@cairn-tool/cairn 2.0.0

package/dist/agent/package/index.js

@@ -0,0 +1,339 @@
+import crypto from "node:crypto";
+import { diagnostic } from "../types.js";
+import { profileFor } from "../targets/index.js";
+import { packageName, packageVersion } from "../../version.js";
+import { archive } from "./tar.js";
+export const PACKAGE_REPORT = "package-report.json";
+export const CHECKSUMS = "checksums.sha256";
+export const SBOM = "sbom.json";
+function sha256(content) {
+    return crypto.createHash("sha256").update(content).digest("hex");
+}
+function error(code, message, extra = {}) {
+    return { ...diagnostic(code, message, "unsupported", extra), severity: "error" };
+}
+/**
+ * Names the bundle key behind a catalog field, which is not always the catalog
+ * key: Claude Code's `owner` and Cursor's `author` both come from
+ * `marketplace.publisher`, so pointing at the catalog name would send an author
+ * to a key that does not exist.
+ */
+function sourceField(field) {
+    switch (field.source.from) {
+        case "marketplace":
+            return `marketplace.${field.source.field}`;
+        case "manifest":
+            return field.source.field;
+        case "computed":
+            return field.name;
+    }
+}
+/** Reshapes a resolved value into the form the target's catalog declares. */
+function reshape(value, transform) {
+    switch (transform ?? "identity") {
+        case "name":
+            return value && typeof value === "object" ? value.name : value;
+        case "first":
+            return Array.isArray(value) ? value[0] : value;
+        case "identity":
+            return value;
+    }
+}
+/** Resolves one catalog field from the manifest, the marketplace block, or the layout. */
+function resolveField(field, bundle, source) {
+    switch (field.source.from) {
+        case "computed":
+            return reshape(source, field.transform);
+        case "manifest":
+            return reshape(bundle.manifest[field.source.field], field.transform);
+        case "marketplace":
+            return reshape(bundle.marketplace?.[field.source.field], field.transform);
+    }
+}
+/**
+ * Fills one catalog object from a field list, reporting AB500 per missing
+ * requirement. Shared by the document and its entries so a target's identity
+ * fields resolve by exactly the rules its plugin fields do.
+ */
+function collectFields(fields, bundle, source, onMissing) {
+    const result = {};
+    for (const field of fields) {
+        const value = resolveField(field, bundle, source);
+        if (empty(value)) {
+            if (field.required)
+                onMissing(field);
+            continue;
+        }
+        result[field.name] = value;
+    }
+    return result;
+}
+function empty(value) {
+    if (value === undefined || value === null)
+        return true;
+    if (typeof value === "string")
+        return value.trim() === "";
+    if (Array.isArray(value))
+        return value.length === 0;
+    return false;
+}
+/**
+ * Reads image dimensions from a PNG or JPEG header.
+ *
+ * Header parsing only — pulling in an image library to answer "is this a PNG"
+ * would be a dependency for a validation nicety.
+ */
+export function imageKind(content) {
+    if (content.length > 8 && content.subarray(0, 8).equals(Buffer.from("89504e470d0a1a0a", "hex")))
+        return "png";
+    if (content.length > 3 && content[0] === 0xff && content[1] === 0xd8)
+        return "jpeg";
+    if (content.subarray(0, 512).toString("utf8").includes("<svg"))
+        return "svg";
+    return null;
+}
+/**
+ * Builds a marketplace catalog per selected target, covering every bundle given.
+ *
+ * Field names and requirements come from the target profile, so the packager
+ * itself contains no per-target branching and a catalog change is a data edit.
+ * `AB500` and `AB501` fire from here for every caller — `agent package` with one
+ * bundle, `agent marketplace` with a collection — so a consumer's suppression
+ * list means the same thing whichever command produced the catalog.
