open-multi-agent-kit 0.80.6 → 0.80.7

package/dist/core/package-procurement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-procurement.js","sourceRoot":"","sources":["../../src/core/package-procurement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA+G9C,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAChC,2FAA2F,CAAC;AAE7F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACzB,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,IAAI;IACJ,KAAK;IACL,SAAS;IACT,QAAQ;IACR,cAAc;IACd,UAAU;CACV,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAOlD,MAAM,UAAU,uBAAuB,CAAC,OAA2B,EAAqB;IACvF,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,KAAK,cAAc,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,KAAK,2BAA2B,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,KAAK,+BAA+B,EAAE,CAAC;AAAA,CAC3F;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,0DAA0D,CAAC;AAIpF,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAkB;IACpE,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,mCAAmC,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAAA,CACjC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAOvH,MAAM,UAAU,cAAc,CAAC,GAAuB,EAAE,cAAuB,EAAiB;IAC/F,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,KAAK,uBAAuB,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,KAAK,+CAA+C,EAAE,CAAC;IAC9G,CAAC;IAED,wFAAwF;IACxF,MAAM,MAAM,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,KAAK,wCAAwC,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,MAAM,qBAAqB,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAAA,CAC9D;AAYD,MAAM,UAAU,kBAAkB,CAAC,KAA4B,EAAuB;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtD,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,MAAM,YAAY,GAAG,uBAAuB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,EAAE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACrC,OAAO;gBACN,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,OAAO,SAAS,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE;gBACvD,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,OAAO,EAAE,YAAY,CAAC,OAAO;aAC7B,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM;IACN,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,IAAI,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO;YACN,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE;YACxD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAAA,CAC9B;AAED,SAAS,cAAc,CAAC,IAAY,EAAuD;IAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAAA,CACnE;AAsBD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,KAAK;IACL,OAAO;IACP,KAAK;IACL,KAAK;IACL,cAAc;IACd,cAAc;IACd,YAAY;IACZ,MAAM;IACN,WAAW;IACX,SAAS;IACT,eAAe;IACf,MAAM;IACN,YAAY;IACZ,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3G,SAAS,UAAU,CAAC,OAAe,EAAU;IAC5C,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAAA,CACxD;AAED,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAyB;IACnF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChG,OAAO,eAAe,CAAC;IACxB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAClD,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAwB;IAC1E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9D,MAAM,YAAY,GACjB,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9B,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,cAAc,KAAK,eAAe,CAAC,CAAC;IAE/G,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC3G,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,cAAc,KAAK,kBAAkB,IAAI,cAAc,KAAK,iBAAiB,EAAE,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,+EAA+E;IAC/E,IACC,KAAK,CAAC,WAAW,KAAK,iBAAiB;QACvC,CAAC,CAAC,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,EACnE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YACpD,IAAI,eAAe,KAAK,iBAAiB,IAAI,eAAe,KAAK,kBAAkB,EAAE,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YACrE,CAAC;YACD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YACrE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAAA,CAClE;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACxD,YAAY;IACZ,SAAS;IACT,aAAa;IACb,cAAc;IACd,WAAW;IACX,eAAe;IACf,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,SAAS;IACT,UAAU;CACV,CAAC;AAqBF,MAAM,UAAU,wBAAwB,CAAC,KAA2B,EAA0B;IAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAAA,CAC5D,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAClC,OAAO;YACN,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,IAAI;YACvB,OAAO,EAAE,CAAC,8BAA8B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,IAAI,OAAO,CAAC;IACrD,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,eAAe,CAAC,EAAE,CAAC;QAChE,OAAO;YACN,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,IAAI;YACvB,OAAO,EAAE;gBACR,eAAe;oBACd,CAAC,CAAC,iDAAiD;oBACnD,CAAC,CAAC,2DAA2D;aAC9D;SACD,CAAC;IACH,CAAC;IACD,OAAO;QACN,OAAO,EAAE,MAAM;QACf,eAAe,EAAE,QAAQ;QACzB,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,CAAC,oDAAoD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;KACpF,CAAC;AAAA,CACF;AA2BD,MAAM,mBAAmB,GAAkB;IAC1C,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACxE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACtE,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE;IAC7E,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAC/E,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACxF,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACvE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE;IAChG,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE;CACtE,CAAC;AAEF,SAAS,aAAa,CAAC,OAAqB,EAAE,KAAoB,EAAiB;IAClF,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;qBAClC,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAqB,EAA2B;IACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE5D,IAAI,OAA0B,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,cAAc,CAAC;IAC1B,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QACnB,wFAAwF;QACxF,OAAO,GAAG,YAAY,CAAC;IACxB,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAAA,CAC7B;AAWD,MAAM,gBAAgB,GAAkB;IACvC,uDAAuD;IACvD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC9F,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACrF;QACC,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,6DAA6D;KACtE;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mDAAmD,EAAE;IAC5G,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACpG,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,sDAAsD,EAAE;IAC5G;QACC,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4EAA4E;KACrF;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iFAAiF;KAC1F;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,8CAA8C,EAAE;IACtG,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2DAA2D,EAAE;IAC7G,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACtF,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC9E,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAClE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE;IAClF,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE;IACxE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC5E,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAChG,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACnG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACnE,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACjG,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uDAAuD,EAAE;CACjH,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,OAAqB,EAAwB;IACnF,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAAA,CAClC;AAoBD,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAoB;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACtG,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,UAAU,CAAC;IAC/C,IAAI,OAAO,GAAG,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;AAAA,CAC9D;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAK,GAAyB,EAAE,EAAa;IAClF,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAChH,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IACvD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,OAAO,CAAC,CAAY,EAAE,CAAY,EAAa;IACvD,MAAM,IAAI,GAA8B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACvE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAClC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;AAC3E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE1F,MAAM,UAAU,SAAS,CACxB,YAAsB,EACtB,cAA2B,EAC3B,gBAA6B,EAC7B,UAAiC,EACrB;IACZ,IAAI,IAAI,GAAc,KAAK,CAAC;IAC5B,IACC,cAAc,KAAK,QAAQ;QAC3B,gBAAgB,KAAK,QAAQ;QAC7B,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EACxE,CAAC;QACF,IAAI,GAAG,MAAM,CAAC;IACf,CAAC;SAAM,IACN,cAAc,KAAK,QAAQ;QAC3B,gBAAgB,KAAK,QAAQ;QAC7B,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAC1E,CAAC;QACF,IAAI,GAAG,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC;AAAA,CACxD;AAyBD,SAAS,eAAe,CAAC,WAAwB,EAAY;IAC5D,QAAQ,WAAW,EAAE,CAAC;QACrB,KAAK,QAAQ;YACZ,OAAO,QAAQ,CAAC;QACjB,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY;YAChB,OAAO,QAAQ,CAAC;QACjB,KAAK,iBAAiB;YACrB,OAAO,iBAAiB,CAAC;QAC1B,KAAK,iBAAiB;YACrB,OAAO,mBAAmB,CAAC;QAC5B,KAAK,WAAW;YACf,OAAO,gBAAgB,CAAC;QACzB,KAAK,UAAU;YACd,OAAO,eAAe,CAAC;QACxB,KAAK,aAAa;YACjB,OAAO,aAAa,CAAC;QACtB,KAAK,mBAAmB;YACvB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;AAAA,CACD;AAED,SAAS,QAAQ,CAAC,MAAsB,EAAE,eAAe,GAAa,EAAE,EAAoB;IAC3F,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,CACvG;AAED,SAAS,gBAAgB,CAAC,KAAoB,EAA6B;IAC1E,OAAO,KAAK,CAAC,aAAa,CAAC;AAAA,CAC3B;AAED,SAAS,oBAAoB,CAAC,MAAuC,EAAW;IAC/E,OAAO,OAAO,CACb,MAAM,EAAE,UAAU,KAAK,IAAI;QAC1B,MAAM,CAAC,eAAe,KAAK,IAAI;QAC/B,MAAM,CAAC,aAAa,KAAK,IAAI;QAC7B,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAClC,CAAC;AAAA,CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB,EAAoB;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEvC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAClB,IACC,IAAI,KAAK,QAAQ;YACjB,IAAI,KAAK,gBAAgB;YACzB,IAAI,KAAK,eAAe;YACxB,IAAI,KAAK,aAAa;YACtB,IAAI,KAAK,mBAAmB,EAC3B,CAAC;YACF,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC/F,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC5F,IAAI,KAAK,CAAC,iBAAiB,KAAK,cAAc;YAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC5F,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QAC5G,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,cAAc,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,oBAAoB,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,0BAA0B,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IAED,IACC,MAAM,EAAE,WAAW,KAAK,eAAe;QACvC,IAAI,KAAK,mBAAmB;QAC5B,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,EACzC,CAAC;QACF,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACrF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC5C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,IACC,KAAK,CAAC,cAAc,KAAK,QAAQ;YACjC,KAAK,CAAC,gBAAgB,KAAK,QAAQ;YACnC,KAAK,CAAC,iBAAiB,KAAK,SAAS,EACpC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC9C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAAA,CACjE;AAwCD,MAAM,UAAU,gBAAgB,CAAC,MAA+B,EAAqB;IACpF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAE7B,MAAM,OAAO,GAAG,eAAe,CAAC;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,WAAW,EAAE,SAAS,CAAC,WAAW;KAClC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,wBAAwB,CAAC;QAC1C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,iBAAiB,EAAE,MAAM,CAAC,uBAAuB;QACjD,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACrD,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QAChE