type\": {\n          \"const\": \"hello\"\n        },\n        \"product\": {\n          \"const\": \"caveat\"\n        },\n        \"product_version\": {\n          \"type\": \"string\",\n          \"pattern\": \"^(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\\\+[0-9A-Za-z-]+(?:\\\\.[0-9A-Za-z-]+)*)?$\",\n          \"maxLength\": 128\n        },\n        \"public_diagnostic_schema\": {\n          \"const\": \"caveat.native_factory_diagnostics.v1\"\n        },\n        \"transport\": {\n          \"enum\": [\n            \"posix-fd-v1\",\n            \"windows-named-pipe-v1\"\n          ]\n        },\n        \"process\": {\n          \"type\": \"object\",\n          \"additionalProperties\": false,\n          \"required\": [\n            \"pid\",\n            \"parent_pid\",\n            \"start_identity\",\n            \"identity\",\n            \"exec_path\",\n            \"entry_realpath\",\n            \"package_version\",\n            \"build_id\",\n            \"missing_reasons\"\n          ],\n          \"properties\": {\n            \"pid\": {\n              \"type\": \"integer\",\n              \"minimum\": 1,\n              \"maximum\": 9007199254740991\n            },\n            \"parent_pid\": {\n              \"anyOf\": [\n                {\n                  \"type\": \"integer\",\n                  \"minimum\": 0,\n                  \"maximum\": 9007199254740991\n                },\n                {\n                  \"type\": \"null\"\n                }\n              ]\n            },\n            \"start_identity\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"source\",\n                \"value\"\n              ],\n              \"properties\": {\n                \"source\": {\n                  \"enum\": [\n                    \"linux_proc_start\",\n                    \"windows_process_creation\",\n                    \"os_process_start\",\n                    \"unavailable\"\n                  ]\n                },\n                \"value\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"string\",\n                      \"minLength\": 1,\n                      \"maxLength\": 256\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                }\n              },\n              \"allOf\": [\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"source\": {\n                        \"const\": \"unavailable\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  },\n                  \"else\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"string\"\n                      }\n                    }\n                  }\n                }\n              ]\n            },\n            \"identity\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"kind\",\n                \"uid\",\n                \"gid\",\n                \"sid\"\n              ],\n              \"properties\": {\n                \"kind\": {\n                  \"enum\": [\n                    \"uid_gid\",\n                    \"windows_sid\",\n                    \"unknown\"\n                  ]\n                },\n                \"uid\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"integer\",\n                      \"minimum\": 0,\n                      \"maximum\": 9007199254740991\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"gid\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"integer\",\n                      \"minimum\": 0,\n                      \"maximum\": 9007199254740991\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"sid\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"string\",\n                      \"pattern\": \"^S-1-[0-9]+(?:-[0-9]+)+$\",\n                      \"maxLength\": 256\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                }\n              },\n              \"allOf\": [\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"kind\": {\n                        \"const\": \"uid_gid\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"uid\": {\n                        \"type\": \"integer\"\n                      },\n                      \"gid\": {\n                        \"type\": \"integer\"\n                      },\n                      \"sid\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  }\n                },\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"kind\": {\n                        \"const\": \"windows_sid\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"uid\": {\n                        \"type\": \"null\"\n                      },\n                      \"gid\": {\n                        \"type\": \"null\"\n                      },\n                      \"sid\": {\n                        \"type\": \"string\"\n                      }\n                    }\n                  }\n                },\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"kind\": {\n                        \"const\": \"unknown\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"uid\": {\n                        \"type\": \"null\"\n                      },\n                      \"gid\": {\n                        \"type\": \"null\"\n                      },\n                      \"sid\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  }\n                }\n              ]\n            },\n            \"exec_path\": {\n              \"anyOf\": [\n                {\n                  \"type\": \"string\",\n                  \"minLength\": 1,\n                  \"maxLength\": 4096\n                },\n                {\n                  \"type\": \"null\"\n                }\n              ]\n            },\n            \"entry_realpath\": {\n              \"anyOf\": [\n                {\n                  \"type\": \"string\",\n                  \"minLength\": 1,\n                  \"maxLength\": 4096\n                },\n                {\n                  \"type\": \"null\"\n                }\n              ]\n            },\n            \"package_version\": {\n              \"type\": \"string\",\n              \"pattern\": \"^(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\\\+[0-9A-Za-z-]+(?:\\\\.[0-9A-Za-z-]+)*)?$\",\n              \"maxLength\": 128\n            },\n            \"build_id\": {\n              \"anyOf\": [\n                {\n                  \"type\": \"string\",\n                  \"minLength\": 1,\n                  \"maxLength\": 256\n                },\n                {\n                  \"type\": \"null\"\n                }\n              ]\n            },\n            \"missing_reasons\": {\n              \"type\": \"array\",\n              \"uniqueItems\": true,\n              \"items\": {\n                \"enum\": [\n                  \"parent_identity_unavailable\",\n                  \"start_identity_unavailable\",\n                  \"actor_identity_unavailable\",\n                  \"exec_path_unavailable\",\n                  \"entry_path_unavailable\",\n                  \"build_id_unavailable\"\n                ]\n              }\n            }\n          }\n        }\n      }\n    },\n    {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"schema\",\n        \"collection_id\",\n        \"nonce\",\n        \"execution_id\",\n        \"type\",\n        \"public_output\",\n        \"public_result\",\n        \"sync_observation\",\n        \"operation_receipt\"\n      ],\n      \"properties\": {\n        \"schema\": {\n          \"const\": \"caveat.factory_private_evidence.v1\"\n        },\n        \"collection_id\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n        },\n        \"nonce\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{64}$\"\n        },\n        \"execution_id\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n        },\n        \"type\": {\n          \"const\": \"diagnostic_result\"\n        },\n        \"public_output\": {\n          \"type\": \"object\",\n          \"additionalProperties\": false,\n          \"required\": [\n            \"bytes\",\n            \"sha256\"\n          ],\n          \"properties\": {\n            \"bytes\": {\n              \"type\": \"integer\",\n              \"minimum\": 0,\n              \"maximum\": 9007199254740991\n            },\n            \"sha256\": {\n              \"type\": \"string\",\n              \"pattern\": \"^[0-9a-f]{64}$\"\n            }\n          }\n        },\n        \"public_result\": {\n          \"type\": \"object\",\n          \"additionalProperties\": false,\n          \"required\": [\n            \"schema\",\n            \"overall_status\",\n            \"planned_exit_code\"\n          ],\n          \"properties\": {\n            \"schema\": {\n              \"const\": \"caveat.native_factory_diagnostics.v1\"\n            },\n            \"overall_status\": {\n              \"enum\": [\n                \"ready\",\n                \"not_ready\",\n                \"unverified\"\n              ]\n            },\n            \"planned_exit_code\": {\n              \"enum\": [\n                0,\n                1\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"overall_status\": {\n                    \"const\": \"ready\"\n                  }\n                }\n              },\n              \"then\": {\n                \"properties\": {\n                  \"planned_exit_code\": {\n                    \"const\": 0\n                  }\n                }\n              },\n              \"else\": {\n                \"properties\": {\n                  \"planned_exit_code\": {\n                    \"const\": 1\n                  }\n                }\n              }\n            }\n          ]\n        },\n        \"sync_observation\": {\n          \"type\": \"object\",\n          \"additionalProperties\": false,\n          \"required\": [\n            \"status\",\n            \"reason_code\",\n            \"repo_identity\",\n            \"local_head\",\n            \"remote_head\",\n            \"comparison\",\n            \"relation_counts\"\n          ],\n          \"properties\": {\n            \"status\": {\n              \"enum\": [\n                \"ready\",\n                \"not_ready\",\n                \"unverified\"\n              ]\n            },\n            \"reason_code\": {\n              \"type\": \"string\",\n              \"pattern\": \"^[a-z][a-z0-9_]{0,63}$\"\n            },\n            \"repo_identity\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"status\",\n                \"algorithm\",\n                \"digest\",\n                \"reason\"\n              ],\n              \"properties\": {\n                \"status\": {\n                  \"enum\": [\n                    \"available\",\n                    \"not_observed\",\n                    \"unverified\"\n                  ]\n                },\n                \"algorithm\": {\n                  \"anyOf\": [\n                    {\n                      \"const\": \"origin-descriptor-sha256-v1\"\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"digest\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"string\",\n                      \"pattern\": \"^[0-9a-f]{64}$\"\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"reason\": {\n                  \"enum\": [\n                    \"origin_descriptor_observed\",\n                    \"origin_not_reached\",\n                    \"origin_capture_unverified\",\n                    \"origin_syntax_unsupported\",\n                    \"origin_semantics_ambiguous\"\n                  ]\n                }\n              },\n              \"allOf\": [\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"status\": {\n                        \"const\": \"available\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"algorithm\": {\n                        \"const\": \"origin-descriptor-sha256-v1\"\n                      },\n                      \"digest\": {\n                        \"type\": \"string\",\n                        \"pattern\": \"^[0-9a-f]{64}$\"\n                      },\n                      \"reason\": {\n                        \"const\": \"origin_descriptor_observed\"\n                      }\n                    }\n                  },\n                  \"else\": {\n                    \"properties\": {\n                      \"algorithm\": {\n                        \"type\": \"null\"\n                      },\n                      \"digest\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  }\n                },\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"status\": {\n                        \"const\": \"not_observed\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"reason\": {\n                        \"const\": \"origin_not_reached\"\n                      }\n                    }\n                  }\n                },\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"status\": {\n                        \"const\": \"unverified\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"reason\": {\n                        \"enum\": [\n                          \"origin_capture_unverified\",\n                          \"origin_syntax_unsupported\",\n                          \"origin_semantics_ambiguous\"\n                        ]\n                      }\n                    }\n                  }\n                }\n              ]\n            },\n            \"local_head\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"status\",\n                \"value\",\n                \"reason\"\n              ],\n              \"properties\": {\n                \"status\": {\n                  \"enum\": [\n                    \"observed\",\n                    \"not_observed\",\n                    \"unverified\"\n                  ]\n                },\n                \"value\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"string\",\n                      \"pattern\": \"^[0-9a-f]{40}$\"\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"reason\": {\n                  \"type\": \"string\",\n                  \"pattern\": \"^[a-z][a-z0-9_]{0,63}$\"\n                }\n              },\n              \"allOf\": [\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"status\": {\n                        \"const\": \"observed\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"string\",\n                        \"pattern\": \"^[0-9a-f]{40}$\"\n                      }\n                    }\n                  },\n                  \"else\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  }\n                }\n              ]\n            },\n            \"remote_head\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"status\",\n                \"value\",\n                \"reason\"\n              ],\n              \"properties\": {\n                \"status\": {\n                  \"enum\": [\n                    \"observed\",\n                    \"not_observed\",\n                    \"unverified\"\n                  ]\n                },\n                \"value\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"string\",\n                      \"pattern\": \"^[0-9a-f]{40}$\"\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"reason\": {\n                  \"type\": \"string\",\n                  \"pattern\": \"^[a-z][a-z0-9_]{0,63}$\"\n                }\n              },\n              \"allOf\": [\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"status\": {\n                        \"const\": \"observed\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"string\",\n                        \"pattern\": \"^[0-9a-f]{40}$\"\n                      }\n                    }\n                  },\n                  \"else\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  }\n                }\n              ]\n            },\n            \"comparison\": {\n              \"enum\": [\n                \"equal\",\n                \"different\",\n                \"not_evaluated\"\n              ]\n            },\n            \"relation_counts\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"status\",\n                \"behind\",\n                \"ahead\"\n              ],\n              \"properties\": {\n                \"status\": {\n                  \"const\": \"not_supported\"\n                },\n                \"behind\": {\n                  \"type\": \"null\"\n                },\n                \"ahead\": {\n                  \"type\": \"null\"\n                }\n              }\n            }\n          }\n        },\n        \"operation_receipt\": {\n          \"type\": \"object\",\n          \"additionalProperties\": false,\n          \"required\": [\n            \"status\",\n            \"receipt\"\n          ],\n          \"properties\": {\n            \"status\": {\n              \"const\": \"not_supported\"\n            },\n            \"receipt\": {\n              \"type\": \"null\"\n            }\n          }\n        }\n      }\n    }\n  ]\n}\n","{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"urn:caveat:factory-private-evidence-windows-channel:v1\",\n  \"title\": \"Draft: local Windows private channel descriptor\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"transport\",\n    \"path\",\n    \"server_pid\",\n    \"server_start_identity\",\n    \"owner_sid\"\n  ],\n  \"properties\": {\n    \"transport\": {\n      \"const\": \"windows-named-pipe-v1\"\n    },\n    \"path\": {\n      \"type\": \"string\",\n      \"pattern\": \"^\\\\\\\\\\\\\\\\\\\\.\\\\\\\\pipe\\\\\\\\caveat-evidence-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n    },\n    \"server_pid\": {\n      \"type\": \"integer\",\n      \"minimum\": 1,\n      \"maximum\": 9007199254740991\n    },\n    \"server_start_identity\": {\n      \"type\": \"string\",\n      \"minLength\": 1,\n      \"maxLength\": 256\n    },\n    \"owner_sid\": {\n      \"type\": \"string\",\n      \"pattern\": \"^S-1-[0-9]+(?:-[0-9]+)+$\",\n      \"maxLength\": 256\n    }\n  }\n}\n"],"mappings":";;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,aAAa,yBAAyB;AAC/C,SAAS,eAAe;AACxB,SAAS,aAAa;;;ACHtB;AAAA,EACE,SAAW;AAAA,EACX,KAAO;AAAA,EACP,OAAS;AAAA,EACT,MAAQ;AAAA,EACR,sBAAwB;AAAA,EACxB,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,YAAc;AAAA,IACZ,QAAU;AAAA,MACR,OAAS;AAAA,IACX;AAAA,IACA,SAAW;AAAA,MACT,OAAS;AAAA,IACX;AAAA,IACA,iBAAmB;AAAA,MACjB,MAAQ;AAAA,MACR,SAAW;AAAA,MACX,WAAa;AAAA,IACf;AAAA,IACA,0BAA4B;AAAA,MAC1B,OAAS;AAAA,IACX;AAAA,IACA,kBAAoB;AAAA,MAClB,OAAS;AAAA,IACX;AAAA,IACA,YAAc;AAAA,MACZ,MAAQ;AAAA,MACR,UAAY;AAAA,MACZ,aAAe;AAAA,MACf,OAAS;AAAA,QACP,OAAS;AAAA,UACP;AAAA,YACE,MAAQ;AAAA,YACR,sBAAwB;AAAA,YACxB,UAAY;AAAA,cACV;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,IAAM;AAAA,gBACJ,OAAS;AAAA,cACX;AAAA,cACA,WAAa;AAAA,gBACX,MAAQ;AAAA,gBACR,UAAY;AAAA,gBACZ,UAAY;AAAA,gBACZ,aAAe;AAAA,gBACf,OAAS;AAAA,kBACP,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,cAAgB;AAAA,gBACd,MAAQ;AAAA,gBACR,UAAY;AAAA,gBACZ,UAAY;AAAA,gBACZ,aAAe;AAAA,gBACf,OAAS;AAAA,kBACP,MAAQ;AAAA,oBACN;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,UACA;AAAA,YACE,MAAQ;AAAA,YACR,sBAAwB;AAAA,YACxB,UAAY;AAAA,cACV;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,IAAM;AAAA,gBACJ,OAAS;AAAA,cACX;AAAA,cACA,WAAa;AAAA,gBACX,MAAQ;AAAA,gBACR,UAAY;AAAA,gBACZ,UAAY;AAAA,gBACZ,aAAe;AAAA,gBACf,OAAS;AAAA,kBACP,MAAQ;AAAA,oBACN;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,cAAgB;AAAA,gBACd,MAAQ;AAAA,gBACR,UAAY;AAAA,gBACZ,UAAY;AAAA,gBACZ,aAAe;AAAA,gBACf,OAAS;AAAA,kBACP,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,OAAS;AAAA,QACP;AAAA,UACE,UAAY;AAAA,YACV,MAAQ;AAAA,YACR,UAAY;AAAA,cACV;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,IAAM;AAAA,gBACJ,OAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAAA,UACA,aAAe;AAAA,UACf,aAAe;AAAA,QACjB;AAAA,QACA;AAAA,UACE,UAAY;AAAA,YACV,MAAQ;AAAA,YACR,UAAY;AAAA,cACV;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,IAAM;AAAA,gBACJ,OAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAAA,UACA,aAAe;AAAA,UACf,aAAe;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAAA,IACA,mBAAqB;AAAA,MACnB,OAAS;AAAA,IACX;AAAA,IACA,mBAAqB;AAAA,MACnB,OAAS;AAAA,IACX;AAAA,EACF;AACF;;;AC5JA;AAAA,EACE,SAAW;AAAA,EACX,KAAO;AAAA,EACP,OAAS;AAAA,EACT,OAAS;AAAA,IACP;AAAA,MACE,MAAQ;AAAA,MACR,sBAAwB;AAAA,MACxB,UAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAc;AAAA,QACZ,QAAU;AAAA,UACR,OAAS;AAAA,QACX;AAAA,QACA,eAAiB;AAAA,UACf,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,OAAS;AAAA,UACP,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,cAAgB;AAAA,UACd,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,MAAQ;AAAA,UACN,OAAS;AAAA,QACX;AAAA,QACA,SAAW;AAAA,UACT,OAAS;AAAA,QACX;AAAA,QACA,iBAAmB;AAAA,UACjB,MAAQ;AAAA,UACR,SAAW;AAAA,UACX,WAAa;AAAA,QACf;AAAA,QACA,0BAA4B;AAAA,UAC1B,OAAS;AAAA,QACX;AAAA,QACA,WAAa;AAAA,UACX,MAAQ;AAAA,YACN;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,QACA,SAAW;AAAA,UACT,MAAQ;AAAA,UACR,sBAAwB;AAAA,UACxB,UAAY;AAAA,YACV;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA,YAAc;AAAA,YACZ,KAAO;AAAA,cACL,MAAQ;AAAA,cACR,SAAW;AAAA,cACX,SAAW;AAAA,YACb;AAAA,YACA,YAAc;AAAA,cACZ,OAAS;AAAA,gBACP;AAAA,kBACE,MAAQ;AAAA,kBACR,SAAW;AAAA,kBACX,SAAW;AAAA,gBACb;AAAA,gBACA;AAAA,kBACE,MAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AAAA,YACA,gBAAkB;AAAA,cAChB,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,OAAS;AAAA,kBACP,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,WAAa;AAAA,sBACb,WAAa;AAAA,oBACf;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,OAAS;AAAA,gBACP;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,YACA,UAAY;AAAA,cACV,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,MAAQ;AAAA,kBACN,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,KAAO;AAAA,kBACL,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,sBACX,SAAW;AAAA,oBACb;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,KAAO;AAAA,kBACL,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,sBACX,SAAW;AAAA,oBACb;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,KAAO;AAAA,kBACL,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,sBACX,WAAa;AAAA,oBACf;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,OAAS;AAAA,gBACP;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,MAAQ;AAAA,wBACN,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,MAAQ;AAAA,wBACN,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,MAAQ;AAAA,wBACN,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,YACA,WAAa;AAAA,cACX,OAAS;AAAA,gBACP;AAAA,kBACE,MAAQ;AAAA,kBACR,WAAa;AAAA,kBACb,WAAa;AAAA,gBACf;AAAA,gBACA;AAAA,kBACE,MAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AAAA,YACA,gBAAkB;AAAA,cAChB,OAAS;AAAA,gBACP;AAAA,kBACE,MAAQ;AAAA,kBACR,WAAa;AAAA,kBACb,WAAa;AAAA,gBACf;AAAA,gBACA;AAAA,kBACE,MAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AAAA,YACA,iBAAmB;AAAA,cACjB,MAAQ;AAAA,cACR,SAAW;AAAA,cACX,WAAa;AAAA,YACf;AAAA,YACA,UAAY;AAAA,cACV,OAAS;AAAA,gBACP;AAAA,kBACE,MAAQ;AAAA,kBACR,WAAa;AAAA,kBACb,WAAa;AAAA,gBACf;AAAA,gBACA;AAAA,kBACE,MAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AAAA,YACA,iBAAmB;AAAA,cACjB,MAAQ;AAAA,cACR,aAAe;AAAA,cACf,OAAS;AAAA,gBACP,MAAQ;AAAA,kBACN;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAQ;AAAA,MACR,sBAAwB;AAAA,MACxB,UAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAc;AAAA,QACZ,QAAU;AAAA,UACR,OAAS;AAAA,QACX;AAAA,QACA,eAAiB;AAAA,UACf,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,OAAS;AAAA,UACP,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,cAAgB;AAAA,UACd,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,MAAQ;AAAA,UACN,OAAS;AAAA,QACX;AAAA,QACA,eAAiB;AAAA,UACf,MAAQ;AAAA,UACR,sBAAwB;AAAA,UACxB,UAAY;AAAA,YACV;AAAA,YACA;AAAA,UACF;AAAA,UACA,YAAc;AAAA,YACZ,OAAS;AAAA,cACP,MAAQ;AAAA,cACR,SAAW;AAAA,cACX,SAAW;AAAA,YACb;AAAA,YACA,QAAU;AAAA,cACR,MAAQ;AAAA,cACR,SAAW;AAAA,YACb;AAAA,UACF;AAAA,QACF;AAAA,QACA,eAAiB;AAAA,UACf,MAAQ;AAAA,UACR,sBAAwB;AAAA,UACxB,UAAY;AAAA,YACV;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA,YAAc;AAAA,YACZ,QAAU;AAAA,cACR,OAAS;AAAA,YACX;AAAA,YACA,gBAAkB;AAAA,cAChB,MAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,YACA,mBAAqB;AAAA,cACnB,MAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,UACA,OAAS;AAAA,YACP;AAAA,cACE,IAAM;AAAA,gBACJ,YAAc;AAAA,kBACZ,gBAAkB;AAAA,oBAChB,OAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,cACA,MAAQ;AAAA,gBACN,YAAc;AAAA,kBACZ,mBAAqB;AAAA,oBACnB,OAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,cACA,MAAQ;AAAA,gBACN,YAAc;AAAA,kBACZ,mBAAqB;AAAA,oBACnB,OAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,kBAAoB;AAAA,UAClB,MAAQ;AAAA,UACR,sBAAwB;AAAA,UACxB,UAAY;AAAA,YACV;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA,YAAc;AAAA,YACZ,QAAU;AAAA,cACR,MAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,YACA,aAAe;AAAA,cACb,MAAQ;AAAA,cACR,SAAW;AAAA,YACb;AAAA,YACA,eAAiB;AAAA,cACf,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,WAAa;AAAA,kBACX,OAAS;AAAA,oBACP;AAAA,sBACE,OAAS;AAAA,oBACX;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,QAAU;AAAA,kBACR,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,oBACb;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,QAAU;AAAA,kBACR,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,OAAS;AAAA,gBACP;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,WAAa;AAAA,wBACX,OAAS;AAAA,sBACX;AAAA,sBACA,QAAU;AAAA,wBACR,MAAQ;AAAA,wBACR,SAAW;AAAA,sBACb;AAAA,sBACA,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,WAAa;AAAA,wBACX,MAAQ;AAAA,sBACV;AAAA,sBACA,QAAU;AAAA,wBACR,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,MAAQ;AAAA,0BACN;AAAA,0BACA;AAAA,0BACA;AAAA,wBACF;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,OAAS;AAAA,kBACP,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,oBACb;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,QAAU;AAAA,kBACR,MAAQ;AAAA,kBACR,SAAW;AAAA,gBACb;AAAA,cACF;AAAA,cACA,OAAS;AAAA,gBACP;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,wBACR,SAAW;AAAA,sBACb;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,YACA,aAAe;AAAA,cACb,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,OAAS;AAAA,kBACP,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,oBACb;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,QAAU;AAAA,kBACR,MAAQ;AAAA,kBACR,SAAW;AAAA,gBACb;AAAA,cACF;AAAA,cACA,OAAS;AAAA,gBACP;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,wBACR,SAAW;AAAA,sBACb;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,MAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,YACA,iBAAmB;AAAA,cACjB,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,OAAS;AAAA,gBACX;AAAA,gBACA,QAAU;AAAA,kBACR,MAAQ;AAAA,gBACV;AAAA,gBACA,OAAS;AAAA,kBACP,MAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,mBAAqB;AAAA,UACnB,MAAQ;AAAA,UACR,sBAAwB;AAAA,UACxB,UAAY;AAAA,YACV;AAAA,YACA;AAAA,UACF;AAAA,UACA,YAAc;AAAA,YACZ,QAAU;AAAA,cACR,OAAS;AAAA,YACX;AAAA,YACA,SAAW;AAAA,cACT,MAAQ;AAAA,YACV;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACnuBA;AAAA,EACE,SAAW;AAAA,EACX,KAAO;AAAA,EACP,OAAS;AAAA,EACT,MAAQ;AAAA,EACR,sBAAwB;AAAA,EACxB,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,YAAc;AAAA,IACZ,WAAa;AAAA,MACX,OAAS;AAAA,IACX;AAAA,IACA,MAAQ;AAAA,MACN,MAAQ;AAAA,MACR,SAAW;AAAA,IACb;AAAA,IACA,YAAc;AAAA,MACZ,MAAQ;AAAA,MACR,SAAW;AAAA,MACX,SAAW;AAAA,IACb;AAAA,IACA,uBAAyB;AAAA,MACvB,MAAQ;AAAA,MACR,WAAa;AAAA,MACb,WAAa;AAAA,IACf;AAAA,IACA,WAAa;AAAA,MACX,MAAQ;AAAA,MACR,SAAW;AAAA,MACX,WAAa;AAAA,IACf;AAAA,EACF;AACF;;;AH7BA,IAAM,MAAM,IAAI,QAAQ,EAAE,QAAQ,MAAM,gBAAgB,MAAM,CAAC;AACxD,IAAM,qBAAqB,IAAI,QAAQ,4BAAgB;AACvD,IAAM,gBAAgB,IAAI,QAAQ,+BAAW;AAC7C,IAAM,4BAA4B,IAAI,QAAQ,iCAAa;AAC3D,IAAM,OAAO;AACpB,IAAM,QAAQ;AACP,IAAM,oBAAoB;AAG1B,SAAS,WAAW,OAAmB,QAAQ,mBAA4B;AAChF,MAAI,MAAM,eAAe,KAAK,MAAM,aAAa,MAAO,OAAM,IAAI,MAAM,aAAa;AACrF,QAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC,EAAE,OAAO,KAAK;AACpF,QAAM,UAAyB,CAAC;AAChC,MAAI,QAAQ,GAAG,UAAU;AACzB,QAAM,MAAM;AAAA,IACV,gBAAgB;AAAE,UAAI,EAAE,QAAQ,GAAI,OAAM,IAAI,MAAM,YAAY;AAAG,cAAQ,KAAK,oBAAI,IAAI,CAAC;AAAA,IAAG;AAAA,IAC5F,iBAAiB,KAAK;AAAE,YAAM,OAAO,QAAQ,GAAG,EAAE;AAAI,UAAI,KAAK,IAAI,GAAG,EAAG,WAAU;AAAM,WAAK,IAAI,GAAG;AAAA,IAAG;AAAA,IACxG,cAAc;AAAE,cAAQ,IAAI;AAAG;AAAA,IAAS;AAAA,IACxC,eAAe;AAAE,UAAI,EAAE,QAAQ,GAAI,OAAM,IAAI,MAAM,YAAY;AAAA,IAAG;AAAA,IAClE,aAAa;AAAE;AAAA,IAAS;AAAA,IACxB,UAAU;AAAE,gBAAU;AAAA,IAAM;AAAA,EAC9B,GAAG,EAAE,kBAAkB,MAAM,oBAAoB,OAAO,mBAAmB,MAAM,CAAC;AAClF,MAAI,WAAW,UAAU,KAAK,QAAQ,WAAW,EAAG,OAAM,IAAI,MAAM,cAAc;AAClF,SAAO,KAAK,MAAM,IAAI;AACxB;AAGO,SAAS,gBAAgB,KAAmD;AACjF,MAAI,IAAI,oCAAoC,KAAM,QAAO,EAAE,QAAQ,MAAM;AACzE,QAAM,aAAa,IAAI;AACvB,QAAM,QAAQ,IAAI;AAClB,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,cAAc,CAAC,KAAK,KAAK,UAAU,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,KAAK,CAAC,WAAW,QAAQ,SAAS;AACxG,WAAO,EAAE,QAAQ,cAAc,QAAQ,kBAAkB;AAC3D,MAAI,YAAY,OAAQ,QAAO,EAAE,QAAQ,SAAS,eAAe,YAAY,OAAO,WAAW,cAAc;AAC7G,MAAI;AACF,UAAM,aAAa,WAAW,OAAO,KAAK,OAAO,CAAC;AAClD,QAAI,0BAA0B,UAAU;AACtC,aAAO,EAAE,QAAQ,SAAS,eAAe,YAAY,OAAO,WAAW,wBAAwB;AAAA,EACnG,QAAQ;AAAA,EAAuE;AAC/E,SAAO,EAAE,QAAQ,cAAc,QAAQ,kBAAkB;AAC3D;AAEO,SAAS,iBAAiB,SAA6C,YAC5E,iBAAyB,UAAkB,YAAoB;AAC/D,MAAI,QAAQ,WAAW,MAAO,QAAO,EAAE,QAAQ,MAAM;AACrD,MAAI,QAAQ,WAAW,QAAS,QAAO,EAAE,QAAQ,cAAc,QAAQ,kBAAkB;AACzF,MAAI,cAAc,KAAM,QAAO,EAAE,QAAQ,iBAAiB,QAAQ,oBAAoB;AACtF,MAAI,CAAC,mBAAmB,UAAU,KAAM,WAAoB,oBAAoB;AAC9E,WAAO,EAAE,QAAQ,cAAc,QAAQ,qBAAqB;AAC9D,QAAM,SAAU,WAAoB,WAAW,KAAK,CAAC,MACnD,EAAE,OAAO,QAAQ,aAAa,EAAE,UAAU,SAAS,QAAQ,KAAK,EAAE,aAAa,SAAS,UAAU,CAAC;AAErG,SAAO,SAAS,EAAE,QAAQ,qCAAqC,IAC3D,EAAE,QAAQ,iBAAiB,QAAQ,wBAAwB;AACjE;AAGO,SAAS,iBAAiB,OAIsB;AACrD,QAAM,MAAM,CAAC,YAAoB,EAAE,QAAQ,cAAc,OAAO;AAChE,MAAI;AACF,QAAI,MAAM,QAAQ,WAAW,WAAW,MAAM,QAAQ,QAAQ,MAAM,iBAAiB,KAAM,QAAO,IAAI,oBAAoB;AAC1H,QAAI,CAAC,mBAAmB,MAAM,UAAU,KAAM,MAAM,WAAoB,oBAAoB,MAAM;AAChG,aAAO,IAAI,oBAAoB;AACjC,QAAI,MAAM,aAAa,aAAa,kBAAmB,QAAO,IAAI,gBAAgB;AAClF,UAAM,QAAQ,OAAO,KAAK,MAAM,YAAY;AAC5C,QAAI,MAAM,GAAG,EAAE,MAAM,GAAI,QAAO,IAAI,eAAe;AACnD,UAAM,QAAQ,MAAM,SAAS,QAAQ,EAAE,MAAM,IAAI;AACjD,QAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,GAAI,QAAO,IAAI,eAAe;AACrE,UAAM,SAAS,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,UAAQ,WAAW,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAS;AAC5F,QAAI,OAAO,KAAK,WAAS,CAAC,cAAc,KAAK,CAAC,EAAG,QAAO,IAAI,cAAc;AAC1E,UAAM,CAAC,OAAO,MAAM,IAAI;AACxB,QAAI,MAAM,SAAS,WAAW,OAAO,SAAS,oBAAqB,QAAO,IAAI,aAAa;AAC3F,QAAI,CAAC,KAAK,KAAK,MAAM,YAAY,EAAG,QAAO,IAAI,gBAAgB;AAC/D,eAAW,OAAO,CAAC,UAAU,iBAAiB,SAAS,cAAc;AACnE,UAAI,MAAM,GAAG,MAAM,OAAO,GAAG,EAAG,QAAO,IAAI,gBAAgB;AAC7D,QAAI,MAAM,kBAAkB,MAAM,QAAQ,iBAAiB,MAAM,UAAU,MAAM,QAAQ,SACrF,MAAM,oBAAoB,MAAM,mBAAmB,MAAM,QAAQ,oBAAoB,MAAM,mBAC3F,MAAM,cAAc,MAAM,QAAQ,UAAW,QAAO,IAAI,gBAAgB;AAC5E,QAAI,iBAAiB,MAAM,SAAS,MAAM,YAAY,MAAM,iBAAiB,MAAM,UAAU,MAAM,UAAU,EAAE,WAC3G,qCAAsC,QAAO,IAAI,uBAAuB;AAC5E,UAAM,IAAI,MAAM;AAChB,QAAI,CAAC,MAAM,mBAAmB,CAAC,kBAAkB,GAAG,MAAM,eAAe,EAAG,QAAO,IAAI,eAAe;AACtG,UAAM,SAAmB,CAAC;AAC1B,eAAW,CAAC,KAAK,MAAM,KAAK;AAAA,MAAC,CAAC,cAAc,6BAA6B;AAAA,MAAG,CAAC,aAAa,uBAAuB;AAAA,MAC/G,CAAC,kBAAkB,wBAAwB;AAAA,MAAG,CAAC,YAAY,sBAAsB;AAAA,IAAC;AAClF,UAAI,EAAE,GAAI,MAAM,KAAM,QAAO,KAAK,MAAO;AAC3C,QAAI,EAAE,eAAe,WAAW,cAAe,QAAO,KAAK,4BAA4B;AACvF,QAAI,EAAE,SAAS,SAAS,UAAW,QAAO,KAAK,4BAA4B;AAC3E,QAAI,CAAC,kBAAkB,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,EAAG,QAAO,IAAI,wBAAwB;AAC9G,QAAI,MAAM,YAAY,GAAG,EAAE,MAAM,MAAM,MAAM,YAAY,SAAS,GAAG,EAAE,EAAE,SAAS,EAAE,EAAG,QAAO,IAAI,gBAAgB;AAClH,UAAM,MAAM,WAAW,MAAM,aAAa,KAAK;AAC/C,QAAI,IAAI,WAAW,MAAM,4BAA4B,IAAI,YAAY,YAAY,IAAI,YAAY,MAAM,mBACnG,IAAI,SAAS,WAAW,OAAO,cAAc,kBAAkB,IAAI,MAAM,WAAW,OAAO,iBAAiB,UAC5G,IAAI,MAAM,gBAAgB,OAAO,iBAAiB,YAAa,QAAO,IAAI,iBAAiB;AAC/F,QAAI,OAAO,cAAc,UAAU,MAAM,YAAY,cAAc,OAAO,cAAc,WACpF,WAAW,QAAQ,EAAE,OAAO,MAAM,WAAW,EAAE,OAAO,KAAK,EAAG,QAAO,IAAI,uBAAuB;AACpG,UAAM,OAAO,OAAO;AACpB,UAAM,OAAO,KAAK,WAAW,WAAW,cAAc,KAAK,YAAY,WAAW;AAClF,UAAM,aAAa,OAAO,KAAK,WAAW,UAAU,KAAK,YAAY,QAAQ,UAAU,cAAc;AACrG,QAAI,KAAK,eAAe,WAAY,QAAO,IAAI,iBAAiB;AAChE,UAAM,OAAO,KAAK;AAClB,UAAM,UAAU,KAAK,WAAW,cAAc,CAAC,4BAA4B,IAAI,KAAK,WAAW,iBAC3F,CAAC,oBAAoB,IAAI,CAAC,6BAA6B,6BAA6B,4BAA4B;AACpH,QAAI,CAAC,QAAQ,SAAS,KAAK,MAAM,EAAG,QAAO,IAAI,eAAe;AAC9D,WAAO,EAAE,QAAQ,SAAS,QAAQ,8BAA8B;AAAA,EAClE,QAAQ;AAAE,WAAO,IAAI,kBAAkB;AAAA,EAAG;AAC5C;","names":[]}
+{"version":3,"sources":["../../src/privateEvidence/validation.ts","../../src/contracts/factory-private-evidence/capability.v1.schema.json","../../src/contracts/factory-private-evidence/private-frame.v1.schema.json","../../src/contracts/factory-private-evidence/windows-channel.v1.schema.json"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { TextDecoder, isDeepStrictEqual } from 'node:util';\nimport { Ajv2020 } from 'ajv/dist/2020.js';\nimport { visit } from 'jsonc-parser';\nimport capabilitySchema from '../contracts/factory-private-evidence/capability.v1.schema.json' with { type: 'json' };\nimport frameSchema from '../contracts/factory-private-evidence/private-frame.v1.schema.json' with { type: 'json' };\nimport windowsSchema from '../contracts/factory-private-evidence/windows-channel.v1.schema.json' with { type: 'json' };\n\nconst ajv = new Ajv2020({ strict: true, strictRequired: false });\nexport const validateCapability = ajv.compile(capabilitySchema);\nexport const validateFrame = ajv.compile(frameSchema);\nexport const validateWindowsDescriptor = ajv.compile(windowsSchema);\nexport const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;\nconst NONCE = /^[0-9a-f]{64}$/;\nexport const MAX_CHANNEL_BYTES = 16384;\n\n/** Strict, bounded JSON. The parser library supplies tokenization and nesting events. */\nexport function strictJson(bytes: Uint8Array, limit = MAX_CHANNEL_BYTES): unknown {\n  if (bytes.byteLength === 0 || bytes.byteLength > limit) throw new Error('json_budget');\n  const text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);\n  const objects: Set<string>[] = [];\n  let depth = 0, invalid = false;\n  visit(text, {\n    onObjectBegin() { if (++depth > 32) throw new Error('json_depth'); objects.push(new Set()); },\n    onObjectProperty(key) { const keys = objects.at(-1)!; if (keys.has(key)) invalid = true; keys.add(key); },\n    onObjectEnd() { objects.pop(); depth--; },\n    onArrayBegin() { if (++depth > 32) throw new Error('json_depth'); },\n    onArrayEnd() { depth--; },\n    onError() { invalid = true; },\n  }, { disallowComments: true, allowTrailingComma: false, allowEmptyContent: false });\n  if (invalid || depth !== 0 || objects.length !== 0) throw new Error('json_invalid');\n  return JSON.parse(text);\n}\n\ntype Dict = Record<string, any>; // Schema checks narrow every use below; values never enter logs.\nexport function validateRequest(env: Readonly<Record<string, string | undefined>>) {\n  if (env.CAVEAT_FACTORY_PRIVATE_EVIDENCE !== 'v1') return { status: 'off' } as const;\n  const collection = env.CAVEAT_FACTORY_PRIVATE_COLLECTION_ID;\n  const nonce = env.CAVEAT_FACTORY_PRIVATE_NONCE;\n  const channel = env.CAVEAT_FACTORY_PRIVATE_CHANNEL;\n  if (!collection || !UUID.test(collection) || !nonce || !NONCE.test(nonce) || !channel || channel.length > MAX_CHANNEL_BYTES)\n    return { status: 'unverified', reason: 'request_invalid' } as const;\n  if (channel === 'fd:3') return { status: 'valid', collection_id: collection, nonce, transport: 'posix-fd-v1' } as const;\n  try {\n    const descriptor = strictJson(Buffer.from(channel));\n    if (validateWindowsDescriptor(descriptor))\n      return { status: 'valid', collection_id: collection, nonce, transport: 'windows-named-pipe-v1' } as const;\n  } catch { /* A fixed reason only; never propagate an input or parser error. */ }\n  return { status: 'unverified', reason: 'request_invalid' } as const;\n}\n\nexport function selectCapability(request: ReturnType<typeof validateRequest>, capability: unknown,\n  expectedVersion: string, platform: string, launchPath: string) {\n  if (request.status === 'off') return { status: 'off' } as const;\n  if (request.status !== 'valid') return { status: 'unverified', reason: 'request_invalid' } as const;\n  if (capability == null) return { status: 'not_supported', reason: 'capability_absent' } as const;\n  if (!validateCapability(capability) || (capability as Dict).package_version !== expectedVersion)\n    return { status: 'unverified', reason: 'capability_invalid' } as const;\n  const common = (capability as Dict).transports.some((t: Dict) =>\n    t.id === request.transport && t.platforms.includes(platform) && t.launch_paths.includes(launchPath));\n  // This pure selection is NOT permission to open a channel. OS safety must be separately established.\n  return common ? { status: 'candidate_requires_os_verification' } as const\n    : { status: 'not_supported', reason: 'transport_unsupported' } as const;\n}\n\n/** Validates a synthetic or already received complete channel. Does not read/send a real channel. */\nexport function validateExchange(input: {\n  channelBytes: Uint8Array; eof: boolean; publicBytes: Uint8Array;\n  request: ReturnType<typeof validateRequest>; capability: unknown; expectedVersion: string;\n  peerVerified: boolean; expectedProcess: unknown; platform: string; launchPath: string;\n}): { status: 'valid' | 'unverified'; reason: string } {\n  const bad = (reason: string) => ({ status: 'unverified', reason } as const);\n  try {\n    if (input.request.status !== 'valid' || input.eof !== true || input.peerVerified !== true) return bad('channel_incomplete');\n    if (!validateCapability(input.capability) || (input.capability as Dict).package_version !== input.expectedVersion)\n      return bad('capability_invalid');\n    if (input.channelBytes.byteLength > MAX_CHANNEL_BYTES) return bad('channel_budget');\n    const bytes = Buffer.from(input.channelBytes);\n    if (bytes.at(-1) !== 10) return bad('frame_framing');\n    const lines = bytes.toString('latin1').split('\\n');\n    if (lines.length !== 3 || lines[2] !== '') return bad('frame_framing');\n    const frames = lines.slice(0, 2).map(line => strictJson(Buffer.from(line, 'latin1')) as Dict);\n    if (frames.some(frame => !validateFrame(frame))) return bad('frame_schema');\n    const [hello, result] = frames as [Dict, Dict];\n    if (hello.type !== 'hello' || result.type !== 'diagnostic_result') return bad('frame_order');\n    if (!UUID.test(hello.execution_id)) return bad('frame_identity');\n    for (const key of ['schema', 'collection_id', 'nonce', 'execution_id'])\n      if (hello[key] !== result[key]) return bad('frame_identity');\n    if (hello.collection_id !== input.request.collection_id || hello.nonce !== input.request.nonce ||\n        hello.product_version !== input.expectedVersion || hello.process.package_version !== input.expectedVersion ||\n        hello.transport !== input.request.transport) return bad('frame_identity');\n    if (selectCapability(input.request, input.capability, input.expectedVersion, input.platform, input.launchPath).status !==\n        'candidate_requires_os_verification') return bad('transport_unsupported');\n    const p = hello.process;\n    if (!input.expectedProcess || !isDeepStrictEqual(p, input.expectedProcess)) return bad('peer_identity');\n    const needed: string[] = [];\n    for (const [key, reason] of [['parent_pid', 'parent_identity_unavailable'], ['exec_path', 'exec_path_unavailable'],\n      ['entry_realpath', 'entry_path_unavailable'], ['build_id', 'build_id_unavailable']])\n      if (p[key!] === null) needed.push(reason!);\n    if (p.start_identity.source === 'unavailable') needed.push('start_identity_unavailable');\n    if (p.identity.kind === 'unknown') needed.push('actor_identity_unavailable');\n    if (!isDeepStrictEqual([...needed].sort(), [...p.missing_reasons].sort())) return bad('process_missing_reason');\n    if (input.publicBytes.at(-1) !== 10 || input.publicBytes.subarray(0, -1).includes(10)) return bad('public_framing');\n    const pub = strictJson(input.publicBytes, 65536) as Dict;\n    if (pub.schema !== hello.public_diagnostic_schema || pub.product !== 'caveat' || pub.version !== input.expectedVersion ||\n        pub.overall?.status !== result.public_result.overall_status || pub.sync?.status !== result.sync_observation.status ||\n        pub.sync?.reason_code !== result.sync_observation.reason_code) return bad('public_mismatch');\n    if (result.public_output.bytes !== input.publicBytes.byteLength || result.public_output.sha256 !==\n        createHash('sha256').update(input.publicBytes).digest('hex')) return bad('public_bytes_mismatch');\n    const sync = result.sync_observation;\n    const both = sync.local_head.status === 'observed' && sync.remote_head.status === 'observed';\n    const comparison = both ? sync.local_head.value === sync.remote_head.value ? 'equal' : 'different' : 'not_evaluated';\n    if (sync.comparison !