+ */
+export function buildCatalogs(bundles, targets, profiles, mode, options = {}) {
+    const list = Array.isArray(bundles) ? bundles : [bundles];
+    const artifacts = [];
+    const entries = [];
+    const diagnostics = [];
+    if (mode === "none")
+        return { artifacts, entries, diagnostics };
+    for (const target of targets) {
+        const spec = profileFor(target).marketplace;
+        if (!spec)
+            continue;
+        const location = spec.catalog[mode];
+        if (!location) {
+            diagnostics.push(diagnostic("AB507", `${target} has no ${mode} marketplace catalog`, "unsupported", {
+                target,
+            }));
+            continue;
+        }
+        for (const profile of profiles) {
+            if (profile !== "plugin")
+                continue;
+            const at = (bundle) => (options.attributeToBundle ? { path: bundle.root } : {});
+            const missing = (bundle) => (field) => {
+                diagnostics.push(error("AB500", `Catalog field '${field.name}' is required by ${target}`, {
+                    target,
+                    profile,
+                    ...at(bundle),
+                    remediation: `Set ${sourceField(field)} in agent-bundle.yaml.`,
+                }));
+            };
+            const collected = [];
+            for (const bundle of list) {
+                const source = options.sourceFor?.(bundle, target, profile) ?? `./${target}/${profile}`;
+                const entry = collectFields(spec.entryFields, bundle, source, missing(bundle));
+                // A catalog naming a version the manifest disagrees with would install
+                // one thing and advertise another.
+                if (entry.version !== undefined && entry.version !== bundle.version)
+                    diagnostics.push(error("AB501", `Catalog version '${String(entry.version)}' disagrees with the bundle`, {
+                        target,
+                        profile,
+                        ...at(bundle),
+                    }));
+                collected.push(entry);
+            }
+            // Document identity comes from the first bundle unless a caller supplies
+            // it. `source` is irrelevant to document fields, so any value serves.
+            const document = options.document ??
+                collectFields(spec.documentFields ?? [], list[0], `./${target}/${profile}`, missing(list[0]));
+            const catalogPath = options.catalogPathFor?.(target, profile, location) ??
+                `${target}/${profile}/${location.directory}/${location.file}`;
+            artifacts.push({
+                path: catalogPath,
+                content: Buffer.from(JSON.stringify({ ...document, [spec.entriesKey]: collected }, null, 2) + "\n"),
+                mode: 0o644,
+            });
+            entries.push({ target, profile, path: catalogPath });
+        }
+    }
+    return { artifacts, entries, diagnostics };
+}
+/** Validates declared marketplace assets against the target's asset rules. */
+export function checkAssets(bundle, targets, payload) {
+    const diagnostics = [];
+    const byName = new Map(payload.map((artifact) => [artifact.path, artifact]));
+    for (const target of targets) {
+        const spec = profileFor(target).marketplace;
+        if (!spec)
+            continue;
+        for (const rule of spec.assets) {
+            const declared = rule.role === "icon"
+                ? bundle.marketplace?.icon
+                    ? [bundle.marketplace.icon]
+                    : []
+                : (bundle.marketplace?.screenshots ?? []);
+            if (!declared.length) {
+                if (rule.required)
+                    diagnostics.push(error("AB502", `${target} requires a marketplace ${rule.role}`, {
+                        target,
+                        remediation: `Set marketplace.${rule.role === "icon" ? "icon" : "screenshots"}.`,
+                    }));
+                continue;
+            }
+            for (const reference of declared) {
+                const found = [...byName.entries()].find(([candidate]) => candidate.endsWith(`/${reference}`))?.[1];
+                if (!found) {
+                    diagnostics.push(error("AB502", `Marketplace ${rule.role} '${reference}' is not in the package`, {
+                        target,
+                        remediation: "Add it under the bundle's assets directory.",
+                    }));
+                    continue;
+                }
+                if (!rule.extensions.some((extension) => reference.toLowerCase().endsWith(extension)))
+                    diagnostics.push(diagnostic("AB503", `Marketplace ${rule.role} '${reference}' is not one of ${rule.extensions.join(", ")}`, "approximate", { target }));
+                else if (imageKind(found.content) === null)
