@deksden-com/dd-flow-cli 0.9.0-beta.135 → 0.9.0-beta.136

package/dist/services/model-catalog.js

@@ -0,0 +1,109 @@
+import { AppError } from "../shared/errors.js";
+import { validateHybridContract } from "./hybrid-contracts.js";
+import { mergeModelListing } from "./model-discovery.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+// Reviewed adapter fallbacks and retained eval configurations, not vendor
+// availability promises or recommended defaults. Missing facts stay unknown;
+// historical eval qualification/capacity claims are deliberately not imported.
+const seed = {
+    schema_id: "dd-flow/model-catalog@1", version: "1.1.0",
+    entries: [{ harness: "agy", provider: "google", model: "gemini-3.1-pro-high",
+            settings: { reasoning: ["unknown"], mode: ["unknown"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-flow-cli/blob/2ba2ce2364705cf59fdc48bdd5dc5b37fb7cd784/src/harness-runtime/lib/dd-agy.mjs#L7",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "grok", provider: "xai", model: "grok-4.6",
+            settings: { reasoning: ["high"], mode: ["bypassPermissions"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-flow-cli/blob/2ba2ce2364705cf59fdc48bdd5dc5b37fb7cd784/src/harness-runtime/lib/dd-grok.mjs#L48",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "codex", provider: "unknown", model: "gpt-6.1-sol",
+            settings: { reasoning: ["high"], mode: ["unknown"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/codex-desktop-gpt-6-1-sol-high.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "zcode", provider: "builtin:zai-coding-plan", model: "GLM-5.3",
+            settings: { reasoning: ["high"], mode: ["yolo"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/zcode-acp-zai-glm-5-3-high.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "opencode", provider: "opencode", model: "big-pickle",
+            settings: { reasoning: ["default"], mode: ["build"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/opencode-server-opencode-big-pickle-default.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "droid", provider: "openai", model: "gpt-5.6-sol",
+            settings: { reasoning: ["high"], mode: ["auto-high"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/droid-cli-openai-gpt-5-6-sol-high.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } }]
+};
+const families = ["codex", "zcode", "agy", "opencode", "grok", "droid"];
+const identifier = (value, max = 128) => typeof value === "string" && value.length <= max && /^[A-Za-z0-9][A-Za-z0-9._:/+-]*$/.test(value);
+const providerId = (value) => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value);
+function invalid() {
+    throw new AppError("model_catalog_input", "Model catalog input requires reviewed seed data and an explicit observation scope; see dd-flow models --help", 2, { effect: "no_effect", help: "models" });
+}
+function readJson(file) {
+    let bytes;
+    try {
+        bytes = readBoundedReleaseFile(file, 4 * 1024 * 1024);
+    }
+    catch {
+        throw new AppError("model_input_unavailable", "Model input must be a bounded readable regular file; see dd-flow models --help", 1, { effect: "no_effect", help: "models" });
+    }
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return invalid();
+    }
+}
+export function readModelSeed(file) {
+    const input = file === undefined ? structuredClone(seed) : readJson(file);
+    if (validateHybridContract("model-catalog", input).length)
+        invalid();
+    const catalog = input;
+    if (catalog.entries.length > 10_000 || catalog.entries.some(entry => {
+        let source;
+        try {
+            source = new URL(entry.provenance.source);
+        }
+        catch {
+            return true;
+        }
+        const reviewed = entry.provenance.reviewed_at;
+        return entry.qualification.scope !== "seed-only" || !providerId(entry.provider) || !identifier(entry.model, 256)
+            || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(reviewed) || !Number.isFinite(Date.parse(reviewed))
+            || new Date(reviewed).toISOString() !== reviewed.replace(/Z$/, reviewed.includes(".") ? "Z" : ".000Z")
+            || source.protocol !== "https:" || source.username !== "" || source.password !== "" || source.search !== ""
+            || entry.provenance.source.length > 2048
+            || [...entry.settings.reasoning, ...entry.settings.mode].some(value => !identifier(value, 64));
+    }))
+        invalid();
+    return structuredClone(catalog);
+}
+/** Offline reader only. A supplied snapshot is an observation, not account authorization. */
+export function listOperatorModels(input) {
+    if (input.harness !== undefined && !families.includes(input.harness) || input.provider !== undefined && !providerId(input.provider)
+        || input.model !== undefined && !identifier(input.model, 256)
+        || input.accountSha256 !== undefined && !/^[a-f0-9]{64}$/.test(input.accountSha256)
+        || (input.accountSha256 !== undefined || input.observationFile !== undefined) && (!input.harness || !input.provider || !input.accountSha256))
+        invalid();
+    // Validate all selectors before opening operator files.
