@deksden-com/dd-flow-cli 0.9.0-beta.136 → 0.9.0-beta.137

package/dist/services/model-discovery.js

@@ -1,46 +0,0 @@
-import { AppError } from "../shared/errors.js";
-import { validateHybridContract } from "./hybrid-contracts.js";
-const invalid = () => new AppError("model_discovery_input", "Model discovery input does not match its scoped contract", 2, { effect: "no_effect" });
-export function validateModelScope(scope) {
-    if (!scope || typeof scope !== "object" || Array.isArray(scope)
-        || ["harness", "provider", "account_sha256"].some(key => !Object.hasOwn(scope, key))
-        || Object.keys(scope).some(key => !["harness", "provider", "account_sha256"].includes(key))
-        || !["codex", "zcode", "agy", "opencode", "grok", "droid"].includes(scope.harness)
-        || typeof scope.provider !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(scope.provider)
-        || typeof scope.account_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(scope.account_sha256))
-        throw invalid();
-}
-/** Merge only a matching account/provider snapshot. Listed is not authorized or qualified. */
-export function mergeModelListing(seed, scope, observation) {
-    validateModelScope(scope);
-    if (validateHybridContract("model-catalog", seed).length)
-        throw invalid();
-    if (observation !== undefined) {
-        if (!observation || typeof observation !== "object" || Array.isArray(observation)
-            || ["scope", "observed_at", "status", "complete", "models"].some(key => !Object.hasOwn(observation, key)))
-            throw invalid();
-        validateModelScope(observation.scope);
-        if (Object.keys(observation).some(key => !["scope", "observed_at", "status", "complete", "models"].includes(key))
-            || typeof observation.observed_at !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(observation.observed_at)
-            || !Number.isFinite(Date.parse(observation.observed_at))
-            || new Date(observation.observed_at).toISOString() !== observation.observed_at.replace(/Z$/, observation.observed_at.includes(".") ? "Z" : ".000Z")
-            || !["listed", "unavailable"].includes(observation.status)
-            || typeof observation.complete !== "boolean" || !Array.isArray(observation.models)
-            || observation.models.length > 10_000 || observation.models.some(model => typeof model !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,255}$/.test(model))
-            || new Set(observation.models).size !== observation.models.length
-            || observation.status === "unavailable" && (observation.models.length > 0 || observation.complete))
-            throw invalid();
-    }
-    const matches = observation && observation.scope.harness === scope.harness && observation.scope.provider === scope.provider
-        && observation.scope.account_sha256 === scope.account_sha256;
-    const listing = matches && observation.status === "listed" ? observation : undefined;
-    const entries = seed.entries.filter(entry => entry.harness === scope.harness && entry.provider === scope.provider);
-    const seeded = new Map(entries.map(entry => [entry.model, entry]));
-    const names = new Set([...seeded.keys(), ...(listing?.models ?? [])]);
-    return { scope: { ...scope }, observed_at: matches ? observation.observed_at : null,
-        reason: !observation ? "not_observed" : !matches ? "foreign_scope_ignored" : !listing ? "listing_unavailable" : "scoped_listing",
-        entries: [...names].sort().map(model => ({ model,
-            seed: seeded.has(model) ? structuredClone(seeded.get(model)) : null,
-            availability: listing?.models.includes(model) ? "listed" : listing?.complete ? "not_listed" : "unknown",
-            account_access: "unknown", qualified: "unknown" })) };
-}

package/dist/services/operator-profiles.js

@@ -1,236 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { randomUUID } from "node:crypto";
-import { AppError } from "../shared/errors.js";
-import { hybridDigest, validateHybridContract } from "./hybrid-contracts.js";
-import { acquireInstallationLock } from "./installation-lock.js";
-import { readBoundedReleaseFile } from "./release-source.js";
-export function operatorSettingsPath(home) { return path.join(home, "profile-settings.json"); }
-function profileError(code, message, exitCode = 2) {
-    return new AppError(code, `${message}; use dd-flow profiles --help`, exitCode, { phase: "profiles", effect: "no_effect", recoverable: true });
-}
-function completeSettings(input) {
-    const value = { ...input, profiles: input.profiles.map(entry => ({ ...entry, revision: hybridDigest(entry.profile) })) };
-    return { ...value, revision: hybridDigest(value) };
-}
-function admittedSettings(input) {
-    const issues = validateHybridContract("profile-settings", input);
-    if (issues.length)
-        throw profileError("profile_settings_invalid", "Profile settings violate the schema or aliases/revision contract");
-    const settings = input;
-    for (const { profile } of settings.profiles) {
-        if ([profile.provider, profile.model, profile.reasoning, profile.mode].some(value => !value.trim())) {
-            throw profileError("profile_settings_invalid", "Profile execution values must not be blank");
-        }
-    }
-    return settings;
-}
-function readRegularJson(file) {
-    try {
-        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readBoundedReleaseFile(file, 4 * 1024 * 1024)));
-    }
-    catch {
-        // Parser errors can contain submitted secrets. Never retain input text or cause.