+                    diagnostics.push(diagnostic("AB503", `Marketplace ${rule.role} '${reference}' does not look like an image`, "approximate", { target }));
+                if (rule.maxBytes !== null && found.content.length > rule.maxBytes)
+                    diagnostics.push(diagnostic("AB503", `Marketplace ${rule.role} '${reference}' exceeds ${rule.maxBytes} bytes`, "approximate", { target }));
+            }
+        }
+    }
+    return diagnostics;
+}
+/** Flags executable files outside the directories where a script belongs. */
+export function checkExecutables(payload) {
+    return payload
+        .filter((artifact) => (artifact.mode & 0o111) !== 0)
+        .filter((artifact) => !/(^|\/)(hooks|scripts|bin)\//.test(artifact.path))
+        .map((artifact) => diagnostic("AB504", `Executable file outside hooks/, scripts/, or bin/: ${artifact.path}`, "approximate", { path: artifact.path, remediation: "Move it, or clear the execute bit." }));
+}
+/** Flags paths that collide when the filesystem is case-insensitive. */
+export function checkCaseCollisions(payload) {
+    const seen = new Map();
+    const diagnostics = [];
+    for (const artifact of payload) {
+        const key = artifact.path.toLowerCase();
+        const existing = seen.get(key);
+        if (existing && existing !== artifact.path)
+            diagnostics.push(error("AB505", `Paths collide case-insensitively: '${existing}' and '${artifact.path}'`, {
+                path: artifact.path,
+            }));
+        else
+            seen.set(key, artifact.path);
+    }
+    return diagnostics;
+}
+/** Notes MCP servers invoked through an unpinned package specifier. */
+export function checkPinning(bundle) {
+    const servers = bundle.mcp?.value.mcpServers;
+    if (!servers || typeof servers !== "object")
+        return [];
+    const diagnostics = [];
+    for (const [name, value] of Object.entries(servers)) {
+        if (!value || typeof value !== "object")
+            continue;
+        const server = value;
+        if (server.command !== "npx" || !Array.isArray(server.args))
+            continue;
+        const spec = server.args.map(String).find((arg) => !arg.startsWith("-"));
+        // A bare package name resolves to whatever is newest at install time.
+        if (spec && !/.@[^/]+$/.test(spec))
+            diagnostics.push(diagnostic("AB506", `MCP server '${name}' invokes an unpinned package: ${spec}`, "exact", {
+                path: bundle.mcp?.path,
+                remediation: "Pin a version, for example package@1.2.3.",
+            }));
+    }
+    return diagnostics;
+}
+/** `sha256sum -c` compatible, sorted by byte order for reproducibility. */
+export function buildChecksums(payload) {
+    const lines = payload
+        .map((artifact) => `${sha256(artifact.content)}  ${artifact.path}`)
+        .sort((a, b) => (a.slice(66) < b.slice(66) ? -1 : 1));
+    return { path: CHECKSUMS, content: Buffer.from(lines.join("\n") + "\n"), mode: 0o644 };
+}
+/**
+ * Content-derived file type, as recorded in `sbom.json`. Exported because
+ * `agent audit --baseline` reads that `type` field back and must classify the
+ * current side by the same rule.
+ */
+export function classify(artifact) {
+    if ((artifact.mode & 0o111) !== 0)
+        return artifact.content.subarray(0, 2).toString("utf8") === "#!" ? "script" : "executable";
+    if (artifact.content.includes(0))
+        return "binary";
+    if (/\.(json|ya?ml|toml)$/i.test(artifact.path))
+        return "config";
+    if (/\.md$/i.test(artifact.path))
+        return "document";
+    return "asset";
+}
+/**
+ * A file inventory, deliberately not a CycloneDX claim.
+ *
+ * `bomFormat` and `specVersion` identify it as this tool's own format so a
+ * later `--sbom cyclonedx` can be added without changing what this one means.
+ */
+export function buildSbom(bundle, payload) {
+    const document = {
+        bomFormat: "cairn-inventory",
+        specVersion: "1",
+        generator: { name: packageName, version: packageVersion },
+        subject: { name: bundle.name, version: bundle.version },
+        components: payload.map((artifact) => ({
+            path: artifact.path,
+            type: classify(artifact),
+            sha256: sha256(artifact.content),
+            bytes: artifact.content.length,
+            mode: `0${artifact.mode.toString(8)}`,
+            origin: artifact.origin ?? "portable",
+        })),
+    };
+    return {
+        path: SBOM,
+        content: Buffer.from(JSON.stringify(document, null, 2) + "\n"),
+        mode: 0o644,
+    };
+}
+/** One deterministic archive per target and profile. */
+export function buildArchives(bundle, payload, targets, profiles) {
+    const artifacts = [];
+    const archives = [];
+    for (const target of targets) {
+        const spec = profileFor(target).marketplace;
+        if (!spec)
+            continue;
