open-multi-agent-kit 1.0.0 → 1.2.2

package/dist/core/verified-run/authority-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-store.js","sourceRoot":"","sources":["../../../src/core/verified-run/authority-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,SAAS,EACT,UAAU,EACV,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACN,cAAc,EACd,iBAAiB,EAEjB,YAAY,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAmB,qBAAqB,EAAiB,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EACN,0BAA0B,EAC1B,kCAAkC,EAElC,wBAAwB,EACxB,0BAA0B,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAIN,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEN,gBAAgB,EAChB,iBAAiB,EAEjB,cAAc,EACd,UAAU,GACV,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAKxH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAErF,MAAM,eAAe,GAAG,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;AASjG,MAAM,oBAAoB,GAAkB,MAAM,CAAC,MAAM,CAAC;IACzD,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,CAAC;IACP,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,gBAAgB;CAC1B,CAAC,CAAC;AAOH,SAAS,mBAAmB,CAAC,IAAmB,EAAE,KAAoB,EAAW;IAChF,OAAO,CACN,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAChC,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI;YAC1B,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI;YAC7B,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI;gBAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,KAAK,KAAK,CAAC,YAAY,CAAC,GAAG;gBAChD,IAAI,CAAC,YAAY,CAAC,GAAG,KAAK,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CACnD,CAAC;AAAA,CACF;AAED,SAAS,SAAS,CAAC,GAAY,EAAiB;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC5G,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,oCAAoC;QAC/E,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,YAAY,GAAkC,IAAI,CAAC;IACvD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;YAC9E,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAuC,CAAC;QAC/D,IACC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS;YACpD,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAChC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC3B,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAChC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAE3B,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1C,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IACC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QAChC,KAAK,CAAC,IAAe,GAAG,CAAC;QAC1B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,KAAK,CAAC,OAAkB,GAAG,CAAC;QAC7B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpG,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,YAAY;QACZ,IAAI,EAAE,KAAK,CAAC,IAAc;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAiB;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACxB,CAAC,CAAC;AAAA,CACH;AAED,SAAS,cAAc,CAAC,IAGvB,EAA8C;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAAA,CACvE;AAED,SAAS,gBAAgB,CAAC,IAAmC,EAAE,KAAoC,EAAW;IAC7G,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AAAA,CAC3G;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,KAAiB,EAAQ;IACtD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;AAAA,CACpG;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAiB,EAAQ;IAC7D,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpG,IAAI,CAAC;QACJ,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACpB,SAAS,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;YAAS,CAAC;QACV,SAAS,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;AAAA,CACD;AA+DD,SAAS,WAAW,CAAC,OAAqB,EAAE,IAAmB,EAAQ;IACtE,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,MAAM,CAAC;IACvD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClG,IAAI,CAAC;QACJ,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,SAAS,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;YAAS,CAAC;QACV,SAAS,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACJ,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,SAAS,gBAAgB,CAAC,OAAqB,EAAE,KAAa,EAAQ;IACrE,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC;IACxC,6BAA6B,CAAC,GAAG,OAAO,CAAC,IAAI,eAAe,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;AAAA,CACnF;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,OAAqB,EAAE,MAAe,EAAE,MAAsB,EAAiB;IACrG,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAkB;QAC5B,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACvC,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACjF,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,KAAK,CAAC;QAC3F,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,IACC,CAAC,MAAM,CAAC,MAAM,EAAE;YAChB,CAAC,KAAK,CAAC,MAAM,EAAE;YACf,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAC1B,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAChC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU;YAE/B,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,GACX,MAAM;YACN,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;YAClD,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI;YAC7B,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO;YAClC,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YACvE,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;YACtC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC;YAAS,CAAC;QACV,SAAS,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;AAAA,CACD;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAC1B,OAAqB,EACrB,IAAmB,EACnB,KAAa,EACb,MAAkD,EAClD,MAAe,EACC;IAChB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACtG,MAAM,KAAK,GACV,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,IAAI,GAAG;gBACxD,CAAC,CAAC,mBAAmB,CAAE,GAA0B,CAAC,KAAK,CAAC;gBACxD,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,KAAK,EAAE,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBAChG,mEAAmE;gBACnE,uEAAuE;gBACvE,IACC,aAAa,CAAC,GAAG,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC;oBAC5C,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC,OAAO;oBAC9C,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,QAAQ,EACpC,CAAC;oBACF,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;wBACtB,YAAY,EAAE,MAAM;wBACpB,IAAI,EAAE,KAAK,CAAC,UAAU;wBACtB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,QAAQ,EAAE,MAAM,CAAC,IAAI;qBACrB,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,IAAI,KAAK,YAAY,gBAAgB,CAAC;YAAE,MAAM,KAAK,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACvD,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,YAAY,CAAC,KAA2B,EAAsC;IACtF,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAAA,CAC3C;AAED,SAAS,iBAAiB,CAAC,KAAe,EAAY;IACrD,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAAA,CAC5C;AAED,SAAS,wBAAwB,CAAC,KAAa,EAAE,KAAa,EAAQ;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACzE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;AAAA,CACpE;AAED,oDAAoD;AACpD,MAAM,OAAO,cAAc;IACT,OAAO,CAAe;IACtB,QAAQ,CAAS;IACjB,KAAK,CAAiB;IACtB,KAAK,CAAkB;IAChC,QAAQ,CAAgB;IACxB,QAAQ,GAAG,KAAK,CAAC;IACR,GAAG,CAAe;IAClB,iBAAiB,CAAU;IAE5C,YACC,OAAqB,EACrB,KAAsB,EACtB,QAAuB,EACvB,OAAkC,EACjC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;QAC3C,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC;IAAA,CAC7D;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,CAAC,IAAY,EAAE,OAAkC,EAAkB;QAC7E,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAC7F,MAAM,QAAQ,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,KAAsB,CAAC;QAC3B,IAAI,CAAC;YACJ,KAAK,GAAG,0BAA0B,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GACZ,KAAK,YAAY,wBAAwB;gBACxC,CAAC,CAAC,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;gBAChF,CAAC,CAAC,KAAK,CAAC;YACV,IAAI,CAAC;gBACJ,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpB,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACvB,MAAM,IAAI,cAAc,CACvB,CAAC,OAAO,EAAE,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EACzF,4CAA4C,CAC5C,CAAC;YACH,CAAC;YACD,MAAM,OAAO,CAAC;QACf,CAAC;QACD,IAAI,KAAqB,CAAC;QAC1B,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC;gBACJ,KAAK,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACvB,MAAM,IAAI,cAAc,CACvB,CAAC,KAAK,EAAE,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EACvF,qCAAqC,CACrC,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;gBAAS,CAAC;YACV,QAAQ,CAAC,OAAO,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,CAAC;YACJ,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3E,+DAA+D;gBAC/D,sEAAsE;gBACtE,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAC5B,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC;gBACJ,KAAK,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACvB,MAAM,IAAI,cAAc,CACvB,CAAC,KAAK,EAAE,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EACvF,qCAAqC,CACrC,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IAAA,CACb;IAED,6EAA6E;IAC7E,MAAM,CAAC,OAAO,CAAC,IAAY,EAAuB;QACjD,MAAM,OAAO,GAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC5E,OAAO,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAAA,CAClD;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,IAAY,EAA8B;QAC/D,MAAM,OAAO,GAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;YAC7B,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO;YACjC,IAAI,EAAE,SAAS,CAAC,IAAI;SACpB,CAAC,CAAC;IAAA,CACH;IAED,IAAI,IAAI,GAAW;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAAA,CACzB;IAED,IAAI,IAAI,GAAkB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAAA,CAC1B;IAED,IAAI,KAAK,GAAwB;QAChC,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAA,CACnD;IAED,IAAI,UAAU,GAA8B;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IAAA,CACnC;IAED,IAAI,gBAAgB,GAAY;QAC/B,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAAA,CAC7C;IAEO,QAAQ,GAAW;QAC1B,IAAI,CAAC;YACJ,OAAO,GAAG,YAAY,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,WAAW,OAAO,CAAC,GAAG,EAAE,CAAC;QACjC,CAAC;IAAA,CACD;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,MAAiC,EAAQ;QACvD,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,YAAY,CAAC,CAAC;YACxG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;gBACxB,OAAO;YACR,CAAC;YACD,qEAAqE;YACrE,4BAA4B;YAC5B,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YACjC,IAAI,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,GAAG,IAAI,CAAC,CAAC;gBACT,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACvD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/B,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;YACxB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACpD,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAChF,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3F,IAAI,IAAmB,CAAC;YACxB,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3B,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,8CAA8C;gBAC9C,IACC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU;oBACpD,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI;wBAClC,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;oBAEpE,MAAM,IAAI,mBAAmB,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;oBACpB,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC;oBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,GAAG;oBACZ,QAAQ,EAAE,QAAQ;iBAClB,CAAC,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACV,SAAS,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACxC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClG,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBACzF,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,CAAC;gBAAS,CAAC;YACV,QAAQ,CAAC,OAAO,EAAE,CAAC;QACpB,CAAC;IAAA,CACD;IAEO,kBAAkB,GAAS;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;aAC5C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aAC1D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,MAAM,CAAC,MAAM,CAAC;YACb,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAE,aAAuB,CAAC,CAAC,CAAE,WAAqB;SAC7E,CAAC,CACF,CAAC;QACH,IAAI,CAAC,MAAM,CAAC;YACX,EAAE,IAAI,EAAE,0BAA0B,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE;SACnG,CAAC,CAAC;IAAA,CACH;IAED,kFAAkF;IAClF,QAAQ,CAAC,SAAiB,EAAY;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAC1D,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACtE,OAAO,WAAW,CAAC;IAAA,CACnB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,KAA4B,EAA0B;QAC7D,wBAAwB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACjC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC;YACrD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC5D,MAAM,qBAAqB,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,iCAAiC,CAAC,CAAC;QAC1G,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,WAAW;YAC/D,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAChH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAC5D,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEzF,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,qEAAmE;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,wBAAwB,CAAC,KAAK,EAAE;gBAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW;gBACX,MAAM;gBACN,MAAM;aACN,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,WAAW,IAAI,KAAK,CAAC,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YAC5E,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACvF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBAAE,SAAS;YAClD,wBAAwB,CAAC,KAAK,EAAE;gBAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW;gBACX,MAAM;gBACN,MAAM;aACN,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE5G,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,MAAM,KAAK,GAAyB,MAAM,CAAC,MAAM,CAAC;YACjD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACpB,cAAc,EAAE,KAAK;gBACrB,aAAa;gBACb,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,kBAAkB,EAAE,WAAW;gBAC/B,qBAAqB;aACrB,CAAC;YACF,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM;YACN,MAAM;YACN,KAAK,EAAE,UAAU;YACjB,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAAA,CACnE;IAEO,YAAY,CAAC,KAAiB,EAAE,aAAsB,EAAoC;QACjG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACpE,IAAI,aAAa,EAAE,CAAC;YACnB,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACpC,IACC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;gBACzC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,kBAAkB;gBACzE,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;gBAEtC,OAAO,SAAS,CAAC;QACnB,CAAC;aAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACpE,OAAO,KAAK,CAAC;IAAA,CACb;IAED;;;;OAIG;IACH,cAAc,CAAC,KAAiB,EAAE,UAAkB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAW;QAChF,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC;YACX,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE;SACxG,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,4FAA4F;IAC5F,aAAa,CACZ,KAAiB,EACjB,YAA2C,EAC3C,QAA4B,EAC5B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EACN;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC;YACX;gBACC,IAAI,EAAE,gBAAgB;gBACtB,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,MAAM;gBACpB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC;SACD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,oGAAoG;IACpG,gBAAgB,CAAC,KAAiB,EAAE,YAA2C,EAAW;QACzF,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtD,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,YAAY,CAClB,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAC1D,KAAK,CAAC,MAAM,CACZ,CAAC;IAAA,CACF;IAED,mFAAmF;IACnF,MAAM,CAAC,KAAiB,EAAW;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC;YACX;gBACC,IAAI,EAAE,kBAAkB;gBACxB,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,cAAc,EAAE,KAAK;gBACrB,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;aACvD;SACD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,gEAAgE;IAChE,MAAM,CAAC,GAAW,EAAQ;QACzB,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO;QAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAAA,CACvC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,KAAiB,EAAW;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACjH,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,yEAAyE;IACzE,YAAY,CAAC,SAAiB,EAAE,YAAoB,EAAE,GAAW,EAAE,WAAmB,EAAQ;QAC7F,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;QACpE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAC1G,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;QAC7D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACxF,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC;YACX;gBACC,IAAI,EAAE,iBAAiB;gBACvB,SAAS;gBACT,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,YAAY;gBACZ,YAAY,EAAE,GAAG;gBACjB,WAAW,EAAE,GAAG,GAAG,WAAW;aAC9B;SACD,CAAC,CAAC;IAAA,CACH;IAED,0DAA0D;IAC1D,MAAM,CAAC,SAAiB,EAAE,GAAW,EAAmB;QACvD,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,SAAS,CAAC,WAAW,IAAI,GAAG;gBAClC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClD,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACnF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;YAC7C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACrF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAAA,CAC7B;IAED;;;;;;OAMG;IACH,SAAS,CAAC,KAAsB,EAAQ;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;YAAE,OAAO;QAC9C,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QAClC,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,YAAY,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,sBAAsB;oBAC5B,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;oBACxC,cAAc,EAAE,KAAK;iBACrB,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAAA,CACpB;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,GAAW,EAAgC;QAClD,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,YAAY,CAAC,CAAC;YACxG,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YACnC,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAY,CAAC;YACtC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;YACxC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnD,IAAI,SAAS,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBACjC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;oBACvC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBACxC,CAAC;YACF,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAC9F,CAAC;YACF,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YACxG,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAChG,IAAI,OAAO,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;gBACvC,GAAG,KAAK;gBACR,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC1E,UAAU,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;aACxE,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE;gBACrF,IAAI,EAAE,oBAAoB;gBAC1B,uBAAuB,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;gBAC/C,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;gBACtC,KAAK,EAAE,QAAQ;aACf,CAAC,CAAC;YACH,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7F,IAAI,IAAmB,CAAC;YACxB,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3B,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;oBACpB,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC;oBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,MAAM,CAAC,GAAG;oBACnB,QAAQ,EAAE,MAAM,CAAC,IAAI;iBACrB,CAAC,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACV,SAAS,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACV,QAAQ,CAAC,OAAO,EAAE,CAAC;QACpB,CAAC;IAAA,CACD;IAED,gEAAgE;IAChE,OAAO,GAAS;QACf,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAAA,CACrB;CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n\tcloseSync,\n\texistsSync,\n\tconstants as fsConstants,\n\tfstatSync,\n\tfsyncSync,\n\tftruncateSync,\n\tmkdirSync,\n\topenSync,\n\treadFileSync,\n\trenameSync,\n\tunlinkSync,\n\twriteSync,\n} from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport {\n\tcanonicalClaim,\n\tclaimSetsConflict,\n\ttype ResourceClaimInput,\n\tsameClaimSet,\n} from \"../../coordination/resource.ts\";\nimport { type GrantToken, SETTLED_EFFECT_STATES, type Sequence, sequence } from \"../../coordination/types.ts\";\nimport { atomicRewriteFileSync } from \"../atomic-session-file.ts\";\nimport {\n\tacquireDurableFileLockSync,\n\tacquireDurableFileMutationLockSync,\n\ttype DurableFileLock,\n\tDurableFileLockBusyError,\n\tinspectDurableFileLockSync,\n} from \"../durable-file-identity.ts\";\nimport { fsyncDirectorySync, writeExclusiveFileDurablySync } from \"../durable-file-io.ts\";\nimport { canonicalJson } from \"../run-journal.ts\";\nimport { createAuthorityClock } from \"./authority-clock.ts\";\nimport { AuthorityLeaseHeldError, AuthorityStoreError } from \"./authority-errors.ts\";\nimport {\n\ttype AuthorityEvent,\n\ttype AuthorityGrantRecord,\n\ttype AuthorityProjection,\n\tapplyAuthorityEvents,\n\tauthorityPendingReconcile,\n\tparseAuthorityEvent,\n\tsnapshotFromProjection,\n} from \"./authority-events.ts\";\nimport {\n\ttype AuthorityRecord,\n\tGENESIS_PREVIOUS,\n\tmaterializeRecord,\n\ttype ParsedAuthority,\n\tparseCommitted,\n\trecordLine,\n} from \"./authority-journal.ts\";\nimport { assertSameCommandMeaning, authorizationStillOpen, expiryEvents, sameGrantToken } from \"./authority-meaning.ts\";\n\nexport type { AuthorityRecord } from \"./authority-journal.ts\";\n\nimport type { NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { readRunClock } from \"./recovery-clock.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { probeOwnedNamespace } from \"./supervisor-adapter.ts\";\n\n/**\n * Durable authority store (WP03): the single-writer boundary for supervisor\n * authorization state.\n *\n * Storage is a head-sidecar pair — `authority.events.jsonl` plus\n * `authority.events.jsonl.head` — mirroring `ReplayLedgerStore`: the committed\n * head is the transaction boundary, bytes after `head.size` are uncommitted\n * and get quarantined then truncated on the next open, and every append is an\n * expected-head CAS inside the `\"mutation\"` lock critical section. Cross-process\n * exclusion is the `\"authority\"` scope durable-file lease held for the store's\n * lifetime; its owner record (pid+host+token) is the writer identity, and dead\n * owners are reclaimed by the existing reclaim protocol.\n *\n * Authority epoch durability: `open` appends `authority-epoch-advanced` inside\n * the lease critical section — never the in-memory default \"1\" — and leaves the\n * epoch unreconciled. Only `reconcile()` (termination-witness probes per\n * quarantined effect, then `authority-reconciled`) reopens admission. A crash\n * between the epoch event and reconciliation leaves `pendingReconcile` set;\n * the next open adopts that epoch instead of advancing again.\n */\n\nexport { AuthorityLeaseHeldError, AuthorityStoreError } from \"./authority-errors.ts\";\n\nconst AUTHORITY_SCOPE = \"authority\";\n\nexport const authorityStorePath = (root: string): string => join(root, \"authority.events.jsonl\");\n\nexport interface AuthorityHead {\n\treadonly fileIdentity: { readonly dev: string; readonly ino: string } | null;\n\treadonly size: number;\n\treadonly lastSeq: number;\n\treadonly lastHash: string;\n}\n\nconst EMPTY_AUTHORITY_HEAD: AuthorityHead = Object.freeze({\n\tfileIdentity: null,\n\tsize: 0,\n\tlastSeq: 0,\n\tlastHash: GENESIS_PREVIOUS,\n});\n\ninterface CommittedView {\n\treadonly head: AuthorityHead;\n\treadonly parsed: ParsedAuthority;\n}\n\nfunction authorityHeadsEqual(left: AuthorityHead, right: AuthorityHead): boolean {\n\treturn (\n\t\tleft.size === right.size &&\n\t\tleft.lastSeq === right.lastSeq &&\n\t\tleft.lastHash === right.lastHash &&\n\t\t(left.fileIdentity === null\n\t\t\t? right.fileIdentity === null\n\t\t\t: right.fileIdentity !== null &&\n\t\t\t\tleft.fileIdentity.dev === right.fileIdentity.dev &&\n\t\t\t\tleft.fileIdentity.ino === right.fileIdentity.ino)\n\t);\n}\n\nfunction parseHead(raw: unknown): AuthorityHead {\n\tif (typeof raw !== \"object\" || raw === null || Array.isArray(raw)) throw new AuthorityStoreError(\"corrupt\");\n\tconst value = raw as Record<string, unknown>;\n\tif (Object.keys(value).sort().join(\",\") !== \"fileIdentity,lastHash,lastSeq,size\")\n\t\tthrow new AuthorityStoreError(\"corrupt\");\n\tlet fileIdentity: AuthorityHead[\"fileIdentity\"] = null;\n\tif (value.fileIdentity !== null) {\n\t\tif (typeof value.fileIdentity !== \"object\" || Array.isArray(value.fileIdentity))\n\t\t\tthrow new AuthorityStoreError(\"corrupt\");\n\t\tconst identity = value.fileIdentity as Record<string, unknown>;\n\t\tif (\n\t\t\tObject.keys(identity).sort().join(\",\") !== \"dev,ino\" ||\n\t\t\ttypeof identity.dev !== \"string\" ||\n\t\t\t!/^\\d+$/.test(identity.dev) ||\n\t\t\ttypeof identity.ino !== \"string\" ||\n\t\t\t!/^\\d+$/.test(identity.ino)\n\t\t)\n\t\t\tthrow new AuthorityStoreError(\"corrupt\");\n\t\tfileIdentity = Object.freeze({ dev: identity.dev, ino: identity.ino });\n\t}\n\tif (\n\t\t!Number.isSafeInteger(value.size) ||\n\t\t(value.size as number) < 0 ||\n\t\t!Number.isSafeInteger(value.lastSeq) ||\n\t\t(value.lastSeq as number) < 0 ||\n\t\ttypeof value.lastHash !== \"string\" ||\n\t\t(value.lastSeq === 0 ? value.lastHash !== GENESIS_PREVIOUS : !/^[0-9a-f]{64}$/.test(value.lastHash))\n\t)\n\t\tthrow new AuthorityStoreError(\"corrupt\");\n\treturn Object.freeze({\n\t\tfileIdentity,\n\t\tsize: value.size as number,\n\t\tlastSeq: value.lastSeq as number,\n\t\tlastHash: value.lastHash,\n\t});\n}\n\nfunction fileIdentityOf(stat: {\n\tdev: number | bigint;\n\tino: number | bigint;\n}): NonNullable<AuthorityHead[\"fileIdentity\"]> {\n\treturn Object.freeze({ dev: String(stat.dev), ino: String(stat.ino) });\n}\n\nfunction sameFileIdentity(left: AuthorityHead[\"fileIdentity\"], right: AuthorityHead[\"fileIdentity\"]): boolean {\n\treturn left === null ? right === null : right !== null && left.dev === right.dev && left.ino === right.ino;\n}\n\nfunction writeAll(fd: number, bytes: Uint8Array): void {\n\tlet offset = 0;\n\twhile (offset < bytes.byteLength) offset += writeSync(fd, bytes, offset, bytes.byteLength - offset);\n}\n\nfunction appendDurably(path: string, bytes: Uint8Array): void {\n\tconst fd = openSync(path, fsConstants.O_CREAT | fsConstants.O_APPEND | fsConstants.O_WRONLY, 0o600);\n\ttry {\n\t\twriteAll(fd, bytes);\n\t\tfsyncSync(fd);\n\t} finally {\n\t\tcloseSync(fd);\n\t}\n}\n\nexport interface AuthorityStoreHooks {\n\t/** Fires after the events file is fsynced but before the head publishes — the commit crash window. */\n\treadonly afterLedgerFsync?: () => void;\n\t/** Fires before a quarantine artifact is fsynced. */\n\treadonly beforeQuarantineFsync?: () => void;\n\t/** Fires after GC's atomic rewrite lands but before the new head publishes — the GC crash window. */\n\treadonly afterAtomicRewrite?: () => void;\n\t/** Test seam replacing the durable record append. */\n\treadonly persistRecord?: (path: string, bytes: Uint8Array) => void;\n}\n\nexport type AuthorityProbe = (grant: AuthorityGrantRecord) => \"terminated\" | \"alive\" | \"unknown\";\n\nexport interface OpenAuthorityStoreOptions {\n\t/** Total admissible weight of concurrently active grants (broker parity). */\n\treadonly capacity: number;\n\treadonly hooks?: AuthorityStoreHooks;\n\treadonly probe?: AuthorityProbe;\n\t/** Trusted host clock; never supplied by a serialized command. */\n\treadonly clock?: () => number;\n\t/** Disable only the parsing cache; disk integrity and durability checks always run. */\n\treadonly incrementalReplay?: boolean;\n}\n\nexport interface AuthorityAcquireInput {\n\treadonly sessionId: string;\n\treadonly incarnation: Sequence | string;\n\t/** Idempotency key; unique across grants and tombstones (I08/I31). */\n\treadonly commandId: string;\n\treadonly intentDigest: string;\n\treadonly claims: readonly ResourceClaimInput[];\n\treadonly now: number;\n\treadonly ttl: number;\n\treadonly weight?: number;\n}\n\nexport type AuthorityAcquireResult =\n\t| { readonly status: \"granted\"; readonly token: GrantToken; readonly duplicate: boolean }\n\t| { readonly status: \"blocked\" }\n\t| { readonly status: \"result\"; readonly resultDigest: string; readonly token: GrantToken }\n\t| { readonly status: \"result-expired\" };\n\nexport type AuthorityLookup =\n\t| { readonly status: \"pending\"; readonly token: GrantToken }\n\t| { readonly status: \"result\"; readonly resultDigest: string; readonly token: GrantToken }\n\t| { readonly status: \"result-expired\"; readonly token: GrantToken }\n\t| { readonly status: \"unknown\" };\n\n/** Committed projection plus the hashed records it was replayed from. */\nexport interface AuthorityJournalInspection {\n\treadonly state: AuthorityProjection;\n\treadonly records: readonly AuthorityRecord[];\n\treadonly head: AuthorityHead;\n}\n\ninterface StoreContext {\n\treadonly path: string;\n\treadonly headPath: string;\n\treadonly hooks: AuthorityStoreHooks;\n}\n\nfunction publishHead(context: StoreContext, head: AuthorityHead): void {\n\tconst temp = `${context.headPath}.${randomUUID()}.tmp`;\n\tconst fd = openSync(temp, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY, 0o600);\n\ttry {\n\t\twriteAll(fd, Buffer.from(`${JSON.stringify(head)}\\n`, \"utf8\"));\n\t\tfsyncSync(fd);\n\t} finally {\n\t\tcloseSync(fd);\n\t}\n\ttry {\n\t\trenameSync(temp, context.headPath);\n\t\tfsyncDirectorySync(dirname(context.headPath));\n\t} catch (error) {\n\t\tif (existsSync(temp)) unlinkSync(temp);\n\t\tthrow error;\n\t}\n}\n\nfunction quarantineSuffix(context: StoreContext, bytes: Buffer): void {\n\tcontext.hooks.beforeQuarantineFsync?.();\n\twriteExclusiveFileDurablySync(`${context.path}.quarantine-${randomUUID()}`, bytes);\n}\n\n/**\n * Load committed state. With `repair`, an uncommitted suffix is quarantined\n * and truncated; a file whose identity no longer matches its head is accepted\n * only when it begins with exactly the GC snapshot continuation of that head\n * (the GC rename-landed/head-publish-crashed window), otherwise the store is\n * tampered and opens refuse. Without `repair` the suffix is left untouched\n * and simply not part of committed state.\n */\nfunction loadCommitted(context: StoreContext, repair: boolean, cached?: CommittedView): CommittedView {\n\tconst fileExists = existsSync(context.path);\n\tconst headExists = existsSync(context.headPath);\n\tconst empty: CommittedView = {\n\t\thead: EMPTY_AUTHORITY_HEAD,\n\t\tparsed: parseCommitted(Buffer.alloc(0)),\n\t};\n\tif (!fileExists && !headExists) return empty;\n\tif (fileExists && !headExists) {\n\t\tconst fd = openSync(context.path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));\n\t\ttry {\n\t\t\tconst stat = fstatSync(fd);\n\t\t\tif (!stat.isFile() || stat.size !