-        throw profileError("profile_settings_invalid", "Profile input is unreadable or malformed JSON");
-    }
-}
-/** First successful write imports valid legacy IDs; thereafter the settings file is the sole owner. */
-export function readOperatorProfiles(home) {
-    const file = operatorSettingsPath(home);
-    if (fs.existsSync(file))
-        return admittedSettings(readRegularJson(file));
-    const profiles = [];
-    const legacy = path.join(home, "agent-profiles");
-    if (fs.existsSync(legacy)) {
-        for (const entry of fs.readdirSync(legacy).sort()) {
-            if (!entry.endsWith(".json"))
-                continue;
-            const profile = readRegularJson(path.join(legacy, entry));
-            const id = entry.slice(0, -5);
-            profiles.push({ id, revision: hybridDigest(profile), profile });
-        }
-    }
-    return admittedSettings(completeSettings({ schema_id: "dd-flow/profile-settings@1", profiles,
-        aliases: {}, default_profile: null }));
-}
-export function resolveOperatorProfile(settings, id) {
-    const selected = id ?? settings.default_profile;
-    if (!selected)
-        throw profileError("agent_profile_missing", "Select an explicit profile or configure a default", 1);
-    const target = Object.hasOwn(settings.aliases, selected) ? settings.aliases[selected] : selected;
-    const entry = settings.profiles.find(item => item.id === target);
-    if (!entry)
-        throw profileError("agent_profile_missing", "Selected profile is unavailable", 1);
-    return structuredClone(entry.profile);
-}
-/** Used by explicit files and onboarding alike; extra credential fields fail before any write. */
-export function prepareOperatorProfile(input) {
-    if (!input || typeof input !== "object" || Array.isArray(input))
-        throw profileError("profile_settings_invalid", "Profile must be an object");
-    const sample = input;
-    const value = completeSettings({ schema_id: "dd-flow/profile-settings@1", profiles: [
-            { id: sample?.id, revision: hybridDigest(input), profile: sample }
-        ], aliases: {}, default_profile: null });
-    return admittedSettings(value).profiles[0].profile;
-}
-export function readOperatorProfileInput(file) {
-    return prepareOperatorProfile(readRegularJson(file));
-}
-function changedSettings(current, mutation) {
-    const next = structuredClone(current);
-    if (mutation.action === "create" || mutation.action === "edit") {
-        if (mutation.action === "create" && mutation.setDefault !== undefined && typeof mutation.setDefault !== "boolean") {
-            throw profileError("profile_settings_invalid", "Default selection must be an explicit boolean");
-        }
-        const profile = prepareOperatorProfile(mutation.profile);
-        const index = next.profiles.findIndex(entry => entry.id === profile.id);
-        if (mutation.action === "create" && index >= 0)
-            throw profileError("profile_conflict", "Profile ID already exists", 1);
-        if (mutation.action === "edit" && index < 0)
-            throw profileError("agent_profile_missing", "Cannot edit a missing profile", 1);
-        const entry = { id: profile.id, revision: hybridDigest(profile), profile };
-        if (index >= 0)
-            next.profiles[index] = entry;
-        else
-            next.profiles.push(entry);
-        if (mutation.action === "create" && mutation.setDefault === true)
-            next.default_profile = profile.id;
-    }
-    else if (mutation.action === "remove") {
-        if (!next.profiles.some(entry => entry.id === mutation.id))
-            throw profileError("agent_profile_missing", "Cannot remove a missing profile", 1);
-        if (Object.values(next.aliases).includes(mutation.id) || next.default_profile === mutation.id
-            || next.default_profile !== null && next.aliases[next.default_profile] === mutation.id) {
-            throw profileError("profile_in_use", "Remove aliases and change the default before removing this profile", 1);
-        }
-        next.profiles = next.profiles.filter(entry => entry.id !== mutation.id);
-    }
-    else if (mutation.action === "alias") {
-        if (mutation.target === null) {
-            if (!Object.hasOwn(next.aliases, mutation.alias))
-                throw profileError("profile_alias_missing", "Alias is unavailable", 1);
-            if (next.default_profile === mutation.alias)
-                throw profileError("profile_in_use", "Change the default before removing its alias", 1);
-            delete next.aliases[mutation.alias];
-        }
-        else
-            Object.defineProperty(next.aliases, mutation.alias, { value: mutation.target, enumerable: true, writable: true, configurable: true });
-    }
-    else if (mutation.action === "set-default")
-        next.default_profile = mutation.id;
-    else
-        throw profileError("profile_settings_invalid", "Unknown profile mutation");
-    const { revision: _revision, ...content } = next;
-    void _revision;
-    return admittedSettings(completeSettings(content));
-}
-/** Pure preflight suitable for freezing into an installation request before any effects. */
-export function prepareProfileCreation(settings, profile, setDefault) {
-    if (typeof setDefault !== "boolean")
-        throw profileError("profile_settings_invalid", "Default selection requires explicit consent");
-    const before = admittedSettings(structuredClone(settings)), admitted = prepareOperatorProfile(profile);
-    const after = changedSettings(before, { action: "create", profile: admitted, setDefault });
-    return { schema_id: "dd-flow/profile-creation-intent@1", before, after, profile: structuredClone(admitted), set_default: setDefault };
-}
-/** Exact frozen intent reconciliation: an already-applied write is not applied a second time.