+    const catalog = readModelSeed(input.seedFile);
+    let entries, reason, observedAt = null;
+    if (input.accountSha256) {
+        const scope = { harness: input.harness, provider: input.provider, account_sha256: input.accountSha256 };
+        const observation = input.observationFile === undefined ? undefined : readJson(input.observationFile);
+        const merged = mergeModelListing(catalog, scope, observation);
+        entries = merged.entries.map(entry => ({ harness: scope.harness, provider: scope.provider, ...entry }));
+        reason = merged.reason;
+        observedAt = merged.observed_at;
+    }
+    else {
+        entries = catalog.entries.filter(entry => (!input.harness || entry.harness === input.harness) && (!input.provider || entry.provider === input.provider))
+            .map(entry => ({ harness: entry.harness, provider: entry.provider, model: entry.model, seed: structuredClone(entry),
+            availability: "unknown", account_access: "unknown", qualified: "unknown" }));
+        reason = "account_scope_not_selected";
+    }
+    if (input.model)
+        entries = entries.filter(entry => entry.model === input.model);
+    return { catalog_version: catalog.version, observed_at: observedAt, reason, entries,
+        families: families.map(harness => ({ harness, seed_status: catalog.entries.some(entry => entry.harness === harness) ? "reviewed_entries" : "not_curated",
+            account_access: "unknown", qualified: "unknown" })) };
+}

package/dist/services/model-discovery.js

@@ -0,0 +1,46 @@
+import { AppError } from "../shared/errors.js";
+import { validateHybridContract } from "./hybrid-contracts.js";
+const invalid = () => new AppError("model_discovery_input", "Model discovery input does not match its scoped contract", 2, { effect: "no_effect" });
+export function validateModelScope(scope) {
+    if (!scope || typeof scope !== "object" || Array.isArray(scope)
+        || ["harness", "provider", "account_sha256"].some(key => !Object.hasOwn(scope, key))
+        || Object.keys(scope).some(key => !["harness", "provider", "account_sha256"].includes(key))
+        || !["codex", "zcode", "agy", "opencode", "grok", "droid"].includes(scope.harness)
+        || typeof scope.provider !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(scope.provider)
+        || typeof scope.account_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(scope.account_sha256))
+        throw invalid();
+}
+/** Merge only a matching account/provider snapshot. Listed is not authorized or qualified. */
+export function mergeModelListing(seed, scope, observation) {
+    validateModelScope(scope);
+    if (validateHybridContract("model-catalog", seed).length)
+        throw invalid();
+    if (observation !== undefined) {
+        if (!observation || typeof observation !== "object" || Array.isArray(observation)
+            || ["scope", "observed_at", "status", "complete", "models"].some(key => !Object.hasOwn(observation, key)))
+            throw invalid();
+        validateModelScope(observation.scope);
+        if (Object.keys(observation).some(key => !["scope", "observed_at", "status", "complete", "models"].includes(key))
+            || typeof observation.observed_at !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(observation.observed_at)
+            || !Number.isFinite(Date.parse(observation.observed_at))
+            || new Date(observation.observed_at).toISOString() !== observation.observed_at.replace(/Z$/, observation.observed_at.includes(".") ? "Z" : ".000Z")
+            || !["listed", "unavailable"].includes(observation.status)
+            || typeof observation.complete !== "boolean" || !Array.isArray(observation.models)
+            || observation.models.length > 10_000 || observation.models.some(model => typeof model !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,255}$/.test(model))
+            || new Set(observation.models).size !== observation.models.length
+            || observation.status === "unavailable" && (observation.models.length > 0 || observation.complete))
+            throw invalid();
+    }
+    const matches = observation && observation.scope.harness === scope.harness && observation.scope.provider === scope.provider