== 0) throw new AuthorityStoreError(\"corrupt\");\n\t\t} finally {\n\t\t\tcloseSync(fd);\n\t\t}\n\t\tif (!repair) return empty;\n\t\tunlinkSync(context.path);\n\t\tfsyncDirectorySync(dirname(context.path));\n\t\treturn empty;\n\t}\n\tif (!fileExists) throw new AuthorityStoreError(\"corrupt\");\n\tlet head: AuthorityHead;\n\ttry {\n\t\thead = parseHead(JSON.parse(readFileSync(context.headPath, \"utf8\")));\n\t} catch (error) {\n\t\tif (error instanceof AuthorityStoreError || error instanceof VerifiedRunError) throw error;\n\t\tthrow new AuthorityStoreError(\"corrupt\");\n\t}\n\tconst fd = openSync(context.path, fsConstants.O_RDWR | (fsConstants.O_NOFOLLOW ?? 0));\n\ttry {\n\t\tconst before = fstatSync(fd);\n\t\tconst bytes = readFileSync(fd);\n\t\tconst after = fstatSync(fd);\n\t\tif (\n\t\t\t!before.isFile() ||\n\t\t\t!after.isFile() ||\n\t\t\tbefore.size !== after.size ||\n\t\t\tbefore.ctimeMs !== after.ctimeMs ||\n\t\t\tafter.size !== bytes.byteLength\n\t\t)\n\t\t\tthrow new AuthorityStoreError(\"tampered\");\n\t\tconst actual = fileIdentityOf(after);\n\t\tif (!sameFileIdentity(head.fileIdentity, actual)) {\n\t\t\thead = healGarbageCollect(context, head, bytes, actual, repair);\n\t\t}\n\t\tif (head.size > after.size) throw new AuthorityStoreError(\"tampered\");\n\t\tconst committed = Buffer.from(bytes.subarray(0, head.size));\n\t\tconst prefix =\n\t\t\tcached &&\n\t\t\tsameFileIdentity(cached.head.fileIdentity, actual) &&\n\t\t\thead.size >= cached.head.size &&\n\t\t\thead.lastSeq >= cached.head.lastSeq\n\t\t\t\t? cached.parsed\n\t\t\t\t: undefined;\n\t\tconst parsed = parseCommitted(committed, prefix);\n\t\tif (parsed.lastSeq !== head.lastSeq || parsed.lastHash !== head.lastHash)\n\t\t\tthrow new AuthorityStoreError(\"tampered\");\n\t\tif (head.size < after.size && repair) {\n\t\t\tquarantineSuffix(context, bytes.subarray(head.size));\n\t\t\tftruncateSync(fd, head.size);\n\t\t\tfsyncSync(fd);\n\t\t\tfsyncDirectorySync(dirname(context.path));\n\t\t}\n\t\treturn { head, parsed };\n\t} finally {\n\t\tcloseSync(fd);\n\t}\n}\n\n/**\n * The only legal file whose identity differs from its head: an atomic GC\n * rewrite that landed but whose head publish never committed. Its first\n * record must be exactly the snapshot continuing `head`; the healed head\n * covers just that record, and any bytes after it are uncommitted suffix.\n */\nfunction healGarbageCollect(\n\tcontext: StoreContext,\n\thead: AuthorityHead,\n\tbytes: Buffer,\n\tactual: NonNullable<AuthorityHead[\"fileIdentity\"]>,\n\trepair: boolean,\n): AuthorityHead {\n\tif (!repair) throw new AuthorityStoreError(\"tampered\");\n\tlet healed: AuthorityHead | null = null;\n\ttry {\n\t\tconst newline = bytes.indexOf(10);\n\t\tif (newline > 0) {\n\t\t\tconst first = bytes.subarray(0, newline + 1);\n\t\t\tconst raw: unknown = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(first).slice(0, -1));\n\t\t\tconst event =\n\t\t\t\ttypeof raw === \"object\" && raw !== null && \"event\" in raw\n\t\t\t\t\t? parseAuthorityEvent((raw as { event: unknown }).event)\n\t\t\t\t\t: null;\n\t\t\tif (event?.kind === \"authority-snapshot\") {\n\t\t\t\tconst record = materializeRecord(event.archivedThroughSequence + 1, event.continuesHash, event);\n\t\t\t\t// Only the snapshot line itself must be proven: any bytes after it\n\t\t\t\t// (including a torn tail) are uncommitted suffix and go to quarantine.\n\t\t\t\tif (\n\t\t\t\t\tcanonicalJson(raw) === canonicalJson(record) &&\n\t\t\t\t\tevent.archivedThroughSequence === head.lastSeq &&\n\t\t\t\t\tevent.continuesHash === head.lastHash\n\t\t\t\t) {\n\t\t\t\t\thealed = Object.freeze({\n\t\t\t\t\t\tfileIdentity: actual,\n\t\t\t\t\t\tsize: first.byteLength,\n\t\t\t\t\t\tlastSeq: record.seq,\n\t\t\t\t\t\tlastHash: record.hash,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t} catch (error) {\n\t\tif (!(error instanceof AuthorityStoreError || error instanceof VerifiedRunError)) throw error;\n\t}\n\tif (!healed) throw new AuthorityStoreError(\"tampered\");\n\tpublishHead(context, healed);\n\treturn healed;\n}\n\nfunction defaultProbe(grant: AuthorityGrantRecord): \"terminated\" | \"alive\" | \"unknown\" {\n\tif (!grant.identity) return \"unknown\";\n\treturn probeOwnedNamespace(grant.identity);\n}\n\nfunction nextSequenceValue(value: Sequence): Sequence {\n\treturn sequence(String(BigInt(value) + 1n));\n}\n\nfunction assertNonNegativeInteger(value: number, label: string): void {\n\tif (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0)\n\t\tthrow new TypeError(`${label} must be a nonnegative safe integer`);\n}\n\n/** The durable single-writer authority boundary. */\nexport class AuthorityStore {\n\tprivate readonly context: StoreContext;\n\tprivate readonly capacity: number;\n\tprivate readonly probe: AuthorityProbe;\n\tprivate readonly lease: DurableFileLock;\n\tprivate accepted: CommittedView;\n\tprivate released = false;\n\tprivate readonly now: () => number;\n\tprivate readonly incrementalReplay: boolean;\n\n\tprivate constructor(\n\t\tcontext: StoreContext,\n\t\tlease: DurableFileLock,\n\t\taccepted: CommittedView,\n\t\toptions: OpenAuthorityStoreOptions,\n\t) {\n\t\tthis.context = context;\n\t\tthis.lease = lease;\n\t\tthis.accepted = accepted;\n\t\tthis.capacity = options.capacity;\n\t\tthis.probe = options.probe ?? defaultProbe;\n\t\tthis.now = createAuthorityClock(options.clock);\n\t\tthis.incrementalReplay = options.incrementalReplay !== false;\n\t}\n\n\t/**\n\t * Take the `\"authority\"` scope lease and advance the persisted epoch.\n\t * When the previous epoch never reconciled, this restart adopts it — the\n\t * pending reconciliation must finish before new admission, and the epoch\n\t * is not bumped again (review §5 fault row).\n\t */\n\tstatic open(path: string, options: OpenAuthorityStoreOptions): AuthorityStore {\n\t\tassertNonNegativeInteger(options.capacity, \"capacity\");\n\t\tmkdirSync(dirname(path), { recursive: true });\n\t\tconst context: StoreContext = { path, headPath: `${path}.head`, hooks: options.hooks ?? {} };\n\t\tconst mutation = acquireDurableFileMutationLockSync(path);\n\t\tlet lease: DurableFileLock;\n\t\ttry {\n\t\t\tlease = acquireDurableFileLockSync(path, AUTHORITY_SCOPE, { timeoutMs: 0 });\n\t\t} catch (error) {\n\t\t\tconst failure =\n\t\t\t\terror instanceof DurableFileLockBusyError\n\t\t\t\t\t? new AuthorityLeaseHeldError(inspectDurableFileLockSync(path, AUTHORITY_SCOPE))\n\t\t\t\t\t: error;\n\t\t\ttry {\n\t\t\t\tmutation.release();\n\t\t\t} catch (cleanupError) {\n\t\t\t\tthrow new AggregateError(\n\t\t\t\t\t[failure, cleanupError instanceof Error ? cleanupError : new Error(String(cleanupError))],\n\t\t\t\t\t\"Authority lease acquisition cleanup failed\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tthrow failure;\n\t\t}\n\t\tlet store: AuthorityStore;\n\t\ttry {\n\t\t\tstore = new AuthorityStore(context, lease, loadCommitted(context, true), options);\n\t\t} catch (error) {\n\t\t\ttry {\n\t\t\t\tlease.release();\n\t\t\t} catch (releaseError) {\n\t\t\t\tthrow new AggregateError(\n\t\t\t\t\t[error, releaseError instanceof Error ? releaseError : new Error(String(releaseError))],\n\t\t\t\t\t\"Authority store open cleanup failed\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tthrow error;\n\t\t} finally {\n\t\t\tmutation.release();\n\t\t}\n\t\ttry {\n\t\t\tif (store.state.epoch === null || !authorityPendingReconcile(store.state)) {\n\t\t\t\t// Fresh store or fully reconciled previous epoch: this restart\n\t\t\t\t// durably advances the epoch. A pending epoch is adopted, not bumped.\n\t\t\t\tstore.commitEpochAdvance();\n\t\t\t}\n\t\t} catch (error) {\n\t\t\ttry {\n\t\t\t\tstore.release();\n\t\t\t} catch (releaseError) {\n\t\t\t\tthrow new AggregateError(\n\t\t\t\t\t[error, releaseError instanceof Error ? releaseError : new Error(String(releaseError))],\n\t\t\t\t\t\"Authority store open cleanup failed\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t\treturn store;\n\t}\n\n\t/** Read-only committed projection; performs no repair and writes nothing. */\n\tstatic inspect(path: string): AuthorityProjection {\n\t\tconst context: StoreContext = { path, headPath: `${path}.head`, hooks: {} };\n\t\treturn loadCommitted(context, false).parsed.state;\n\t}\n\n\t/**\n\t * Read-only committed journal: projection plus the hashed records it was\n\t * replayed from, so callers can see transition causes (cancel-requested vs\n\t * authorization-expired vs epoch restart) and termination witnesses — the\n\t * projection alone intentionally does not restate them.\n\t */\n\tstatic inspectJournal(path: string): AuthorityJournalInspection {\n\t\tconst context: StoreContext = { path, headPath: `${path}.head`, hooks: {} };\n\t\tconst committed = loadCommitted(context, false);\n\t\treturn Object.freeze({\n\t\t\tstate: committed.parsed.state,\n\t\t\trecords: committed.parsed.records,\n\t\t\thead: committed.head,\n\t\t});\n\t}\n\n\tget path(): string {\n\t\treturn this.context.path;\n\t}\n\n\tget head(): AuthorityHead {\n\t\treturn this.accepted.head;\n\t}\n\n\tget state(): AuthorityProjection {\n\t\treturn structuredClone(this.accepted.parsed.state);\n\t}\n\n\tget lastReplay(): ParsedAuthority[\"replay\"] {\n\t\treturn this.accepted.parsed.replay;\n\t}\n\n\tget pendingReconcile(): boolean {\n\t\treturn authorityPendingReconcile(this.state);\n\t}\n\n\tprivate writerId(): string {\n\t\ttry {\n\t\t\treturn `${readRunClock().bootId}:${process.pid}`;\n\t\t} catch {\n\t\t\treturn `unknown:${process.pid}`;\n\t\t}\n\t}\n\n\t/**\n\t * Commit events as one transaction: mutation lock → committed-head CAS →\n\t * reducer pre-validation → append+fsync → head publish → re-read\n\t * verification. The head CAS is the fencing boundary — a store whose lease\n\t * was reclaimed and taken by another writer sees a changed head and fails\n\t * closed instead of authorizing. Persist failures never mint in-memory\n\t * state (docs/04: no memory-only authorization after storage failure).\n\t */\n\tprivate commit(events: readonly AuthorityEvent[]): void {\n\t\tif (this.released) throw new AuthorityStoreError(\"stale_owner\");\n\t\tconst mutation = acquireDurableFileMutationLockSync(this.context.path);\n\t\ttry {\n\t\t\tconst current = loadCommitted(this.context, true, this.incrementalReplay ? this.accepted : undefined);\n\t\t\tif (!authorityHeadsEqual(current.head, this.accepted.head)) throw new AuthorityStoreError(\"stale_head\");\n\t\t\tif (events.length === 0) {\n\t\t\t\tthis.accepted = current;\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// Every event must be accepted by the deterministic reducer before a\n\t\t\t// single byte reaches disk.\n\t\t\tapplyAuthorityEvents(current.parsed.state, events);\n\t\t\tconst lines: string[] = [];\n\t\t\tlet seq = current.parsed.lastSeq;\n\t\t\tlet previous = current.parsed.lastHash;\n\t\t\tfor (const event of events) {\n\t\t\t\tseq += 1;\n\t\t\t\tconst record = materializeRecord(seq, previous, event);\n\t\t\t\tlines.push(recordLine(record));\n\t\t\t\tprevious = record.hash;\n\t\t\t}\n\t\t\tconst payload = Buffer.from(lines.join(\"\"), \"utf8\");\n\t\t\t(this.context.hooks.persistRecord ?? appendDurably)(this.context.path, payload);\n\t\t\tconst fd = openSync(this.context.path, fsConstants.O_RDWR | (fsConstants.O_NOFOLLOW ?? 0));\n\t\t\tlet head: AuthorityHead;\n\t\t\ttry {\n\t\t\t\tconst stat = fstatSync(fd);\n\t\t\t\t// CAS on the file itself: for an established store the inode must be\n\t\t\t\t// the one the committed head names; for genesis the append must have\n\t\t\t\t// produced exactly the expected size. Anything else is a replaced or\n\t\t\t\t// foreign file and commits must not bless it.\n\t\t\t\tif (\n\t\t\t\t\tstat.size !== current.head.size + payload.byteLength ||\n\t\t\t\t\t(current.head.fileIdentity !== null &&\n\t\t\t\t\t\t!sameFileIdentity(current.head.fileIdentity, fileIdentityOf(stat)))\n\t\t\t\t)\n\t\t\t\t\tthrow new AuthorityStoreError(\"stale_head\");\n\t\t\t\thead = Object.freeze({\n\t\t\t\t\tfileIdentity: fileIdentityOf(stat),\n\t\t\t\t\tsize: stat.size,\n\t\t\t\t\tlastSeq: seq,\n\t\t\t\t\tlastHash: previous,\n\t\t\t\t});\n\t\t\t} finally {\n\t\t\t\tcloseSync(fd);\n\t\t\t}\n\t\t\tthis.context.hooks.afterLedgerFsync?.();\n\t\t\tpublishHead(this.context, head);\n\t\t\tconst verified = loadCommitted(this.context, false, this.incrementalReplay ? current : undefined);\n\t\t\tif (verified.parsed.lastSeq !== head.lastSeq || verified.parsed.lastHash !== head.lastHash)\n\t\t\t\tthrow new AuthorityStoreError(\"corrupt\");\n\t\t\tthis.accepted = verified;\n\t\t} finally {\n\t\t\tmutation.release();\n\t\t}\n\t}\n\n\tprivate commitEpochAdvance(): void {\n\t\tconst state = this.state;\n\t\tconst epoch = nextSequenceValue(state.epoch ?? sequence(\"0\"));\n\t\tconst transitions = [...state.grants.values()]\n\t\t\t.filter((grant) => !SETTLED_EFFECT_STATES.has(grant.state))\n\t\t\t.map((grant) =>\n\t\t\t\tObject.freeze({\n\t\t\t\t\tgrantSequence: grant.token.grantSequence,\n\t\t\t\t\toutcome: grant.effectLive ? (\"quarantined\" as const) : (\"cancelled\" as const),\n\t\t\t\t}),\n\t\t\t);\n\t\tthis.commit([\n\t\t\t{ kind: \"authority-epoch-advanced\", authorityEpoch: epoch, writerId: this.writerId(), transitions },\n\t\t]);\n\t}\n\n\t/** Announce a session incarnation (S2); the counter survives restarts durably. */\n\tregister(sessionId: string): Sequence {\n\t\tif (typeof sessionId !== \"string\" || sessionId.length === 0)\n\t\t\tthrow new TypeError(\"sessionId must be a non-empty string\");\n\t\tconst current = this.state.incarnations.get(sessionId) ?? sequence(\"0\");\n\t\tconst incarnation = nextSequenceValue(current);\n\t\tthis.commit([{ kind: \"session-registered\", sessionId, incarnation }]);\n\t\treturn incarnation;\n\t}\n\n\t/**\n\t * Admit an authorization: claim-overlap check, capacity check, idempotency\n\t * replay, and the `grant-reserved` record in one lease/mutation-locked\n\t * critical section — the check and the record are one transaction (docs/04).\n\t * The lease is held for the store's lifetime, so committed state cannot\n\t * move between the check and the append; the head CAS in commit() is the\n\t * backstop if it ever could.\n\t */\n\tacquire(input: AuthorityAcquireInput): AuthorityAcquireResult {\n\t\tassertNonNegativeInteger(input.now, \"now\");\n\t\tconst weight = input.weight ?? 1;\n\t\tassertNonNegativeInteger(weight, \"weight\");\n\t\tif (!Number.isSafeInteger(input.ttl) || input.ttl <= 0)\n\t\t\tthrow new TypeError(\"ttl must be a positive safe integer\");\n\t\tconst authorizationDeadline = input.now + input.ttl;\n\t\tif (!Number.isSafeInteger(authorizationDeadline)) throw new RangeError(\"authorization deadline overflow\");\n\t\tconst incarnation = sequence(input.incarnation);\n\t\tif (this.state.incarnations.get(input.sessionId) !== incarnation)\n\t\t\tthrow new AuthorityStoreError(\"stale_incarnation\");\n\t\tif (!