- * A later edit/default change is a conflict, never a reason to restore old settings.
- */
-export function validateProfileCreationIntent(input) {
-    if (!input || typeof input !== "object" || Array.isArray(input)
-        || Object.keys(input).some(key => !["schema_id", "before", "after", "profile", "set_default"].includes(key))
-        || ["schema_id", "before", "after", "profile", "set_default"].some(key => !Object.hasOwn(input, key))
-        || input.schema_id !== "dd-flow/profile-creation-intent@1")
-        throw profileError("profile_settings_invalid", "Invalid profile creation intent");
-    const expected = prepareProfileCreation(input.before, input.profile, input.set_default);
-    admittedSettings(input.after);
-    if (hybridDigest(expected) !== hybridDigest(input))
-        throw profileError("profile_settings_invalid", "Profile creation intent changed");
-}
-export function readProfileCreationIntent(file) {
-    try {
-        const input = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readBoundedReleaseFile(file, 4 * 1024 * 1024)));
-        validateProfileCreationIntent(input);
-        return input;
-    }
-    catch {
-        throw profileError("profile_settings_invalid", "Profile creation intent must be a bounded valid regular JSON file");
-    }
-}
-export function commitProfileCreation(home, input) {
-    validateProfileCreationIntent(input);
-    const current = readOperatorProfiles(home);
-    if (current.revision === input.after.revision)
-        return { replayed: true, settings: current };
-    return { replayed: false, settings: mutateOperatorProfiles(home, input.before.revision, { action: "create", profile: input.profile, setDefault: input.set_default }) };
-}
-/** Compare-and-swap under an exclusive owned lock; no dual writer for legacy profile files. */
-export function mutateOperatorProfiles(home, expectedRevision, mutation) {
-    const before = readOperatorProfiles(home);
-    if (before.revision !== expectedRevision)
-        throw profileError("profile_revision_conflict", "Profile settings changed; reread before retrying", 1);
-    const prepared = changedSettings(before, mutation); // Fully validate before creating the home/lock.
-    const serialized = JSON.stringify(prepared, null, 2) + "\n";
-    if (Buffer.byteLength(serialized) > 4 * 1024 * 1024)
-        throw profileError("profile_settings_invalid", "Profile settings exceed the bounded reader limit");
-    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
-    const lock = path.join(home, "profile-settings.lock");
-    // Profiles use storage-owner identity, not a setup request ledger. A dead
-    // writer may be recovered by a later CAS mutation, including after commit.