+        for (const profile of profiles) {
+            const prefix = `${target}/${profile}/`;
+            const entries = payload
+                .filter((artifact) => artifact.path.startsWith(prefix))
+                .map((artifact) => ({
+                path: artifact.path.slice(prefix.length),
+                content: artifact.content,
+                mode: artifact.mode,
+            }));
+            if (!entries.length)
+                continue;
+            const name = spec.archiveName
+                .replace("{name}", bundle.name)
+                .replace("{version}", bundle.version)
+                .replace("{target}", target)
+                .replace("{profile}", profile);
+            const content = archive(entries);
+            const destination = `archives/${name}`;
+            artifacts.push({ path: destination, content, mode: 0o644 });
+            archives.push({
+                target,
+                profile,
+                path: destination,
+                sha256: sha256(content),
+                bytes: content.length,
+            });
+        }
+    }
+    return { artifacts, archives };
+}
+//# sourceMappingURL=index.js.map

package/dist/agent/package/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/agent/package/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAQjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAC5C,MAAM,CAAC,MAAM,IAAI,GAAG,WAAW,CAAC;AAoBhC,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,KAAK,CACZ,IAAY,EACZ,OAAe,EACf,QAAkC,EAAE;IAEpC,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAA4B;IAC/C,QAAQ,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,aAAa;YAChB,OAAO,eAAe,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5B,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,OAAO,CAAC,KAAc,EAAE,SAAgD;IAC/E,QAAQ,SAAS,IAAI,UAAU,EAAE,CAAC;QAChC,KAAK,MAAM;YACT,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACxF,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjD,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,KAA4B,EAAE,MAAmB,EAAE,MAAc;IACrF,QAAQ,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,UAAU;YACb,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,KAAK,UAAU;YACb,OAAO,OAAO,CACX,MAAM,CAAC,QAAoC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAChE,KAAK,CAAC,SAAS,CAChB,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO,OAAO,CACX,MAAM,CAAC,WAAmD,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EACjF,KAAK,CAAC,SAAS,CAChB,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACpB,MAA+B,EAC/B,MAAmB,EACnB,MAAc,EACd,SAAiD;IAEjD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,IAAI,KAAK,CAAC,QAAQ;gBAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC;IACf,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACpF,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAuCD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAoC,EACpC,OAAsB,EACtB,QAAwB,EACxB,IAAqB,EACrB,UAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAEhE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,WAAW,CAAC,IAAI,CACd,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,WAAW,IAAI,sBAAsB,EAAE,aAAa,EAAE;gBACjF,MAAM;aACP,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,KAAK,QAAQ;gBAAE,SAAS;YACnC,MAAM,EAAE,GAAG,CAAC,MAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7F,MAAM,OAAO,GACX,CAAC,MAAmB,EAAE,EAAE,CACxB,CAAC,KAA4B,EAAQ,EAAE;gBACrC,WAAW,CAAC,IAAI,CACd,KAAK,CAAC,OAAO,EAAE,kBAAkB,KAAK,CAAC,IAAI,oBAAoB,MAAM,EAAE,EAAE;oBACvE,MAAM;oBACN,OAAO;oBACP,GAAG,EAAE,CAAC,MAAM,CAAC;oBACb,WAAW,EAAE,OAAO,WAAW,CAAC,KAAK,CAAC,wBAAwB;iBAC/D,CAAC,CACH,CAAC;YACJ,CAAC,CAAC;YAEJ,MAAM,SAAS,GAA8B,EAAE,CAAC;YAChD,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,EAAE,CAAC;gBACxF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/E,uEAAuE;gBACvE,mCAAmC;gBACnC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;oBACjE,WAAW,CAAC,IAAI,CACd,KAAK,CAAC,OAAO,EAAE,oBAAoB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,6BAA6B,EAAE;wBACrF,MAAM;wBACN,OAAO;wBACP,GAAG,EAAE,CAAC,MAAM,CAAC;qBACd,CAAC,CACH,CAAC;gBACJ,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YAED,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;gBAChB,aAAa,CACX,IAAI,CAAC,cAAc,IAAI,EAAE,EACzB,IAAI,CAAC,CAAC,CAAC,EACP,KAAK,MAAM,IAAI,OAAO,EAAE,EACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACjB,CAAC;YAEJ,MAAM,WAAW,GACf,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;gBACnD,GAAG,MAAM,IAAI,OAAO,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChE,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,MAAM,CAAC,IAAI,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAC9E;gBACD,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CACzB,MAAmB,EACnB,OAAsB,EACtB,OAAmB;IAEnB,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,MAAM;gBAClB,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI;oBACxB,