/^[a-f0-9]{64}$/.test(input.intentDigest)) throw new TypeError(\"intentDigest must be a sha256 hex digest\");\n\t\tif (!Array.isArray(input.claims) || input.claims.length === 0)\n\t\t\tthrow new TypeError(\"an unknown scope must not be admitted as an empty scope\");\n\t\tconst claims = Object.freeze(Array.from(input.claims, (claim) => canonicalClaim(claim)));\n\n\t\t// Idempotency (I08): replayed commands return their recorded disposition\n\t\t// without re-executing. A live tombstone returns the result; an expired\n\t\t// one reports expiry; an in-flight grant is a duplicate only when the\n\t\t// full intent matches — otherwise it is an ID collision (I09/I20).\n\t\tconst tombstone = this.state.tombstones.get(input.commandId);\n\t\tif (tombstone) {\n\t\t\tconst grant = this.state.grants.get(tombstone.grantSequence);\n\t\t\tif (!grant) throw new AuthorityStoreError(\"corrupt\");\n\t\t\tassertSameCommandMeaning(grant, {\n\t\t\t\tintentDigest: input.intentDigest,\n\t\t\t\tsessionId: input.sessionId,\n\t\t\t\tincarnation,\n\t\t\t\tclaims,\n\t\t\t\tweight,\n\t\t\t});\n\t\t\tif (tombstone.expiresAtMs <= input.now) return { status: \"result-expired\" };\n\t\t\treturn { status: \"result\", resultDigest: tombstone.resultDigest, token: grant.token };\n\t\t}\n\t\tfor (const grant of this.state.grants.values()) {\n\t\t\tif (grant.commandId !== input.commandId) continue;\n\t\t\tassertSameCommandMeaning(grant, {\n\t\t\t\tintentDigest: input.intentDigest,\n\t\t\t\tsessionId: input.sessionId,\n\t\t\t\tincarnation,\n\t\t\t\tclaims,\n\t\t\t\tweight,\n\t\t\t});\n\t\t\treturn { status: \"granted\", token: grant.token, duplicate: true };\n\t\t}\n\n\t\tif (this.pendingReconcile) throw new AuthorityStoreError(\"reconcile_pending\");\n\t\tconst epoch = this.state.epoch;\n\t\tif (epoch === null) throw new AuthorityStoreError(\"corrupt\");\n\n\t\tconst expired = expiryEvents(this.state, input.now, epoch);\n\t\tconst settledState = expired.length ? applyAuthorityEvents(this.state, expired) : this.state;\n\t\tconst active = [...settledState.grants.values()].filter((grant) => !SETTLED_EFFECT_STATES.has(grant.state));\n\t\tconst used = active.reduce((sum, grant) => sum + grant.weight, 0);\n\t\tif (weight > this.capacity - used) return { status: \"blocked\" };\n\t\tif (active.some((grant) => claimSetsConflict([...claims], [...grant.claims]))) return { status: \"blocked\" };\n\n\t\tconst grantSequence = nextSequenceValue(this.state.grantCounter);\n\t\tconst grant: AuthorityGrantRecord = Object.freeze({\n\t\t\ttoken: Object.freeze({\n\t\t\t\tauthorityEpoch: epoch,\n\t\t\t\tgrantSequence,\n\t\t\t\tsessionId: input.sessionId,\n\t\t\t\tsessionIncarnation: incarnation,\n\t\t\t\tauthorizationDeadline,\n\t\t\t}),\n\t\t\tcommandId: input.commandId,\n\t\t\tintentDigest: input.intentDigest,\n\t\t\tclaims,\n\t\t\tweight,\n\t\t\tstate: \"reserved\",\n\t\t\teffectLive: false,\n\t\t\tdispatchId: null,\n\t\t\tactualClaims: null,\n\t\t\tidentity: null,\n\t\t});\n\t\tthis.commit([...expired, { kind: \"grant-reserved\", grant }]);\n\t\treturn { status: \"granted\", token: grant.token, duplicate: false };\n\t}\n\n\tprivate resolveToken(token: GrantToken, authoritative: boolean): AuthorityGrantRecord | undefined {\n\t\tconst grant = this.state.grants.get(token.grantSequence);\n\t\tif (!grant || !sameGrantToken(grant.token, token)) return undefined;\n\t\tif (authoritative) {\n\t\t\tif (this.released) return undefined;\n\t\t\tif (\n\t\t\t\ttoken.authorityEpoch !== this.state.epoch ||\n\t\t\t\tthis.state.incarnations.get(token.sessionId) !== token.sessionIncarnation ||\n\t\t\t\tSETTLED_EFFECT_STATES.has(grant.state)\n\t\t\t)\n\t\t\t\treturn undefined;\n\t\t} else if (SETTLED_EFFECT_STATES.has(grant.state)) return undefined;\n\t\treturn grant;\n\t}\n\n\t/**\n\t * Persisted dispatch intent. A committed intent whose spawn was never\n\t * witnessed cannot be assumed un-run; on restart it quarantines like any\n\t * other possibly-live effect (I01/I02).\n\t */\n\tdispatchIntent(token: GrantToken, dispatchId: string, now = this.now()): boolean {\n\t\tif (!/^[A-Za-z0-9_-]{1,128}$/.test(dispatchId)) throw new TypeError(\"dispatchId is invalid\");\n\t\tconst grant = this.resolveToken(token, true);\n\t\tif (!grant || grant.state !== \"reserved\") return false;\n\t\tconst epoch = this.state.epoch;\n\t\tif (epoch === null) return false;\n\t\tif (!authorizationStillOpen(now, grant.token.authorizationDeadline)) {\n\t\t\tthis.expire(now);\n\t\t\treturn false;\n\t\t}\n\t\tthis.commit([\n\t\t\t{ kind: \"dispatch-intent\", grantSequence: grant.token.grantSequence, authorityEpoch: epoch, dispatchId },\n\t\t]);\n\t\treturn true;\n\t}\n\n\t/** Bind an effect to its reservation; actual claims must equal the reserved set exactly. */\n\teffectStarted(\n\t\ttoken: GrantToken,\n\t\tactualClaims: readonly ResourceClaimInput[],\n\t\tidentity?: NamespaceIdentity,\n\t\tnow = this.now(),\n\t): boolean {\n\t\tconst grant = this.resolveToken(token, true);\n\t\tif (!grant || (grant.state !== \"reserved\" && grant.state !== \"starting\")) return false;\n\t\tif (!authorizationStillOpen(now, grant.token.authorizationDeadline)) {\n\t\t\tthis.expire(now);\n\t\t\treturn false;\n\t\t}\n\t\tif (!Array.isArray(actualClaims)) throw new TypeError(\"actualClaims must be an array\");\n\t\tconst claims = Object.freeze(Array.from(actualClaims, (entry) => canonicalClaim(entry)));\n\t\tif (!sameClaimSet([...claims], [...grant.claims])) return false;\n\t\tconst epoch = this.state.epoch;\n\t\tif (epoch === null) return false;\n\t\tthis.commit([\n\t\t\t{\n\t\t\t\tkind: \"effect-started\",\n\t\t\t\tgrantSequence: grant.token.grantSequence,\n\t\t\t\tauthorityEpoch: epoch,\n\t\t\t\tactualClaims: claims,\n\t\t\t\t...(identity ? { identity } : {}),\n\t\t\t},\n\t\t]);\n\t\treturn true;\n\t}\n\n\t/** Revalidate a running effect before its next irreversible boundary, without starting it again. */\n\teffectAuthorized(token: GrantToken, actualClaims: readonly ResourceClaimInput[]): boolean {\n\t\tif (this.released) return false;\n\t\tthis.commit([]);\n\t\tconst now = this.now();\n\t\tconst grant = this.resolveToken(token, true);\n\t\tif (!grant || grant.state !== \"running\") return false;\n\t\tif (!authorizationStillOpen(now, token.authorizationDeadline)) {\n\t\t\tthis.expire(now);\n\t\t\treturn false;\n\t\t}\n\t\treturn sameClaimSet(\n\t\t\tArray.from(actualClaims, (claim) => canonicalClaim(claim)),\n\t\t\tgrant.claims,\n\t\t);\n\t}\n\n\t/** Requested cancellation is not observed termination; live effects quarantine. */\n\tcancel(token: GrantToken): boolean {\n\t\tconst grant = this.resolveToken(token, false);\n\t\tif (!grant) return false;\n\t\tconst epoch = this.state.epoch;\n\t\tif (epoch === null) return false;\n\t\tthis.commit([\n\t\t\t{\n\t\t\t\tkind: \"cancel-requested\",\n\t\t\t\tgrantSequence: grant.token.grantSequence,\n\t\t\t\tauthorityEpoch: epoch,\n\t\t\t\toutcome: grant.effectLive ? \"quarantined\" : \"cancelled\",\n\t\t\t},\n\t\t]);\n\t\treturn true;\n\t}\n\n\t/** Settle lapsed authorizations; never evicts a live effect. */\n\texpire(now: number): void {\n\t\tassertNonNegativeInteger(now, \"now\");\n\t\tconst epoch = this.state.epoch;\n\t\tif (epoch === null) return;\n\t\tconst events = expiryEvents(this.state, now, epoch);\n\t\tif (events.length) this.commit(events);\n\t}\n\n\t/**\n\t * Trusted supervisor witness: this exact effect is gone. Accepted across\n\t * superseded epochs so a restarted authority can settle what the previous\n\t * one started, never to authorize new work.\n\t */\n\tconfirmTerminated(token: GrantToken): boolean {\n\t\tconst grant = this.resolveToken(token, false);\n\t\tif (!grant) return false;\n\t\tconst epoch = this.state.epoch;\n\t\tif (epoch === null) return false;\n\t\tthis.commit([{ kind: \"termination-observed\", grantSequence: grant.token.grantSequence, authorityEpoch: epoch }]);\n\t\treturn true;\n\t}\n\n\t/** Retain the final result as an idempotency tombstone (S3, docs/04). */\n\tretainResult(commandId: string, resultDigest: string, now: number, retentionMs: number): void {\n\t\tassertNonNegativeInteger(now, \"now\");\n\t\tif (!Number.isSafeInteger(retentionMs) || retentionMs <= 0)\n\t\t\tthrow new TypeError(\"retentionMs must be a positive safe integer\");\n\t\tif (!/^[a-f0-9]{64}$/.test(resultDigest)) throw new TypeError(\"resultDigest must be a sha256 hex digest\");\n\t\tconst grant = [...this.state.grants.values()].find((entry) => entry.commandId === commandId);\n\t\tif (!grant) throw new AuthorityStoreError(\"unknown_command\");\n\t\tif (!SETTLED_EFFECT_STATES.has(grant.state)) throw new AuthorityStoreError(\"unsettled\");\n\t\tif (this.state.tombstones.has(commandId)) throw new AuthorityStoreError(\"duplicate\");\n\t\tthis.commit([\n\t\t\t{\n\t\t\t\tkind: \"result-retained\",\n\t\t\t\tcommandId,\n\t\t\t\tgrantSequence: grant.token.grantSequence,\n\t\t\t\tresultDigest,\n\t\t\t\tretainedAtMs: now,\n\t\t\t\texpiresAtMs: now + retentionMs,\n\t\t\t},\n\t\t]);\n\t}\n\n\t/** Command disposition without re-execution (I08/I31). */\n\tlookup(commandId: string, now: number): AuthorityLookup {\n\t\tassertNonNegativeInteger(now, \"now\");\n\t\tconst tombstone = this.state.tombstones.get(commandId);\n\t\tif (tombstone) {\n\t\t\tconst grant = this.state.grants.get(tombstone.grantSequence);\n\t\t\tif (!grant) throw new AuthorityStoreError(\"corrupt\");\n\t\t\treturn tombstone.expiresAtMs <= now\n\t\t\t\t? { status: \"result-expired\", token: grant.token }\n\t\t\t\t: { status: \"result\", resultDigest: tombstone.resultDigest, token: grant.token };\n\t\t}\n\t\tfor (const grant of this.state.grants.values())\n\t\t\tif (grant.commandId === commandId) return { status: \"pending\", token: grant.token };\n\t\treturn { status: \"unknown\" };\n\t}\n\n\t/**\n\t * Finish the restart reconciliation: every quarantined effect is compared\n\t * against the real execution boundary — only an observed termination\n\t * settles it (\"gone\"); \"alive\"/\"unknown\" stay quarantined and keep their\n\t * claims (docs/04, review §6). Ends with `authority-reconciled` for the\n\t * current epoch; the reconciled scope only then admits new work.\n\t */\n\treconcile(probe?: AuthorityProbe): void {\n\t\tconst state = this.state;\n\t\tconst epoch = state.epoch;\n\t\tif (epoch === null) throw new AuthorityStoreError(\"corrupt\");\n\t\tif (!authorityPendingReconcile(state)) return;\n\t\tconst check = probe ?? this.probe;\n\t\tconst events: AuthorityEvent[] = [];\n\t\tfor (const grant of state.grants.values()) {\n\t\t\tif (grant.state !== \"quarantined\") continue;\n\t\t\tif (check(grant) === \"terminated\") {\n\t\t\t\tevents.push({\n\t\t\t\t\tkind: \"termination-observed\",\n\t\t\t\t\tgrantSequence: grant.token.grantSequence,\n\t\t\t\t\tauthorityEpoch: epoch,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tevents.push({ kind: \"authority-reconciled\", authorityEpoch: epoch });\n\t\tthis.commit(events);\n\t}\n\n\t/**\n\t * GC (review §7): fold droppable state into an `authority-snapshot` and\n\t * atomically rewrite the log to that snapshot. Retained: the epoch pair,\n\t * incarnation counters, the grant counter (I31 — sequences never reissue),\n\t * every unsettled grant, every settled grant still referenced by an\n\t * unexpired tombstone, and the unexpired tombstones themselves. A crash\n\t * between the atomic rewrite and head publish self-heals on next open via\n\t * the snapshot continuation check.\n\t */\n\tcompact(now: number): { readonly dropped: number } {\n\t\tassertNonNegativeInteger(now, \"now\");\n\t\tif (this.released) throw new AuthorityStoreError(\"stale_owner\");\n\t\tconst mutation = acquireDurableFileMutationLockSync(this.context.path);\n\t\ttry {\n\t\t\tconst current = loadCommitted(this.context, true);\n\t\t\tif (!authorityHeadsEqual(current.head, this.accepted.head)) throw new AuthorityStoreError(\"stale_head\");\n\t\t\tconst state = current.parsed.state;\n\t\t\tif (state.epoch === null) return { dropped: 0 };\n\t\t\tconst keepGrant = new Set<Sequence>();\n\t\t\tconst keepTombstone = new Set<string>();\n\t\t\tfor (const tombstone of state.tombstones.values()) {\n\t\t\t\tif (tombstone.expiresAtMs > now) {\n\t\t\t\t\tkeepTombstone.add(tombstone.commandId);\n\t\t\t\t\tkeepGrant.add(tombstone.grantSequence);\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst grants = [...state.grants.values()].filter(\n\t\t\t\t(grant) => !SETTLED_EFFECT_STATES.has(grant.state) || keepGrant.has(grant.token.grantSequence),\n\t\t\t);\n\t\t\tconst tombstones = [...state.tombstones.values()].filter((stone) => keepTombstone.has(stone.commandId));\n\t\t\tconst dropped = state.grants.size - grants.length + (state.tombstones.size - tombstones.length);\n\t\t\tif (dropped === 0) return { dropped: 0 };\n\t\t\tconst snapshot = snapshotFromProjection({\n\t\t\t\t...state,\n\t\t\t\tgrants: new Map(grants.map((grant) => [grant.token.grantSequence, grant])),\n\t\t\t\ttombstones: new Map(tombstones.map((stone) => [stone.commandId, stone])),\n\t\t\t});\n\t\t\tconst record = materializeRecord(current.parsed.lastSeq + 1, current.parsed.lastHash, {\n\t\t\t\tkind: \"authority-snapshot\",\n\t\t\t\tarchivedThroughSequence: current.parsed.lastSeq,\n\t\t\t\tcontinuesHash: current.parsed.lastHash,\n\t\t\t\tstate: snapshot,\n\t\t\t});\n\t\t\tatomicRewriteFileSync(this.context.path, recordLine(record));\n\t\t\tthis.context.hooks.afterAtomicRewrite?.();\n\t\t\tconst fd = openSync(this.context.path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));\n\t\t\tlet head: AuthorityHead;\n\t\t\ttry {\n\t\t\t\tconst stat = fstatSync(fd);\n\t\t\t\thead = Object.freeze({\n\t\t\t\t\tfileIdentity: fileIdentityOf(stat),\n\t\t\t\t\tsize: stat.size,\n\t\t\t\t\tlastSeq: record.seq,\n\t\t\t\t\tlastHash: record.hash,\n\t\t\t\t});\n\t\t\t} finally {\n\t\t\t\tcloseSync(fd);\n\t\t\t}\n\t\t\tpublishHead(this.context, head);\n\t\t\tthis.accepted = loadCommitted(this.context, false);\n\t\t\treturn { dropped };\n\t\t} finally {\n\t\t\tmutation.release();\n\t\t}\n\t}\n\n\t/** Release the authority lease; further commits fail closed. */\n\trelease(): void {\n\t\tif (this.released) return;\n\t\tthis.released = true;\n\t\tthis.lease.release();\n\t}\n}\n"]}

package/dist/core/verified-run/broker.d.ts

@@ -9,6 +9,8 @@ export interface SandboxExecution {
     readonly maxOutputBytes: number;
     readonly signal?: AbortSignal;
     readonly onReady?: (identity: NamespaceIdentity) => void | Promise<void>;
+    /** Trusted built-in publisher only: readonly worktree, writable .git, readonly current Node executable. */
+    readonly gitPublication?: true;
 }
 export interface SandboxOutcome {
     readonly stdout: Buffer;
@@ -21,6 +23,11 @@ export interface SandboxOutcome {
 }
 export declare function commandEnvironmentDigest(contract: RunContract, driver?: "legacy" | "gated-v1"): string;
 export declare function probeVerifiedSandbox(): void;
-/** The only process dispatch port; close means the PID namespace and its inherited pipes have drained. */
+/**
+ * The only process dispatch port. Resolution requires two witnesses: the
+ * child's `close` (namespace init exited, inherited pipes drained) followed
+ * by an empty-member scan of the recorded PID namespace. A platform without
+ * the supervised namespace backend is refused, never degraded to best effort.