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;KACrD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACrC,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;KACf,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,IAAI,GACT,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAClH,MAAM,aAAa,GAClB,MAAM,CAAC,aAAa;QACpB,SAAS,CAAC,aAAa;QACvB,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAE5F,MAAM,QAAQ,GAAG,cAAc,CAAC;QAC/B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,IAAI;QACJ,KAAK,EAAE,MAAM;QACb,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,gBAAgB,EAAE,SAAS,CAAC,OAAO;QACnC,iBAAiB,EAAE,aAAa,CAAC,OAAO;QACxC,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,aAAa;QACb,OAAO,EAAE,SAAS,CAAC,OAAO;KAC1B,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACpB,eAAe,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO;QACN,SAAS;QACT,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAC7C,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,qBAAqB,EAAE,OAAO,CAAC,cAAc;QAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,gBAAgB,EAAE,SAAS,CAAC,OAAO;QACnC,wBAAwB,EAAE,SAAS,CAAC,eAAe;QACnD,iBAAiB,EAAE,aAAa,CAAC,OAAO;QACxC,qBAAqB,EAAE,aAAa,CAAC,QAAQ;QAC7C,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,kBAAkB,EAAE,YAAY,CAAC,QAAQ;QACzC,IAAI;QACJ,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC7F,iBAAiB,EAAE,UAAU,CAAC,OAAO;QACrC,cAAc;QACd,eAAe;KACf,CAAC;AAAA,CACF;AAmBD,SAAS,iBAAiB,CACzB,MAAyB,EACzB,MAAsB,EACtB,cAAsB,EACF;IACpB,OAAO;QACN,GAAG,MAAM;QACT,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,MAAM;QACtB,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC;KAC5D,CAAC;AAAA,CACF;AAED,SAAS,iBAAiB,CAAC,MAAyB,EAAW;IAC9D,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC;AAAA,CACtE;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA4B,EAA0B;IAC3F,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC;YAC/B,SAAS;YACT,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK;YAC/C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,GAAG,EAAE,KAAK,CAAC,GAAG;SACd,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC;QACrC,IAAI,KAAK,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1C,eAAe,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,KAAK,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;AAAA,CACzD;AAED,SAAS,cAAc,CAAC,UAA4B,EAAU;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;AAAA,CACnD","sourcesContent":["/**\n * Package procurement / exact-pin gate.\n *\n * Pure, native-only procurement algorithms for OMK package adoption. None of these\n * functions install, fetch, clone, spawn, or touch the filesystem/network. They take\n * already-supplied source-review inputs (manifest fields, license metadata, source\n * text) and return advisory verdicts so an external installer never runs against an\n * unvetted, mutable, or copyleft-contaminated source.\n *\n * Implements PR A from .omk/runs/omk-pi-package-hardening-plan/{procurement.md,algorithm-plan.md}:\n *   - exact npm semver validation (shared pattern with scripts/check-pinned-deps.mjs)\n *   - mutable range/tag/branch rejection\n *   - candidate input normalization to a canonical pinned source string\n *   - license verdict gate (permissive / weak / strong / network copyleft / unknown)\n *   - lifecycle-script gate (fail-closed; reviewed allowlist exception only)\n *   - .pi/.omk compatibility scan over provided source text\n *   - source capability scan (credential reads, sockets, network, exec, fs writes)\n *   - risk/adoption decision matrix\n */\n\nimport { parseGitUrl } from \"../utils/git.ts\";\n\n// ---------------------------------------------------------------------------\n// Shared types\n// ---------------------------------------------------------------------------\n\nexport type IntendedUse =\n\t| \"native\"\n\t| \"vendor\"\n\t| \"ephemeral-adopt\"\n\t| \"permanent-adopt\"\n\t| \"theme-port\"\n\t| \"reference\"\n\t| \"advisory\"\n\t| \"report-only\"\n\t| \"measurement-gated\";\nexport type DeclaredUse =\n\t| \"sandbox\"\n\t| \"loadout\"\n\t| \"checkpoint\"\n\t| \"observability\"\n\t| \"advisor\"\n\t| \"quality\"\n\t| \"memory\"\n\t| \"workflow-reference\"\n\t| \"cache-perf\";\nexport type ResourceKind = \"extension\" | \"skill\" | \"prompt\" | \"theme\" | \"tool\";\nexport type RiskLevel = \"low\" | \"medium\" | \"high\";\nexport type GateVerdict = \"pass\" | \"review\" | \"reject\";\nexport type PathCompatibility = \"omk-native\" | \"pi-hardcoded\" | \"unknown\";\nexport type Adoption =\n\t| \"native\"\n\t| \"vendor\"\n\t| \"ephemeral-trial\"\n\t| \"permanent-package\"\n\t| \"reference-only\"\n\t| \"advisory-only\"\n\t| \"report-only\"\n\t| \"measurement-gated\"\n\t| \"deferred\"\n\t| \"reject\";\nexport type DeferredReason =\n\t| \"missing-exact-pin\"\n\t| \"pending-native-spec\"\n\t| \"pending-metrics\"\n\t| \"pending-export-policy\"\n\t| \"group-excluded\"\n\t| \"pending-identity-reconciliation\"\n\t| \"pending-advisory-spec\"\n\t| \"pending-measurement-plan\"\n\t| \"pending-sandbox-backend\";\nexport type LifecycleAllowlistMode = \"exact\" | \"identity\";\nexport type SandboxBackend = \"seatbelt\" | \"bubblewrap\" | \"none\";\nexport type MutationMode = \"report-only\";\n\nexport interface NativeSpecPrecondition {\n\texists: boolean;\n\ttrackId?: string;\n\tspecPath?: string;\n}\n\nexport interface MaintainerTrustInput {\n\tscope?: string;\n\tverifiedPublisher?: boolean;\n\taccountAgeDays?: number;\n}\n\nexport interface ExportPolicyOverlay {\n\tdefaultOff: boolean;\n\tofflineDisables: boolean;\n\tdenyRawPrompt: boolean;\n\tdenyRawToolOutput: boolean;\n\tpayloadTier?: \"metadata\" | \"summary\" | \"full\";\n}\n\nexport interface PolicyOverlay {\n\tdeclaredUse: DeclaredUse;\n\tsandboxBackend?: SandboxBackend;\n\texportPolicy?: ExportPolicyOverlay;\n\tmutationMode?: MutationMode;\n\tadvisoryOnly?: boolean;\n\treplayInput?: boolean;\n\tactivateAlongsideScheduler?: boolean;\n}\n\nexport interface CandidatePackageInput {\n\tname: string;\n\texactVersion?: string;\n\tgitRepo?: string;\n\tgitRef?: string;\n\t/** Reviewed full commit SHA used to anchor an otherwise-mutable tag. */\n\tresolvedCommit?: string;\n\tintendedUse: IntendedUse;\n\tdeclaredUse?: DeclaredUse;\n\texpectedResources: ResourceKind[];\n\tallowLifecycleScripts?: boolean;\n\trisk?: RiskLevel;\n\tnativeSpec?: NativeSpecPrecondition;\n\tpolicyOverlay?: PolicyOverlay;\n\tmetrics?: string[];\n\texcludeGroup?: string;\n\tpublishedAt?: string;\n\tminReleaseAgeDays?: number;\n\tmaintainer?: MaintainerTrustInput;\n}\n\nexport interface SourceText {\n\tpath?: string;\n\ttext: string;\n}\n\n// ---------------------------------------------------------------------------\n// Exact npm version validation\n// ---------------------------------------------------------------------------\n\n/** Exact semver shape, identical to scripts/check-pinned-deps.mjs. */\nexport const EXACT_SEMVER_PATTERN =\n\t/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/;\n\nconst DIST_TAGS = new Set([\n\t\"latest\",\n\t\"next\",\n\t\"beta\",\n\t\"alpha\",\n\t\"canary\",\n\t\"rc\",\n\t\"dev\",\n\t\"nightly\",\n\t\"stable\",\n\t\"experimental\",\n\t\"insiders\",\n]);\n\n// whitespace, range operators (^ ~ > < = *), or a standalone wildcard x/X\nconst RANGE_INDICATOR = /[\\s^~><=*|]|\\bx\\b|\\bX\\b/;\n\nexport type NpmVersionRejectReason = \"missing\" | \"dist-tag\" | \"range\" | \"invalid\";\nexport type NpmVersionVerdict =\n\t| { ok: true; version: string }\n\t| { ok: false; reason: NpmVersionRejectReason; message: string };\n\nexport function validateExactNpmVersion(version: string | undefined): NpmVersionVerdict {\n\tconst value = (version ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, reason: \"missing\", message: \"exact version is required\" };\n\t}\n\tif (DIST_TAGS.has(value.toLowerCase())) {\n\t\treturn { ok: false, reason: \"dist-tag\", message: `dist-tag \"${value}\" is mutable` };\n\t}\n\tif (EXACT_SEMVER_PATTERN.test(value)) {\n\t\treturn { ok: true, version: value };\n\t}\n\tif (RANGE_INDICATOR.test(value)) {\n\t\treturn { ok: false, reason: \"range\", message: `range/wildcard \"${value}\" is not an exact version` };\n\t}\n\treturn { ok: false, reason: \"invalid\", message: `\"${value}\" is not a valid exact semver` };\n}\n\n// ---------------------------------------------------------------------------\n// npm package name validation\n// ---------------------------------------------------------------------------\n\nconst NPM_NAME_PATTERN = /^(?:@[a-z0-9-~][a-z0-9-._~]*\\/)?[a-z0-9-~][a-z0-9-._~]*$/;\n\nexport type NpmNameVerdict = { ok: true; name: string } | { ok: false; message: string };\n\nexport function validateNpmPackageName(name: string): NpmNameVerdict {\n\tconst value = (name ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, message: \"package name is required\" };\n\t}\n\tif (value.length > 214) {\n\t\treturn { ok: false, message: \"package name exceeds 214 characters\" };\n\t}\n\tif (value !== value.toLowerCase()) {\n\t\treturn { ok: false, message: \"package name must be lowercase\" };\n\t}\n\tif (value.includes(\"..\")) {\n\t\treturn { ok: false, message: \"package name must not contain path traversal\" };\n\t}\n\tif (!NPM_NAME_PATTERN.test(value)) {\n\t\treturn { ok: false, message: `\"${value}\" is not a valid npm package name` };\n\t}\n\treturn { ok: true, name: value };\n}\n\n// ---------------------------------------------------------------------------\n// git ref validation\n// ---------------------------------------------------------------------------\n\nconst FULL_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;\nconst HEX_ONLY = /^[0-9a-f]+$/;\nconst MUTABLE_BRANCHES = new Set([\"main\", \"master\", \"develop\", \"dev\", \"trunk\", \"head\", \"release\", \"stable\", \"latest\"]);\n\nexport type GitRefRejectReason = \"missing\" | \"mutable-branch\" | \"short-sha\" | \"unresolved-tag\" | \"invalid\";\nexport type GitRefVerdict =\n\t| { ok: true; ref: string; commit: string; kind: \"commit\" | \"resolved-tag\" }\n\t| { ok: false; reason: GitRefRejectReason; message: string };\n\nexport function validateGitRef(ref: string | undefined, resolvedCommit?: string): GitRefVerdict {\n\tconst value = (ref ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, reason: \"missing\", message: \"git ref is required\" };\n\t}\n\tif (FULL_SHA.test(value)) {\n\t\treturn { ok: true, ref: value, commit: value, kind: \"commit\" };\n\t}\n\n\tconst lower = value.toLowerCase();\n\tif (MUTABLE_BRANCHES.has(lower) || value === \"HEAD\" || value.startsWith(\"refs/heads/\")) {\n\t\treturn { ok: false, reason: \"mutable-branch\", message: `\"${value}\" is a mutable branch` };\n\t}\n\tif (HEX_ONLY.test(lower) && lower.length < 40) {\n\t\treturn { ok: false, reason: \"short-sha\", message: `\"${value}\" is an abbreviated commit; full SHA required` };\n\t}\n\n\t// Treat anything else as a tag: immutable only when anchored to a reviewed full commit.