+        && observation.scope.account_sha256 === scope.account_sha256;
+    const listing = matches && observation.status === "listed" ? observation : undefined;
+    const entries = seed.entries.filter(entry => entry.harness === scope.harness && entry.provider === scope.provider);
+    const seeded = new Map(entries.map(entry => [entry.model, entry]));
+    const names = new Set([...seeded.keys(), ...(listing?.models ?? [])]);
+    return { scope: { ...scope }, observed_at: matches ? observation.observed_at : null,
+        reason: !observation ? "not_observed" : !matches ? "foreign_scope_ignored" : !listing ? "listing_unavailable" : "scoped_listing",
+        entries: [...names].sort().map(model => ({ model,
+            seed: seeded.has(model) ? structuredClone(seeded.get(model)) : null,
+            availability: listing?.models.includes(model) ? "listed" : listing?.complete ? "not_listed" : "unknown",
+            account_access: "unknown", qualified: "unknown" })) };
+}

package/dist/services/operator-profiles.js

@@ -0,0 +1,236 @@
+import fs from "node:fs";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest, validateHybridContract } from "./hybrid-contracts.js";
+import { acquireInstallationLock } from "./installation-lock.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+export function operatorSettingsPath(home) { return path.join(home, "profile-settings.json"); }
+function profileError(code, message, exitCode = 2) {
+    return new AppError(code, `${message}; use dd-flow profiles --help`, exitCode, { phase: "profiles", effect: "no_effect", recoverable: true });
+}
+function completeSettings(input) {
+    const value = { ...input, profiles: input.profiles.map(entry => ({ ...entry, revision: hybridDigest(entry.profile) })) };
+    return { ...value, revision: hybridDigest(value) };
+}
+function admittedSettings(input) {
+    const issues = validateHybridContract("profile-settings", input);
+    if (issues.length)
+        throw profileError("profile_settings_invalid", "Profile settings violate the schema or aliases/revision contract");
+    const settings = input;
+    for (const { profile } of settings.profiles) {
+        if ([profile.provider, profile.model, profile.reasoning, profile.mode].some(value => !value.trim())) {
+            throw profileError("profile_settings_invalid", "Profile execution values must not be blank");
+        }
+    }
+    return settings;
+}
+function readRegularJson(file) {
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readBoundedReleaseFile(file, 4 * 1024 * 1024)));
+    }
+    catch {
+        // Parser errors can contain submitted secrets. Never retain input text or cause.
+        throw profileError("profile_settings_invalid", "Profile input is unreadable or malformed JSON");
+    }
+}
+/** First successful write imports valid legacy IDs; thereafter the settings file is the sole owner. */
+export function readOperatorProfiles(home) {
+    const file = operatorSettingsPath(home);
+    if (fs.existsSync(file))
+        return admittedSettings(readRegularJson(file));
+    const profiles = [];
+    const legacy = path.join(home, "agent-profiles");
+    if (fs.existsSync(legacy)) {
+        for (const entry of fs.readdirSync(legacy).sort()) {
+            if (!entry.endsWith(".json"))
+                continue;
+            const profile = readRegularJson(path.join(legacy, entry));
+            const id = entry.slice(0, -5);
+            profiles.push({ id, revision: hybridDigest(profile), profile });
+        }
+    }
+    return admittedSettings(completeSettings({ schema_id: "dd-flow/profile-settings@1", profiles,
+        aliases: {}, default_profile: null }));
+}
+export function resolveOperatorProfile(settings, id) {
+    const selected = id ?? settings.default_profile;
+    if (!selected)
+        throw profileError("agent_profile_missing", "Select an explicit profile or configure a default", 1);
+    const target = Object.hasOwn(settings.aliases, selected) ? settings.aliases[selected] : selected;
+    const entry = settings.profiles.find(item => item.id === target);
+    if (!entry)
+        throw profileError("agent_profile_missing", "Selected profile is unavailable", 1);
+    return structuredClone(entry.profile);
+}