== comparison) return bad('head_comparison');\n    const repo = sync.repo_identity;\n    const allowed = repo.status === 'available' ? ['origin_descriptor_observed'] : repo.status === 'not_observed'\n      ? ['origin_not_reached'] : ['origin_capture_unverified', 'origin_syntax_unsupported', 'origin_semantics_ambiguous'];\n    if (!allowed.includes(repo.reason)) return bad('origin_reason');\n    return { status: 'valid', reason: 'complete_synthetic_exchange' };\n  } catch { return bad('exchange_invalid'); }\n}\n","{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"urn:caveat:factory-private-evidence-capability:v1\",\n  \"title\": \"Draft: Caveat official private evidence capability v1\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"schema\",\n    \"product\",\n    \"package_version\",\n    \"public_diagnostic_schema\",\n    \"private_protocol\",\n    \"transports\",\n    \"max_channel_bytes\",\n    \"operation_receipt\"\n  ],\n  \"properties\": {\n    \"schema\": {\n      \"const\": \"caveat.factory_private_evidence_capability.v1\"\n    },\n    \"product\": {\n      \"const\": \"caveat\"\n    },\n    \"package_version\": {\n      \"type\": \"string\",\n      \"pattern\": \"^(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\\\+[0-9A-Za-z-]+(?:\\\\.[0-9A-Za-z-]+)*)?$\",\n      \"maxLength\": 128\n    },\n    \"public_diagnostic_schema\": {\n      \"const\": \"caveat.native_factory_diagnostics.v1\"\n    },\n    \"private_protocol\": {\n      \"const\": \"caveat.factory_private_evidence.v1\"\n    },\n    \"transports\": {\n      \"type\": \"array\",\n      \"maxItems\": 2,\n      \"uniqueItems\": true,\n      \"items\": {\n        \"oneOf\": [\n          {\n            \"type\": \"object\",\n            \"additionalProperties\": false,\n            \"required\": [\n              \"id\",\n              \"platforms\",\n              \"launch_paths\"\n            ],\n            \"properties\": {\n              \"id\": {\n                \"const\": \"posix-fd-v1\"\n              },\n              \"platforms\": {\n                \"type\": \"array\",\n                \"minItems\": 1,\n                \"maxItems\": 2,\n                \"uniqueItems\": true,\n                \"items\": {\n                  \"enum\": [\n                    \"linux\",\n                    \"darwin\"\n                  ]\n                }\n              },\n              \"launch_paths\": {\n                \"type\": \"array\",\n                \"minItems\": 1,\n                \"maxItems\": 1,\n                \"uniqueItems\": true,\n                \"items\": {\n                  \"enum\": [\n                    \"direct_node_entry\"\n                  ]\n                }\n              }\n            }\n          },\n          {\n            \"type\": \"object\",\n            \"additionalProperties\": false,\n            \"required\": [\n              \"id\",\n              \"platforms\",\n              \"launch_paths\"\n            ],\n            \"properties\": {\n              \"id\": {\n                \"const\": \"windows-named-pipe-v1\"\n              },\n              \"platforms\": {\n                \"type\": \"array\",\n                \"minItems\": 1,\n                \"maxItems\": 1,\n                \"uniqueItems\": true,\n                \"items\": {\n                  \"enum\": [\n                    \"win32\"\n                  ]\n                }\n              },\n              \"launch_paths\": {\n                \"type\": \"array\",\n                \"minItems\": 1,\n                \"maxItems\": 2,\n                \"uniqueItems\": true,\n                \"items\": {\n                  \"enum\": [\n                    \"native_exe\",\n                    \"powershell_standard_shim\"\n                  ]\n                }\n              }\n            }\n          }\n        ]\n      },\n      \"allOf\": [\n        {\n          \"contains\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"id\"\n            ],\n            \"properties\": {\n              \"id\": {\n                \"const\": \"posix-fd-v1\"\n              }\n            }\n          },\n          \"minContains\": 0,\n          \"maxContains\": 1\n        },\n        {\n          \"contains\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"id\"\n            ],\n            \"properties\": {\n              \"id\": {\n                \"const\": \"windows-named-pipe-v1\"\n              }\n            }\n          },\n          \"minContains\": 0,\n          \"maxContains\": 1\n        }\n      ]\n    },\n    \"max_channel_bytes\": {\n      \"const\": 16384\n    },\n    \"operation_receipt\": {\n      \"const\": \"not_supported\"\n    }\n  }\n}\n","{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"urn:caveat:factory-private-evidence:v1\",\n  \"title\": \"Draft: Caveat official private evidence NDJSON frame v1\",\n  \"oneOf\": [\n    {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"schema\",\n        \"collection_id\",\n        \"nonce\",\n        \"execution_id\",\n        \"type\",\n        \"product\",\n        \"product_version\",\n        \"public_diagnostic_schema\",\n        \"transport\",\n        \"process\"\n      ],\n      \"properties\": {\n        \"schema\": {\n          \"const\": \"caveat.factory_private_evidence.v1\"\n        },\n        \"collection_id\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n        },\n        \"nonce\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{64}$\"\n        },\n        \"execution_id\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n        },\n        \"type\": {\n          \"const\": \"hello\"\n        },\n        \"product\": {\n          \"const\": \"caveat\"\n        },\n        \"product_version\": {\n          \"type\": \"string\",\n          \"pattern\": \"^(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\\\+[0-9A-Za-z-]+(?:\\\\.[0-9A-Za-z-]+)*)?$\",\n          \"maxLength\": 128\n        },\n        \"public_diagnostic_schema\": {\n          \"const\": \"caveat.native_factory_diagnostics.v1\"\n        },\n        \"transport\": {\n          \"enum\": [\n            \"posix-fd-v1\",\n            \"windows-named-pipe-v1\"\n          ]\n        },\n        \"process\": {\n          \"type\": \"object\",\n          \"additionalProperties\": false,\n          \"required\": [\n            \"pid\",\n            \"parent_pid\",\n            \"start_identity\",\n            \"identity\",\n            \"exec_path\",\n            \"entry_realpath\",\n            \"package_version\",\n            \"build_id\",\n            \"missing_reasons\"\n          ],\n          \"properties\": {\n            \"pid\": {\n              \"type\": \"integer\",\n              \"minimum\": 1,\n              \"maximum\": 9007199254740991\n            },\n            \"parent_pid\": {\n              \"anyOf\": [\n                {\n                  \"type\": \"integer\",\n                  \"minimum\": 0,\n                  \"maximum\": 9007199254740991\n                },\n                {\n                  \"type\": \"null\"\n                }\n              ]\n            },\n            \"start_identity\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"source\",\n                \"value\"\n              ],\n              \"properties\": {\n                \"source\": {\n                  \"enum\": [\n                    \"linux_proc_start\",\n                    \"windows_process_creation\",\n                    \"os_process_start\",\n                    \"unavailable\"\n                  ]\n                },\n                \"value\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"string\",\n                      \"minLength\": 1,\n                      \"maxLength\": 256\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                }\n              },\n              \"allOf\": [\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"source\": {\n                        \"const\": \"unavailable\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  },\n                  \"else\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"string\"\n                      }\n                    }\n                  }\n                }\n              ]\n            },\n            \"identity\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"kind\",\n                \"uid\",\n                \"gid\",\n                \"sid\"\n              ],\n              \"properties\": {\n                \"kind\": {\n                  \"enum\": [\n                    \"uid_gid\",\n                    \"windows_sid\",\n                    \"unknown\"\n                  ]\n                },\n                \"uid\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"integer\",\n                      \"minimum\": 0,\n                      \"maximum\": 9007199254740991\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"gid\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"integer\",\n                      \"minimum\": 0,\n                      \"maximum\": 9007199254740991\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"sid\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"string\",\n                      \"pattern\": \"^S-1-[0-9]+(?:-[0-9]+)+$\",\n                      \"maxLength\": 256\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                }\n              },\n              \"allOf\": [\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"kind\": {\n                        \"const\": \"uid_gid\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"uid\": {\n                        \"type\": \"integer\"\n                      },\n                      \"gid\": {\n                        \"type\": \"integer\"\n                      },\n                      \"sid\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  }\n                },\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"kind\": {\n                        \"const\": \"windows_sid\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"uid\": {\n                        \"type\": \"null\"\n                      },\n                      \"gid\": {\n                        \"type\": \"null\"\n                      },\n                      \"sid\": {\n                        \"type\": \"string\"\n                      }\n                    }\n                  }\n                },\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"kind\": {\n                        \"const\": \"unknown\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"uid\": {\n                        \"type\": \"null\"\n                      },\n                      \"gid\": {\n                        \"type\": \"null\"\n                      },\n                      \"sid\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  }\n                }\n              ]\n            },\n            \"exec_path\": {\n              \"anyOf\": [\n                {\n                  \"type\": \"string\",\n                  \"minLength\": 1,\n                  \"maxLength\": 4096\n                },\n                {\n                  \"type\": \"null\"\n                }\n              ]\n            },\n            \"entry_realpath\": {\n              \"anyOf\": [\n                {\n                  \"type\": \"string\",\n                  \"minLength\": 1,\n                  \"maxLength\": 4096\n                },\n                {\n                  \"type\": \"null\"\n                }\n              ]\n            },\n            \"package_version\": {\n              \"type\": \"string\",\n              \"pattern\": \"^(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)\\\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\\\+[0-9A-Za-z-]+(?:\\\\.[0-9A-Za-z-]+)*)?$\",\n              \"maxLength\": 128\n            },\n            \"build_id\": {\n              \"anyOf\": [\n                {\n                  \"type\": \"string\",\n                  \"minLength\": 1,\n                  \"maxLength\": 256\n                },\n                {\n                  \"type\": \"null\"\n                }\n              ]\n            },\n            \"missing_reasons\": {\n              \"type\": \"array\",\n              \"uniqueItems\": true,\n              \"items\": {\n                \"enum\": [\n                  \"parent_identity_unavailable\",\n                  \"start_identity_unavailable\",\n                  \"actor_identity_unavailable\",\n                  \"exec_path_unavailable\",\n                  \"entry_path_unavailable\",\n                  \"build_id_unavailable\"\n                ]\n              }\n            }\n          }\n        }\n      }\n    },\n    {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"schema\",\n        \"collection_id\",\n        \"nonce\",\n        \"execution_id\",\n        \"type\",\n        \"public_output\",\n        \"public_result\",\n        \"sync_observation\",\n        \"operation_receipt\"\n      ],\n      \"properties\": {\n        \"schema\": {\n          \"const\": \"caveat.factory_private_evidence.v1\"\n        },\n        \"collection_id\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n        },\n        \"nonce\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{64}$\"\n        },\n        \"execution_id\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n        },\n        \"type\": {\n          \"const\": \"diagnostic_result\"\n        },\n        \"public_output\": {\n          \"type\": \"object\",\n          \"additionalProperties\": false,\n          \"required\": [\n            \"bytes\",\n            \"sha256\"\n          ],\n          \"properties\": {\n            \"bytes\": {\n              \"type\": \"integer\",\n              \"minimum\": 0,\n              \"maximum\": 9007199254740991\n            },\n            \"sha256\": {\n              \"type\": \"string\",\n              \"pattern\": \"^[0-9a-f]{64}$\"\n            }\n          }\n        },\n        \"public_result\": {\n          \"type\": \"object\",\n          \"additionalProperties\": false,\n          \"required\": [\n            \"schema\",\n            \"overall_status\",\n            \"planned_exit_code\"\n          ],\n          \"properties\": {\n            \"schema\": {\n              \"const\": \"caveat.native_factory_diagnostics.v1\"\n            },\n            \"overall_status\": {\n              \"enum\": [\n                \"ready\",\n                \"not_ready\",\n                \"unverified\"\n              ]\n            },\n            \"planned_exit_code\": {\n              \"enum\": [\n                0,\n                1\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"overall_status\": {\n                    \"const\": \"ready\"\n                  }\n                }\n              },\n              \"then\": {\n                \"properties\": {\n                  \"planned_exit_code\": {\n                    \"const\": 0\n                  }\n                }\n              },\n              \"else\": {\n                \"properties\": {\n                  \"planned_exit_code\": {\n                    \"const\": 1\n                  }\n                }\n              }\n            }\n          ]\n        },\n        \"sync_observation\": {\n          \"type\": \"object\",\n          \"additionalProperties\": false,\n          \"required\": [\n            \"status\",\n            \"reason_code\",\n            \"repo_identity\",\n            \"local_head\",\n            \"remote_head\",\n            \"comparison\",\n            \"relation_counts\"\n          ],\n          \"properties\": {\n            \"status\": {\n              \"enum\": [\n                \"ready\",\n                \"not_ready\",\n                \"unverified\"\n              ]\n            },\n            \"reason_code\": {\n              \"type\": \"string\",\n              \"pattern\": \"^[a-z][a-z0-9_]{0,63}$\"\n            },\n            \"repo_identity\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"status\",\n                \"algorithm\",\n                \"digest\",\n                \"reason\"\n              ],\n              \"properties\": {\n                \"status\": {\n                  \"enum\": [\n                    \"available\",\n                    \"not_observed\",\n                    \"unverified\"\n                  ]\n                },\n                \"algorithm\": {\n                  \"anyOf\": [\n                    {\n                      \"const\": \"origin-descriptor-sha256-v1\"\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"digest\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"string\",\n                      \"pattern\": \"^[0-9a-f]{64}$\"\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"reason\": {\n                  \"enum\": [\n                    \"origin_descriptor_observed\",\n                    \"origin_not_reached\",\n                    \"origin_capture_unverified\",\n                    \"origin_syntax_unsupported\",\n                    \"origin_semantics_ambiguous\"\n                  ]\n                }\n              },\n              \"allOf\": [\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"status\": {\n                        \"const\": \"available\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"algorithm\": {\n                        \"const\": \"origin-descriptor-sha256-v1\"\n                      },\n                      \"digest\": {\n                        \"type\": \"string\",\n                        \"pattern\": \"^[0-9a-f]{64}$\"\n                      },\n                      \"reason\": {\n                        \"const\": \"origin_descriptor_observed\"\n                      }\n                    }\n                  },\n                  \"else\": {\n                    \"properties\": {\n                      \"algorithm\": {\n                        \"type\": \"null\"\n                      },\n                      \"digest\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  }\n                },\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"status\": {\n                        \"const\": \"not_observed\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"reason\": {\n                        \"const\": \"origin_not_reached\"\n                      }\n                    }\n                  }\n                },\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"status\": {\n                        \"const\": \"unverified\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"reason\": {\n                        \"enum\": [\n                          \"origin_capture_unverified\",\n                          \"origin_syntax_unsupported\",\n                          \"origin_semantics_ambiguous\"\n                        ]\n                      }\n                    }\n                  }\n                }\n              ]\n            },\n            \"local_head\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"status\",\n                \"value\",\n                \"reason\"\n              ],\n              \"properties\": {\n                \"status\": {\n                  \"enum\": [\n                    \"observed\",\n                    \"not_observed\",\n                    \"unverified\"\n                  ]\n                },\n                \"value\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"string\",\n                      \"pattern\": \"^[0-9a-f]{40}$\"\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"reason\": {\n                  \"type\": \"string\",\n                  \"pattern\": \"^[a-z][a-z0-9_]{0,63}$\"\n                }\n              },\n              \"allOf\": [\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"status\": {\n                        \"const\": \"observed\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"string\",\n                        \"pattern\": \"^[0-9a-f]{40}$\"\n                      }\n                    }\n                  },\n                  \"else\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  }\n                }\n              ]\n            },\n            \"remote_head\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"status\",\n                \"value\",\n                \"reason\"\n              ],\n              \"properties\": {\n                \"status\": {\n                  \"enum\": [\n                    \"observed\",\n                    \"not_observed\",\n                    \"unverified\"\n                  ]\n                },\n                \"value\": {\n                  \"anyOf\": [\n                    {\n                      \"type\": \"string\",\n                      \"pattern\": \"^[0-9a-f]{40}$\"\n                    },\n                    {\n                      \"type\": \"null\"\n                    }\n                  ]\n                },\n                \"reason\": {\n                  \"type\": \"string\",\n                  \"pattern\": \"^[a-z][a-z0-9_]{0,63}$\"\n                }\n              },\n              \"allOf\": [\n                {\n                  \"if\": {\n                    \"properties\": {\n                      \"status\": {\n                        \"const\": \"observed\"\n                      }\n                    }\n                  },\n                  \"then\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"string\",\n                        \"pattern\": \"^[0-9a-f]{40}$\"\n                      }\n                    }\n                  },\n                  \"else\": {\n                    \"properties\": {\n                      \"value\": {\n                        \"type\": \"null\"\n                      }\n                    }\n                  }\n                }\n              ]\n            },\n            \"comparison\": {\n              \"enum\": [\n                \"equal\",\n                \"different\",\n                \"not_evaluated\"\n              ]\n            },\n            \"relation_counts\": {\n              \"type\": \"object\",\n              \"additionalProperties\": false,\n              \"required\": [\n                \"status\",\n                \"behind\",\n                \"ahead\"\n              ],\n              \"properties\": {\n                \"status\": {\n                  \"const\": \"not_supported\"\n                },\n                \"behind\": {\n                  \"type\": \"null\"\n                },\n                \"ahead\": {\n                  \"type\": \"null\"\n                }\n              }\n            }\n          }\n        },\n        \"operation_receipt\": {\n          \"type\": \"object\",\n          \"additionalProperties\": false,\n          \"required\": [\n            \"status\",\n            \"receipt\"\n          ],\n          \"properties\": {\n            \"status\": {\n              \"const\": \"not_supported\"\n            },\n            \"receipt\": {\n              \"type\": \"null\"\n            }\n          }\n        }\n      }\n    }\n  ]\n}\n","{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"urn:caveat:factory-private-evidence-windows-channel:v1\",\n  \"title\": \"Draft: local Windows private channel descriptor\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"transport\",\n    \"path\",\n    \"server_pid\",\n    \"server_start_identity\",\n    \"owner_sid\"\n  ],\n  \"properties\": {\n    \"transport\": {\n      \"const\": \"windows-named-pipe-v1\"\n    },\n    \"path\": {\n      \"type\": \"string\",\n      \"pattern\": \"^\\\\\\\\\\\\\\\\\\\\.\\\\\\\\pipe\\\\\\\\caveat-evidence-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n    },\n    \"server_pid\": {\n      \"type\": \"integer\",\n      \"minimum\": 1,\n      \"maximum\": 9007199254740991\n    },\n    \"server_start_identity\": {\n      \"type\": \"string\",\n      \"minLength\": 1,\n      \"maxLength\": 256\n    },\n    \"owner_sid\": {\n      \"type\": \"string\",\n      \"pattern\": \"^S-1-[0-9]+(?:-[0-9]+)+$\",\n      \"maxLength\": 256\n    }\n  }\n}\n"],"mappings":";;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,aAAa,yBAAyB;AAC/C,SAAS,eAAe;AACxB,SAAS,aAAa;;;ACHtB;AAAA,EACE,SAAW;AAAA,EACX,KAAO;AAAA,EACP,OAAS;AAAA,EACT,MAAQ;AAAA,EACR,sBAAwB;AAAA,EACxB,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,YAAc;AAAA,IACZ,QAAU;AAAA,MACR,OAAS;AAAA,IACX;AAAA,IACA,SAAW;AAAA,MACT,OAAS;AAAA,IACX;AAAA,IACA,iBAAmB;AAAA,MACjB,MAAQ;AAAA,MACR,SAAW;AAAA,MACX,WAAa;AAAA,IACf;AAAA,IACA,0BAA4B;AAAA,MAC1B,OAAS;AAAA,IACX;AAAA,IACA,kBAAoB;AAAA,MAClB,OAAS;AAAA,IACX;AAAA,IACA,YAAc;AAAA,MACZ,MAAQ;AAAA,MACR,UAAY;AAAA,MACZ,aAAe;AAAA,MACf,OAAS;AAAA,QACP,OAAS;AAAA,UACP;AAAA,YACE,MAAQ;AAAA,YACR,sBAAwB;AAAA,YACxB,UAAY;AAAA,cACV;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,IAAM;AAAA,gBACJ,OAAS;AAAA,cACX;AAAA,cACA,WAAa;AAAA,gBACX,MAAQ;AAAA,gBACR,UAAY;AAAA,gBACZ,UAAY;AAAA,gBACZ,aAAe;AAAA,gBACf,OAAS;AAAA,kBACP,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,cAAgB;AAAA,gBACd,MAAQ;AAAA,gBACR,UAAY;AAAA,gBACZ,UAAY;AAAA,gBACZ,aAAe;AAAA,gBACf,OAAS;AAAA,kBACP,MAAQ;AAAA,oBACN;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,UACA;AAAA,YACE,MAAQ;AAAA,YACR,sBAAwB;AAAA,YACxB,UAAY;AAAA,cACV;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,IAAM;AAAA,gBACJ,OAAS;AAAA,cACX;AAAA,cACA,WAAa;AAAA,gBACX,MAAQ;AAAA,gBACR,UAAY;AAAA,gBACZ,UAAY;AAAA,gBACZ,aAAe;AAAA,gBACf,OAAS;AAAA,kBACP,MAAQ;AAAA,oBACN;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,cAAgB;AAAA,gBACd,MAAQ;AAAA,gBACR,UAAY;AAAA,gBACZ,UAAY;AAAA,gBACZ,aAAe;AAAA,gBACf,OAAS;AAAA,kBACP,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,OAAS;AAAA,QACP;AAAA,UACE,UAAY;AAAA,YACV,MAAQ;AAAA,YACR,UAAY;AAAA,cACV;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,IAAM;AAAA,gBACJ,OAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAAA,UACA,aAAe;AAAA,UACf,aAAe;AAAA,QACjB;AAAA,QACA;AAAA,UACE,UAAY;AAAA,YACV,MAAQ;AAAA,YACR,UAAY;AAAA,cACV;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,IAAM;AAAA,gBACJ,OAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAAA,UACA,aAAe;AAAA,UACf,aAAe;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAAA,IACA,mBAAqB;AAAA,MACnB,OAAS;AAAA,IACX;AAAA,IACA,mBAAqB;AAAA,MACnB,OAAS;AAAA,IACX;AAAA,EACF;AACF;;;AC5JA;AAAA,EACE,SAAW;AAAA,EACX,KAAO;AAAA,EACP,OAAS;AAAA,EACT,OAAS;AAAA,IACP;AAAA,MACE,MAAQ;AAAA,MACR,sBAAwB;AAAA,MACxB,UAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAc;AAAA,QACZ,QAAU;AAAA,UACR,OAAS;AAAA,QACX;AAAA,QACA,eAAiB;AAAA,UACf,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,OAAS;AAAA,UACP,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,cAAgB;AAAA,UACd,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,MAAQ;AAAA,UACN,OAAS;AAAA,QACX;AAAA,QACA,SAAW;AAAA,UACT,OAAS;AAAA,QACX;AAAA,QACA,iBAAmB;AAAA,UACjB,MAAQ;AAAA,UACR,SAAW;AAAA,UACX,WAAa;AAAA,QACf;AAAA,QACA,0BAA4B;AAAA,UAC1B,OAAS;AAAA,QACX;AAAA,QACA,WAAa;AAAA,UACX,MAAQ;AAAA,YACN;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,QACA,SAAW;AAAA,UACT,MAAQ;AAAA,UACR,sBAAwB;AAAA,UACxB,UAAY;AAAA,YACV;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA,YAAc;AAAA,YACZ,KAAO;AAAA,cACL,MAAQ;AAAA,cACR,SAAW;AAAA,cACX,SAAW;AAAA,YACb;AAAA,YACA,YAAc;AAAA,cACZ,OAAS;AAAA,gBACP;AAAA,kBACE,MAAQ;AAAA,kBACR,SAAW;AAAA,kBACX,SAAW;AAAA,gBACb;AAAA,gBACA;AAAA,kBACE,MAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AAAA,YACA,gBAAkB;AAAA,cAChB,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,OAAS;AAAA,kBACP,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,WAAa;AAAA,sBACb,WAAa;AAAA,oBACf;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,OAAS;AAAA,gBACP;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,YACA,UAAY;AAAA,cACV,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,MAAQ;AAAA,kBACN,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,KAAO;AAAA,kBACL,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,sBACX,SAAW;AAAA,oBACb;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,KAAO;AAAA,kBACL,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,sBACX,SAAW;AAAA,oBACb;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,KAAO;AAAA,kBACL,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,sBACX,WAAa;AAAA,oBACf;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,OAAS;AAAA,gBACP;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,MAAQ;AAAA,wBACN,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,MAAQ;AAAA,wBACN,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,MAAQ;AAAA,wBACN,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,sBACA,KAAO;AAAA,wBACL,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,YACA,WAAa;AAAA,cACX,OAAS;AAAA,gBACP;AAAA,kBACE,MAAQ;AAAA,kBACR,WAAa;AAAA,kBACb,WAAa;AAAA,gBACf;AAAA,gBACA;AAAA,kBACE,MAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AAAA,YACA,gBAAkB;AAAA,cAChB,OAAS;AAAA,gBACP;AAAA,kBACE,MAAQ;AAAA,kBACR,WAAa;AAAA,kBACb,WAAa;AAAA,gBACf;AAAA,gBACA;AAAA,kBACE,MAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AAAA,YACA,iBAAmB;AAAA,cACjB,MAAQ;AAAA,cACR,SAAW;AAAA,cACX,WAAa;AAAA,YACf;AAAA,YACA,UAAY;AAAA,cACV,OAAS;AAAA,gBACP;AAAA,kBACE,MAAQ;AAAA,kBACR,WAAa;AAAA,kBACb,WAAa;AAAA,gBACf;AAAA,gBACA;AAAA,kBACE,MAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AAAA,YACA,iBAAmB;AAAA,cACjB,MAAQ;AAAA,cACR,aAAe;AAAA,cACf,OAAS;AAAA,gBACP,MAAQ;AAAA,kBACN;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAQ;AAAA,MACR,sBAAwB;AAAA,MACxB,UAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAc;AAAA,QACZ,QAAU;AAAA,UACR,OAAS;AAAA,QACX;AAAA,QACA,eAAiB;AAAA,UACf,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,OAAS;AAAA,UACP,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,cAAgB;AAAA,UACd,MAAQ;AAAA,UACR,SAAW;AAAA,QACb;AAAA,QACA,MAAQ;AAAA,UACN,OAAS;AAAA,QACX;AAAA,QACA,eAAiB;AAAA,UACf,MAAQ;AAAA,UACR,sBAAwB;AAAA,UACxB,UAAY;AAAA,YACV;AAAA,YACA;AAAA,UACF;AAAA,UACA,YAAc;AAAA,YACZ,OAAS;AAAA,cACP,MAAQ;AAAA,cACR,SAAW;AAAA,cACX,SAAW;AAAA,YACb;AAAA,YACA,QAAU;AAAA,cACR,MAAQ;AAAA,cACR,SAAW;AAAA,YACb;AAAA,UACF;AAAA,QACF;AAAA,QACA,eAAiB;AAAA,UACf,MAAQ;AAAA,UACR,sBAAwB;AAAA,UACxB,UAAY;AAAA,YACV;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA,YAAc;AAAA,YACZ,QAAU;AAAA,cACR,OAAS;AAAA,YACX;AAAA,YACA,gBAAkB;AAAA,cAChB,MAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,YACA,mBAAqB;AAAA,cACnB,MAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