+ */
 export declare function executeSandbox(request: SandboxExecution): Promise<SandboxOutcome>;
 //# sourceMappingURL=broker.d.ts.map

package/dist/core/verified-run/broker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/broker.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAsCjE,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE;AACD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAE,QAAQ,GAAG,UAAqB,GAAG,MAAM,CA0ChH;AAED,wBAAgB,oBAAoB,IAAI,IAAI,CAS3C;AAED,0GAA0G;AAC1G,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CA8GvF","sourcesContent":["import { spawn, spawnSync } from \"node:child_process\";\nimport { existsSync, readFileSync, realpathSync } from \"node:fs\";\nimport { release } from \"node:os\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunContract } from \"omk-protocol\";\nimport type { NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { identityFromSandboxInfo, PROCESS_GATE_ARGV } from \"./process-gate.ts\";\nimport { digestBytes, digestObject, VerifiedRunError } from \"./storage.ts\";\n\nconst BWRAP = \"/usr/bin/bwrap\";\nconst SYSTEM_ARGS = [\n\t\"--unshare-all\",\n\t\"--die-with-parent\",\n\t\"--new-session\",\n\t\"--cap-drop\",\n\t\"ALL\",\n\t\"--clearenv\",\n\t\"--ro-bind\",\n\t\"/usr\",\n\t\"/usr\",\n\t\"--symlink\",\n\t\"usr/bin\",\n\t\"/bin\",\n\t\"--symlink\",\n\t\"usr/lib\",\n\t\"/lib\",\n\t\"--symlink\",\n\t\"usr/lib64\",\n\t\"/lib64\",\n\t\"--proc\",\n\t\"/proc\",\n\t\"--dev\",\n\t\"/dev\",\n\t\"--tmpfs\",\n\t\"/tmp\",\n\t\"--setenv\",\n\t\"PATH\",\n\t\"/usr/bin:/bin\",\n\t\"--setenv\",\n\t\"LANG\",\n\t\"C.UTF-8\",\n] as const;\n\nexport interface SandboxExecution {\n\treadonly workspace: string;\n\treadonly argv: readonly string[];\n\treadonly writable: boolean;\n\treadonly timeoutMs: number;\n\treadonly cleanupMs: number;\n\treadonly maxOutputBytes: number;\n\treadonly signal?: AbortSignal;\n\treadonly onReady?: (identity: NamespaceIdentity) => void | Promise<void>;\n}\nexport interface SandboxOutcome {\n\treadonly stdout: Buffer;\n\treadonly stderr: Buffer;\n\treadonly exitCode: number | null;\n\treadonly failure: string | null;\n\treadonly startedAt: string;\n\treadonly finishedAt: string;\n\treadonly durationMs: number;\n}\n\nexport function commandEnvironmentDigest(contract: RunContract, driver: \"legacy\" | \"gated-v1\" = \"legacy\"): string {\n\tif (process.platform !== \"linux\" || !existsSync(BWRAP)) throw new VerifiedRunError(\"unsupported\");\n\tlet writers: readonly (readonly string[])[];\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-v1\":\n\t\t\twriters = [contract.writer];\n\t\t\tbreak;\n\t\tcase \"linux-scripted-agent-v1\":\n\t\t\twriters = contract.writer.steps;\n\t\t\tbreak;\n\t\tcase \"linux-command-dag-v1\":\n\t\t\twriters = contract.writer.tasks.flatMap((task) => task.attempts);\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tconst binaries = [\n\t\t...new Set([\n\t\t\tBWRAP,\n\t\t\t...writers.map((argv) => argv[0]),\n\t\t\t...contract.checks.map((check) => check.argv[0]),\n\t\t\t...(driver === \"gated-v1\" ? [PROCESS_GATE_ARGV[0]] : []),\n\t\t]),\n\t];\n\tconst materials = binaries.map((binary) => {\n\t\tif (!binary || (!binary.startsWith(\"/usr/bin/\") && !binary.startsWith(\"/bin/\")))\n\t\t\tthrow new VerifiedRunError(\"unsupported_executable\");\n\t\tconst path = realpathSync(binary);\n\t\tif (!path.startsWith(\"/usr/\")) throw new VerifiedRunError(\"unsupported_executable\");\n\t\treturn { path, digest: digestBytes(readFileSync(path)) };\n\t});\n\treturn digestObject({\n\t\tprofile: contract.profile,\n\t\tplatform: process.platform,\n\t\tarchitecture: process.arch,\n\t\tkernel: release(),\n\t\tsandbox: SYSTEM_ARGS,\n\t\t...(driver === \"gated-v1\" ? { gate: PROCESS_GATE_ARGV, infoFd: 3 } : {}),\n\t\tbinaries: materials,\n\t});\n}\n\nexport function probeVerifiedSandbox(): void {\n\tif (process.platform !== \"linux\" || !existsSync(BWRAP)) throw new VerifiedRunError(\"unsupported\");\n\tconst probe = spawnSync(BWRAP, [...SYSTEM_ARGS, \"--\", \"/bin/true\"], {\n\t\tenv: {},\n\t\ttimeout: 3000,\n\t\tmaxBuffer: 4096,\n\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t});\n\tif (probe.error || probe.status !== 0) throw new VerifiedRunError(\"unsupported\");\n}\n\n/** The only process dispatch port; close means the PID namespace and its inherited pipes have drained. */\nexport async function executeSandbox(request: SandboxExecution): Promise<SandboxOutcome> {\n\tif (request.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tif (request.timeoutMs <= 0) throw new VerifiedRunError(\"deadline\");\n\tconst started = performance.now();\n\tconst startedAt = new Date().toISOString();\n\tconst argv = [\n\t\t...SYSTEM_ARGS,\n\t\trequest.writable ? \"--bind\" : \"--ro-bind\",\n\t\trequest.workspace,\n\t\t\"/workspace\",\n\t\t\"--chdir\",\n\t\t\"/workspace\",\n\t\t...(request.onReady ? [\"--info-fd\", \"3\", \"--\", ...PROCESS_GATE_ARGV] : [\"--\"]),\n\t\t...request.argv,\n\t];\n\treturn new Promise((resolve, reject) => {\n\t\tconst child = request.onReady\n\t\t\t? spawn(BWRAP, argv, { env: {}, stdio: [\"pipe\", \"pipe\", \"pipe\", \"pipe\"] })\n\t\t\t: spawn(BWRAP, argv, { env: {}, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n\t\tlet gateFailed = false;\n\t\tlet gateError: unknown;\n\t\tconst stdout: Buffer[] = [];\n\t\tconst stderr: Buffer[] = [];\n\t\tlet size = 0;\n\t\tlet failure: string | null = null;\n\t\tlet cleanup: ReturnType<typeof setTimeout> | undefined;\n\t\tlet finished = false;\n\t\tconst stop = (reason: string): void => {\n\t\t\tif (finished || failure) return;\n\t\t\tfailure = reason;\n\t\t\tchild.kill(\"SIGKILL\");\n\t\t\t// When the gate already failed, surface its real cause rather than a\n\t\t\t// generic unsettled — the close handler may still arrive first, and\n\t\t\t// either path must report the same error.\n\t\t\tcleanup = setTimeout(\n\t\t\t\t() =>\n\t\t\t\t\treject(\n\t\t\t\t\t\tgateFailed ? (gateError ?? new VerifiedRunError(\"unsettled\")) : new VerifiedRunError(\"unsettled\"),\n\t\t\t\t\t),\n\t\t\t\trequest.cleanupMs,\n\t\t\t);\n\t\t};\n\t\tconst deadline = setTimeout(() => stop(\"deadline\"), request.timeoutMs);\n\t\tconst abort = (): void => stop(\"cancelled\");\n\t\trequest.signal?.addEventListener(\"abort\", abort, { once: true });\n\t\tif (request.signal?.aborted) abort();\n\t\tconst collect = (target: Buffer[], chunk: Buffer): void => {\n\t\t\tif (failure) return;\n\t\t\tsize += chunk.length;\n\t\t\tif (size > request.maxOutputBytes) {\n\t\t\t\tstop(\"output_limit\");\n\t\t\t\treturn;\n\t\t\t}\n\t\t\ttarget.push(chunk);\n\t\t};\n\t\tchild.stdout?.on(\"data\", (chunk: Buffer) => collect(stdout, chunk));\n\t\tchild.stderr?.on(\"data\", (chunk: Buffer) => collect(stderr, chunk));\n\t\tif (request.onReady) {\n\t\t\tconst info = child.stdio[3];\n\t\t\tlet metadata = \"\";\n\t\t\tif (!info || !child.stdin) {\n\t\t\t\tgateFailed = true;\n\t\t\t\tgateError = new VerifiedRunError(\"process_identity\");\n\t\t\t\tstop(\"process_identity\");\n\t\t\t} else {\n\t\t\t\tchild.stdin.on(\"error\", () => stop(\"execution_failed\"));\n\t\t\t\tinfo.on(\"data\", (chunk: Buffer) => {\n\t\t\t\t\tmetadata += chunk.toString(\"utf8\");\n\t\t\t\t\tif (metadata.length > 4096) stop(\"process_identity\");\n\t\t\t\t});\n\t\t\t\tinfo.once(\"end\", async () => {\n\t\t\t\t\tif (finished || failure) return;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait request.onReady?.(identityFromSandboxInfo(metadata));\n\t\t\t\t\t\tif (performance.now() - started >= request.timeoutMs || request.signal?.aborted)\n\t\t\t\t\t\t\tstop(request.signal?.aborted ? \"cancelled\" : \"deadline\");\n\t\t\t\t\t\tif (!finished && !failure) child.stdin?.end(\"go\\n\");\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tgateFailed = true;\n\t\t\t\t\t\tgateError = error;\n\t\t\t\t\t\tstop(\"process_identity\");\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tchild.once(\"error\", () => {\n\t\t\tfailure = \"execution_failed\";\n\t\t});\n\t\tchild.once(\"close\", (exitCode) => {\n\t\t\tfinished = true;\n\t\t\tclearTimeout(deadline);\n\t\t\tclearTimeout(cleanup);\n\t\t\trequest.signal?.removeEventListener(\"abort\", abort);\n\t\t\tif (gateFailed) {\n\t\t\t\treject(gateError);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst durationMs = Math.max(0, Math.round(performance.now() - started));\n\t\t\tresolve({\n\t\t\t\tstdout: Buffer.concat(stdout),\n\t\t\t\tstderr: Buffer.concat(stderr),\n\t\t\t\texitCode,\n\t\t\t\tfailure: failure ?? (exitCode === 0 ? null : \"execution_failed\"),\n\t\t\t\tstartedAt,\n\t\t\t\t// Project the finish instant from the start's wall reference and monotonic elapsed time.\n\t\t\t\tfinishedAt: new Date(Date.parse(startedAt) + durationMs).toISOString(),\n\t\t\t\tdurationMs,\n\t\t\t});\n\t\t});\n\t});\n}\n"]}
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/broker.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAWjE,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,2GAA2G;IAC3G,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;CAC/B;AACD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAE,QAAQ,GAAG,UAAqB,GAAG,MAAM,CA0ChH;AAED,wBAAgB,oBAAoB,IAAI,IAAI,CAS3C;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CA6IvF","sourcesContent":["import { spawn, spawnSync } from \"node:child_process\";\nimport { existsSync, readFileSync, realpathSync } from \"node:fs\";\nimport { release } from \"node:os\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunContract } from \"omk-protocol\";\nimport { ownedGitMounts } from \"./git-sandbox-layout.ts\";\nimport type { NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { identityFromSandboxInfo, PROCESS_GATE_ARGV } from \"./process-gate.ts\";\nimport { digestBytes, digestObject, VerifiedRunError } from \"./storage.ts\";\nimport {\n\tawaitBoundaryDrained,\n\tescalateTermination,\n\tloadSupervisorBackend,\n\tSUPERVISOR_BINARY,\n\tSUPERVISOR_SYSTEM_ARGS,\n} from \"./supervisor-adapter.ts\";\n\nexport interface SandboxExecution {\n\treadonly workspace: string;\n\treadonly argv: readonly string[];\n\treadonly writable: boolean;\n\treadonly timeoutMs: number;\n\treadonly cleanupMs: number;\n\treadonly maxOutputBytes: number;\n\treadonly signal?: AbortSignal;\n\treadonly onReady?: (identity: NamespaceIdentity) => void | Promise<void>;\n\t/** Trusted built-in publisher only: readonly worktree, writable .git, readonly current Node executable. */\n\treadonly gitPublication?: true;\n}\nexport interface SandboxOutcome {\n\treadonly stdout: Buffer;\n\treadonly stderr: Buffer;\n\treadonly exitCode: number | null;\n\treadonly failure: string | null;\n\treadonly startedAt: string;\n\treadonly finishedAt: string;\n\treadonly durationMs: number;\n}\n\nexport function commandEnvironmentDigest(contract: RunContract, driver: \"legacy\" | \"gated-v1\" = \"legacy\"): string {\n\tif (process.platform !== \"linux\" || !existsSync(SUPERVISOR_BINARY)) throw new VerifiedRunError(\"unsupported\");\n\tlet writers: readonly (readonly string[])[];\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-v1\":\n\t\t\twriters = [contract.writer];\n\t\t\tbreak;\n\t\tcase \"linux-scripted-agent-v1\":\n\t\t\twriters = contract.writer.steps;\n\t\t\tbreak;\n\t\tcase \"linux-command-dag-v1\":\n\t\t\twriters = contract.writer.tasks.flatMap((task) => task.attempts);\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tconst binaries = [\n\t\t...new Set([\n\t\t\tSUPERVISOR_BINARY,\n\t\t\t...writers.map((argv) => argv[0]),\n\t\t\t...contract.checks.map((check) => check.argv[0]),\n\t\t\t...(driver === \"gated-v1\" ? [PROCESS_GATE_ARGV[0]] : []),\n\t\t]),\n\t];\n\tconst materials = binaries.map((binary) => {\n\t\tif (!binary || (!binary.startsWith(\"/usr/bin/\") && !binary.startsWith(\"/bin/\")))\n\t\t\tthrow new VerifiedRunError(\"unsupported_executable\");\n\t\tconst path = realpathSync(binary);\n\t\tif (!path.startsWith(\"/usr/\")) throw new VerifiedRunError(\"unsupported_executable\");\n\t\treturn { path, digest: digestBytes(readFileSync(path)) };\n\t});\n\treturn digestObject({\n\t\tprofile: contract.profile,\n\t\tplatform: process.platform,\n\t\tarchitecture: process.arch,\n\t\tkernel: release(),\n\t\tsandbox: SUPERVISOR_SYSTEM_ARGS,\n\t\t...(driver === \"gated-v1\" ? { gate: PROCESS_GATE_ARGV, infoFd: 3 } : {}),\n\t\tbinaries: materials,\n\t});\n}\n\nexport function probeVerifiedSandbox(): void {\n\tif (process.platform !== \"linux\" || !existsSync(SUPERVISOR_BINARY)) throw new VerifiedRunError(\"unsupported\");\n\tconst probe = spawnSync(SUPERVISOR_BINARY, [...SUPERVISOR_SYSTEM_ARGS, \"--\", \"/bin/true\"], {\n\t\tenv: {},\n\t\ttimeout: 3000,\n\t\tmaxBuffer: 4096,\n\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t});\n\tif (probe.error || probe.status !== 0) throw new VerifiedRunError(\"unsupported\");\n}\n\n/**\n * The only process dispatch port. Resolution requires two witnesses: the\n * child's `close` (namespace init exited, inherited pipes drained) followed\n * by an empty-member scan of the recorded PID namespace. A platform without\n * the supervised namespace backend is refused, never degraded to best effort.\n */\nexport async function executeSandbox(request: SandboxExecution): Promise<SandboxOutcome> {\n\tif (request.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tif (request.timeoutMs <= 0) throw new VerifiedRunError(\"deadline\");\n\t// Dispatch is only defined inside a supervised namespace boundary whose\n\t// identity is committed before candidate code runs; there is no ungated lane.\n\tif (!request.onReady) throw new VerifiedRunError(\"unsupported_boundary\");\n\tconst backend = loadSupervisorBackend();\n\tif (request.gitPublication && request.writable) throw new VerifiedRunError(\"unsupported_boundary\");\n\tconst started = performance.now();\n\tconst startedAt = new Date().toISOString();\n\tconst argv = [\n\t\t...backend.args,\n\t\trequest.writable ? \"--bind\" : \"--ro-bind\",\n\t\trequest.workspace,\n\t\t\"/workspace\",\n\t\t...(request.gitPublication ? ownedGitMounts(request.workspace) : []),\n\t\t\"--chdir\",\n\t\t\"/workspace\",\n\t\t\"--info-fd\",\n\t\t\"3\",\n\t\t\"--\",\n\t\t...PROCESS_GATE_ARGV,\n\t\t...request.argv,\n\t];\n\treturn new Promise((resolve, reject) => {\n\t\tconst child = spawn(backend.binary, argv, { env: {}, stdio: [\"pipe\", \"pipe\", \"pipe\", \"pipe\"] });\n\t\tlet identity: NamespaceIdentity | undefined;\n\t\tlet gateFailed = false;\n\t\tlet gateError: unknown;\n\t\tconst stdout: Buffer[] = [];\n\t\tconst stderr: Buffer[] = [];\n\t\tlet size = 0;\n\t\tlet failure: string | null = null;\n\t\tlet cleanup: ReturnType<typeof setTimeout> | undefined;\n\t\tlet finished = false;\n\t\tconst stop = (reason: string): void => {\n\t\t\tif (finished || failure) return;\n\t\t\tfailure = reason;\n\t\t\tescalateTermination(child);\n\t\t\t// When the gate already failed, surface its real cause rather than a\n\t\t\t// generic unsettled — the close handler may still arrive first, and\n\t\t\t// either path must report the same error.