\n\tconst commit = (resolvedCommit ?? \"\").trim();\n\tif (!commit) {\n\t\treturn { ok: false, reason: \"unresolved-tag\", message: `tag \"${value}\" needs a reviewed resolved commit SHA` };\n\t}\n\tif (!FULL_SHA.test(commit)) {\n\t\treturn { ok: false, reason: \"invalid\", message: `resolvedCommit \"${commit}\" is not a full SHA` };\n\t}\n\treturn { ok: true, ref: value, commit, kind: \"resolved-tag\" };\n}\n\n// ---------------------------------------------------------------------------\n// Candidate normalization\n// ---------------------------------------------------------------------------\n\nexport type NormalizedSource =\n\t| { ok: true; kind: \"npm\"; source: string; name: string; version: string }\n\t| { ok: true; kind: \"git\"; source: string; repo: string; host: string; path: string; ref: string; commit: string };\n\nexport type NormalizedCandidate = NormalizedSource | { ok: false; reasons: string[] };\n\nexport function normalizeCandidate(input: CandidatePackageInput): NormalizedCandidate {\n\tconst reasons: string[] = [];\n\tconst hasNpm = Boolean(input.exactVersion);\n\tconst hasGit = Boolean(input.gitRepo || input.gitRef);\n\n\tif (hasNpm && hasGit) {\n\t\treasons.push(\"ambiguous-source: provide either an npm exactVersion or a git repo+ref, not both\");\n\t\treturn { ok: false, reasons };\n\t}\n\tif (!hasNpm && !hasGit) {\n\t\treasons.push(\"missing-source: provide exactVersion (npm) or gitRepo+gitRef (git)\");\n\t\treturn { ok: false, reasons };\n\t}\n\n\tif (hasNpm) {\n\t\tconst nameCheck = validateNpmPackageName(input.name);\n\t\tif (!nameCheck.ok) reasons.push(`invalid-npm-name: ${nameCheck.message}`);\n\t\tconst versionCheck = validateExactNpmVersion(input.exactVersion);\n\t\tif (!versionCheck.ok) reasons.push(`version: ${versionCheck.message}`);\n\t\tif (nameCheck.ok && versionCheck.ok) {\n\t\t\treturn {\n\t\t\t\tok: true,\n\t\t\t\tkind: \"npm\",\n\t\t\t\tsource: `npm:${nameCheck.name}@${versionCheck.version}`,\n\t\t\t\tname: nameCheck.name,\n\t\t\t\tversion: versionCheck.version,\n\t\t\t};\n\t\t}\n\t\treturn { ok: false, reasons };\n\t}\n\n\t// git\n\tconst git = resolveGitRepo(input.gitRepo ?? \"\");\n\tif (!git) reasons.push(\"invalid-git-repo: could not parse a host/org/repo from gitRepo\");\n\tconst refCheck = validateGitRef(input.gitRef, input.resolvedCommit);\n\tif (!refCheck.ok) reasons.push(`git-ref: ${refCheck.message}`);\n\tif (git && refCheck.ok) {\n\t\treturn {\n\t\t\tok: true,\n\t\t\tkind: \"git\",\n\t\t\tsource: `git:${git.host}/${git.path}@${refCheck.commit}`,\n\t\t\trepo: git.repo,\n\t\t\thost: git.host,\n\t\t\tpath: git.path,\n\t\t\tref: refCheck.ref,\n\t\t\tcommit: refCheck.commit,\n\t\t};\n\t}\n\treturn { ok: false, reasons };\n}\n\nfunction resolveGitRepo(repo: string): { repo: string; host: string; path: string } | null {\n\tconst trimmed = repo.trim();\n\tif (!trimmed) return null;\n\tconst parsed = parseGitUrl(trimmed) ?? parseGitUrl(`git:${trimmed}`);\n\tif (!parsed) return null;\n\treturn { repo: parsed.repo, host: parsed.host, path: parsed.path };\n}\n\n// ---------------------------------------------------------------------------\n// License gate\n// ---------------------------------------------------------------------------\n\nexport type LicenseClassification = \"permissive\" | \"weak-copyleft\" | \"strong-copyleft\" | \"network-copyleft\" | \"unknown\";\n\nexport interface LicenseInput {\n\tdeclaredLicense?: string;\n\tlicenseFiles?: string[];\n\ttransitiveLicenses?: string[];\n\tintendedUse: IntendedUse;\n}\n\nexport interface LicenseVerdictResult {\n\tverdict: GateVerdict;\n\tclassification: LicenseClassification;\n\tnoticeNeeded: boolean;\n\treasons: string[];\n}\n\nconst PERMISSIVE_LICENSES = new Set([\n\t\"MIT\",\n\t\"MIT-0\",\n\t\"ISC\",\n\t\"BSD\",\n\t\"BSD-2-CLAUSE\",\n\t\"BSD-3-CLAUSE\",\n\t\"APACHE-2.0\",\n\t\"0BSD\",\n\t\"UNLICENSE\",\n\t\"CC0-1.0\",\n\t\"BLUEOAK-1.0.0\",\n\t\"ZLIB\",\n\t\"PYTHON-2.0\",\n\t\"WTFPL\",\n]);\n\nconst NOTICE_REQUIRED_LICENSES = new Set([\"APACHE-2.0\", \"BSD\", \"BSD-2-CLAUSE\", \"BSD-3-CLAUSE\", \"MPL-2.0\"]);\n\nfunction licenseKey(license: string): string {\n\treturn license.trim().toUpperCase().replace(/\\s+/g, \"\");\n}\n\nexport function classifyLicense(license: string | undefined): LicenseClassification {\n\tif (!license || !license.trim()) return \"unknown\";\n\tconst key = licenseKey(license);\n\tif (key.includes(\"AGPL\") || key.includes(\"SSPL\")) return \"network-copyleft\";\n\tif (key.includes(\"LGPL\") || key.includes(\"MPL\") || key.includes(\"EPL\") || key.includes(\"CDDL\")) {\n\t\treturn \"weak-copyleft\";\n\t}\n\tif (key.includes(\"GPL\")) return \"strong-copyleft\";\n\tif (PERMISSIVE_LICENSES.has(key)) return \"permissive\";\n\treturn \"unknown\";\n}\n\nexport function evaluateLicense(input: LicenseInput): LicenseVerdictResult {\n\tconst reasons: string[] = [];\n\tconst classification = classifyLicense(input.declaredLicense);\n\tconst noticeNeeded =\n\t\tBoolean(input.declaredLicense) &&\n\t\t(NOTICE_REQUIRED_LICENSES.has(licenseKey(input.declaredLicense ?? \"\")) || classification === \"weak-copyleft\");\n\n\tif (classification === \"unknown\") {\n\t\treasons.push(input.declaredLicense ? `unrecognized-license: ${input.declaredLicense}` : \"missing-license\");\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\tif (classification === \"network-copyleft\" || classification === \"strong-copyleft\") {\n\t\treasons.push(`copyleft-blocks-adoption: ${input.declaredLicense}`);\n\t\treturn { verdict: \"reject\", classification, noticeNeeded, reasons };\n\t}\n\tif (classification === \"weak-copyleft\") {\n\t\treasons.push(`weak-copyleft-needs-review: ${input.declaredLicense}`);\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\n\t// Permissive: runtime/permanent adoption needs a transitive license inventory.\n\tif (\n\t\tinput.intendedUse === \"permanent-adopt\" &&\n\t\t(!input.transitiveLicenses || input.transitiveLicenses.length === 0)\n\t) {\n\t\treasons.push(\"transitive-license-inventory-required\");\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\tif (input.transitiveLicenses) {\n\t\tfor (const transitive of input.transitiveLicenses) {\n\t\t\tconst transitiveClass = classifyLicense(transitive);\n\t\t\tif (transitiveClass === \"strong-copyleft\" || transitiveClass === \"network-copyleft\") {\n\t\t\t\treasons.push(`transitive-copyleft: ${transitive}`);\n\t\t\t\treturn { verdict: \"reject\", classification, noticeNeeded, reasons };\n\t\t\t}\n\t\t\tif (transitiveClass === \"unknown\" || transitiveClass === \"weak-copyleft\") {\n\t\t\t\treasons.push(`transitive-needs-review: ${transitive}`);\n\t\t\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t\t\t}\n\t\t}\n\t}\n\treturn { verdict: \"pass\", classification, noticeNeeded, reasons };\n}\n\n// ---------------------------------------------------------------------------\n// Lifecycle-script gate\n// ---------------------------------------------------------------------------\n\n/** npm/pnpm/bun lifecycle hooks that run automatically during install or pack. */\nexport const LIFECYCLE_SCRIPT_NAMES: readonly string[] = [\n\t\"preinstall\",\n\t\"install\",\n\t\"postinstall\",\n\t\"preuninstall\",\n\t\"uninstall\",\n\t\"postuninstall\",\n\t\"prepare\",\n\t\"prepublish\",\n\t\"prepublishOnly\",\n\t\"prepack\",\n\t\"postpack\",\n];\n\nexport interface LifecycleScriptInput {\n\tpackageJsonScripts?: Record<string, string>;\n\tallowLifecycleScripts?: boolean;\n\treviewedAllowlist?: string[];\n\t/** Full pinned source spec, e.g. npm:pi-sandbox@0.4.3 */\n\tsource?: string;\n\t/** Identity without version/ref, e.g. npm:pi-sandbox */\n\tidentity?: string;\n\t/** Defaults to exact, matching the published shrinkwrap allowlist semantics. */\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n}\n\nexport interface LifecycleVerdictResult {\n\tverdict: GateVerdict;\n\tdeclaredScripts: string[];\n\trequiresException: boolean;\n\treasons: string[];\n}\n\nexport function evaluateLifecycleScripts(input: LifecycleScriptInput): LifecycleVerdictResult {\n\tconst scripts = input.packageJsonScripts ?? {};\n\tconst declared = LIFECYCLE_SCRIPT_NAMES.filter((name) => {\n\t\tconst value = scripts[name];\n\t\treturn typeof value === \"string\" && value.trim().length > 0;\n\t});\n\n\tif (declared.length === 0) {\n\t\treturn { verdict: \"pass\", declaredScripts: [], requiresException: false, reasons: [] };\n\t}\n\n\tif (!input.allowLifecycleScripts) {\n\t\treturn {\n\t\t\tverdict: \"reject\",\n\t\t\tdeclaredScripts: declared,\n\t\t\trequiresException: true,\n\t\t\treasons: [`lifecycle-scripts-present: ${declared.join(\", \")}`],\n\t\t};\n\t}\n\n\tconst allow = new Set((input.reviewedAllowlist ?? []).filter((entry) => Boolean(entry?.trim())));\n\tconst exactMatched = Boolean(input.source && allow.has(input.source));\n\tconst identityMatched = Boolean(input.identity && allow.has(input.identity));\n\tconst mode = input.lifecycleAllowlistMode ?? \"exact\";\n\tif (!exactMatched && !(mode === \"identity\" && identityMatched)) {\n\t\treturn {\n\t\t\tverdict: \"review\",\n\t\t\tdeclaredScripts: declared,\n\t\t\trequiresException: true,\n\t\t\treasons: [\n\t\t\t\tidentityMatched\n\t\t\t\t\t? \"lifecycle-scripts-require-exact-allowlist-entry\"\n\t\t\t\t\t: \"lifecycle-scripts-opt-in-without-reviewed-allowlist-entry\",\n\t\t\t],\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"pass\",\n\t\tdeclaredScripts: declared,\n\t\trequiresException: true,\n\t\treasons: [`lifecycle-scripts-allowed-by-reviewed-allowlist: ${declared.join(\", \")}`],\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// .pi / .omk compatibility scan\n// ---------------------------------------------------------------------------\n\nexport type FindingSeverity = \"info\" | \"warn\" | \"block\";\n\nexport interface ScanFinding {\n\tkind: string;\n\tseverity: FindingSeverity;\n\tpath?: string;\n\tline: number;\n\tsnippet: string;\n}\n\nexport interface CompatibilityScanResult {\n\tverdict: PathCompatibility;\n\tfindings: ScanFinding[];\n}\n\ninterface PatternRule {\n\tkind: string;\n\tseverity: FindingSeverity;\n\tpattern: RegExp;\n}\n\nconst COMPATIBILITY_RULES: PatternRule[] = [\n\t{ kind: \"pi-home-path\", severity: \"block\", pattern: /~\\/\\.pi(?:\\/|\\b)/ },\n\t{ kind: \"pi-state-dir\", severity: \"block\", pattern: /\\.pi\\/agents\\b/ },\n\t{ kind: \"pi-project-path\", severity: \"block\", pattern: /(?:^|[^.\\w])\\.pi\\// },\n\t{ kind: \"pi-coding-agent-path\", severity: \"block\", pattern: /pi-coding-agent/ },\n\t{ kind: \"pi-cli-invocation\", severity: \"block\", pattern: /\\bpi\\s+(?:install|update)\\b/ },\n\t{ kind: \"pi-env\", severity: \"warn\", pattern: /\\bPI_[A-Z][A-Z0-9_]*\\b/ },\n\t{ kind: \"legacy-pi-import\", severity: \"warn\", pattern: /@(?:mariozechner|earendil-works)\\/pi-/ },\n\t{ kind: \"omk-path\", severity: \"info\", pattern: /(?:^|[^.\\w])\\.omk\\// },\n];\n\nfunction scanWithRules(sources: SourceText[], rules: PatternRule[]): ScanFinding[] {\n\tconst findings: ScanFinding[] = [];\n\tfor (const source of sources) {\n\t\tconst lines = source.text.split(/\\r?\\n/);\n\t\tfor (let i = 0; i < lines.length; i++) {\n\t\t\tconst line = lines[i];\n\t\t\tfor (const rule of rules) {\n\t\t\t\tif (rule.pattern.test(line)) {\n\t\t\t\t\tfindings.push({\n\t\t\t\t\t\tkind: rule.kind,\n\t\t\t\t\t\tseverity: rule.severity,\n\t\t\t\t\t\tpath: source.path,\n\t\t\t\t\t\tline: i + 1,\n\t\t\t\t\t\tsnippet: line.trim().slice(0, 200),\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn findings;\n}\n\nexport function scanPiOmkCompatibility(sources: SourceText[]): CompatibilityScanResult {\n\tconst findings = scanWithRules(sources, COMPATIBILITY_RULES);\n\tconst hasBlock = findings.some((f) => f.severity === \"block\");\n\tconst hasOmk = findings.some((f) => f.kind === \"omk-path\");\n\tconst hasWarn = findings.some((f) => f.severity === \"warn\");\n\n\tlet verdict: PathCompatibility;\n\tif (hasBlock) {\n\t\tverdict = \"pi-hardcoded\";\n\t} else if (hasOmk) {\n\t\t// OMK paths present and no hardcoded Pi state: legacy imports are loader-alias covered.