,UACA,OAAS;AAAA,YACP;AAAA,cACE,IAAM;AAAA,gBACJ,YAAc;AAAA,kBACZ,gBAAkB;AAAA,oBAChB,OAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,cACA,MAAQ;AAAA,gBACN,YAAc;AAAA,kBACZ,mBAAqB;AAAA,oBACnB,OAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,cACA,MAAQ;AAAA,gBACN,YAAc;AAAA,kBACZ,mBAAqB;AAAA,oBACnB,OAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,kBAAoB;AAAA,UAClB,MAAQ;AAAA,UACR,sBAAwB;AAAA,UACxB,UAAY;AAAA,YACV;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA,YAAc;AAAA,YACZ,QAAU;AAAA,cACR,MAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,YACA,aAAe;AAAA,cACb,MAAQ;AAAA,cACR,SAAW;AAAA,YACb;AAAA,YACA,eAAiB;AAAA,cACf,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,WAAa;AAAA,kBACX,OAAS;AAAA,oBACP;AAAA,sBACE,OAAS;AAAA,oBACX;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,QAAU;AAAA,kBACR,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,oBACb;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,QAAU;AAAA,kBACR,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,OAAS;AAAA,gBACP;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,WAAa;AAAA,wBACX,OAAS;AAAA,sBACX;AAAA,sBACA,QAAU;AAAA,wBACR,MAAQ;AAAA,wBACR,SAAW;AAAA,sBACb;AAAA,sBACA,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,WAAa;AAAA,wBACX,MAAQ;AAAA,sBACV;AAAA,sBACA,QAAU;AAAA,wBACR,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,MAAQ;AAAA,0BACN;AAAA,0BACA;AAAA,0BACA;AAAA,wBACF;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,OAAS;AAAA,kBACP,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,oBACb;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,QAAU;AAAA,kBACR,MAAQ;AAAA,kBACR,SAAW;AAAA,gBACb;AAAA,cACF;AAAA,cACA,OAAS;AAAA,gBACP;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,wBACR,SAAW;AAAA,sBACb;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,YACA,aAAe;AAAA,cACb,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,MAAQ;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,OAAS;AAAA,kBACP,OAAS;AAAA,oBACP;AAAA,sBACE,MAAQ;AAAA,sBACR,SAAW;AAAA,oBACb;AAAA,oBACA;AAAA,sBACE,MAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,QAAU;AAAA,kBACR,MAAQ;AAAA,kBACR,SAAW;AAAA,gBACb;AAAA,cACF;AAAA,cACA,OAAS;AAAA,gBACP;AAAA,kBACE,IAAM;AAAA,oBACJ,YAAc;AAAA,sBACZ,QAAU;AAAA,wBACR,OAAS;AAAA,sBACX;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,wBACR,SAAW;AAAA,sBACb;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,MAAQ;AAAA,oBACN,YAAc;AAAA,sBACZ,OAAS;AAAA,wBACP,MAAQ;AAAA,sBACV;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,YACA,YAAc;AAAA,cACZ,MAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,YACA,iBAAmB;AAAA,cACjB,MAAQ;AAAA,cACR,sBAAwB;AAAA,cACxB,UAAY;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,OAAS;AAAA,gBACX;AAAA,gBACA,QAAU;AAAA,kBACR,MAAQ;AAAA,gBACV;AAAA,gBACA,OAAS;AAAA,kBACP,MAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,mBAAqB;AAAA,UACnB,MAAQ;AAAA,UACR,sBAAwB;AAAA,UACxB,UAAY;AAAA,YACV;AAAA,YACA;AAAA,UACF;AAAA,UACA,YAAc;AAAA,YACZ,QAAU;AAAA,cACR,OAAS;AAAA,YACX;AAAA,YACA,SAAW;AAAA,cACT,MAAQ;AAAA,YACV;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACnuBA;AAAA,EACE,SAAW;AAAA,EACX,KAAO;AAAA,EACP,OAAS;AAAA,EACT,MAAQ;AAAA,EACR,sBAAwB;AAAA,EACxB,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,YAAc;AAAA,IACZ,WAAa;AAAA,MACX,OAAS;AAAA,IACX;AAAA,IACA,MAAQ;AAAA,MACN,MAAQ;AAAA,MACR,SAAW;AAAA,IACb;AAAA,IACA,YAAc;AAAA,MACZ,MAAQ;AAAA,MACR,SAAW;AAAA,MACX,SAAW;AAAA,IACb;AAAA,IACA,uBAAyB;AAAA,MACvB,MAAQ;AAAA,MACR,WAAa;AAAA,MACb,WAAa;AAAA,IACf;AAAA,IACA,WAAa;AAAA,MACX,MAAQ;AAAA,MACR,SAAW;AAAA,MACX,WAAa;AAAA,IACf;AAAA,EACF;AACF;;;AH7BA,IAAM,MAAM,IAAI,QAAQ,EAAE,QAAQ,MAAM,gBAAgB,MAAM,CAAC;AACxD,IAAM,qBAAqB,IAAI,QAAQ,4BAAgB;AACvD,IAAM,gBAAgB,IAAI,QAAQ,+BAAW;AAC7C,IAAM,4BAA4B,IAAI,QAAQ,iCAAa;AAC3D,IAAM,OAAO;AACpB,IAAM,QAAQ;AACP,IAAM,oBAAoB;AAG1B,SAAS,WAAW,OAAmB,QAAQ,mBAA4B;AAChF,MAAI,MAAM,eAAe,KAAK,MAAM,aAAa,MAAO,OAAM,IAAI,MAAM,aAAa;AACrF,QAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC,EAAE,OAAO,KAAK;AACpF,QAAM,UAAyB,CAAC;AAChC,MAAI,QAAQ,GAAG,UAAU;AACzB,QAAM,MAAM;AAAA,IACV,gBAAgB;AAAE,UAAI,EAAE,QAAQ,GAAI,OAAM,IAAI,MAAM,YAAY;AAAG,cAAQ,KAAK,oBAAI,IAAI,CAAC;AAAA,IAAG;AAAA,IAC5F,iBAAiB,KAAK;AAAE,YAAM,OAAO,QAAQ,GAAG,EAAE;AAAI,UAAI,KAAK,IAAI,GAAG,EAAG,WAAU;AAAM,WAAK,IAAI,GAAG;AAAA,IAAG;AAAA,IACxG,cAAc;AAAE,cAAQ,IAAI;AAAG;AAAA,IAAS;AAAA,IACxC,eAAe;AAAE,UAAI,EAAE,QAAQ,GAAI,OAAM,IAAI,MAAM,YAAY;AAAA,IAAG;AAAA,IAClE,aAAa;AAAE;AAAA,IAAS;AAAA,IACxB,UAAU;AAAE,gBAAU;AAAA,IAAM;AAAA,EAC9B,GAAG,EAAE,kBAAkB,MAAM,oBAAoB,OAAO,mBAAmB,MAAM,CAAC;AAClF,MAAI,WAAW,UAAU,KAAK,QAAQ,WAAW,EAAG,OAAM,IAAI,MAAM,cAAc;AAClF,SAAO,KAAK,MAAM,IAAI;AACxB;AAGO,SAAS,gBAAgB,KAAmD;AACjF,MAAI,IAAI,oCAAoC,KAAM,QAAO,EAAE,QAAQ,MAAM;AACzE,QAAM,aAAa,IAAI;AACvB,QAAM,QAAQ,IAAI;AAClB,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,cAAc,CAAC,KAAK,KAAK,UAAU,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,KAAK,CAAC,WAAW,QAAQ,SAAS;AACxG,WAAO,EAAE,QAAQ,cAAc,QAAQ,kBAAkB;AAC3D,MAAI,YAAY,OAAQ,QAAO,EAAE,QAAQ,SAAS,eAAe,YAAY,OAAO,WAAW,cAAc;AAC7G,MAAI;AACF,UAAM,aAAa,WAAW,OAAO,KAAK,OAAO,CAAC;AAClD,QAAI,0BAA0B,UAAU;AACtC,aAAO,EAAE,QAAQ,SAAS,eAAe,YAAY,OAAO,WAAW,wBAAwB;AAAA,EACnG,QAAQ;AAAA,EAAuE;AAC/E,SAAO,EAAE,QAAQ,cAAc,QAAQ,kBAAkB;AAC3D;AAEO,SAAS,iBAAiB,SAA6C,YAC5E,iBAAyB,UAAkB,YAAoB;AAC/D,MAAI,QAAQ,WAAW,MAAO,QAAO,EAAE,QAAQ,MAAM;AACrD,MAAI,QAAQ,WAAW,QAAS,QAAO,EAAE,QAAQ,cAAc,QAAQ,kBAAkB;AACzF,MAAI,cAAc,KAAM,QAAO,EAAE,QAAQ,iBAAiB,QAAQ,oBAAoB;AACtF,MAAI,CAAC,mBAAmB,UAAU,KAAM,WAAoB,oBAAoB;AAC9E,WAAO,EAAE,QAAQ,cAAc,QAAQ,qBAAqB;AAC9D,QAAM,SAAU,WAAoB,WAAW,KAAK,CAAC,MACnD,EAAE,OAAO,QAAQ,aAAa,EAAE,UAAU,SAAS,QAAQ,KAAK,EAAE,aAAa,SAAS,UAAU,CAAC;AAErG,SAAO,SAAS,EAAE,QAAQ,qCAAqC,IAC3D,EAAE,QAAQ,iBAAiB,QAAQ,wBAAwB;AACjE;AAGO,SAAS,iBAAiB,OAIsB;AACrD,QAAM,MAAM,CAAC,YAAoB,EAAE,QAAQ,cAAc,OAAO;AAChE,MAAI;AACF,QAAI,MAAM,QAAQ,WAAW,WAAW,MAAM,QAAQ,QAAQ,MAAM,iBAAiB,KAAM,QAAO,IAAI,oBAAoB;AAC1H,QAAI,CAAC,mBAAmB,MAAM,UAAU,KAAM,MAAM,WAAoB,oBAAoB,MAAM;AAChG,aAAO,IAAI,oBAAoB;AACjC,QAAI,MAAM,aAAa,aAAa,kBAAmB,QAAO,IAAI,gBAAgB;AAClF,UAAM,QAAQ,OAAO,KAAK,MAAM,YAAY;AAC5C,QAAI,MAAM,GAAG,EAAE,MAAM,GAAI,QAAO,IAAI,eAAe;AACnD,UAAM,QAAQ,MAAM,SAAS,QAAQ,EAAE,MAAM,IAAI;AACjD,QAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,GAAI,QAAO,IAAI,eAAe;AACrE,UAAM,SAAS,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,UAAQ,WAAW,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAS;AAC5F,QAAI,OAAO,KAAK,WAAS,CAAC,cAAc,KAAK,CAAC,EAAG,QAAO,IAAI,cAAc;AAC1E,UAAM,CAAC,OAAO,MAAM,IAAI;AACxB,QAAI,MAAM,SAAS,WAAW,OAAO,SAAS,oBAAqB,QAAO,IAAI,aAAa;AAC3F,QAAI,CAAC,KAAK,KAAK,MAAM,YAAY,EAAG,QAAO,IAAI,gBAAgB;AAC/D,eAAW,OAAO,CAAC,UAAU,iBAAiB,SAAS,cAAc;AACnE,UAAI,MAAM,GAAG,MAAM,OAAO,GAAG,EAAG,QAAO,IAAI,gBAAgB;AAC7D,QAAI,MAAM,kBAAkB,MAAM,QAAQ,iBAAiB,MAAM,UAAU,MAAM,QAAQ,SACrF,MAAM,oBAAoB,MAAM,mBAAmB,MAAM,QAAQ,oBAAoB,MAAM,mBAC3F,MAAM,cAAc,MAAM,QAAQ,UAAW,QAAO,IAAI,gBAAgB;AAC5E,QAAI,iBAAiB,MAAM,SAAS,MAAM,YAAY,MAAM,iBAAiB,MAAM,UAAU,MAAM,UAAU,EAAE,WAC3G,qCAAsC,QAAO,IAAI,uBAAuB;AAC5E,UAAM,IAAI,MAAM;AAChB,QAAI,CAAC,MAAM,mBAAmB,CAAC,kBAAkB,GAAG,MAAM,eAAe,EAAG,QAAO,IAAI,eAAe;AACtG,UAAM,SAAmB,CAAC;AAC1B,eAAW,CAAC,KAAK,MAAM,KAAK;AAAA,MAAC,CAAC,cAAc,6BAA6B;AAAA,MAAG,CAAC,aAAa,uBAAuB;AAAA,MAC/G,CAAC,kBAAkB,wBAAwB;AAAA,MAAG,CAAC,YAAY,sBAAsB;AAAA,IAAC;AAClF,UAAI,EAAE,GAAI,MAAM,KAAM,QAAO,KAAK,MAAO;AAC3C,QAAI,EAAE,eAAe,WAAW,cAAe,QAAO,KAAK,4BAA4B;AACvF,QAAI,EAAE,SAAS,SAAS,UAAW,QAAO,KAAK,4BAA4B;AAC3E,QAAI,CAAC,kBAAkB,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,EAAG,QAAO,IAAI,wBAAwB;AAC9G,QAAI,MAAM,YAAY,GAAG,EAAE,MAAM,MAAM,MAAM,YAAY,SAAS,GAAG,EAAE,EAAE,SAAS,EAAE,EAAG,QAAO,IAAI,gBAAgB;AAClH,UAAM,MAAM,WAAW,MAAM,aAAa,KAAK;AAC/C,QAAI,IAAI,WAAW,MAAM,4BAA4B,IAAI,YAAY,YAAY,IAAI,YAAY,MAAM,mBACnG,IAAI,SAAS,WAAW,OAAO,cAAc,kBAAkB,IAAI,MAAM,WAAW,OAAO,iBAAiB,UAC5G,IAAI,MAAM,gBAAgB,OAAO,iBAAiB,YAAa,QAAO,IAAI,iBAAiB;AAC/F,QAAI,OAAO,cAAc,UAAU,MAAM,YAAY,cAAc,OAAO,cAAc,WACpF,WAAW,QAAQ,EAAE,OAAO,MAAM,WAAW,EAAE,OAAO,KAAK,EAAG,QAAO,IAAI,uBAAuB;AACpG,UAAM,OAAO,OAAO;AACpB,UAAM,OAAO,KAAK,WAAW,WAAW,cAAc,KAAK,YAAY,WAAW;AAClF,UAAM,aAAa,OAAO,KAAK,WAAW,UAAU,KAAK,YAAY,QAAQ,UAAU,cAAc;AACrG,QAAI,KAAK,eAAe,WAAY,QAAO,IAAI,iBAAiB;AAChE,UAAM,OAAO,KAAK;AAClB,UAAM,UAAU,KAAK,WAAW,cAAc,CAAC,4BAA4B,IAAI,KAAK,WAAW,iBAC3F,CAAC,oBAAoB,IAAI,CAAC,6BAA6B,6BAA6B,4BAA4B;AACpH,QAAI,CAAC,QAAQ,SAAS,KAAK,MAAM,EAAG,QAAO,IAAI,eAAe;AAC9D,WAAO,EAAE,QAAQ,SAAS,QAAQ,8BAA8B;AAAA,EAClE,QAAQ;AAAE,WAAO,IAAI,kBAAkB;AAAA,EAAG;AAC5C;","names":[]}

package/dist/stable-entry.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import { dirname } from 'node:path';
+import { lstatSync } from 'node:fs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { readManagedDeployment } from './managed-deployment.js';
+
+// This v1 entry is version independent. Installer updates replace active.json,
+// never this command's definition. Keep argv[1] stable through the product import.
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const userHome = dirname(dirname(dirname(dirname(root))));
+try {
+  const active = readManagedDeployment({ userHome });
+  // File identity handles drive-case/8.3/extended Windows spellings without
+  // accepting a symlink or changing the original stable argv registration.
+  const invoked = lstatSync(process.argv[1], { bigint: true });
+  const expected = lstatSync(active.launcher, { bigint: true });
+  if (invoked.isSymbolicLink() || invoked.dev !== expected.dev || invoked.ino !== expected.ino) throw Error('managed_entry_identity_mismatch');
+  await import(pathToFileURL(active.cliScriptPath).href);
+} catch (error) {
+  // Keep the concrete refusal diagnostic on stderr; never print a malformed
+  // pointer's JSON contents through JSON.parse's SyntaxError excerpt.
+  const reason = error instanceof SyntaxError ? 'invalid_deployment_json'
+    : String(error?.code ?? error?.message ?? 'unknown_deployment_error').replace(/\s+/g, ' ').slice(0, 600);
+  process.stderr.write(`[caveat:fatal] managed deployment is unavailable (${reason}); run caveat deployment status or activate a verified release\n`);
+  process.exitCode = 1;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "caveat-cli",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "Long-term memory CLI for Claude Code, Codex, and Cursor (markdown + SQLite FTS5 + MCP + hooks)",
   "keywords": [
     "caveat",