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;oBAC3B,CAAC,CAAC,EAAE;gBACN,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACrB,IAAI,IAAI,CAAC,QAAQ;oBACf,WAAW,CAAC,IAAI,CACd,KAAK,CAAC,OAAO,EAAE,GAAG,MAAM,2BAA2B,IAAI,CAAC,IAAI,EAAE,EAAE;wBAC9D,MAAM;wBACN,WAAW,EAAE,mBAAmB,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,GAAG;qBACjF,CAAC,CACH,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CACvD,SAAS,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,CACpC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACP,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,WAAW,CAAC,IAAI,CACd,KAAK,CAAC,OAAO,EAAE,eAAe,IAAI,CAAC,IAAI,KAAK,SAAS,yBAAyB,EAAE;wBAC9E,MAAM;wBACN,WAAW,EAAE,6CAA6C;qBAC3D,CAAC,CACH,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACnF,WAAW,CAAC,IAAI,CACd,UAAU,CACR,OAAO,EACP,eAAe,IAAI,CAAC,IAAI,KAAK,SAAS,mBAAmB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACrF,aAAa,EACb,EAAE,MAAM,EAAE,CACX,CACF,CAAC;qBACC,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;oBACxC,WAAW,CAAC,IAAI,CACd,UAAU,CACR,OAAO,EACP,eAAe,IAAI,CAAC,IAAI,KAAK,SAAS,+BAA+B,EACrE,aAAa,EACb,EAAE,MAAM,EAAE,CACX,CACF,CAAC;gBACJ,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ;oBAChE,WAAW,CAAC,IAAI,CACd,UAAU,CACR,OAAO,EACP,eAAe,IAAI,CAAC,IAAI,KAAK,SAAS,aAAa,IAAI,CAAC,QAAQ,QAAQ,EACxE,aAAa,EACb,EAAE,MAAM,EAAE,CACX,CACF,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,OAAmB;IAClD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;SACnD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACxE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChB,UAAU,CACR,OAAO,EACP,sDAAsD,QAAQ,CAAC,IAAI,EAAE,EACrE,aAAa,EACb,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAC3E,CACF,CAAC;AACN,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,OAAmB;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,CAAC,IAAI;YACxC,WAAW,CAAC,IAAI,CACd,KAAK,CAAC,OAAO,EAAE,sCAAsC,QAAQ,UAAU,QAAQ,CAAC,IAAI,GAAG,EAAE;gBACvF,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC,CACH,CAAC;;YACC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,MAAM,GAAG,KAA8C,CAAC;QAC9D,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,sEAAsE;QACtE,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAChC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC,OAAO,EAAE,eAAe,IAAI,kCAAkC,IAAI,EAAE,EAAE,OAAO,EAAE;gBACxF,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI;gBACtB,WAAW,EAAE,2CAA2C;aACzD,CAAC,CACH,CAAC;IACN,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,OAAmB;IAChD,MAAM,KAAK,GAAG,OAAO;SAClB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;SAClE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAkB;IACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAC/B,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7F,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjE,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAmB,EAAE,OAAmB;IAChE,MAAM,QAAQ,GAAG;QACf,SAAS,EAAE,iBAAiB;QAC5B,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;QACzD,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;QACvD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC;YACxB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;YAC9B,IAAI,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACrC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,UAAU;SACtC,CAAC,CAAC;KACJ,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;QAC9D,IAAI,EAAE,KAAK;KACZ,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,aAAa,CAC3B,MAAmB,EACnB,OAAmB,EACnB,OAAsB,EACtB,QAAwB;IAExB,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,GAAG,CAAC;YACvC,MAAM,OAAO,GAAG,OAAO;iBACpB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;iBACtD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;gBACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC,CAAC,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,SAAS;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW;iBAC1B,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;iBAC9B,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC;iBACpC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC;iBAC3B,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,YAAY,IAAI,EAAE,CAAC;YACvC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;gBACvB,KAAK,EAAE,OAAO,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC"}

package/dist/agent/package/tar.d.ts

@@ -0,0 +1,36 @@
+export interface TarEntry {
+    /** POSIX path inside the archive. */
+    path: string;
+    content: Buffer;
+    mode: number;
+}
+export declare class TarPathTooLongError extends Error {
+    readonly path: string;
+    constructor(path: string);
+}
+/**
+ * Normalizes a mode to one of two values.
+ *
+ * This drops group/other write bits and setuid, so a stray 0o777 in a bundle
+ * cannot ship inside an archive.
+ */
+export declare function normalizeMode(mode: number, directory: boolean): number;
+/**
+ * Builds a deterministic ustar archive.