+/** Used by explicit files and onboarding alike; extra credential fields fail before any write. */
+export function prepareOperatorProfile(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        throw profileError("profile_settings_invalid", "Profile must be an object");
+    const sample = input;
+    const value = completeSettings({ schema_id: "dd-flow/profile-settings@1", profiles: [
+            { id: sample?.id, revision: hybridDigest(input), profile: sample }
+        ], aliases: {}, default_profile: null });
+    return admittedSettings(value).profiles[0].profile;
+}
+export function readOperatorProfileInput(file) {
+    return prepareOperatorProfile(readRegularJson(file));
+}
+function changedSettings(current, mutation) {
+    const next = structuredClone(current);
+    if (mutation.action === "create" || mutation.action === "edit") {
+        if (mutation.action === "create" && mutation.setDefault !== undefined && typeof mutation.setDefault !== "boolean") {
+            throw profileError("profile_settings_invalid", "Default selection must be an explicit boolean");
+        }
+        const profile = prepareOperatorProfile(mutation.profile);
+        const index = next.profiles.findIndex(entry => entry.id === profile.id);
+        if (mutation.action === "create" && index >= 0)
+            throw profileError("profile_conflict", "Profile ID already exists", 1);
+        if (mutation.action === "edit" && index < 0)
+            throw profileError("agent_profile_missing", "Cannot edit a missing profile", 1);
+        const entry = { id: profile.id, revision: hybridDigest(profile), profile };
+        if (index >= 0)
+            next.profiles[index] = entry;
+        else
+            next.profiles.push(entry);
+        if (mutation.action === "create" && mutation.setDefault === true)
+            next.default_profile = profile.id;
+    }
+    else if (mutation.action === "remove") {
+        if (!next.profiles.some(entry => entry.id === mutation.id))
+            throw profileError("agent_profile_missing", "Cannot remove a missing profile", 1);
+        if (Object.values(next.aliases).includes(mutation.id) || next.default_profile === mutation.id
+            || next.default_profile !== null && next.aliases[next.default_profile] === mutation.id) {
+            throw profileError("profile_in_use", "Remove aliases and change the default before removing this profile", 1);
+        }
+        next.profiles = next.profiles.filter(entry => entry.id !== mutation.id);
+    }
+    else if (mutation.action === "alias") {
+        if (mutation.target === null) {
+            if (!Object.hasOwn(next.aliases, mutation.alias))
+                throw profileError("profile_alias_missing", "Alias is unavailable", 1);
+            if (next.default_profile === mutation.alias)
+                throw profileError("profile_in_use", "Change the default before removing its alias", 1);
+            delete next.aliases[mutation.alias];
+        }
+        else
+            Object.defineProperty(next.aliases, mutation.alias, { value: mutation.target, enumerable: true, writable: true, configurable: true });
+    }
+    else if (mutation.action === "set-default")
+        next.default_profile = mutation.id;
+    else
+        throw profileError("profile_settings_invalid", "Unknown profile mutation");
+    const { revision: _revision, ...content } = next;
+    void _revision;
+    return admittedSettings(completeSettings(content));
+}
+/** Pure preflight suitable for freezing into an installation request before any effects. */
+export function prepareProfileCreation(settings, profile, setDefault) {
+    if (typeof setDefault !== "boolean")
+        throw profileError("profile_settings_invalid", "Default selection requires explicit consent");
+    const before = admittedSettings(structuredClone(settings)), admitted = prepareOperatorProfile(profile);
+    const after = changedSettings(before, { action: "create", profile: admitted, setDefault });
+    return { schema_id: "dd-flow/profile-creation-intent@1", before, after, profile: structuredClone(admitted), set_default: setDefault };
+}
+/** Exact frozen intent reconciliation: an already-applied write is not applied a second time.
+ * A later edit/default change is a conflict, never a reason to restore old settings.