\n\t\tverdict = \"omk-native\";\n\t} else if (hasWarn) {\n\t\tverdict = \"unknown\";\n\t} else {\n\t\tverdict = \"unknown\";\n\t}\n\treturn { verdict, findings };\n}\n\n// ---------------------------------------------------------------------------\n// Source capability scan\n// ---------------------------------------------------------------------------\n\nexport interface CapabilityScanResult {\n\tcapabilities: string[];\n\tfindings: ScanFinding[];\n}\n\nconst CAPABILITY_RULES: PatternRule[] = [\n\t// Credential / secret file reads are the hard blocker.\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /[\"'`][^\"'`]*\\.env(?:\\.[\\w-]+)?[\"'`]/ },\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /auth\\.json|\\.npmrc|\\.netrc/ },\n\t{\n\t\tkind: \"credential-read\",\n\t\tseverity: \"block\",\n\t\tpattern: /id_rsa|id_ed25519|\\.ssh\\/|\\.aws\\/credentials|\\.kube\\/config/,\n\t},\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /BEGIN\\s+(?:RSA\\s+|EC\\s+|OPENSSH\\s+)?PRIVATE\\s+KEY/ },\n\t{ kind: \"host-socket\", severity: \"block\", pattern: /\\/var\\/run\\/docker\\.sock|dockerode|kubeconfig/ },\n\t{ kind: \"child-process\", severity: \"warn\", pattern: /child_process|\\bspawn\\s*\\(|\\bexec(?:Sync|File)?\\s*\\(/ },\n\t{\n\t\tkind: \"network\",\n\t\tseverity: \"warn\",\n\t\tpattern: /\\bfetch\\s*\\(\\s*[\"'`]?https?:|https?\\.request|node-fetch|axios|undici|got\\(/,\n\t},\n\t{\n\t\tkind: \"filesystem-write\",\n\t\tseverity: \"warn\",\n\t\tpattern: /writeFileSync|appendFileSync|\\bfs\\.(?:write|append)|rmSync|unlinkSync|mkdirSync/,\n\t},\n\t{ kind: \"browser-control\", severity: \"warn\", pattern: /puppeteer|playwright|chrome-devtools|:9222\\b/ },\n\t{ kind: \"telemetry\", severity: \"warn\", pattern: /\\btelemetry\\b|posthog|segment\\.io|@braintrust|analytics\\b/ },\n\t{ kind: \"setFooter\", severity: \"info\", pattern: /\\bsetFooter\\s*\\(/ },\n\t{ kind: \"setHeader\", severity: \"info\", pattern: /\\bsetHeader\\s*\\(/ },\n\t{ kind: \"setEditorComponent\", severity: \"info\", pattern: /\\bsetEditorComponent\\s*\\(/ },\n\t{ kind: \"setStatus\", severity: \"info\", pattern: /\\bsetStatus\\s*\\(/ },\n\t{ kind: \"setActiveTools\", severity: \"info\", pattern: /\\bsetActiveTools\\s*\\(/ },\n\t{ kind: \"setModel\", severity: \"warn\", pattern: /\\bsetModel\\s*\\(/ },\n\t{ kind: \"setThinkingLevel\", severity: \"warn\", pattern: /\\bsetThinkingLevel\\s*\\(/ },\n\t{ kind: \"renderCall\", severity: \"info\", pattern: /\\brenderCall\\s*[:(]/ },\n\t{ kind: \"renderResult\", severity: \"info\", pattern: /\\brenderResult\\s*[:(]/ },\n\t{ kind: \"registerMessageRenderer\", severity: \"info\", pattern: /\\bregisterMessageRenderer\\s*\\(/ },\n\t{ kind: \"before_provider_request\", severity: \"warn\", pattern: /[\"'`]before_provider_request[\"'`]/ },\n\t{ kind: \"context\", severity: \"warn\", pattern: /[\"'`]context[\"'`]/ },\n\t{ kind: \"session_before_compact\", severity: \"warn\", pattern: /[\"'`]session_before_compact[\"'`]/ },\n\t{ kind: \"env-secret-access\", severity: \"info\", pattern: /process\\.env\\.[A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD)/ },\n];\n\nexport function scanSourceCapabilities(sources: SourceText[]): CapabilityScanResult {\n\tconst findings = scanWithRules(sources, CAPABILITY_RULES);\n\tconst capabilities = [...new Set(findings.map((f) => f.kind))];\n\treturn { capabilities, findings };\n}\n\n// ---------------------------------------------------------------------------\n// Release-age and maintainer trust gates\n// ---------------------------------------------------------------------------\n\nexport type ReleaseAgeVerdict = \"pass\" | \"review\" | \"defer\";\n\nexport interface ReleaseAgeInput {\n\tpublishedAt?: string;\n\tminReleaseAgeDays?: number;\n\tnow?: Date;\n}\n\nexport interface ReleaseAgeResult {\n\tverdict: ReleaseAgeVerdict;\n\treason?: string;\n\tageDays?: number;\n}\n\nexport function evaluateReleaseAge(input: ReleaseAgeInput): ReleaseAgeResult {\n\tconst minAge = input.minReleaseAgeDays ?? 0;\n\tif (minAge <= 0) return { verdict: \"pass\", reason: \"release-age-not-required\" };\n\tif (!input.publishedAt) return { verdict: \"review\", reason: \"release-age-published-at-missing\" };\n\tconst published = Date.parse(input.publishedAt);\n\tif (Number.isNaN(published)) return { verdict: \"review\", reason: \"release-age-invalid-published-at\" };\n\tconst now = input.now?.getTime() ?? Date.now();\n\tconst ageDays = (now - published) / 86_400_000;\n\tif (ageDays < minAge) {\n\t\treturn { verdict: \"defer\", reason: `release-age-below-${minAge}-days`, ageDays };\n\t}\n\treturn { verdict: \"pass\", reason: \"release-age-ok\", ageDays };\n}\n\nexport function assessMaintainerTrust(input: MaintainerTrustInput = {}): RiskLevel {\n\tif (input.verifiedPublisher === true) return \"low\";\n\tif (input.verifiedPublisher === false && (input.accountAgeDays ?? Number.POSITIVE_INFINITY) < 60) return \"high\";\n\tif (input.verifiedPublisher === false) return \"medium\";\n\treturn \"low\";\n}\n\nfunction maxRisk(a: RiskLevel, b: RiskLevel): RiskLevel {\n\tconst rank: Record<RiskLevel, number> = { low: 0, medium: 1, high: 2 };\n\treturn rank[a] >= rank[b] ? a : b;\n}\n\n// ---------------------------------------------------------------------------\n// Risk inference\n// ---------------------------------------------------------------------------\n\nconst HIGH_RISK_CAPABILITIES = new Set([\"credential-read\", \"host-socket\"]);\nconst MEDIUM_RISK_CAPABILITIES = new Set([\"child-process\", \"network\", \"browser-control\"]);\n\nexport function inferRisk(\n\tcapabilities: string[],\n\tlicenseVerdict: GateVerdict,\n\tlifecycleVerdict: GateVerdict,\n\tmaintainer?: MaintainerTrustInput,\n): RiskLevel {\n\tlet risk: RiskLevel = \"low\";\n\tif (\n\t\tlicenseVerdict === \"reject\" ||\n\t\tlifecycleVerdict === \"reject\" ||\n\t\tcapabilities.some((capability) => HIGH_RISK_CAPABILITIES.has(capability))\n\t) {\n\t\trisk = \"high\";\n\t} else if (\n\t\tlicenseVerdict === \"review\" ||\n\t\tlifecycleVerdict === \"review\" ||\n\t\tcapabilities.some((capability) => MEDIUM_RISK_CAPABILITIES.has(capability))\n\t) {\n\t\trisk = \"medium\";\n\t}\n\treturn maxRisk(risk, assessMaintainerTrust(maintainer));\n}\n\n// ---------------------------------------------------------------------------\n// Adoption decision matrix\n// ---------------------------------------------------------------------------\n\nexport interface AdoptionInput {\n\tintendedUse: IntendedUse;\n\trisk: RiskLevel;\n\tpinOk: boolean;\n\tlicenseVerdict: GateVerdict;\n\tlifecycleVerdict: GateVerdict;\n\tpathCompatibility: PathCompatibility;\n\tcapabilities: string[];\n\tnativeSpec?: NativeSpecPrecondition;\n\tpolicyOverlay?: PolicyOverlay;\n\tmetrics?: string[];\n}\n\nexport interface AdoptionDecision {\n\tadoption: Adoption;\n\trejectedReasons: string[];\n\tdeferredReason?: DeferredReason;\n}\n\nfunction baseAdoptionFor(intendedUse: IntendedUse): Adoption {\n\tswitch (intendedUse) {\n\t\tcase \"native\":\n\t\t\treturn \"native\";\n\t\tcase \"vendor\":\n\t\tcase \"theme-port\":\n\t\t\treturn \"vendor\";\n\t\tcase \"ephemeral-adopt\":\n\t\t\treturn \"ephemeral-trial\";\n\t\tcase \"permanent-adopt\":\n\t\t\treturn \"permanent-package\";\n\t\tcase \"reference\":\n\t\t\treturn \"reference-only\";\n\t\tcase \"advisory\":\n\t\t\treturn \"advisory-only\";\n\t\tcase \"report-only\":\n\t\t\treturn \"report-only\";\n\t\tcase \"measurement-gated\":\n\t\t\treturn \"measurement-gated\";\n\t}\n}\n\nfunction deferred(reason: DeferredReason, rejectedReasons: string[] = []): AdoptionDecision {\n\treturn { adoption: \"deferred\", deferredReason: reason, rejectedReasons: [reason, ...rejectedReasons] };\n}\n\nfunction policyOverlayFor(input: AdoptionInput): PolicyOverlay | undefined {\n\treturn input.policyOverlay;\n}\n\nfunction hasValidExportPolicy(policy: ExportPolicyOverlay | undefined): boolean {\n\treturn Boolean(\n\t\tpolicy?.defaultOff === true &&\n\t\t\tpolicy.offlineDisables === true &&\n\t\t\tpolicy.denyRawPrompt === true &&\n\t\t\tpolicy.denyRawToolOutput === true,\n\t);\n}\n\nexport function decideAdoption(input: AdoptionInput): AdoptionDecision {\n\tconst reasons: string[] = [];\n\tconst base = baseAdoptionFor(input.intendedUse);\n\tconst policy = policyOverlayFor(input);\n\n\tif (!input.pinOk) {\n\t\tif (\n\t\t\tbase === \"native\" ||\n\t\t\tbase === \"reference-only\" ||\n\t\t\tbase === \"advisory-only\" ||\n\t\t\tbase === \"report-only\" ||\n\t\t\tbase === \"measurement-gated\"\n\t\t) {\n\t\t\treturn deferred(\"missing-exact-pin\");\n\t\t}\n\t\treasons.push(\"exact-pin-required\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"native\") {\n\t\tif (input.nativeSpec?.exists === false) return deferred(\"pending-native-spec\");\n\t\tif (input.capabilities.includes(\"credential-read\")) reasons.push(\"reads-credentials-upstream\");\n\t\tif (input.licenseVerdict === \"reject\") reasons.push(\"license-blocked-upstream\");\n\t\tif (input.lifecycleVerdict === \"reject\") reasons.push(\"lifecycle-scripts-blocked-upstream\");\n\t\tif (input.pathCompatibility === \"pi-hardcoded\") reasons.push(\"pi-hardcoded-paths-upstream\");\n\t\tif (policy?.declaredUse === \"sandbox\" && !policy.sandboxBackend) return deferred(\"pending-sandbox-backend\");\n\t\tif (policy?.declaredUse === \"sandbox\") reasons.push(\"sandbox-risk-floor-high\");\n\t\treturn { adoption: \"native\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"memory\" && input.capabilities.includes(\"credential-read\")) {\n\t\treasons.push(\"memory-credential-read-rejected\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.capabilities.includes(\"credential-read\")) {\n\t\treasons.push(\"reads-credentials\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.licenseVerdict === \"reject\") {\n\t\treasons.push(\"license-blocked\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.lifecycleVerdict === \"reject\") {\n\t\treasons.push(\"lifecycle-scripts-blocked\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.pathCompatibility === \"pi-hardcoded\") {\n\t\treasons.push(\"pi-hardcoded-paths\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"workflow-reference\") {\n\t\tif (policy.activateAlongsideScheduler === true) {\n\t\t\treturn { adoption: \"reject\", rejectedReasons: [\"scheduler-coexistence-denied\"] };\n\t\t}\n\t\treturn { adoption: \"reference-only\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"sandbox\") {\n\t\tif (!policy.sandboxBackend) {\n\t\t\treasons.push(\"sandbox-requires-backend\");\n\t\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t\t}\n\t\treasons.push(\"sandbox-risk-floor-high\");\n\t}\n\n\tif (\n\t\tpolicy?.declaredUse === \"observability\" &&\n\t\tbase === \"permanent-package\" &&\n\t\t!hasValidExportPolicy(policy.exportPolicy)\n\t) {\n\t\treturn deferred(\"pending-export-policy\");\n\t}\n\n\tif (policy?.declaredUse === \"advisor\" || policy?.declaredUse === \"quality\") {\n\t\tif (input.capabilities.includes(\"filesystem-write\") || input.capabilities.includes(\"child-process\")) {\n\t\t\treasons.push(\"report-only-mutation-denied\");\n\t\t}\n\t\treturn { adoption: \"report-only\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"measurement-gated\") {\n\t\tif (!input.metrics || input.metrics.length === 0) return deferred(\"pending-metrics\");\n\t\treturn { adoption: \"measurement-gated\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"reference-only\" || base === \"advisory-only\" || base === \"report-only\") {\n\t\treturn { adoption: base, rejectedReasons: reasons };\n\t}\n\n\tif (base === \"permanent-package\") {\n\t\tif (input.risk === \"high\") {\n\t\t\treasons.push(\"high-risk-permanent-blocked\");\n\t\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t\t}\n\t\tif (\n\t\t\tinput.licenseVerdict === \"review\" ||\n\t\t\tinput.lifecycleVerdict === \"review\" ||\n\t\t\tinput.pathCompatibility === \"unknown\"\n\t\t) {\n\t\t\treasons.push(\"needs-review-before-permanent\");\n\t\t\treturn { adoption: \"ephemeral-trial\", rejectedReasons: reasons };\n\t\t}\n\t\treturn { adoption: \"permanent-package\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"vendor\") {\n\t\tif (input.licenseVerdict === \"review\") reasons.push(\"license-review-before-vendor\");\n\t\treturn { adoption: \"vendor\", rejectedReasons: reasons };\n\t}\n\n\treturn { adoption: \"ephemeral-trial\", rejectedReasons: reasons };\n}\n\n// ---------------------------------------------------------------------------\n// Top-level procurement review\n// ---------------------------------------------------------------------------\n\nexport interface ProcurementReviewInputs {\n\tcandidate: CandidatePackageInput;\n\tpackageJsonScripts?: Record<string, string>;\n\tdeclaredLicense?: string;\n\tlicenseFiles?: string[];\n\ttransitiveLicenses?: string[];\n\tsources?: SourceText[];\n\treviewedScriptAllowlist?: string[];\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n\tpolicyOverlay?: PolicyOverlay;\n\tnow?: Date;\n}\n\nexport interface ProcurementReview {\n\tcandidate: CandidatePackageInput;\n\tnormalized: NormalizedSource | null;\n\tpinned: boolean;\n\tlicenseVerdict: GateVerdict;\n\tlicenseClassification: LicenseClassification;\n\tnoticeNeeded: boolean;\n\tlifecycleVerdict: GateVerdict;\n\tdeclaredLifecycleScripts: string[];\n\tpathCompatibility: PathCompatibility;\n\tcompatibilityFindings: ScanFinding[];\n\tcapabilities: string[];\n\tcapabilityFindings: ScanFinding[];\n\trisk: RiskLevel;\n\tadoption: Adoption;\n\tdeferredReason?: DeferredReason;\n\treleaseAgeVerdict: ReleaseAgeVerdict;\n\tmaintainerRisk: RiskLevel;\n\trejectedReasons: string[];\n}\n\nexport function procureCandidate(inputs: ProcurementReviewInputs): ProcurementReview {\n\tconst candidate = inputs.candidate;\n\tconst normalized = normalizeCandidate(candidate);\n\tconst pinned = normalized.ok;\n\n\tconst license = evaluateLicense({\n\t\tdeclaredLicense: inputs.declaredLicense,\n\t\tlicenseFiles: inputs.licenseFiles,\n\t\ttransitiveLicenses: inputs.transitiveLicenses,\n\t\tintendedUse: candidate.intendedUse,\n\t});\n\n\tconst lifecycle = evaluateLifecycleScripts({\n\t\tpackageJsonScripts: inputs.packageJsonScripts,\n\t\tallowLifecycleScripts: candidate.allowLifecycleScripts,\n\t\treviewedAllowlist: inputs.reviewedScriptAllowlist,\n\t\tsource: normalized.ok ? normalized.source : undefined,\n\t\tidentity: normalized.ok ? sourceIdentity(normalized) : undefined,\n\t\tlifecycleAllowlistMode: inputs.lifecycleAllowlistMode,\n\t});\n\n\tconst sources = inputs.sources ?? [];\n\tconst compatibility = scanPiOmkCompatibility(sources);\n\tconst capabilities = scanSourceCapabilities(sources);\n\tconst releaseAge = evaluateReleaseAge({\n\t\tpublishedAt: candidate.publishedAt,\n\t\tminReleaseAgeDays: candidate.minReleaseAgeDays,\n\t\tnow: inputs.now,\n\t});\n\tconst maintainerRisk = assessMaintainerTrust(candidate.maintainer);\n\tconst risk =\n\t\tcandidate.risk ?? inferRisk(capabilities.capabilities, license.verdict, lifecycle.verdict, candidate.maintainer);\n\tconst policyOverlay =\n\t\tinputs.policyOverlay ??\n\t\tcandidate.policyOverlay ??\n\t\t(candidate.declaredUse === undefined ? undefined : { declaredUse: candidate.declaredUse });\n\n\tconst decision = decideAdoption({\n\t\tintendedUse: candidate.intendedUse,\n\t\trisk,\n\t\tpinOk: pinned,\n\t\tlicenseVerdict: license.verdict,\n\t\tlifecycleVerdict: lifecycle.verdict,\n\t\tpathCompatibility: compatibility.verdict,\n\t\tcapabilities: capabilities.capabilities,\n\t\tnativeSpec: candidate.nativeSpec,\n\t\tpolicyOverlay,\n\t\tmetrics: candidate.metrics,\n\t});\n\n\tconst rejectedReasons = [...decision.rejectedReasons];\n\tif (!normalized.ok) {\n\t\trejectedReasons.push(...normalized.reasons);\n\t}\n\n\treturn {\n\t\tcandidate,\n\t\tnormalized: normalized.ok ? normalized : null,\n\t\tpinned,\n\t\tlicenseVerdict: license.verdict,\n\t\tlicenseClassification: license.classification,\n\t\tnoticeNeeded: license.noticeNeeded,\n\t\tlifecycleVerdict: lifecycle.verdict,\n\t\tdeclaredLifecycleScripts: lifecycle.declaredScripts,\n\t\tpathCompatibility: compatibility.verdict,\n\t\tcompatibilityFindings: compatibility.findings,\n\t\tcapabilities: capabilities.capabilities,\n\t\tcapabilityFindings: capabilities.findings,\n\t\trisk,\n\t\tadoption: decision.adoption,\n\t\t...(decision.deferredReason === undefined ? {} : { deferredReason: decision.deferredReason }),\n\t\treleaseAgeVerdict: releaseAge.verdict,\n\t\tmaintainerRisk,\n\t\trejectedReasons,\n\t};\n}\n\nexport interface ProcurementBatchInput {\n\tcandidates: readonly CandidatePackageInput[];\n\tpackageJsonScripts?: Record<string, string>;\n\tdeclaredLicense?: string;\n\ttransitiveLicenses?: string[];\n\tsources?: SourceText[];\n\treviewedScriptAllowlist?: string[];\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n\tnow?: Date;\n}\n\nexport interface ProcurementBatchResult {\n\tcoverage: ProcurementReview[];\n\tglobalBlockers: string[];\n\tselectedByGroup: Record<string, string>;\n}\n\nfunction withBatchDeferral(\n\treview: ProcurementReview,\n\treason: DeferredReason,\n\trejectedReason: string,\n): ProcurementReview {\n\treturn {\n\t\t...review,\n\t\tadoption: \"deferred\",\n\t\tdeferredReason: reason,\n\t\trejectedReasons: [...review.rejectedReasons, rejectedReason],\n\t};\n}\n\nfunction isAdoptedForGroup(review: ProcurementReview): boolean {\n\treturn review.adoption !== \"reject\" && review.adoption !== \"deferred\";\n}\n\nexport function procureCandidateBatch(input: ProcurementBatchInput): ProcurementBatchResult {\n\tconst selectedByGroup: Record<string, string> = {};\n\tconst coverage: ProcurementReview[] = [];\n\tfor (const candidate of input.candidates) {\n\t\tconst review = procureCandidate({\n\t\t\tcandidate,\n\t\t\tpackageJsonScripts: input.packageJsonScripts,\n\t\t\tdeclaredLicense: input.declaredLicense ?? \"MIT\",\n\t\t\ttransitiveLicenses: input.transitiveLicenses,\n\t\t\tsources: input.sources,\n\t\t\treviewedScriptAllowlist: input.reviewedScriptAllowlist,\n\t\t\tlifecycleAllowlistMode: input.lifecycleAllowlistMode,\n\t\t\tnow: input.now,\n\t\t});\n\t\tconst group = candidate.excludeGroup;\n\t\tif (group && isAdoptedForGroup(review)) {\n\t\t\tif (selectedByGroup[group] === undefined) {\n\t\t\t\tselectedByGroup[group] = candidate.name;\n\t\t\t\tcoverage.push(review);\n\t\t\t} else {\n\t\t\t\tcoverage.push(withBatchDeferral(review, \"group-excluded\", `group-exclusion: ${group}`));\n\t\t\t}\n\t\t} else {\n\t\t\tcoverage.push(review);\n\t\t}\n\t}\n\treturn { coverage, globalBlockers: [], selectedByGroup };\n}\n\nfunction sourceIdentity(normalized: NormalizedSource): string {\n\tif (normalized.kind === \"npm\") {\n\t\treturn `npm:${normalized.name}`;\n\t}\n\treturn `git:${normalized.host}/${normalized.path}`;\n}\n"]}

package/dist/core/package-trial-runtime.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Package-manager-facing trial runtime adapter.
+ *
+ * Narrow, pure adapter around `package-trial-sandbox.ts`. It takes a trial install
+ * request, validates it through the existing `planPackageTrialInstall` gate, and
+ * shapes the result into the three artifacts a package-manager executor needs:
+ *
+ *   - executor instructions: the exact (possibly OS-sandbox-wrapped) argv/cwd/env
+ *     to spawn, so the runtime never re-derives the command;
+ *   - cleanup plan: the ephemeral install root to remove after the trial;
+ *   - audit record: deterministic, secret-free metadata describing the trial.
+ *
+ * This module performs no I/O: it does not install, spawn, clone, read, write, or
+ * mutate any filesystem/network state. It only transforms validated inputs into a
+ * declarative plan consumed by the package-manager executor.
+ */
+import { type PackageTrialInstallInput, type TrialInstallKind, type TrialPackageManagerName } from "./package-trial-sandbox.ts";
+import type { NetworkMode, SandboxMode } from "./sandbox/policy.ts";
+/** Exact spawn instruction for the package-manager executor. */
+export interface TrialExecutorInstruction {
+    /** argv[0] to spawn: the OS-sandbox wrapper when wrapped, otherwise the tool. */
+    readonly command: string;
+    /** Remaining argv to pass to the command. */
+    readonly args: readonly string[];
+    /** Working directory for the spawn. */
+    readonly cwd: string;
+    /** Filtered environment for the spawn (carries spawn-time values, never audited). */
+    readonly env: Readonly<Record<string, string>>;
+    /** True when the argv is wrapped by an OS sandbox backend. */
+    readonly wrapped: boolean;
+    /** Lifecycle scripts are always ignored for trial installs. */
+    readonly lifecycleScripts: "ignored";
+}
+/** Declarative cleanup metadata for the ephemeral trial install. */
+export interface TrialCleanupPlan {
+    /** The trial install root that should be torn down. */
+    readonly installRoot: string;
+    /** Paths to remove after the trial completes (currently the install root). */
+    readonly removePaths: readonly string[];
+    readonly recursive: true;
+    readonly force: true;
+    readonly reason: "ephemeral-trial";
+}
+/** Deterministic, secret-free audit record for the trial. */
+export interface TrialAuditRecord {
+    readonly kind: TrialInstallKind;
+    readonly packageManagerName: TrialPackageManagerName;
+    readonly source: string;
+    readonly installRoot: string;
+    /** Logical tool command (npm/pnpm/bun/git), not the sandbox wrapper. */
+    readonly command: string;
+    /** Logical (unwrapped) args for the tool command. */
+    readonly args: readonly string[];
+    readonly lifecycleScripts: "ignored";
+    readonly sandboxMode: SandboxMode;
+    readonly sandboxWrapped: boolean;
+    readonly sandboxRule: string;
+    readonly networkMode: NetworkMode;
+}
+export type TrialRuntimePlan = {
+    readonly ok: false;
+    readonly reason: string;
+} | {
+    readonly ok: true;
+    readonly executor: TrialExecutorInstruction;
+    readonly cleanup: TrialCleanupPlan;
+    readonly audit: TrialAuditRecord;
+};
+/**
+ * Validate a trial install request and shape it into executor/cleanup/audit
+ * artifacts. Pure and deterministic: identical inputs always produce identical
+ * output, and no side effects are performed.