-    let lease;
-    try {
-        lease = acquireInstallationLock(lock, hybridDigest({ resource: "profile-settings", home: path.resolve(home) }));
-    }
-    catch {
-        throw profileError("profile_write_conflict", "Another profile writer or unreconciled lock exists", 1);
-    }
-    const temporary = path.join(home, `.profile-settings-${randomUUID()}.tmp`);
-    let ownsTemporary = false;
-    let renameAttempted = false;
-    let failure;
-    let result;
-    try {
-        if (readOperatorProfiles(home).revision !== expectedRevision)
-            throw profileError("profile_revision_conflict", "Profile settings changed while acquiring the lock", 1);
-        const fd = fs.openSync(temporary, "wx", 0o600);
-        ownsTemporary = true;
-        try {
-            fs.writeFileSync(fd, serialized);
-            fs.fsyncSync(fd);
-        }
-        finally {
-            fs.closeSync(fd);
-        }
-        renameAttempted = true;
-        fs.renameSync(temporary, operatorSettingsPath(home));
-        result = readOperatorProfiles(home);
-    }
-    catch (error) {
-        failure = error instanceof AppError && !renameAttempted ? error : new AppError("profile_write_interrupted", "Profile write requires reconciliation; reread settings before retrying", 1, { phase: "profiles", effect: "unknown", recoverable: true,
-            next_action: "dd-flow profiles list --json" });
-    }
-    finally {
-        let cleanupFailed = false;
-        try {
-            if (ownsTemporary && fs.existsSync(temporary))
-                fs.unlinkSync(temporary);
-        }
-        catch {
-            cleanupFailed = true;
-        }
-        try {
-            lease.release();
-        }
-        catch {
-            cleanupFailed = true;
-        }
-        if (cleanupFailed) {
-            if (failure)
-                failure.details.cleanup = "not_confirmed";
-            else
-                failure = new AppError("profile_cleanup_failed", "Profile writer cleanup requires reconciliation", 1, { phase: "profiles", effect: "unknown", cleanup: "not_confirmed", next_action: "dd-flow profiles list --json" });
-        }
-    }
-    if (failure)
-        throw failure;
-    return result;
-}

package/dist/services/release-archive-producer.js

@@ -1,52 +0,0 @@
-import { gzipSync } from "node:zlib";
-import { createHash } from "node:crypto";
-import { AppError } from "../shared/errors.js";
-import { inspectReleaseArchive } from "./release-archive.js";
-/** Deterministic regular-file-only tar/gzip. Extraction admission is also applied
- * to producer output; producing bytes never grants them installation authority.
- */
-export function produceReleaseArchive(files) {
-    const refuse = () => { throw new AppError("release_producer", "Archive production refused", 1, { reason: "invalid_archive_input", effect: "no_effect" }); };
-    if (!files.length || files.length > 100_000)
-        refuse();
-    const chunks = [];
-    let expanded = 1024;
-    const append = (name, bytes, mode, type) => {
-        expanded += 512 + Math.ceil(bytes.length / 512) * 512;
-        if (expanded > 512 * 1024 * 1024)
-            refuse();
-        const header = Buffer.alloc(512);
-        header.write(name);
-        header.write(mode.toString(8).padStart(7, "0") + "\0", 100);
-        header.write("0000000\0", 108);
-        header.write("0000000\0", 116);
-        header.write(bytes.length.toString(8).padStart(11, "0") + "\0", 124);
-        header.write("00000000000\0", 136);
-        header.fill(32, 148, 156);
-        header[156] = type;
-        header.write("ustar\0", 257);
-        header.write("00", 263);
-        header.write(header.reduce((sum, byte) => sum + byte, 0).toString(8).padStart(6, "0") + "\0 ", 148);
-        chunks.push(header, bytes, Buffer.alloc((512 - bytes.length % 512) % 512));
-    };
-    let index = 0;
-    for (const file of [...files].sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)))) {
-        const length = Buffer.byteLength(file.path);
-        if (!length || length > 4096 || !Buffer.isBuffer(file.bytes) || typeof file.executable !== "boolean")
-            refuse();
-        let name = file.path;
-        if (length > 100) {
-            const record = `path=${file.path}\n`;
-            let size = Buffer.byteLength(record) + 2;
-            while (size !== Buffer.byteLength(record) + String(size).length + 1)
-                size = Buffer.byteLength(record) + String(size).length + 1;
-            append(`PaxHeaders/${index}`, Buffer.from(`${size} ${record}`), 0o644, 120);
-            name = `entries/${index}`;
-        }
-        append(name, file.bytes, file.executable ? 0o755 : 0o644, 48);
-        index++;
-    }
-    const bytes = gzipSync(Buffer.concat([...chunks, Buffer.alloc(1024)]), { level: 9 });
-    inspectReleaseArchive({ url: "https://producer.invalid/archive", bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") }, bytes);