+ *
+ * Every field that could vary between machines or runs is pinned: mtime, uid,
+ * gid, uname, gname, mode, and entry order. Ordering is a byte comparison
+ * rather than `localeCompare`, which is ICU-build and locale dependent and
+ * would otherwise reorder the archive on a differently configured CI runner.
+ */
+export declare function tarball(entries: TarEntry[]): Buffer;
+/**
+ * Gzips deterministically.
+ *
+ * Node already writes a zero mtime, but the OS byte is a compile-time zlib
+ * constant that differs across platforms. Normalizing it keeps the archive
+ * byte-identical on macOS, Linux, and Windows.
+ */
+export declare function gzipDeterministic(payload: Buffer): Buffer;
+/** A deterministic `.tar.gz` for the given entries. */
+export declare function archive(entries: TarEntry[]): Buffer;

package/dist/agent/package/tar.js

@@ -0,0 +1,137 @@
+import zlib from "node:zlib";
+const BLOCK = 512;
+/** GNU's default blocking factor; padding to it keeps every tar implementation happy. */
+const RECORD = BLOCK * 20;
+/** Longest name the ustar `name` field holds; longer paths use the `prefix` field. */
+const NAME_LIMIT = 100;
+const PREFIX_LIMIT = 155;
+export class TarPathTooLongError extends Error {
+    path;
+    constructor(path) {
+        super(`Path does not fit the ustar header: ${path}`);
+        this.path = path;
+        this.name = "TarPathTooLongError";
+    }
+}
+function octal(value, width) {
+    return value.toString(8).padStart(width - 1, "0") + "\0";
+}
+/**
+ * Splits a path across the ustar `name` and `prefix` fields.
+ *
+ * A path that will not fit is refused rather than escalated to a PAX header:
+ * PAX records carry their own name and mtime, which would need a separate
+ * determinism policy. Refusing is honest and can be relaxed later.
+ */
+function splitPath(value) {
+    if (Buffer.byteLength(value) <= NAME_LIMIT)
+        return { name: value, prefix: "" };
+    const segments = value.split("/");
+    for (let index = 1; index < segments.length; index++) {
+        const prefix = segments.slice(0, index).join("/");
+        const name = segments.slice(index).join("/");
+        if (Buffer.byteLength(prefix) <= PREFIX_LIMIT && Buffer.byteLength(name) <= NAME_LIMIT)
+            return { name, prefix };
+    }
+    throw new TarPathTooLongError(value);
+}
+/**
+ * Normalizes a mode to one of two values.
+ *
+ * This drops group/other write bits and setuid, so a stray 0o777 in a bundle
+ * cannot ship inside an archive.
+ */
+export function normalizeMode(mode, directory) {
+    if (directory)
+        return 0o755;
+    return (mode & 0o111) !== 0 ? 0o755 : 0o644;
+}
+function header(entry) {
+    const block = Buffer.alloc(BLOCK, 0);
+    const { name, prefix } = splitPath(entry.directory ? `${entry.path}/` : entry.path);
+    block.write(name, 0, NAME_LIMIT, "utf8");
+    block.write(octal(entry.mode, 8), 100, 8, "utf8");
+    // uid/gid zero and uname/gname empty: a nonempty uname would embed the
+    // building machine's user in the archive bytes.
+    block.write(octal(0, 8), 108, 8, "utf8");
+    block.write(octal(0, 8), 116, 8, "utf8");
+    block.write(octal(entry.size, 12), 124, 12, "utf8");
+    block.write(octal(0, 12), 136, 12, "utf8"); // mtime
+    block.write("        ", 148, 8, "utf8"); // checksum placeholder: eight spaces
+    block.write(entry.directory ? "5" : "0", 156, 1, "utf8");
+    block.write("ustar\0", 257, 6, "utf8");
+    block.write("00", 263, 2, "utf8");
+    block.write(octal(0, 8), 329, 8, "utf8"); // devmajor
+    block.write(octal(0, 8), 337, 8, "utf8"); // devminor
+    if (prefix)
+        block.write(prefix, 345, PREFIX_LIMIT, "utf8");
+    let checksum = 0;
+    for (const byte of block)
+        checksum += byte;
+    block.write(checksum.toString(8).padStart(6, "0") + "\0 ", 148, 8, "utf8");
+    return block;
+}
+function pad(size) {
+    const remainder = size % BLOCK;
+    return remainder === 0 ? Buffer.alloc(0) : Buffer.alloc(BLOCK - remainder, 0);
+}
+/**
+ * Builds a deterministic ustar archive.