+ */
+export declare function createTrialRuntimePlan(input: PackageTrialInstallInput): TrialRuntimePlan;
+//# sourceMappingURL=package-trial-runtime.d.ts.map

package/dist/core/package-trial-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-trial-runtime.d.ts","sourceRoot":"","sources":["../../src/core/package-trial-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACN,KAAK,wBAAwB,EAE7B,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEpE,gEAAgE;AAChE,MAAM,WAAW,wBAAwB;IACxC,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC;CACrC;AAED,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACnC;AAED,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CAClC;AAED,MAAM,MAAM,gBAAgB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IACA,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAChC,CAAC;AAeL;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,GAAG,gBAAgB,CA4CxF","sourcesContent":["/**\n * Package-manager-facing trial runtime adapter.\n *\n * Narrow, pure adapter around `package-trial-sandbox.ts`. It takes a trial install\n * request, validates it through the existing `planPackageTrialInstall` gate, and\n * shapes the result into the three artifacts a package-manager executor needs:\n *\n *   - executor instructions: the exact (possibly OS-sandbox-wrapped) argv/cwd/env\n *     to spawn, so the runtime never re-derives the command;\n *   - cleanup plan: the ephemeral install root to remove after the trial;\n *   - audit record: deterministic, secret-free metadata describing the trial.\n *\n * This module performs no I/O: it does not install, spawn, clone, read, write, or\n * mutate any filesystem/network state. It only transforms validated inputs into a\n * declarative plan consumed by the package-manager executor.\n */\n\nimport {\n\ttype PackageTrialInstallInput,\n\tplanPackageTrialInstall,\n\ttype TrialInstallKind,\n\ttype TrialPackageManagerName,\n} from \"./package-trial-sandbox.ts\";\nimport type { NetworkMode, SandboxMode } from \"./sandbox/policy.ts\";\n\n/** Exact spawn instruction for the package-manager executor. */\nexport interface TrialExecutorInstruction {\n\t/** argv[0] to spawn: the OS-sandbox wrapper when wrapped, otherwise the tool. */\n\treadonly command: string;\n\t/** Remaining argv to pass to the command. */\n\treadonly args: readonly string[];\n\t/** Working directory for the spawn. */\n\treadonly cwd: string;\n\t/** Filtered environment for the spawn (carries spawn-time values, never audited). */\n\treadonly env: Readonly<Record<string, string>>;\n\t/** True when the argv is wrapped by an OS sandbox backend. */\n\treadonly wrapped: boolean;\n\t/** Lifecycle scripts are always ignored for trial installs. */\n\treadonly lifecycleScripts: \"ignored\";\n}\n\n/** Declarative cleanup metadata for the ephemeral trial install. */\nexport interface TrialCleanupPlan {\n\t/** The trial install root that should be torn down. */\n\treadonly installRoot: string;\n\t/** Paths to remove after the trial completes (currently the install root). */\n\treadonly removePaths: readonly string[];\n\treadonly recursive: true;\n\treadonly force: true;\n\treadonly reason: \"ephemeral-trial\";\n}\n\n/** Deterministic, secret-free audit record for the trial. */\nexport interface TrialAuditRecord {\n\treadonly kind: TrialInstallKind;\n\treadonly packageManagerName: TrialPackageManagerName;\n\treadonly source: string;\n\treadonly installRoot: string;\n\t/** Logical tool command (npm/pnpm/bun/git), not the sandbox wrapper. */\n\treadonly command: string;\n\t/** Logical (unwrapped) args for the tool command. */\n\treadonly args: readonly string[];\n\treadonly lifecycleScripts: \"ignored\";\n\treadonly sandboxMode: SandboxMode;\n\treadonly sandboxWrapped: boolean;\n\treadonly sandboxRule: string;\n\treadonly networkMode: NetworkMode;\n}\n\nexport type TrialRuntimePlan =\n\t| { readonly ok: false; readonly reason: string }\n\t| {\n\t\t\treadonly ok: true;\n\t\t\treadonly executor: TrialExecutorInstruction;\n\t\t\treadonly cleanup: TrialCleanupPlan;\n\t\t\treadonly audit: TrialAuditRecord;\n\t  };\n\nconst SOURCE_CREDENTIAL_PATTERN = /(https?:\\/\\/)([^\\s/@]+@)/gi;\nconst SOURCE_TOKEN_QUERY_PATTERN = /([?&](?:access_token|auth|key|password|token)=)[^&#]+/gi;\n\nfunction redactTrialSource(source: string): string {\n\treturn source\n\t\t.replace(SOURCE_CREDENTIAL_PATTERN, \"$1<redacted>@\")\n\t\t.replace(SOURCE_TOKEN_QUERY_PATTERN, \"$1<redacted>\");\n}\n\nfunction redactTrialArgs(args: readonly string[]): string[] {\n\treturn args.map((arg) => redactTrialSource(arg));\n}\n\n/**\n * Validate a trial install request and shape it into executor/cleanup/audit\n * artifacts. Pure and deterministic: identical inputs always produce identical\n * output, and no side effects are performed.\n */\nexport function createTrialRuntimePlan(input: PackageTrialInstallInput): TrialRuntimePlan {\n\tconst plan = planPackageTrialInstall(input);\n\tif (!plan.ok) {\n\t\treturn { ok: false, reason: plan.reason };\n\t}\n\n\tconst sandbox = plan.sandbox;\n\tif (!sandbox.allowed) {\n\t\t// Defensive: planPackageTrialInstall only returns ok when the sandbox is allowed.\n\t\treturn { ok: false, reason: `[${sandbox.rule}] ${sandbox.reason}` };\n\t}\n\n\tconst executor: TrialExecutorInstruction = {\n\t\tcommand: sandbox.argv[0],\n\t\targs: sandbox.argv.slice(1),\n\t\tcwd: sandbox.cwd,\n\t\tenv: sandbox.env,\n\t\twrapped: sandbox.wrapped,\n\t\tlifecycleScripts: plan.lifecycleScripts,\n\t};\n\n\tconst cleanup: TrialCleanupPlan = {\n\t\tinstallRoot: input.installRoot,\n\t\tremovePaths: [input.installRoot],\n\t\trecursive: true,\n\t\tforce: true,\n\t\treason: \"ephemeral-trial\",\n\t};\n\n\tconst audit: TrialAuditRecord = {\n\t\tkind: plan.kind,\n\t\tpackageManagerName: input.packageManagerName,\n\t\tsource: redactTrialSource(input.source),\n\t\tinstallRoot: input.installRoot,\n\t\tcommand: plan.command,\n\t\targs: redactTrialArgs(plan.args),\n\t\tlifecycleScripts: plan.lifecycleScripts,\n\t\tsandboxMode: input.policy.mode,\n\t\tsandboxWrapped: sandbox.wrapped,\n\t\tsandboxRule: sandbox.rule,\n\t\tnetworkMode: input.policy.network.mode,\n\t};\n\n\treturn { ok: true, executor, cleanup, audit };\n}\n"]}

package/dist/core/package-trial-runtime.js

@@ -0,0 +1,73 @@
+/**
+ * Package-manager-facing trial runtime adapter.
+ *
+ * Narrow, pure adapter around `package-trial-sandbox.ts`. It takes a trial install
+ * request, validates it through the existing `planPackageTrialInstall` gate, and
+ * shapes the result into the three artifacts a package-manager executor needs:
+ *
+ *   - executor instructions: the exact (possibly OS-sandbox-wrapped) argv/cwd/env
+ *     to spawn, so the runtime never re-derives the command;
+ *   - cleanup plan: the ephemeral install root to remove after the trial;
+ *   - audit record: deterministic, secret-free metadata describing the trial.
+ *
+ * This module performs no I/O: it does not install, spawn, clone, read, write, or
+ * mutate any filesystem/network state. It only transforms validated inputs into a
+ * declarative plan consumed by the package-manager executor.
+ */
+import { planPackageTrialInstall, } from "./package-trial-sandbox.js";
+const SOURCE_CREDENTIAL_PATTERN = /(https?:\/\/)([^\s/@]+@)/gi;
+const SOURCE_TOKEN_QUERY_PATTERN = /([?&](?:access_token|auth|key|password|token)=)[^&#]+/gi;
+function redactTrialSource(source) {
+    return source
+        .replace(SOURCE_CREDENTIAL_PATTERN, "$1<redacted>@")
+        .replace(SOURCE_TOKEN_QUERY_PATTERN, "$1<redacted>");
+}
+function redactTrialArgs(args) {
+    return args.map((arg) => redactTrialSource(arg));
+}
+/**
+ * Validate a trial install request and shape it into executor/cleanup/audit
+ * artifacts. Pure and deterministic: identical inputs always produce identical
+ * output, and no side effects are performed.
+ */
+export function createTrialRuntimePlan(input) {
+    const plan = planPackageTrialInstall(input);
+    if (!plan.ok) {
+        return { ok: false, reason: plan.reason };
+    }
+    const sandbox = plan.sandbox;
+    if (!sandbox.allowed) {
+        // Defensive: planPackageTrialInstall only returns ok when the sandbox is allowed.
+        return { ok: false, reason: `[${sandbox.rule}] ${sandbox.reason}` };
+    }
+    const executor = {
+        command: sandbox.argv[0],
+        args: sandbox.argv.slice(1),
+        cwd: sandbox.cwd,
+        env: sandbox.env,
+        wrapped: sandbox.wrapped,
+        lifecycleScripts: plan.lifecycleScripts,
+    };
+    const cleanup = {
+        installRoot: input.installRoot,
+        removePaths: [input.installRoot],
+        recursive: true,
+        force: true,
+        reason: "ephemeral-trial",
+    };
+    const audit = {
+        kind: plan.kind,
+        packageManagerName: input.packageManagerName,
+        source: redactTrialSource(input.source),
+        installRoot: input.installRoot,
+        command: plan.command,
+        args: redactTrialArgs(plan.args),
+        lifecycleScripts: plan.lifecycleScripts,
+        sandboxMode: input.policy.mode,
+        sandboxWrapped: sandbox.wrapped,
+        sandboxRule: sandbox.rule,
+        networkMode: input.policy.network.mode,
+    };
+    return { ok: true, executor, cleanup, audit };
+}
+//# sourceMappingURL=package-trial-runtime.js.map

package/dist/core/package-trial-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-trial-runtime.js","sourceRoot":"","sources":["../../src/core/package-trial-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAEN,uBAAuB,GAGvB,MAAM,4BAA4B,CAAC;AAwDpC,MAAM,yBAAyB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,0BAA0B,GAAG,yDAAyD,CAAC;AAE7F,SAAS,iBAAiB,CAAC,MAAc,EAAU;IAClD,OAAO,MAAM;SACX,OAAO,CAAC,yBAAyB,EAAE,eAAe,CAAC;SACnD,OAAO,CAAC,0BAA0B,EAAE,cAAc,CAAC,CAAC;AAAA,CACtD;AAED,SAAS,eAAe,CAAC,IAAuB,EAAY;IAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;AAAA,CACjD;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA+B,EAAoB;IACzF,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtB,kFAAkF;QAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAA6B;QAC1C,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACvC,CAAC;IAEF,MAAM,OAAO,GAAqB;QACjC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;QAChC,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,iBAAiB;KACzB,CAAC;IAEF,MAAM,KAAK,GAAqB;QAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC;QACvC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QAC9B,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;KACtC,CAAC;IAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,CAC9C","sourcesContent":["/**\n * Package-manager-facing trial runtime adapter.\n *\n * Narrow, pure adapter around `package-trial-sandbox.ts`. It takes a trial install\n * request, validates it through the existing `planPackageTrialInstall` gate, and\n * shapes the result into the three artifacts a package-manager executor needs:\n *\n *   - executor instructions: the exact (possibly OS-sandbox-wrapped) argv/cwd/env\n *     to spawn, so the runtime never re-derives the command;\n *   - cleanup plan: the ephemeral install root to remove after the trial;\n *   - audit record: deterministic, secret-free metadata describing the trial.\n *\n * This module performs no I/O: it does not install, spawn, clone, read, write, or\n * mutate any filesystem/network state. It only transforms validated inputs into a\n * declarative plan consumed by the package-manager executor.