+ */
+export function validateProfileCreationIntent(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input)
+        || Object.keys(input).some(key => !["schema_id", "before", "after", "profile", "set_default"].includes(key))
+        || ["schema_id", "before", "after", "profile", "set_default"].some(key => !Object.hasOwn(input, key))
+        || input.schema_id !== "dd-flow/profile-creation-intent@1")
+        throw profileError("profile_settings_invalid", "Invalid profile creation intent");
+    const expected = prepareProfileCreation(input.before, input.profile, input.set_default);
+    admittedSettings(input.after);
+    if (hybridDigest(expected) !== hybridDigest(input))
+        throw profileError("profile_settings_invalid", "Profile creation intent changed");
+}
+export function readProfileCreationIntent(file) {
+    try {
+        const input = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readBoundedReleaseFile(file, 4 * 1024 * 1024)));
+        validateProfileCreationIntent(input);
+        return input;
+    }
+    catch {
+        throw profileError("profile_settings_invalid", "Profile creation intent must be a bounded valid regular JSON file");
+    }
+}
+export function commitProfileCreation(home, input) {
+    validateProfileCreationIntent(input);
+    const current = readOperatorProfiles(home);
+    if (current.revision === input.after.revision)
+        return { replayed: true, settings: current };
+    return { replayed: false, settings: mutateOperatorProfiles(home, input.before.revision, { action: "create", profile: input.profile, setDefault: input.set_default }) };
+}
+/** Compare-and-swap under an exclusive owned lock; no dual writer for legacy profile files. */
+export function mutateOperatorProfiles(home, expectedRevision, mutation) {
+    const before = readOperatorProfiles(home);
+    if (before.revision !== expectedRevision)
+        throw profileError("profile_revision_conflict", "Profile settings changed; reread before retrying", 1);
+    const prepared = changedSettings(before, mutation); // Fully validate before creating the home/lock.
+    const serialized = JSON.stringify(prepared, null, 2) + "\n";
+    if (Buffer.byteLength(serialized) > 4 * 1024 * 1024)
+        throw profileError("profile_settings_invalid", "Profile settings exceed the bounded reader limit");
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    const lock = path.join(home, "profile-settings.lock");
+    // Profiles use storage-owner identity, not a setup request ledger. A dead
+    // writer may be recovered by a later CAS mutation, including after commit.
+    let lease;
+    try {
+        lease = acquireInstallationLock(lock, hybridDigest({ resource: "profile-settings", home: path.resolve(home) }));
+    }
+    catch {
+        throw profileError("profile_write_conflict", "Another profile writer or unreconciled lock exists", 1);
+    }
+    const temporary = path.join(home, `.profile-settings-${randomUUID()}.tmp`);
+    let ownsTemporary = false;
+    let renameAttempted = false;
+    let failure;
+    let result;
+    try {
+        if (readOperatorProfiles(home).revision !== expectedRevision)
+            throw profileError("profile_revision_conflict", "Profile settings changed while acquiring the lock", 1);
+        const fd = fs.openSync(temporary, "wx", 0o600);
+        ownsTemporary = true;
+        try {
+            fs.writeFileSync(fd, serialized);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        renameAttempted = true;
+        fs.renameSync(temporary, operatorSettingsPath(home));
+        result = readOperatorProfiles(home);
+    }
+    catch (error) {
+        failure = error instanceof AppError && !renameAttempted ? error : new AppError("profile_write_interrupted", "Profile write requires reconciliation; reread settings before retrying", 1, { phase: "profiles", effect: "unknown", recoverable: true,
+            next_action: "dd-flow profiles list --json" });
+    }
+    finally {
+        let cleanupFailed = false;
+        try {
+            if (ownsTemporary && fs.existsSync(temporary))
+                fs.unlinkSync(temporary);
+        }
+        catch {
+            cleanupFailed = true;
+        }
+        try {
+            lease.release();
+        }
+        catch {
+            cleanupFailed = true;
+        }
+        if (cleanupFailed) {
+            if (failure)
+                failure.details.cleanup = "not_confirmed";
+            else
+                failure = new AppError("profile_cleanup_failed", "Profile writer cleanup requires reconciliation", 1, { phase: "profiles", effect: "unknown", cleanup: "not_confirmed", next_action: "dd-flow profiles list --json" });
+        }
+    }
+    if (failure)
+        throw failure;
+    return result;
+}

package/dist/services/release-archive-producer.js

@@ -0,0 +1,52 @@
+import { gzipSync } from "node:zlib";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { inspectReleaseArchive } from "./release-archive.js";
+/** Deterministic regular-file-only tar/gzip. Extraction admission is also applied
+ * to producer output; producing bytes never grants them installation authority.