+ *
+ * Every field that could vary between machines or runs is pinned: mtime, uid,
+ * gid, uname, gname, mode, and entry order. Ordering is a byte comparison
+ * rather than `localeCompare`, which is ICU-build and locale dependent and
+ * would otherwise reorder the archive on a differently configured CI runner.
+ */
+export function tarball(entries) {
+    const sorted = [...entries].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    // Directory entries are emitted explicitly so `tar tf` lists a complete tree.
+    const directories = new Set();
+    for (const entry of sorted) {
+        const segments = entry.path.split("/");
+        for (let index = 1; index < segments.length; index++)
+            directories.add(segments.slice(0, index).join("/"));
+    }
+    const all = [
+        ...[...directories].map((path) => ({
+            path,
+            content: Buffer.alloc(0),
+            mode: 0o755,
+            directory: true,
+        })),
+        ...sorted.map((entry) => ({ ...entry, directory: false })),
+    ].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    const blocks = [];
+    for (const entry of all) {
+        blocks.push(header({
+            path: entry.path,
+            size: entry.content.length,
+            mode: normalizeMode(entry.mode, entry.directory),
+            directory: entry.directory,
+        }));
+        if (entry.content.length)
+            blocks.push(entry.content, pad(entry.content.length));
+    }
+    blocks.push(Buffer.alloc(BLOCK * 2, 0));
+    const body = Buffer.concat(blocks);
+    const remainder = body.length % RECORD;
+    return remainder === 0 ? body : Buffer.concat([body, Buffer.alloc(RECORD - remainder, 0)]);
+}
+/**
+ * Gzips deterministically.
+ *
+ * Node already writes a zero mtime, but the OS byte is a compile-time zlib
+ * constant that differs across platforms. Normalizing it keeps the archive
+ * byte-identical on macOS, Linux, and Windows.
+ */
+export function gzipDeterministic(payload) {
+    const compressed = zlib.gzipSync(payload, { level: 9 });
+    compressed.writeUInt32LE(0, 4); // MTIME
+    compressed[9] = 0x03; // OS = Unix
+    return compressed;
+}
+/** A deterministic `.tar.gz` for the given entries. */
+export function archive(entries) {
+    return gzipDeterministic(tarball(entries));
+}
+//# sourceMappingURL=tar.js.map

package/dist/agent/package/tar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.js","sourceRoot":"","sources":["../../../src/agent/package/tar.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,yFAAyF;AACzF,MAAM,MAAM,GAAG,KAAK,GAAG,EAAE,CAAC;AAE1B,sFAAsF;AACtF,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACvB;IAArB,YAAqB,IAAY;QAC/B,KAAK,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;QADlC,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,KAAa;IACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU;YACpF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,SAAkB;IAC5D,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9C,CAAC;AAED,SAAS,MAAM,CAAC,KAAuE;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpF,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,uEAAuE;IACvE,gDAAgD;IAChD,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACpD,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ;IACpD,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,qCAAqC;IAC9E,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;IACrD,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;IACrD,IAAI,MAAM;QAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAE3D,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,QAAQ,IAAI,IAAI,CAAC;IAC3C,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,SAAS,GAAG,IAAI,GAAG,KAAK,CAAC;IAC/B,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,OAAmB;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7F,8EAA8E;IAC9E,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE;YAClD,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI;YACJ,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACxB,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;KAC3D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CACT,MAAM,CAAC;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC1B,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC;YAChD,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CACH,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvC,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;IACxC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,YAAY;IAClC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,OAAO,CAAC,OAAmB;IACzC,OAAO,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/agent/parser.d.ts

@@ -0,0 +1,13 @@
+import type { AgentBundle, SourceFile } from "./types.js";
+export declare function readStructured(file: string): Record<string, unknown>;
+export declare function splitFrontmatter(content: string, file: string): {
+    metadata: Record<string, unknown>;
+    body: string;
+};
+/**
+ * Every file under `directory`, with root-relative paths in the platform's
+ * separator. Refuses a symlink that resolves outside `directory`, which is why
+ * callers outside this module use it rather than walking the tree themselves.
+ */
+export declare function allFiles(directory: string): SourceFile[];
+export declare function loadBundle(source: string): AgentBundle;