\n */\n\nimport {\n\ttype PackageTrialInstallInput,\n\tplanPackageTrialInstall,\n\ttype TrialInstallKind,\n\ttype TrialPackageManagerName,\n} from \"./package-trial-sandbox.ts\";\nimport type { NetworkMode, SandboxMode } from \"./sandbox/policy.ts\";\n\n/** Exact spawn instruction for the package-manager executor. */\nexport interface TrialExecutorInstruction {\n\t/** argv[0] to spawn: the OS-sandbox wrapper when wrapped, otherwise the tool. */\n\treadonly command: string;\n\t/** Remaining argv to pass to the command. */\n\treadonly args: readonly string[];\n\t/** Working directory for the spawn. */\n\treadonly cwd: string;\n\t/** Filtered environment for the spawn (carries spawn-time values, never audited). */\n\treadonly env: Readonly<Record<string, string>>;\n\t/** True when the argv is wrapped by an OS sandbox backend. */\n\treadonly wrapped: boolean;\n\t/** Lifecycle scripts are always ignored for trial installs. */\n\treadonly lifecycleScripts: \"ignored\";\n}\n\n/** Declarative cleanup metadata for the ephemeral trial install. */\nexport interface TrialCleanupPlan {\n\t/** The trial install root that should be torn down. */\n\treadonly installRoot: string;\n\t/** Paths to remove after the trial completes (currently the install root). */\n\treadonly removePaths: readonly string[];\n\treadonly recursive: true;\n\treadonly force: true;\n\treadonly reason: \"ephemeral-trial\";\n}\n\n/** Deterministic, secret-free audit record for the trial. */\nexport interface TrialAuditRecord {\n\treadonly kind: TrialInstallKind;\n\treadonly packageManagerName: TrialPackageManagerName;\n\treadonly source: string;\n\treadonly installRoot: string;\n\t/** Logical tool command (npm/pnpm/bun/git), not the sandbox wrapper. */\n\treadonly command: string;\n\t/** Logical (unwrapped) args for the tool command. */\n\treadonly args: readonly string[];\n\treadonly lifecycleScripts: \"ignored\";\n\treadonly sandboxMode: SandboxMode;\n\treadonly sandboxWrapped: boolean;\n\treadonly sandboxRule: string;\n\treadonly networkMode: NetworkMode;\n}\n\nexport type TrialRuntimePlan =\n\t| { readonly ok: false; readonly reason: string }\n\t| {\n\t\t\treadonly ok: true;\n\t\t\treadonly executor: TrialExecutorInstruction;\n\t\t\treadonly cleanup: TrialCleanupPlan;\n\t\t\treadonly audit: TrialAuditRecord;\n\t  };\n\nconst SOURCE_CREDENTIAL_PATTERN = /(https?:\\/\\/)([^\\s/@]+@)/gi;\nconst SOURCE_TOKEN_QUERY_PATTERN = /([?&](?:access_token|auth|key|password|token)=)[^&#]+/gi;\n\nfunction redactTrialSource(source: string): string {\n\treturn source\n\t\t.replace(SOURCE_CREDENTIAL_PATTERN, \"$1<redacted>@\")\n\t\t.replace(SOURCE_TOKEN_QUERY_PATTERN, \"$1<redacted>\");\n}\n\nfunction redactTrialArgs(args: readonly string[]): string[] {\n\treturn args.map((arg) => redactTrialSource(arg));\n}\n\n/**\n * Validate a trial install request and shape it into executor/cleanup/audit\n * artifacts. Pure and deterministic: identical inputs always produce identical\n * output, and no side effects are performed.\n */\nexport function createTrialRuntimePlan(input: PackageTrialInstallInput): TrialRuntimePlan {\n\tconst plan = planPackageTrialInstall(input);\n\tif (!plan.ok) {\n\t\treturn { ok: false, reason: plan.reason };\n\t}\n\n\tconst sandbox = plan.sandbox;\n\tif (!sandbox.allowed) {\n\t\t// Defensive: planPackageTrialInstall only returns ok when the sandbox is allowed.\n\t\treturn { ok: false, reason: `[${sandbox.rule}] ${sandbox.reason}` };\n\t}\n\n\tconst executor: TrialExecutorInstruction = {\n\t\tcommand: sandbox.argv[0],\n\t\targs: sandbox.argv.slice(1),\n\t\tcwd: sandbox.cwd,\n\t\tenv: sandbox.env,\n\t\twrapped: sandbox.wrapped,\n\t\tlifecycleScripts: plan.lifecycleScripts,\n\t};\n\n\tconst cleanup: TrialCleanupPlan = {\n\t\tinstallRoot: input.installRoot,\n\t\tremovePaths: [input.installRoot],\n\t\trecursive: true,\n\t\tforce: true,\n\t\treason: \"ephemeral-trial\",\n\t};\n\n\tconst audit: TrialAuditRecord = {\n\t\tkind: plan.kind,\n\t\tpackageManagerName: input.packageManagerName,\n\t\tsource: redactTrialSource(input.source),\n\t\tinstallRoot: input.installRoot,\n\t\tcommand: plan.command,\n\t\targs: redactTrialArgs(plan.args),\n\t\tlifecycleScripts: plan.lifecycleScripts,\n\t\tsandboxMode: input.policy.mode,\n\t\tsandboxWrapped: sandbox.wrapped,\n\t\tsandboxRule: sandbox.rule,\n\t\tnetworkMode: input.policy.network.mode,\n\t};\n\n\treturn { ok: true, executor, cleanup, audit };\n}\n"]}

package/dist/core/package-trial-sandbox.d.ts

@@ -0,0 +1,27 @@
+import { type SandboxBackendStatus, type SandboxPathResolver, type SandboxPolicy } from "./sandbox/policy.ts";
+import { type SandboxedSpawnRequest } from "./sandbox/spawn.ts";
+export type TrialPackageManagerName = "npm" | "pnpm" | "bun";
+export type TrialInstallKind = "npm" | "git";
+export interface PackageTrialInstallInput {
+    readonly source: string;
+    readonly installRoot: string;
+    readonly packageManagerName: TrialPackageManagerName;
+    readonly packageManagerCommand?: readonly [string, ...string[]];
+    readonly policy: SandboxPolicy;
+    readonly backend: SandboxBackendStatus;
+    readonly resolver?: SandboxPathResolver;
+    readonly env?: NodeJS.ProcessEnv;
+}
+export type PackageTrialInstallPlan = {
+    readonly ok: false;
+    readonly reason: string;
+} | {
+    readonly ok: true;
+    readonly kind: TrialInstallKind;
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly lifecycleScripts: "ignored";
+    readonly sandbox: SandboxedSpawnRequest;
+};
+export declare function planPackageTrialInstall(input: PackageTrialInstallInput): PackageTrialInstallPlan;
+//# sourceMappingURL=package-trial-sandbox.d.ts.map

package/dist/core/package-trial-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-trial-sandbox.d.ts","sourceRoot":"","sources":["../../src/core/package-trial-sandbox.ts"],"names":[],"mappings":"AAEA,OAAO,EAEN,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA8B,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE5F,MAAM,MAAM,uBAAuB,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,KAAK,CAAC;AAE7C,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;IACrD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAChE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACjC;AAED,MAAM,MAAM,uBAAuB,GAChC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IACA,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;CACvC,CAAC;AAoFL,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,wBAAwB,GAAG,uBAAuB,CAyChG","sourcesContent":["import { validateExactNpmVersion, validateGitRef, validateNpmPackageName } from \"./package-procurement.ts\";\nimport { resolveSandboxPath } from \"./sandbox/path-resolver.ts\";\nimport {\n\tdecidePathAccess,\n\ttype SandboxBackendStatus,\n\ttype SandboxPathResolver,\n\ttype SandboxPolicy,\n} from \"./sandbox/policy.ts\";\nimport { buildSandboxedSpawnRequest, type SandboxedSpawnRequest } from \"./sandbox/spawn.ts\";\n\nexport type TrialPackageManagerName = \"npm\" | \"pnpm\" | \"bun\";\nexport type TrialInstallKind = \"npm\" | \"git\";\n\nexport interface PackageTrialInstallInput {\n\treadonly source: string;\n\treadonly installRoot: string;\n\treadonly packageManagerName: TrialPackageManagerName;\n\treadonly packageManagerCommand?: readonly [string, ...string[]];\n\treadonly policy: SandboxPolicy;\n\treadonly backend: SandboxBackendStatus;\n\treadonly resolver?: SandboxPathResolver;\n\treadonly env?: NodeJS.ProcessEnv;\n}\n\nexport type PackageTrialInstallPlan =\n\t| { readonly ok: false; readonly reason: string }\n\t| {\n\t\t\treadonly ok: true;\n\t\t\treadonly kind: TrialInstallKind;\n\t\t\treadonly command: string;\n\t\t\treadonly args: readonly string[];\n\t\t\treadonly lifecycleScripts: \"ignored\";\n\t\t\treadonly sandbox: SandboxedSpawnRequest;\n\t  };\n\ninterface ParsedNpmTrialSource {\n\treadonly kind: \"npm\";\n\treadonly spec: string;\n\treadonly name: string;\n\treadonly version: string;\n}\n\ninterface ParsedGitTrialSource {\n\treadonly kind: \"git\";\n\treadonly repo: string;\n\treadonly ref: string;\n\treadonly commit: string;\n}\n\ntype ParsedTrialSource = ParsedNpmTrialSource | ParsedGitTrialSource;\n\nfunction parseNpmTrialSource(source: string): ParsedNpmTrialSource | string {\n\tconst spec = source.slice(\"npm:\".length).trim();\n\tconst versionSeparator = spec.lastIndexOf(\"@\");\n\tif (versionSeparator <= 0) return \"npm trial source requires an exact version\";\n\tconst name = spec.slice(0, versionSeparator);\n\tconst version = spec.slice(versionSeparator + 1);\n\tconst nameVerdict = validateNpmPackageName(name);\n\tif (!nameVerdict.ok) return nameVerdict.message;\n\tconst versionVerdict = validateExactNpmVersion(version);\n\tif (!versionVerdict.ok) return versionVerdict.message;\n\treturn { kind: \"npm\", spec, name: nameVerdict.name, version: versionVerdict.version };\n}\n\nfunction parseGitTrialSource(source: string): ParsedGitTrialSource | string {\n\tconst value = source.slice(\"git:\".length).trim();\n\tconst hashIndex = value.lastIndexOf(\"#\");\n\tif (hashIndex <= 0 || hashIndex === value.length - 1) {\n\t\treturn \"git trial source requires a full commit ref after #\";\n\t}\n\tconst repo = value.slice(0, hashIndex);\n\tconst ref = value.slice(hashIndex + 1);\n\tconst refVerdict = validateGitRef(ref);\n\tif (!refVerdict.ok) return refVerdict.message;\n\treturn { kind: \"git\", repo, ref: refVerdict.ref, commit: refVerdict.commit };\n}\n\nfunction parseTrialSource(source: string): ParsedTrialSource | string {\n\tif (source.startsWith(\"npm:\")) return parseNpmTrialSource(source);\n\tif (source.startsWith(\"git:\")) return parseGitTrialSource(source);\n\treturn \"trial source must start with npm: or git:\";\n}\n\nfunction npmTrialArgs(manager: TrialPackageManagerName, spec: string, installRoot: string): string[] {\n\tif (manager === \"bun\") {\n\t\treturn [\"install\", spec, \"--cwd\", installRoot, \"--omit=peer\", \"--ignore-scripts\"];\n\t}\n\tif (manager === \"pnpm\") {\n\t\treturn [\n\t\t\t\"install\",\n\t\t\tspec,\n\t\t\t\"--prefix\",\n\t\t\tinstallRoot,\n\t\t\t\"--config.auto-install-peers=false\",\n\t\t\t\"--config.strict-peer-dependencies=false\",\n\t\t\t\"--config.strict-dep-builds=false\",\n\t\t\t\"--ignore-scripts\",\n\t\t];\n\t}\n\treturn [\"install\", spec, \"--prefix\", installRoot, \"--legacy-peer-deps\", \"--ignore-scripts\"];\n}\n\nfunction buildCommand(\n\tparsed: ParsedNpmTrialSource,\n\tmanager: TrialPackageManagerName,\n\tinstallRoot: string,\n): {\n\tcommand: string;\n\targs: string[];\n} {\n\treturn { command: manager, args: npmTrialArgs(manager, parsed.spec, installRoot) };\n}\n\nfunction resolveForTrialPolicy(input: PackageTrialInstallInput): SandboxPathResolver {\n\treturn input.resolver ?? ((requestPath) => resolveSandboxPath(input.policy.filesystem.root, requestPath));\n}\n\nexport function planPackageTrialInstall(input: PackageTrialInstallInput): PackageTrialInstallPlan {\n\tconst parsed = parseTrialSource(input.source);\n\tif (typeof parsed === \"string\") {\n\t\treturn { ok: false, reason: parsed };\n\t}\n\n\tif (parsed.kind === \"git\") {\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason: \"temporary git trial installs require a shell-free multi-step executor before clone/checkout can run\",\n\t\t};\n\t}\n\n\tconst resolver = resolveForTrialPolicy(input);\n\tconst writeDecision = decidePathAccess(input.policy, { kind: \"write\", path: input.installRoot }, resolver);\n\tif (!writeDecision.allowed) {\n\t\treturn { ok: false, reason: `[${writeDecision.rule}] ${writeDecision.reason}` };\n\t}\n\n\tconst { command, args } = buildCommand(parsed, input.packageManagerName, input.installRoot);\n\tconst packageManagerArgv = input.packageManagerCommand ?? [command];\n\tconst sandbox = buildSandboxedSpawnRequest({\n\t\targv: [...packageManagerArgv, ...args],\n\t\tcwd: input.installRoot,\n\t\tenv: input.env ?? {},\n\t\tpolicy: input.policy,\n\t\tbackend: input.backend,\n\t\tresolver,\n\t});\n\tif (!sandbox.allowed) {\n\t\treturn { ok: false, reason: `[${sandbox.rule}] ${sandbox.reason}` };\n\t}\n\n\treturn {\n\t\tok: true,\n\t\tkind: parsed.kind,\n\t\tcommand,\n\t\targs,\n\t\tlifecycleScripts: \"ignored\",\n\t\tsandbox,\n\t};\n}\n"]}

package/dist/core/package-trial-sandbox.js

@@ -0,0 +1,102 @@
+import { validateExactNpmVersion, validateGitRef, validateNpmPackageName } from "./package-procurement.js";
+import { resolveSandboxPath } from "./sandbox/path-resolver.js";