+ */
+export function produceReleaseArchive(files) {
+    const refuse = () => { throw new AppError("release_producer", "Archive production refused", 1, { reason: "invalid_archive_input", effect: "no_effect" }); };
+    if (!files.length || files.length > 100_000)
+        refuse();
+    const chunks = [];
+    let expanded = 1024;
+    const append = (name, bytes, mode, type) => {
+        expanded += 512 + Math.ceil(bytes.length / 512) * 512;
+        if (expanded > 512 * 1024 * 1024)
+            refuse();
+        const header = Buffer.alloc(512);
+        header.write(name);
+        header.write(mode.toString(8).padStart(7, "0") + "\0", 100);
+        header.write("0000000\0", 108);
+        header.write("0000000\0", 116);
+        header.write(bytes.length.toString(8).padStart(11, "0") + "\0", 124);
+        header.write("00000000000\0", 136);
+        header.fill(32, 148, 156);
+        header[156] = type;
+        header.write("ustar\0", 257);
+        header.write("00", 263);
+        header.write(header.reduce((sum, byte) => sum + byte, 0).toString(8).padStart(6, "0") + "\0 ", 148);
+        chunks.push(header, bytes, Buffer.alloc((512 - bytes.length % 512) % 512));
+    };
+    let index = 0;
+    for (const file of [...files].sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)))) {
+        const length = Buffer.byteLength(file.path);
+        if (!length || length > 4096 || !Buffer.isBuffer(file.bytes) || typeof file.executable !== "boolean")
+            refuse();
+        let name = file.path;
+        if (length > 100) {
+            const record = `path=${file.path}\n`;
+            let size = Buffer.byteLength(record) + 2;
+            while (size !== Buffer.byteLength(record) + String(size).length + 1)
+                size = Buffer.byteLength(record) + String(size).length + 1;
+            append(`PaxHeaders/${index}`, Buffer.from(`${size} ${record}`), 0o644, 120);
+            name = `entries/${index}`;
+        }
+        append(name, file.bytes, file.executable ? 0o755 : 0o644, 48);
+        index++;
+    }
+    const bytes = gzipSync(Buffer.concat([...chunks, Buffer.alloc(1024)]), { level: 9 });
+    inspectReleaseArchive({ url: "https://producer.invalid/archive", bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") }, bytes);
+    return bytes;
+}

package/dist/services/release-archive.js

@@ -0,0 +1,143 @@
+import { gunzipSync } from "node:zlib";
+import { TextDecoder } from "node:util";
+import { AppError } from "../shared/errors.js";
+import { verifyReleaseArchive } from "./release-manifest.js";
+const defaultLimits = { expandedBytes: 512 * 1024 * 1024, entries: 100_000 };
+const decoder = new TextDecoder("utf-8", { fatal: true });
+function refuse(reason) {
+    throw new AppError("archive_integrity", "Release archive cannot be extracted", 1, { reason, phase: "archive_validation", effect: "no_effect", help: "setup" });
+}
+function text(bytes) {
+    try {
+        return decoder.decode(bytes);
+    }
+    catch {
+        return refuse("invalid_utf8");
+    }
+}
+function field(bytes) {
+    const zero = bytes.indexOf(0);
+    if (zero >= 0 && bytes.subarray(zero).some(byte => byte !== 0))
+        refuse("invalid_header_string");
+    return text(zero < 0 ? bytes : bytes.subarray(0, zero));
+}
+function octal(bytes) {
+    const value = text(bytes).replace(/\0.*$/, "").trim();
+    if (!/^[0-7]+$/.test(value))
+        refuse("invalid_numeric_header");
+    const result = Number.parseInt(value, 8);
+    if (!Number.isSafeInteger(result))
+        refuse("oversized_numeric_header");
+    return result;
+}
+function containedPath(input, directory) {
+    const value = directory && input.endsWith("/") ? input.slice(0, -1) : input;
+    if (!value || value !== value.normalize("NFC") || /[\\:]/.test(value) ||
+        [...value].some(character => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127))
+        refuse("unsafe_path");
+    for (const part of value.split("/")) {
+        if (!part || part === "." || part === ".." || /[. ]$/.test(part) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part))
+            refuse("unsafe_path");
+    }
+    return value;
+}
+function pax(bytes) {
+    const result = {};
+    let offset = 0;
+    while (offset < bytes.length) {
+        const space = bytes.indexOf(32, offset);
+        if (space < 0)
+            refuse("invalid_pax");
+        const lengthText = text(bytes.subarray(offset, space));
+        if (!/^[1-9][0-9]*$/.test(lengthText))
+            refuse("invalid_pax");
+        const length = Number(lengthText), end = offset + length;
+        if (!Number.isSafeInteger(length) || end > bytes.length || end <= space + 1 || bytes[end - 1] !== 10)
+            refuse("invalid_pax");
+        const record = text(bytes.subarray(space + 1, end - 1)), equal = record.indexOf("=");
+        if (equal < 1)
+            refuse("invalid_pax");
+        const key = record.slice(0, equal), value = record.slice(equal + 1);
+        if (Object.hasOwn(result, key))
+            refuse("duplicate_pax_key");
+        // Do not allow sparse files, links, custom extraction attributes or size overrides.