\n\t\t\tcleanup = setTimeout(\n\t\t\t\t() =>\n\t\t\t\t\treject(\n\t\t\t\t\t\tgateFailed ? (gateError ?? new VerifiedRunError(\"unsettled\")) : new VerifiedRunError(\"unsettled\"),\n\t\t\t\t\t),\n\t\t\t\trequest.cleanupMs,\n\t\t\t);\n\t\t};\n\t\tconst deadline = setTimeout(() => stop(\"deadline\"), request.timeoutMs);\n\t\tconst abort = (): void => stop(\"cancelled\");\n\t\trequest.signal?.addEventListener(\"abort\", abort, { once: true });\n\t\tif (request.signal?.aborted) abort();\n\t\tconst collect = (target: Buffer[], chunk: Buffer): void => {\n\t\t\tif (failure) return;\n\t\t\tsize += chunk.length;\n\t\t\tif (size > request.maxOutputBytes) {\n\t\t\t\tstop(\"output_limit\");\n\t\t\t\treturn;\n\t\t\t}\n\t\t\ttarget.push(chunk);\n\t\t};\n\t\tchild.stdout?.on(\"data\", (chunk: Buffer) => collect(stdout, chunk));\n\t\tchild.stderr?.on(\"data\", (chunk: Buffer) => collect(stderr, chunk));\n\t\tconst info = child.stdio[3];\n\t\tlet metadata = \"\";\n\t\tif (!info || !child.stdin) {\n\t\t\tgateFailed = true;\n\t\t\tgateError = new VerifiedRunError(\"process_identity\");\n\t\t\tstop(\"process_identity\");\n\t\t} else {\n\t\t\tchild.stdin.on(\"error\", () => stop(\"execution_failed\"));\n\t\t\tinfo.on(\"data\", (chunk: Buffer) => {\n\t\t\t\tmetadata += chunk.toString(\"utf8\");\n\t\t\t\tif (metadata.length > 4096) stop(\"process_identity\");\n\t\t\t});\n\t\t\tinfo.once(\"end\", async () => {\n\t\t\t\tif (finished || failure) return;\n\t\t\t\ttry {\n\t\t\t\t\tidentity = identityFromSandboxInfo(metadata);\n\t\t\t\t\tawait request.onReady?.(identity);\n\t\t\t\t\tif (performance.now() - started >= request.timeoutMs || request.signal?.aborted)\n\t\t\t\t\t\tstop(request.signal?.aborted ? \"cancelled\" : \"deadline\");\n\t\t\t\t\tif (!finished && !failure) child.stdin?.end(\"go\\n\");\n\t\t\t\t} catch (error) {\n\t\t\t\t\tgateFailed = true;\n\t\t\t\t\tgateError = error;\n\t\t\t\t\tstop(\"process_identity\");\n\t\t\t\t}\n\t\t\t});\n\t\t}\n\t\tchild.once(\"error\", () => {\n\t\t\tfailure = \"execution_failed\";\n\t\t});\n\t\tchild.once(\"close\", (exitCode) => {\n\t\t\tfinished = true;\n\t\t\tclearTimeout(deadline);\n\t\t\tclearTimeout(cleanup);\n\t\t\trequest.signal?.removeEventListener(\"abort\", abort);\n\t\t\t// `close` proves only the direct child exited and pipes drained. The\n\t\t\t// termination witness is the recorded namespace reporting no members;\n\t\t\t// until it does, this execution cannot settle and claims stay held.\n\t\t\tconst settle = (drained: \"drained\" | \"populated\" | \"unknown\"): void => {\n\t\t\t\tif (gateFailed) {\n\t\t\t\t\treject(gateError);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (drained === \"populated\") {\n\t\t\t\t\treject(new VerifiedRunError(\"descendant_escape\"));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (drained === \"unknown\") {\n\t\t\t\t\treject(new VerifiedRunError(\"termination_unverified\"));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst durationMs = Math.max(0, Math.round(performance.now() - started));\n\t\t\t\tresolve({\n\t\t\t\t\tstdout: Buffer.concat(stdout),\n\t\t\t\t\tstderr: Buffer.concat(stderr),\n\t\t\t\t\texitCode,\n\t\t\t\t\tfailure: failure ?? (exitCode === 0 ? null : \"execution_failed\"),\n\t\t\t\t\tstartedAt,\n\t\t\t\t\t// Project the finish instant from the start's wall reference and monotonic elapsed time.\n\t\t\t\t\tfinishedAt: new Date(Date.parse(startedAt) + durationMs).toISOString(),\n\t\t\t\t\tdurationMs,\n\t\t\t\t});\n\t\t\t};\n\t\t\tif (!identity) {\n\t\t\t\t// The gate never reported an identity: either the spawn itself failed\n\t\t\t\t// or no supervised namespace was recorded. Nothing provably ran, so\n\t\t\t\t// there is nothing to drain — settle on the child outcome alone.\n\t\t\t\tsettle(\"drained\");\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawaitBoundaryDrained(identity, request.cleanupMs).then(\n\t\t\t\t(drained) => settle(drained),\n\t\t\t\t() => settle(\"unknown\"),\n\t\t\t);\n\t\t});\n\t});\n}\n"]}

package/dist/core/verified-run/broker.js

@@ -2,43 +2,12 @@ import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { release } from "node:os";
 import { performance } from "node:perf_hooks";
+import { ownedGitMounts } from "./git-sandbox-layout.js";
 import { identityFromSandboxInfo, PROCESS_GATE_ARGV } from "./process-gate.js";
 import { digestBytes, digestObject, VerifiedRunError } from "./storage.js";
-const BWRAP = "/usr/bin/bwrap";
-const SYSTEM_ARGS = [
-    "--unshare-all",
-    "--die-with-parent",
-    "--new-session",
-    "--cap-drop",
-    "ALL",
-    "--clearenv",
-    "--ro-bind",
-    "/usr",
-    "/usr",
-    "--symlink",
-    "usr/bin",
-    "/bin",
-    "--symlink",
-    "usr/lib",
-    "/lib",
-    "--symlink",
-    "usr/lib64",
-    "/lib64",
-    "--proc",
-    "/proc",
-    "--dev",
-    "/dev",
-    "--tmpfs",
-    "/tmp",
-    "--setenv",
-    "PATH",
-    "/usr/bin:/bin",
-    "--setenv",
-    "LANG",
-    "C.UTF-8",
-];
+import { awaitBoundaryDrained, escalateTermination, loadSupervisorBackend, SUPERVISOR_BINARY, SUPERVISOR_SYSTEM_ARGS, } from "./supervisor-adapter.js";
 export function commandEnvironmentDigest(contract, driver = "legacy") {
-    if (process.platform !== "linux" || !existsSync(BWRAP))
+    if (process.platform !== "linux" || !existsSync(SUPERVISOR_BINARY))
         throw new VerifiedRunError("unsupported");
     let writers;
     switch (contract.profile) {
@@ -58,7 +27,7 @@ export function commandEnvironmentDigest(contract, driver = "legacy") {
     }
     const binaries = [
         ...new Set([
-            BWRAP,
+            SUPERVISOR_BINARY,
             ...writers.map((argv) => argv[0]),
             ...contract.checks.map((check) => check.argv[0]),
             ...(driver === "gated-v1" ? [PROCESS_GATE_ARGV[0]] : []),
@@ -77,15 +46,15 @@ export function commandEnvironmentDigest(contract, driver = "legacy") {
         platform: process.platform,
         architecture: process.arch,
         kernel: release(),
-        sandbox: SYSTEM_ARGS,
+        sandbox: SUPERVISOR_SYSTEM_ARGS,
         ...(driver === "gated-v1" ? { gate: PROCESS_GATE_ARGV, infoFd: 3 } : {}),
         binaries: materials,
     });
 }
 export function probeVerifiedSandbox() {
-    if (process.platform !== "linux" || !existsSync(BWRAP))
+    if (process.platform !== "linux" || !existsSync(SUPERVISOR_BINARY))
         throw new VerifiedRunError("unsupported");
-    const probe = spawnSync(BWRAP, [...SYSTEM_ARGS, "--", "/bin/true"], {
+    const probe = spawnSync(SUPERVISOR_BINARY, [...SUPERVISOR_SYSTEM_ARGS, "--", "/bin/true"], {
         env: {},
         timeout: 3000,
         maxBuffer: 4096,
@@ -94,28 +63,43 @@ export function probeVerifiedSandbox() {
     if (probe.error || probe.status !== 0)
         throw new VerifiedRunError("unsupported");
 }
-/** The only process dispatch port; close means the PID namespace and its inherited pipes have drained. */
+/**
+ * The only process dispatch port. Resolution requires two witnesses: the
+ * child's `close` (namespace init exited, inherited pipes drained) followed
+ * by an empty-member scan of the recorded PID namespace. A platform without
+ * the supervised namespace backend is refused, never degraded to best effort.
+ */
 export async function executeSandbox(request) {
     if (request.signal?.aborted)
         throw new VerifiedRunError("cancelled");
     if (request.timeoutMs <= 0)
         throw new VerifiedRunError("deadline");
+    // Dispatch is only defined inside a supervised namespace boundary whose
+    // identity is committed before candidate code runs; there is no ungated lane.
+    if (!request.onReady)
+        throw new VerifiedRunError("unsupported_boundary");
+    const backend = loadSupervisorBackend();
+    if (request.gitPublication && request.writable)
+        throw new VerifiedRunError("unsupported_boundary");
     const started = performance.now();
     const startedAt = new Date().toISOString();
     const argv = [
-        ...SYSTEM_ARGS,
+        ...backend.args,
         request.writable ? "--bind" : "--ro-bind",
         request.workspace,
         "/workspace",
+        ...(request.gitPublication ? ownedGitMounts(request.workspace) : []),
         "--chdir",
         "/workspace",
-        ...(request.onReady ? ["--info-fd", "3", "--", ...PROCESS_GATE_ARGV] : ["--"]),
+        "--info-fd",
+        "3",
+        "--",
+        ...PROCESS_GATE_ARGV,
         ...request.argv,
     ];
     return new Promise((resolve, reject) => {
-        const child = request.onReady
-            ? spawn(BWRAP, argv, { env: {}, stdio: ["pipe", "pipe", "pipe", "pipe"] })
-            : spawn(BWRAP, argv, { env: {}, stdio: ["ignore", "pipe", "pipe"] });
+        const child = spawn(backend.binary, argv, { env: {}, stdio: ["pipe", "pipe", "pipe", "pipe"] });
+        let identity;
         let gateFailed = false;
         let gateError;
         const stdout = [];
@@ -128,7 +112,7 @@ export async function executeSandbox(request) {
             if (finished || failure)
                 return;
             failure = reason;
-            child.kill("SIGKILL");
+            escalateTermination(child);
             // When the gate already failed, surface its real cause rather than a
             // generic unsettled — the close handler may still arrive first, and
             // either path must report the same error.
@@ -151,38 +135,37 @@ export async function executeSandbox(request) {
         };
         child.stdout?.on("data", (chunk) => collect(stdout, chunk));
         child.stderr?.on("data", (chunk) => collect(stderr, chunk));
-        if (request.onReady) {
-            const info = child.stdio[3];
-            let metadata = "";
-            if (!info || !child.stdin) {
-                gateFailed = true;
-                gateError = new VerifiedRunError("process_identity");
-                stop("process_identity");
-            }
-            else {
-                child.stdin.on("error", () => stop("execution_failed"));
-                info.on("data", (chunk) => {
-                    metadata += chunk.toString("utf8");
-                    if (metadata.length > 4096)
-                        stop("process_identity");
-                });
-                info.once("end", async () => {
-                    if (finished || failure)
-                        return;
-                    try {
-                        await request.onReady?.(identityFromSandboxInfo(metadata));
-                        if (performance.now() - started >= request.timeoutMs || request.signal?.aborted)
-                            stop(request.signal?.aborted ? "cancelled" : "deadline");
-                        if (!finished && !failure)
-                            child.stdin?.end("go\n");
-                    }
-                    catch (error) {
-                        gateFailed = true;
-                        gateError = error;
-                        stop("process_identity");
-                    }
-                });
-            }
+        const info = child.stdio[3];
+        let metadata = "";
+        if (!info || !child.stdin) {
+            gateFailed = true;
+            gateError = new VerifiedRunError("process_identity");
+            stop("process_identity");
+        }
+        else {
+            child.stdin.on("error", () => stop("execution_failed"));
+            info.on("data", (chunk) => {
+                metadata += chunk.toString("utf8");
+                if (metadata.length > 4096)
+                    stop("process_identity");
+            });
+            info.once("end", async () => {
+                if (finished || failure)
+                    return;
+                try {
+                    identity = identityFromSandboxInfo(metadata);
+                    await request.onReady?.(identity);
+                    if (performance.now() - started >= request.timeoutMs || request.signal?.aborted)
+                        stop(request.signal?.aborted ? "cancelled" : "deadline");
+                    if (!finished && !failure)
+                        child.stdin?.end("go\n");
+                }
+                catch (error) {
+                    gateFailed = true;
+                    gateError = error;
+                    stop("process_identity");
+                }
+            });
         }
         child.once("error", () => {
             failure = "execution_failed";
@@ -192,21 +175,42 @@ export async function executeSandbox(request) {
             clearTimeout(deadline);
             clearTimeout(cleanup);
             request.signal?.removeEventListener("abort", abort);
-            if (gateFailed) {
-                reject(gateError);
+            // `close` proves only the direct child exited and pipes drained. The
+            // termination witness is the recorded namespace reporting no members;
+            // until it does, this execution cannot settle and claims stay held.
+            const settle = (drained) => {
+                if (gateFailed) {
+                    reject(gateError);
+                    return;
+                }
+                if (drained === "populated") {
+                    reject(new VerifiedRunError("descendant_escape"));
+                    return;
+                }
+                if (drained === "unknown") {
+                    reject(new VerifiedRunError("termination_unverified"));
+                    return;
+                }
+                const durationMs = Math.max(0, Math.round(performance.now() - started));
+                resolve({
+                    stdout: Buffer.concat(stdout),
+                    stderr: Buffer.concat(stderr),
+                    exitCode,
+                    failure: failure ?? (exitCode === 0 ? null : "execution_failed"),
+                    startedAt,
+                    // Project the finish instant from the start's wall reference and monotonic elapsed time.
+                    finishedAt: new Date(Date.parse(startedAt) + durationMs).toISOString(),
+                    durationMs,
+                });
+            };
+            if (!identity) {
+                // The gate never reported an identity: either the spawn itself failed
+                // or no supervised namespace was recorded. Nothing provably ran, so
+                // there is nothing to drain — settle on the child outcome alone.
+                settle("drained");
                 return;
             }
-            const durationMs = Math.max(0, Math.round(performance.now() - started));
-            resolve({
-                stdout: Buffer.concat(stdout),
-                stderr: Buffer.concat(stderr),
-                exitCode,
-                failure: failure ?? (exitCode === 0 ? null : "execution_failed"),
-                startedAt,
-                // Project the finish instant from the start's wall reference and monotonic elapsed time.