+import { decidePathAccess, } from "./sandbox/policy.js";
+import { buildSandboxedSpawnRequest } from "./sandbox/spawn.js";
+function parseNpmTrialSource(source) {
+    const spec = source.slice("npm:".length).trim();
+    const versionSeparator = spec.lastIndexOf("@");
+    if (versionSeparator <= 0)
+        return "npm trial source requires an exact version";
+    const name = spec.slice(0, versionSeparator);
+    const version = spec.slice(versionSeparator + 1);
+    const nameVerdict = validateNpmPackageName(name);
+    if (!nameVerdict.ok)
+        return nameVerdict.message;
+    const versionVerdict = validateExactNpmVersion(version);
+    if (!versionVerdict.ok)
+        return versionVerdict.message;
+    return { kind: "npm", spec, name: nameVerdict.name, version: versionVerdict.version };
+}
+function parseGitTrialSource(source) {
+    const value = source.slice("git:".length).trim();
+    const hashIndex = value.lastIndexOf("#");
+    if (hashIndex <= 0 || hashIndex === value.length - 1) {
+        return "git trial source requires a full commit ref after #";
+    }
+    const repo = value.slice(0, hashIndex);
+    const ref = value.slice(hashIndex + 1);
+    const refVerdict = validateGitRef(ref);
+    if (!refVerdict.ok)
+        return refVerdict.message;
+    return { kind: "git", repo, ref: refVerdict.ref, commit: refVerdict.commit };
+}
+function parseTrialSource(source) {
+    if (source.startsWith("npm:"))
+        return parseNpmTrialSource(source);
+    if (source.startsWith("git:"))
+        return parseGitTrialSource(source);
+    return "trial source must start with npm: or git:";
+}
+function npmTrialArgs(manager, spec, installRoot) {
+    if (manager === "bun") {
+        return ["install", spec, "--cwd", installRoot, "--omit=peer", "--ignore-scripts"];
+    }
+    if (manager === "pnpm") {
+        return [
+            "install",
+            spec,
+            "--prefix",
+            installRoot,
+            "--config.auto-install-peers=false",
+            "--config.strict-peer-dependencies=false",
+            "--config.strict-dep-builds=false",
+            "--ignore-scripts",
+        ];
+    }
+    return ["install", spec, "--prefix", installRoot, "--legacy-peer-deps", "--ignore-scripts"];
+}
+function buildCommand(parsed, manager, installRoot) {
+    return { command: manager, args: npmTrialArgs(manager, parsed.spec, installRoot) };
+}
+function resolveForTrialPolicy(input) {
+    return input.resolver ?? ((requestPath) => resolveSandboxPath(input.policy.filesystem.root, requestPath));
+}
+export function planPackageTrialInstall(input) {
+    const parsed = parseTrialSource(input.source);
+    if (typeof parsed === "string") {
+        return { ok: false, reason: parsed };
+    }
+    if (parsed.kind === "git") {
+        return {
+            ok: false,
+            reason: "temporary git trial installs require a shell-free multi-step executor before clone/checkout can run",
+        };
+    }
+    const resolver = resolveForTrialPolicy(input);
+    const writeDecision = decidePathAccess(input.policy, { kind: "write", path: input.installRoot }, resolver);
+    if (!writeDecision.allowed) {
+        return { ok: false, reason: `[${writeDecision.rule}] ${writeDecision.reason}` };
+    }
+    const { command, args } = buildCommand(parsed, input.packageManagerName, input.installRoot);
+    const packageManagerArgv = input.packageManagerCommand ?? [command];
+    const sandbox = buildSandboxedSpawnRequest({
+        argv: [...packageManagerArgv, ...args],
+        cwd: input.installRoot,
+        env: input.env ?? {},
+        policy: input.policy,
+        backend: input.backend,
+        resolver,
+    });
+    if (!sandbox.allowed) {
+        return { ok: false, reason: `[${sandbox.rule}] ${sandbox.reason}` };
+    }
+    return {
+        ok: true,
+        kind: parsed.kind,
+        command,
+        args,
+        lifecycleScripts: "ignored",
+        sandbox,
+    };
+}
+//# sourceMappingURL=package-trial-sandbox.js.map

package/dist/core/package-trial-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-trial-sandbox.js","sourceRoot":"","sources":["../../src/core/package-trial-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACN,gBAAgB,GAIhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,0BAA0B,EAA8B,MAAM,oBAAoB,CAAC;AA2C5F,SAAS,mBAAmB,CAAC,MAAc,EAAiC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,gBAAgB,IAAI,CAAC;QAAE,OAAO,4CAA4C,CAAC;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC;IAChD,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,cAAc,CAAC,EAAE;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC;AAAA,CACtF;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAiC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,qDAAqD,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC;IAC9C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AAAA,CAC7E;AAED,SAAS,gBAAgB,CAAC,MAAc,EAA8B;IACrE,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClE,OAAO,2CAA2C,CAAC;AAAA,CACnD;AAED,SAAS,YAAY,CAAC,OAAgC,EAAE,IAAY,EAAE,WAAmB,EAAY;IACpG,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO;YACN,SAAS;YACT,IAAI;YACJ,UAAU;YACV,WAAW;YACX,mCAAmC;YACnC,yCAAyC;YACzC,kCAAkC;YAClC,kBAAkB;SAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;AAAA,CAC5F;AAED,SAAS,YAAY,CACpB,MAA4B,EAC5B,OAAgC,EAChC,WAAmB,EAIlB;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;AAAA,CACnF;AAED,SAAS,qBAAqB,CAAC,KAA+B,EAAuB;IACpF,OAAO,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AAAA,CAC1G;AAED,MAAM,UAAU,uBAAuB,CAAC,KAA+B,EAA2B;IACjG,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qGAAqG;SAC7G,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3G,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,aAAa,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5F,MAAM,kBAAkB,GAAG,KAAK,CAAC,qBAAqB,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,0BAA0B,CAAC;QAC1C,IAAI,EAAE,CAAC,GAAG,kBAAkB,EAAE,GAAG,IAAI,CAAC;QACtC,GAAG,EAAE,KAAK,CAAC,WAAW;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ;KACR,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,OAAO;QACN,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO;QACP,IAAI;QACJ,gBAAgB,EAAE,SAAS;QAC3B,OAAO;KACP,CAAC;AAAA,CACF","sourcesContent":["import { validateExactNpmVersion, validateGitRef, validateNpmPackageName } from \"./package-procurement.ts\";\nimport { resolveSandboxPath } from \"./sandbox/path-resolver.ts\";\nimport {\n\tdecidePathAccess,\n\ttype SandboxBackendStatus,\n\ttype SandboxPathResolver,\n\ttype SandboxPolicy,\n} from \"./sandbox/policy.ts\";\nimport { buildSandboxedSpawnRequest, type SandboxedSpawnRequest } from \"./sandbox/spawn.ts\";\n\nexport type TrialPackageManagerName = \"npm\" | \"pnpm\" | \"bun\";\nexport type TrialInstallKind = \"npm\" | \"git\";\n\nexport interface PackageTrialInstallInput {\n\treadonly source: string;\n\treadonly installRoot: string;\n\treadonly packageManagerName: TrialPackageManagerName;\n\treadonly packageManagerCommand?: readonly [string, ...string[]];\n\treadonly policy: SandboxPolicy;\n\treadonly backend: SandboxBackendStatus;\n\treadonly resolver?: SandboxPathResolver;\n\treadonly env?: NodeJS.ProcessEnv;\n}\n\nexport type PackageTrialInstallPlan =\n\t| { readonly ok: false; readonly reason: string }\n\t| {\n\t\t\treadonly ok: true;\n\t\t\treadonly kind: TrialInstallKind;\n\t\t\treadonly command: string;\n\t\t\treadonly args: readonly string[];\n\t\t\treadonly lifecycleScripts: \"ignored\";\n\t\t\treadonly sandbox: SandboxedSpawnRequest;\n\t  };\n\ninterface ParsedNpmTrialSource {\n\treadonly kind: \"npm\";\n\treadonly spec: string;\n\treadonly name: string;\n\treadonly version: string;\n}\n\ninterface ParsedGitTrialSource {\n\treadonly kind: \"git\";\n\treadonly repo: string;\n\treadonly ref: string;\n\treadonly commit: string;\n}\n\ntype ParsedTrialSource = ParsedNpmTrialSource | ParsedGitTrialSource;\n\nfunction parseNpmTrialSource(source: string): ParsedNpmTrialSource | string {\n\tconst spec = source.slice(\"npm:\".length).trim();\n\tconst versionSeparator = spec.lastIndexOf(\"@\");\n\tif (versionSeparator <= 0) return \"npm trial source requires an exact version\";\n\tconst name = spec.slice(0, versionSeparator);\n\tconst version = spec.slice(versionSeparator + 1);\n\tconst nameVerdict = validateNpmPackageName(name);\n\tif (!nameVerdict.ok) return nameVerdict.message;\n\tconst versionVerdict = validateExactNpmVersion(version);\n\tif (!versionVerdict.ok) return versionVerdict.message;\n\treturn { kind: \"npm\", spec, name: nameVerdict.name, version: versionVerdict.version };\n}\n\nfunction parseGitTrialSource(source: string): ParsedGitTrialSource | string {\n\tconst value = source.slice(\"git:\".length).trim();\n\tconst hashIndex = value.lastIndexOf(\"#\");\n\tif (hashIndex <= 0 || hashIndex === value.length - 1) {\n\t\treturn \"git trial source requires a full commit ref after #\";\n\t}\n\tconst repo = value.slice(0, hashIndex);\n\tconst ref = value.slice(hashIndex + 1);\n\tconst refVerdict = validateGitRef(ref);\n\tif (!refVerdict.ok) return refVerdict.message;\n\treturn { kind: \"git\", repo, ref: refVerdict.ref, commit: refVerdict.commit };\n}\n\nfunction parseTrialSource(source: string): ParsedTrialSource | string {\n\tif (source.startsWith(\"npm:\")) return parseNpmTrialSource(source);\n\tif (source.startsWith(\"git:\")) return parseGitTrialSource(source);\n\treturn \"trial source must start with npm: or git:\";\n}\n\nfunction npmTrialArgs(manager: TrialPackageManagerName, spec: string, installRoot: string): string[] {\n\tif (manager === \"bun\") {\n\t\treturn [\"install\", spec, \"--cwd\", installRoot, \"--omit=peer\", \"--ignore-scripts\"];\n\t}\n\tif (manager === \"pnpm\") {\n\t\treturn [\n\t\t\t\"install\",\n\t\t\tspec,\n\t\t\t\"--prefix\",\n\t\t\tinstallRoot,\n\t\t\t\"--config.auto-install-peers=false\",\n\t\t\t\"--config.strict-peer-dependencies=false\",\n\t\t\t\"--config.strict-dep-builds=false\",\n\t\t\t\"--ignore-scripts\",\n\t\t];\n\t}\n\treturn [\"install\", spec, \"--prefix\", installRoot, \"--legacy-peer-deps\", \"--ignore-scripts\"];\n}\n\nfunction buildCommand(\n\tparsed: ParsedNpmTrialSource,\n\tmanager: TrialPackageManagerName,\n\tinstallRoot: string,\n): {\n\tcommand: string;\n\targs: string[];\n} {\n\treturn { command: manager, args: npmTrialArgs(manager, parsed.spec, installRoot) };\n}\n\nfunction resolveForTrialPolicy(input: PackageTrialInstallInput): SandboxPathResolver {\n\treturn input.resolver ?? ((requestPath) => resolveSandboxPath(input.policy.filesystem.root, requestPath));\n}\n\nexport function planPackageTrialInstall(input: PackageTrialInstallInput): PackageTrialInstallPlan {\n\tconst parsed = parseTrialSource(input.source);\n\tif (typeof parsed === \"string\") {\n\t\treturn { ok: false, reason: parsed };\n\t}\n\n\tif (parsed.kind === \"git\") {\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason: \"temporary git trial installs require a shell-free multi-step executor before clone/checkout can run\",\n\t\t};\n\t}\n\n\tconst resolver = resolveForTrialPolicy(input);\n\tconst writeDecision = decidePathAccess(input.policy, { kind: \"write\", path: input.installRoot }, resolver);\n\tif (!writeDecision.allowed) {\n\t\treturn { ok: false, reason: `[${writeDecision.rule}] ${writeDecision.reason}` };\n\t}\n\n\tconst { command, args } = buildCommand(parsed, input.packageManagerName, input.installRoot);\n\tconst packageManagerArgv = input.packageManagerCommand ?? [command];\n\tconst sandbox = buildSandboxedSpawnRequest({\n\t\targv: [...packageManagerArgv, ...args],\n\t\tcwd: input.installRoot,\n\t\tenv: input.env ?? {},\n\t\tpolicy: input.policy,\n\t\tbackend: input.backend,\n\t\tresolver,\n\t});\n\tif (!sandbox.allowed) {\n\t\treturn { ok: false, reason: `[${sandbox.rule}] ${sandbox.reason}` };\n\t}\n\n\treturn {\n\t\tok: true,\n\t\tkind: parsed.kind,\n\t\tcommand,\n\t\targs,\n\t\tlifecycleScripts: \"ignored\",\n\t\tsandbox,\n\t};\n}\n"]}