+        if (!["path", "mtime", "atime", "ctime", "uid", "gid", "uname", "gname"].includes(key))
+            refuse("unsupported_pax_key");
+        result[key] = value;
+        offset = end;
+    }
+    return result;
+}
+/** Validate the entire archive before writing any entry. Links and special files never enter staging. */
+export function inspectReleaseArchive(identity, compressed, limits = defaultLimits) {
+    verifyReleaseArchive(identity, compressed);
+    if (!Number.isSafeInteger(limits.expandedBytes) || limits.expandedBytes < 1024 || !Number.isSafeInteger(limits.entries) || limits.entries < 1)
+        refuse("invalid_limits");
+    let tar;
+    try {
+        tar = gunzipSync(compressed, { maxOutputLength: limits.expandedBytes });
+    }
+    catch {
+        return refuse("invalid_or_oversized_gzip");
+    }
+    if (tar.length % 512 !== 0)
+        refuse("truncated_tar");
+    const entries = [], paths = new Map(), kinds = new Map();
+    let offset = 0, headers = 0, pending = null;
+    while (offset + 512 <= tar.length) {
+        const header = tar.subarray(offset, offset + 512);
+        if (header.every(byte => byte === 0)) {
+            if (pending || offset + 1024 > tar.length || tar.subarray(offset).some(byte => byte !== 0))
+                refuse("invalid_tar_trailer");
+            return entries;
+        }
+        if (++headers > limits.entries * 2)
+            refuse("too_many_headers");
+        const checksum = header.reduce((sum, byte, index) => sum + (index >= 148 && index < 156 ? 32 : byte), 0);
+        if (octal(header.subarray(148, 156)) !== checksum)
+            refuse("header_checksum_mismatch");
+        const size = octal(header.subarray(124, 136)), mode = octal(header.subarray(100, 108));
+        const next = offset + 512 + Math.ceil(size / 512) * 512;
+        if (!Number.isSafeInteger(next) || next > tar.length)
+            refuse("truncated_entry");
+        const bytes = tar.subarray(offset + 512, offset + 512 + size);
+        const type = header[156];
+        if (type === 120) {
+            if (pending)
+                refuse("stacked_pax_headers");
+            pending = pax(bytes);
+            offset = next;
+            continue;
+        }
+        if (type !== 0 && type !== 48 && type !== 53)
+            refuse("unsupported_entry_type");
+        const directory = type === 53;
+        if (directory && size !== 0)
+            refuse("directory_has_data");
+        const prefix = field(header.subarray(345, 500));
+        const name = field(header.subarray(0, 100));
+        const entryPath = containedPath(pending?.path ?? (prefix ? `${prefix}/${name}` : name), directory);
+        pending = null;
+        const parts = entryPath.split("/");
+        for (let index = 1; index <= parts.length; index++) {
+            const partial = parts.slice(0, index).join("/"), folded = partial.toLowerCase();
+            const previous = paths.get(folded);
+            if (previous && previous !== partial)
+                refuse("case_collision");
+            paths.set(folded, partial);
+            if (index < parts.length && kinds.get(partial) === "file")
+                refuse("file_directory_collision");
+            if (index < parts.length && !kinds.has(partial))
+                kinds.set(partial, "implicit_directory");
+        }
+        const previous = kinds.get(entryPath);
+        if (previous && !(directory && previous === "implicit_directory"))
+            refuse("duplicate_or_conflicting_entry");
+        kinds.set(entryPath, directory ? "directory" : "file");
+        if (entries.length >= limits.entries)
+            refuse("too_many_entries");
+        entries.push({ path: entryPath, kind: directory ? "directory" : "file", mode: mode & 0o111 ? 0o755 : 0o644, bytes: Buffer.from(bytes) });
+        offset = next;
+    }
+    return refuse("missing_tar_trailer");
+}