-                finishedAt: new Date(Date.parse(startedAt) + durationMs).toISOString(),
-                durationMs,
-            });
+            awaitBoundaryDrained(identity, request.cleanupMs).then((drained) => settle(drained), () => settle("unknown"));
         });
     });
 }

package/dist/core/verified-run/broker.js.map

@@ -1 +1 @@
-{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../../src/core/verified-run/broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE3E,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,WAAW,GAAG;IACnB,eAAe;IACf,mBAAmB;IACnB,eAAe;IACf,YAAY;IACZ,KAAK;IACL,YAAY;IACZ,WAAW;IACX,MAAM;IACN,MAAM;IACN,WAAW;IACX,SAAS;IACT,MAAM;IACN,WAAW;IACX,SAAS;IACT,MAAM;IACN,WAAW;IACX,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,MAAM;IACN,UAAU;IACV,MAAM;IACN,eAAe;IACf,UAAU;IACV,MAAM;IACN,SAAS;CACA,CAAC;AAsBX,MAAM,UAAU,wBAAwB,CAAC,QAAqB,EAAE,MAAM,GAA0B,QAAQ,EAAU;IACjH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAClG,IAAI,OAAuC,CAAC;IAC5C,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,kBAAkB;YACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM;QACP,KAAK,yBAAyB;YAC7B,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAChC,MAAM;QACP,KAAK,sBAAsB;YAC1B,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM;QACP,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG;QAChB,GAAG,IAAI,GAAG,CAAC;YACV,KAAK;YACL,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;KACF,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9E,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IAAA,CACzD,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,IAAI;QAC1B,MAAM,EAAE,OAAO,EAAE;QACjB,OAAO,EAAE,WAAW;QACpB,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,QAAQ,EAAE,SAAS;KACnB,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,oBAAoB,GAAS;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE;QACnE,GAAG,EAAE,EAAE;QACP,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;AAAA,CACjF;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB,EAA2B;IACxF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG;QACZ,GAAG,WAAW;QACd,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;QACzC,OAAO,CAAC,SAAS;QACjB,YAAY;QACZ,SAAS;QACT,YAAY;QACZ,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9E,GAAG,OAAO,CAAC,IAAI;KACf,CAAC;IACF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO;YAC5B,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1E,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,SAAkB,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,OAAkD,CAAC;QACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,CAAC,MAAc,EAAQ,EAAE,CAAC;YACtC,IAAI,QAAQ,IAAI,OAAO;gBAAE,OAAO;YAChC,OAAO,GAAG,MAAM,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,qEAAqE;YACrE,sEAAoE;YACpE,0CAA0C;YAC1C,OAAO,GAAG,UAAU,CACnB,GAAG,EAAE,CACJ,MAAM,CACL,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,CACjG,EACF,OAAO,CAAC,SAAS,CACjB,CAAC;QAAA,CACF,CAAC;QACF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,KAAK,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,KAAa,EAAQ,EAAE,CAAC;YAC1D,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,cAAc,CAAC,CAAC;gBACrB,OAAO;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAA,CACnB,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC3B,UAAU,GAAG,IAAI,CAAC;gBAClB,SAAS,GAAG,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;gBACrD,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACxD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC;oBAClC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACnC,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI;wBAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAAA,CACrD,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;oBAC5B,IAAI,QAAQ,IAAI,OAAO;wBAAE,OAAO;oBAChC,IAAI,CAAC;wBACJ,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC;wBAC3D,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;4BAC9E,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;wBAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;4BAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACrD,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,UAAU,GAAG,IAAI,CAAC;wBAClB,SAAS,GAAG,KAAK,CAAC;wBAClB,IAAI,CAAC,kBAAkB,CAAC,CAAC;oBAC1B,CAAC;gBAAA,CACD,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YACzB,OAAO,GAAG,kBAAkB,CAAC;QAAA,CAC7B,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClB,OAAO;YACR,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;YACxE,OAAO,CAAC;gBACP,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC7B,QAAQ;gBACR,OAAO,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;gBAChE,SAAS;gBACT,yFAAyF;gBACzF,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;gBACtE,UAAU;aACV,CAAC,CAAC;QAAA,CACH,CAAC,CAAC;IAAA,CACH,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { spawn, spawnSync } from \"node:child_process\";\nimport { existsSync, readFileSync, realpathSync } from \"node:fs\";\nimport { release } from \"node:os\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunContract } from \"omk-protocol\";\nimport type { NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { identityFromSandboxInfo, PROCESS_GATE_ARGV } from \"./process-gate.ts\";\nimport { digestBytes, digestObject, VerifiedRunError } from \"./storage.ts\";\n\nconst BWRAP = \"/usr/bin/bwrap\";\nconst SYSTEM_ARGS = [\n\t\"--unshare-all\",\n\t\"--die-with-parent\",\n\t\"--new-session\",\n\t\"--cap-drop\",\n\t\"ALL\",\n\t\"--clearenv\",\n\t\"--ro-bind\",\n\t\"/usr\",\n\t\"/usr\",\n\t\"--symlink\",\n\t\"usr/bin\",\n\t\"/bin\",\n\t\"--symlink\",\n\t\"usr/lib\",\n\t\"/lib\",\n\t\"--symlink\",\n\t\"usr/lib64\",\n\t\"/lib64\",\n\t\"--proc\",\n\t\"/proc\",\n\t\"--dev\",\n\t\"/dev\",\n\t\"--tmpfs\",\n\t\"/tmp\",\n\t\"--setenv\",\n\t\"PATH\",\n\t\"/usr/bin:/bin\",\n\t\"--setenv\",\n\t\"LANG\",\n\t\"C.UTF-8\",\n] as const;\n\nexport interface SandboxExecution {\n\treadonly workspace: string;\n\treadonly argv: readonly string[];\n\treadonly writable: boolean;\n\treadonly timeoutMs: number;\n\treadonly cleanupMs: number;\n\treadonly maxOutputBytes: number;\n\treadonly signal?: AbortSignal;\n\treadonly onReady?: (identity: NamespaceIdentity) => void | Promise<void>;\n}\nexport interface SandboxOutcome {\n\treadonly stdout: Buffer;\n\treadonly stderr: Buffer;\n\treadonly exitCode: number | null;\n\treadonly failure: string | null;\n\treadonly startedAt: string;\n\treadonly finishedAt: string;\n\treadonly durationMs: number;\n}\n\nexport function commandEnvironmentDigest(contract: RunContract, driver: \"legacy\" | \"gated-v1\" = \"legacy\"): string {\n\tif (process.platform !== \"linux\" || !existsSync(BWRAP)) throw new VerifiedRunError(\"unsupported\");\n\tlet writers: readonly (readonly string[])[];\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-v1\":\n\t\t\twriters = [contract.writer];\n\t\t\tbreak;\n\t\tcase \"linux-scripted-agent-v1\":\n\t\t\twriters = contract.writer.steps;\n\t\t\tbreak;\n\t\tcase \"linux-command-dag-v1\":\n\t\t\twriters = contract.writer.tasks.flatMap((task) => task.attempts);\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tconst binaries = [\n\t\t...new Set([\n\t\t\tBWRAP,\n\t\t\t...writers.map((argv) => argv[0]),\n\t\t\t...contract.checks.map((check) => check.argv[0]),\n\t\t\t...(driver === \"gated-v1\" ? [PROCESS_GATE_ARGV[0]] : []),\n\t\t]),\n\t];\n\tconst materials = binaries.map((binary) => {\n\t\tif (!binary || (!binary.startsWith(\"/usr/bin/\") && !binary.startsWith(\"/bin/\")))\n\t\t\tthrow new VerifiedRunError(\"unsupported_executable\");\n\t\tconst path = realpathSync(binary);\n\t\tif (!path.startsWith(\"/usr/\")) throw new VerifiedRunError(\"unsupported_executable\");\n\t\treturn { path, digest: digestBytes(readFileSync(path)) };\n\t});\n\treturn digestObject({\n\t\tprofile: contract.profile,\n\t\tplatform: process.platform,\n\t\tarchitecture: process.arch,\n\t\tkernel: release(),\n\t\tsandbox: SYSTEM_ARGS,\n\t\t...(driver === \"gated-v1\" ? { gate: PROCESS_GATE_ARGV, infoFd: 3 } : {}),\n\t\tbinaries: materials,\n\t});\n}\n\nexport function probeVerifiedSandbox(): void {\n\tif (process.platform !== \"linux\" || !existsSync(BWRAP)) throw new VerifiedRunError(\"unsupported\");\n\tconst probe = spawnSync(BWRAP, [...SYSTEM_ARGS, \"--\", \"/bin/true\"], {\n\t\tenv: {},\n\t\ttimeout: 3000,\n\t\tmaxBuffer: 4096,\n\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t});\n\tif (probe.error || probe.status !== 0) throw new VerifiedRunError(\"unsupported\");\n}\n\n/** The only process dispatch port; close means the PID namespace and its inherited pipes have drained. */\nexport async function executeSandbox(request: SandboxExecution): Promise<SandboxOutcome> {\n\tif (request.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tif (request.timeoutMs <= 0) throw new VerifiedRunError(\"deadline\");\n\tconst started = performance.now();\n\tconst startedAt = new Date().toISOString();\n\tconst argv = [\n\t\t...SYSTEM_ARGS,\n\t\trequest.writable ? \"--bind\" : \"--ro-bind\",\n\t\trequest.workspace,\n\t\t\"/workspace\",\n\t\t\"--chdir\",\n\t\t\"/workspace\",\n\t\t...(request.onReady ? [\"--info-fd\", \"3\", \"--\", ...PROCESS_GATE_ARGV] : [\"--\"]),\n\t\t...request.argv,\n\t];\n\treturn new Promise((resolve, reject) => {\n\t\tconst child = request.onReady\n\t\t\t? spawn(BWRAP, argv, { env: {}, stdio: [\"pipe\", \"pipe\", \"pipe\", \"pipe\"] })\n\t\t\t: spawn(BWRAP, argv, { env: {}, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n\t\tlet gateFailed = false;\n\t\tlet gateError: unknown;\n\t\tconst stdout: Buffer[] = [];\n\t\tconst stderr: Buffer[] = [];\n\t\tlet size = 0;\n\t\tlet failure: string | null = null;\n\t\tlet cleanup: ReturnType<typeof setTimeout> | undefined;\n\t\tlet finished = false;\n\t\tconst stop = (reason: string): void => {\n\t\t\tif (finished || failure) return;\n\t\t\tfailure = reason;\n\t\t\tchild.kill(\"SIGKILL\");\n\t\t\t// When the gate already failed, surface its real cause rather than a\n\t\t\t// generic unsettled — the close handler may still arrive first, and\n\t\t\t// either path must report the same error.\n\t\t\tcleanup = setTimeout(\n\t\t\t\t() =>\n\t\t\t\t\treject(\n\t\t\t\t\t\tgateFailed ? (gateError ?? new VerifiedRunError(\"unsettled\")) : new VerifiedRunError(\"unsettled\"),\n\t\t\t\t\t),\n\t\t\t\trequest.cleanupMs,\n\t\t\t);\n\t\t};\n\t\tconst deadline = setTimeout(() => stop(\"deadline\"), request.timeoutMs);\n\t\tconst abort = (): void => stop(\"cancelled\");\n\t\trequest.signal?.addEventListener(\"abort\", abort, { once: true });\n\t\tif (request.signal?.aborted) abort();\n\t\tconst collect = (target: Buffer[], chunk: Buffer): void => {\n\t\t\tif (failure) return;\n\t\t\tsize += chunk.length;\n\t\t\tif (size > request.maxOutputBytes) {\n\t\t\t\tstop(\"output_limit\");\n\t\t\t\treturn;\n\t\t\t}\n\t\t\ttarget.push(chunk);\n\t\t};\n\t\tchild.stdout?.on(\"data\", (chunk: Buffer) => collect(stdout, chunk));\n\t\tchild.stderr?.on(\"data\", (chunk: Buffer) => collect(stderr, chunk));\n\t\tif (request.onReady) {\n\t\t\tconst info = child.stdio[3];\n\t\t\tlet metadata = \"\";\n\t\t\tif (!info || !child.stdin) {\n\t\t\t\tgateFailed = true;\n\t\t\t\tgateError = new VerifiedRunError(\"process_identity\");\n\t\t\t\tstop(\"process_identity\");\n\t\t\t} else {\n\t\t\t\tchild.stdin.on(\"error\", () => stop(\"execution_failed\"));\n\t\t\t\tinfo.on(\"data\", (chunk: Buffer) => {\n\t\t\t\t\tmetadata += chunk.toString(\"utf8\");\n\t\t\t\t\tif (metadata.length > 4096) stop(\"process_identity\");\n\t\t\t\t});\n\t\t\t\tinfo.once(\"end\", async () => {\n\t\t\t\t\tif (finished || failure) return;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait request.onReady?.(identityFromSandboxInfo(metadata));\n\t\t\t\t\t\tif (performance.now() - started >= request.timeoutMs || request.signal?.aborted)\n\t\t\t\t\t\t\tstop(request.signal?.aborted ? \"cancelled\" : \"deadline\");\n\t\t\t\t\t\tif (!finished && !failure) child.stdin?.end(\"go\\n\");\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tgateFailed = true;\n\t\t\t\t\t\tgateError = error;\n\t\t\t\t\t\tstop(\"process_identity\");\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tchild.once(\"error\", () => {\n\t\t\tfailure = \"execution_failed\";\n\t\t});\n\t\tchild.once(\"close\", (exitCode) => {\n\t\t\tfinished = true;\n\t\t\tclearTimeout(deadline);\n\t\t\tclearTimeout(cleanup);\n\t\t\trequest.signal?.removeEventListener(\"abort\", abort);\n\t\t\tif (gateFailed) {\n\t\t\t\treject(gateError);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst durationMs = Math.max(0, Math.round(performance.now() - started));\n\t\t\tresolve({\n\t\t\t\tstdout: Buffer.concat(stdout),\n\t\t\t\tstderr: Buffer.concat(stderr),\n\t\t\t\texitCode,\n\t\t\t\tfailure: failure ?? (exitCode === 0 ? null : \"execution_failed\"),\n\t\t\t\tstartedAt,\n\t\t\t\t// Project the finish instant from the start's wall reference and monotonic elapsed time.\n\t\t\t\tfinishedAt: new Date(Date.parse(startedAt) + durationMs).toISOString(),\n\t\t\t\tdurationMs,\n\t\t\t});\n\t\t});\n\t});\n}\n"]}
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../../src/core/verified-run/broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,yBAAyB,CAAC;AAwBjC,MAAM,UAAU,wBAAwB,CAAC,QAAqB,EAAE,MAAM,GAA0B,QAAQ,EAAU;IACjH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC9G,IAAI,OAAuC,CAAC;IAC5C,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,kBAAkB;YACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM;QACP,KAAK,yBAAyB;YAC7B,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAChC,MAAM;QACP,KAAK,sBAAsB;YAC1B,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM;QACP,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG;QAChB,GAAG,IAAI,GAAG,CAAC;YACV,iBAAiB;YACjB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;KACF,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9E,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IAAA,CACzD,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,IAAI;QAC1B,MAAM,EAAE,OAAO,EAAE;QACjB,OAAO,EAAE,sBAAsB;QAC/B,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,QAAQ,EAAE,SAAS;KACnB,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,oBAAoB,GAAS;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB,EAAE,CAAC,GAAG,sBAAsB,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE;QAC1F,GAAG,EAAE,EAAE;QACP,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;AAAA,CACjF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB,EAA2B;IACxF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACnE,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG;QACZ,GAAG,OAAO,CAAC,IAAI;QACf,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;QACzC,OAAO,CAAC,SAAS;QACjB,YAAY;QACZ,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,SAAS;QACT,YAAY;QACZ,WAAW;QACX,GAAG;QACH,IAAI;QACJ,GAAG,iBAAiB;QACpB,GAAG,OAAO,CAAC,IAAI;KACf,CAAC;IACF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAChG,IAAI,QAAuC,CAAC;QAC5C,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,SAAkB,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,OAAkD,CAAC;QACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,CAAC,MAAc,EAAQ,EAAE,CAAC;YACtC,IAAI,QAAQ,IAAI,OAAO;gBAAE,OAAO;YAChC,OAAO,GAAG,MAAM,CAAC;YACjB,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,qEAAqE;YACrE,sEAAoE;YACpE,0CAA0C;YAC1C,OAAO,GAAG,UAAU,CACnB,GAAG,EAAE,CACJ,MAAM,CACL,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,CACjG,EACF,OAAO,CAAC,SAAS,CACjB,CAAC;QAAA,CACF,CAAC;QACF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,KAAK,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,KAAa,EAAQ,EAAE,CAAC;YAC1D,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,cAAc,CAAC,CAAC;gBACrB,OAAO;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAA,CACnB,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3B,UAAU,GAAG,IAAI,CAAC;YAClB,SAAS,GAAG,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;YACrD,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACxD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC;gBAClC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnC,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI;oBAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAAA,CACrD,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC5B,IAAI,QAAQ,IAAI,OAAO;oBAAE,OAAO;gBAChC,IAAI,CAAC;oBACJ,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;oBAC7C,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;oBAClC,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;wBAC9E,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;oBAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;wBAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,UAAU,GAAG,IAAI,CAAC;oBAClB,SAAS,GAAG,KAAK,CAAC;oBAClB,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC1B,CAAC;YAAA,CACD,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YACzB,OAAO,GAAG,kBAAkB,CAAC;QAAA,CAC7B,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,MAAM,GAAG,CAAC,OAA4C,EAAQ,EAAE,CAAC;gBACtE,IAAI,UAAU,EAAE,CAAC;oBAChB,MAAM,CAAC,SAAS,CAAC,CAAC;oBAClB,OAAO;gBACR,CAAC;gBACD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC;oBAClD,OAAO;gBACR,CAAC;gBACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,CAAC;oBACvD,OAAO;gBACR,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;gBACxE,OAAO,CAAC;oBACP,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC7B,QAAQ;oBACR,OAAO,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;oBAChE,SAAS;oBACT,yFAAyF;oBACzF,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;oBACtE,UAAU;iBACV,CAAC,CAAC;YAAA,CACH,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,sEAAsE;gBACtE,oEAAoE;gBACpE,mEAAiE;gBACjE,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClB,OAAO;YACR,CAAC;YACD,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CACrD,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAC5B,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACvB,CAAC;QAAA,CACF,CAAC,CAAC;IAAA,CACH,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { spawn, spawnSync } from \"node:child_process\";\nimport { existsSync, readFileSync, realpathSync } from \"node:fs\";\nimport { release } from \"node:os\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunContract } from \"omk-protocol\";\nimport { ownedGitMounts } from \"./git-sandbox-layout.ts\";\nimport type { NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { identityFromSandboxInfo, PROCESS_GATE_ARGV } from \"./process-gate.ts\";\nimport { digestBytes, digestObject, VerifiedRunError } from \"./storage.ts\";\nimport {\n\tawaitBoundaryDrained,\n\tescalateTermination,\n\tloadSupervisorBackend,\n\tSUPERVISOR_BINARY,\n\tSUPERVISOR_SYSTEM_ARGS,\n} from \"./supervisor-adapter.ts\";\n\nexport interface SandboxExecution {\n\treadonly workspace: string;\n\treadonly argv: readonly string[];\n\treadonly writable: boolean;\n\treadonly timeoutMs: number;\n\treadonly cleanupMs: number;\n\treadonly maxOutputBytes: number;\n\treadonly signal?: AbortSignal;\n\treadonly onReady?: (identity: NamespaceIdentity) => void | Promise<void>;\n\t/** Trusted built-in publisher only: readonly worktree, writable .git, readonly current Node executable. */\n\treadonly gitPublication?: true;\n}\nexport interface SandboxOutcome {\n\treadonly stdout: Buffer;\n\treadonly stderr: Buffer;\n\treadonly exitCode: number | null;\n\treadonly failure: string | null;\n\treadonly startedAt: string;\n\treadonly finishedAt: string;\n\treadonly durationMs: number;\n}\n\nexport function commandEnvironmentDigest(contract: RunContract, driver: \"legacy\" | \"gated-v1\" = \"legacy\"): string {\n\tif (process.platform !== \"linux\" || !existsSync(SUPERVISOR_BINARY)) throw new VerifiedRunError(\"unsupported\");\n\tlet writers: readonly (readonly string[])[];\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-v1\":\n\t\t\twriters = [contract.writer];\n\t\t\tbreak;\n\t\tcase \"linux-scripted-agent-v1\":\n\t\t\twriters = contract.writer.steps;\n\t\t\tbreak;\n\t\tcase \"linux-command-dag-v1\":\n\t\t\twriters = contract.writer.tasks.flatMap((task) => task.attempts);\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tconst binaries = [\n\t\t...new Set([\n\t\t\tSUPERVISOR_BINARY,\n\t\t\t...writers.map((argv) => argv[0]),\n\t\t\t...contract.checks.map((check) => check.argv[0]),\n\t\t\t...(driver === \"gated-v1\" ? [PROCESS_GATE_ARGV[0]] : []),\n\t\t]),\n\t];\n\tconst materials = binaries.map((binary) => {\n\t\tif (!binary || (!binary.startsWith(\"/usr/bin/\") && !binary.startsWith(\"/bin/\")))\n\t\t\tthrow new VerifiedRunError(\"unsupported_executable\");\n\t\tconst path = realpathSync(binary);\n\t\tif (!path.startsWith(\"/usr/\")) throw new VerifiedRunError(\"unsupported_executable\");\n\t\treturn { path, digest: digestBytes(readFileSync(path)) };\n\t});\n\treturn digestObject({\n\t\tprofile: contract.profile,\n\t\tplatform: process.platform,\n\t\tarchitecture: process.arch,\n\t\tkernel: release(),\n\t\tsandbox: SUPERVISOR_SYSTEM_ARGS,\n\t\t...(driver === \"gated-v1\" ? { gate: PROCESS_GATE_ARGV, infoFd: 3 } : {}),\n\t\tbinaries: materials,\n\t});\n}\n\nexport function probeVerifiedSandbox(): void {\n\tif (process.platform !== \"linux\" || !existsSync(SUPERVISOR_BINARY)) throw new VerifiedRunError(\"unsupported\");\n\tconst probe = spawnSync(SUPERVISOR_BINARY, [...SUPERVISOR_SYSTEM_ARGS, \"--\", \"/bin/true\"], {\n\t\tenv: {},\n\t\ttimeout: 3000,\n\t\tmaxBuffer: 4096,\n\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t});\n\tif (probe.error || probe.status !== 0) throw new VerifiedRunError(\"unsupported\");\n}\n\n/**\n * The only process dispatch port. Resolution requires two witnesses: the\n * child's `close` (namespace init exited, inherited pipes drained) followed\n * by an empty-member scan of the recorded PID namespace. A platform without\n * the supervised namespace backend is refused, never degraded to best effort.\n */\nexport async function executeSandbox(request: SandboxExecution): Promise<SandboxOutcome> {\n\tif (request.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tif (request.timeoutMs <= 0) throw new VerifiedRunError(\"deadline\");\n\t// Dispatch is only defined inside a supervised namespace boundary whose\n\t// identity is committed before candidate code runs; there is no ungated lane.\n\tif (!request.onReady) throw new VerifiedRunError(\"unsupported_boundary\");\n\tconst backend = loadSupervisorBackend();\n\tif (request.gitPublication && request.writable) throw new VerifiedRunError(\"unsupported_boundary\");\n\tconst started = performance.now();\n\tconst startedAt = new Date().toISOString();\n\tconst argv = [\n\t\t...backend.args,\n\t\trequest.writable ? \"--bind\" : \"--ro-bind\",\n\t\trequest.workspace,\n\t\t\"/workspace\",\n\t\t...(request.gitPublication ? ownedGitMounts(request.workspace) : []),\n\t\t\"--chdir\",\n\t\t\"/workspace\",\n\t\t\"--info-fd\",\n\t\t\"3\",\n\t\t\"--\",\n\t\t...PROCESS_GATE_ARGV,\n\t\t...request.argv,\n\t];\n\treturn new Promise((resolve, reject) => {\n\t\tconst child = spawn(backend.binary, argv, { env: {}, stdio: [\"pipe\", \"pipe\", \"pipe\", \"pipe\"] });\n\t\tlet identity: NamespaceIdentity | undefined;\n\t\tlet gateFailed = false;\n\t\tlet gateError: unknown;\n\t\tconst stdout: Buffer[] = [];\n\t\tconst stderr: Buffer[] = [];\n\t\tlet size = 0;\n\t\tlet failure: string | null = null;\n\t\tlet cleanup: ReturnType<typeof setTimeout> | undefined;\n\t\tlet finished = false;\n\t\tconst stop = (reason: string): void => {\n\t\t\tif (finished || failure) return;\n\t\t\tfailure = reason;\n\t\t\tescalateTermination(child);\n\t\t\t// When the gate already failed, surface its real cause rather than a\n\t\t\t// generic unsettled — the close handler may still arrive first, and\n\t\t\t// either path must report the same error.\n\t\t\tcleanup = setTimeout(\n\t\t\t\t() =>\n\t\t\t\t\treject(\n\t\t\t\t\t\tgateFailed ? (gateError ?? new VerifiedRunError(\"unsettled\")) : new VerifiedRunError(\"unsettled\"),\n\t\t\t\t\t),\n\t\t\t\trequest.cleanupMs,\n\t\t\t);\n\t\t};\n\t\tconst deadline = setTimeout(() => stop(\"deadline\"), request.timeoutMs);\n\t\tconst abort = (): void => stop(\"cancelled\");\n\t\trequest.signal?.addEventListener(\"abort\", abort, { once: true });\n\t\tif (request.signal?.aborted) abort();\n\t\tconst collect = (target: Buffer[], chunk: Buffer): void => {\n\t\t\tif (failure) return;\n\t\t\tsize += chunk.length;\n\t\t\tif (size > request.maxOutputBytes) {\n\t\t\t\tstop(\"output_limit\");\n\t\t\t\treturn;\n\t\t\t}\n\t\t\ttarget.push(chunk);\n\t\t};\n\t\tchild.stdout?.on(\"data\", (chunk: Buffer) => collect(stdout, chunk));\n\t\tchild.stderr?.on(\"data\", (chunk: Buffer) => collect(stderr, chunk));\n\t\tconst info = child.stdio[3];\n\t\tlet metadata = \"\";\n\t\tif (!info || !child.stdin) {\n\t\t\tgateFailed = true;\n\t\t\tgateError = new VerifiedRunError(\"process_identity\");\n\t\t\tstop(\"process_identity\");\n\t\t} else {\n\t\t\tchild.stdin.on(\"error\", () => stop(\"execution_failed\"));\n\t\t\tinfo.on(\"data\", (chunk: Buffer) => {\n\t\t\t\tmetadata += chunk.toString(\"utf8\");\n\t\t\t\tif (metadata.length > 4096) stop(\"process_identity\");\n\t\t\t});\n\t\t\tinfo.once(\"end\", async () => {\n\t\t\t\tif (finished || failure) return;\n\t\t\t\ttry {\n\t\t\t\t\tidentity = identityFromSandboxInfo(metadata);\n\t\t\t\t\tawait request.onReady?.(identity);\n\t\t\t\t\tif (performance.now() - started >= request.timeoutMs || request.signal?.aborted)\n\t\t\t\t\t\tstop(request.signal?.aborted ? \"cancelled\" : \"deadline\");\n\t\t\t\t\tif (!finished && !failure) child.stdin?.end(\"go\\n\");\n\t\t\t\t} catch (error) {\n\t\t\t\t\tgateFailed = true;\n\t\t\t\t\tgateError = error;\n\t\t\t\t\tstop(\"process_identity\");\n\t\t\t\t}\n\t\t\t});\n\t\t}\n\t\tchild.once(\"error\", () => {\n\t\t\tfailure = \"execution_failed\";\n\t\t});\n\t\tchild.once(\"close\", (exitCode) => {\n\t\t\tfinished = true;\n\t\t\tclearTimeout(deadline);\n\t\t\tclearTimeout(cleanup);\n\t\t\trequest.signal?.removeEventListener(\"abort\", abort);\n\t\t\t// `close` proves only the direct child exited and pipes drained. The\n\t\t\t// termination witness is the recorded namespace reporting no members;\n\t\t\t// until it does, this execution cannot settle and claims stay held.\n\t\t\tconst settle = (drained: \"drained\" | \"populated\" | \"unknown\"): void => {\n\t\t\t\tif (gateFailed) {\n\t\t\t\t\treject(gateError);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (drained === \"populated\") {\n\t\t\t\t\treject(new VerifiedRunError(\"descendant_escape\"));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (drained === \"unknown\") {\n\t\t\t\t\treject(new VerifiedRunError(\"termination_unverified\"));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst durationMs = Math.max(0, Math.round(performance.now() - started));\n\t\t\t\tresolve({\n\t\t\t\t\tstdout: Buffer.concat(stdout),\n\t\t\t\t\tstderr: Buffer.concat(stderr),\n\t\t\t\t\texitCode,\n\t\t\t\t\tfailure: failure ?? (exitCode === 0 ? null : \"execution_failed\"),\n\t\t\t\t\tstartedAt,\n\t\t\t\t\t// Project the finish instant from the start's wall reference and monotonic elapsed time.\n\t\t\t\t\tfinishedAt: new Date(Date.parse(startedAt) + durationMs).toISOString(),\n\t\t\t\t\tdurationMs,\n\t\t\t\t});\n\t\t\t};\n\t\t\tif (!identity) {\n\t\t\t\t// The gate never reported an identity: either the spawn itself failed\n\t\t\t\t// or no supervised namespace was recorded. Nothing provably ran, so\n\t\t\t\t// there is nothing to drain — settle on the child outcome alone.\n\t\t\t\tsettle(\"drained\");\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawaitBoundaryDrained(identity, request.cleanupMs).then(\n\t\t\t\t(drained) => settle(drained),\n\t\t\t\t() => settle(\"unknown\"),\n\t\t\t);\n\t\t});\n\t});\n}\n"]}

package/dist/core/verified-run/candidate-policy.d.ts

@@ -0,0 +1,10 @@
+/** Whole-tree inclusion, with explicit metadata exclusions and sensitive-name rejection. */
+export declare const CANDIDATE_POLICY: Readonly<{
+    version: "whole-tree-sensitive-names-v1";
+    excludedRoots: readonly string[];
+    deniedNames: readonly string[];
+    deniedSuffixes: readonly string[];
+}>;
+export declare function safeCandidatePath(path: string): void;
+export declare function assertPublishablePath(path: string): void;
+//# sourceMappingURL=candidate-policy.d.ts.map

package/dist/core/verified-run/candidate-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidate-policy.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/candidate-policy.ts"],"names":[],"mappings":"AAEA,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB;;;;;EAgB3B,CAAC;AAGH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQpD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAIxD","sourcesContent":["import { VerifiedRunError } from \"./storage.ts\";\n\n/** Whole-tree inclusion, with explicit metadata exclusions and sensitive-name rejection. */\nexport const CANDIDATE_POLICY = Object.freeze({\n\tversion: \"whole-tree-sensitive-names-v1\",\n\texcludedRoots: Object.freeze([\".git\", \".omk\"]),\n\tdeniedNames: Object.freeze([\n\t\t\".env\",\n\t\t\".env.local\",\n\t\t\".env.production\",\n\t\t\".env.development\",\n\t\t\".npmrc\",\n\t\t\".netrc\",\n\t\t\".pypirc\",\n\t\t\"credentials.json\",\n\t\t\"id_rsa\",\n\t\t\"id_ed25519\",\n\t]),\n\tdeniedSuffixes: Object.freeze([\".pem\", \".key\"]),\n});\nconst denied = new Set(CANDIDATE_POLICY.deniedNames);\n\nexport function safeCandidatePath(path: string): void {\n\tif (\n\t\t!path ||\n\t\tBuffer.from(path, \"utf8\").toString(\"utf8\") !== path ||\n\t\t/[\\\\\\u0000-\\u001f\\u007f]/.test(path) ||\n\t\tpath.split(\"/\").some((part) => [\"\", \".\", \"..\", \".git\", \".omk\"].includes(part))\n\t)\n\t\tthrow new VerifiedRunError(\"file_type\");\n}\n\nexport function assertPublishablePath(path: string): void {\n\tconst name = path.slice(path.lastIndexOf(\"/\") + 1);\n\tif (denied.has(name) || CANDIDATE_POLICY.deniedSuffixes.some((suffix) => name.endsWith(suffix)))\n\t\tthrow new VerifiedRunError(\"secret_path\");\n}\n"]}