-    return bytes;
-}

package/dist/services/release-archive.js

@@ -1,143 +0,0 @@
-import { gunzipSync } from "node:zlib";
-import { TextDecoder } from "node:util";
-import { AppError } from "../shared/errors.js";
-import { verifyReleaseArchive } from "./release-manifest.js";
-const defaultLimits = { expandedBytes: 512 * 1024 * 1024, entries: 100_000 };
-const decoder = new TextDecoder("utf-8", { fatal: true });
-function refuse(reason) {
-    throw new AppError("archive_integrity", "Release archive cannot be extracted", 1, { reason, phase: "archive_validation", effect: "no_effect", help: "setup" });
-}
-function text(bytes) {
-    try {
-        return decoder.decode(bytes);
-    }
-    catch {
-        return refuse("invalid_utf8");
-    }
-}
-function field(bytes) {
-    const zero = bytes.indexOf(0);
-    if (zero >= 0 && bytes.subarray(zero).some(byte => byte !== 0))
-        refuse("invalid_header_string");
-    return text(zero < 0 ? bytes : bytes.subarray(0, zero));
-}
-function octal(bytes) {
-    const value = text(bytes).replace(/\0.*$/, "").trim();
-    if (!/^[0-7]+$/.test(value))
-        refuse("invalid_numeric_header");
-    const result = Number.parseInt(value, 8);
-    if (!Number.isSafeInteger(result))
-        refuse("oversized_numeric_header");
-    return result;
-}
-function containedPath(input, directory) {
-    const value = directory && input.endsWith("/") ? input.slice(0, -1) : input;
-    if (!value || value !== value.normalize("NFC") || /[\\:]/.test(value) ||
-        [...value].some(character => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127))
-        refuse("unsafe_path");
-    for (const part of value.split("/")) {
-        if (!part || part === "." || part === ".." || /[. ]$/.test(part) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part))
-            refuse("unsafe_path");
-    }
-    return value;
-}
-function pax(bytes) {
-    const result = {};
-    let offset = 0;
-    while (offset < bytes.length) {
-        const space = bytes.indexOf(32, offset);
-        if (space < 0)
-            refuse("invalid_pax");
-        const lengthText = text(bytes.subarray(offset, space));
-        if (!/^[1-9][0-9]*$/.test(lengthText))
-            refuse("invalid_pax");
-        const length = Number(lengthText), end = offset + length;
-        if (!Number.isSafeInteger(length) || end > bytes.length || end <= space + 1 || bytes[end - 1] !== 10)
-            refuse("invalid_pax");
-        const record = text(bytes.subarray(space + 1, end - 1)), equal = record.indexOf("=");
-        if (equal < 1)
-            refuse("invalid_pax");
-        const key = record.slice(0, equal), value = record.slice(equal + 1);
-        if (Object.hasOwn(result, key))
-            refuse("duplicate_pax_key");
-        // Do not allow sparse files, links, custom extraction attributes or size overrides.
-        if (!["path", "mtime", "atime", "ctime", "uid", "gid", "uname", "gname"].includes(key))
-            refuse("unsupported_pax_key");
-        result[key] = value;
-        offset = end;
-    }
-    return result;
-}
-/** Validate the entire archive before writing any entry. Links and special files never enter staging. */
-export function inspectReleaseArchive(identity, compressed, limits = defaultLimits) {
-    verifyReleaseArchive(identity, compressed);
-    if (!Number.isSafeInteger(limits.expandedBytes) || limits.expandedBytes < 1024 || !Number.isSafeInteger(limits.entries) || limits.entries < 1)
-        refuse("invalid_limits");
-    let tar;
-    try {
-        tar = gunzipSync(compressed, { maxOutputLength: limits.expandedBytes });
-    }
-    catch {
-        return refuse("invalid_or_oversized_gzip");
-    }
-    if (tar.length % 512 !== 0)
-        refuse("truncated_tar");
-    const entries = [], paths = new Map(), kinds = new Map();
-    let offset = 0, headers = 0, pending = null;
-    while (offset + 512 <= tar.length) {
-        const header = tar.subarray(offset, offset + 512);
-        if (header.every(byte => byte === 0)) {
-            if (pending || offset + 1024 > tar.length || tar.subarray(offset).some(byte => byte !== 0))
-                refuse("invalid_tar_trailer");
-            return entries;
-        }
-        if (++headers > limits.entries * 2)
-            refuse("too_many_headers");
-        const checksum = header.reduce((sum, byte, index) => sum + (index >= 148 && index < 156 ? 32 : byte), 0);
-        if (octal(header.subarray(148, 156)) !== checksum)
-            refuse("header_checksum_mismatch");
-        const size = octal(header.subarray(124, 136)), mode = octal(header.subarray(100, 108));
-        const next = offset + 512 + Math.ceil(size / 512) * 512;
-        if (!Number.isSafeInteger(next) || next > tar.length)
-            refuse("truncated_entry");
-        const bytes = tar.subarray(offset + 512, offset + 512 + size);
-        const type = header[156];
-        if (type === 120) {
-            if (pending)
-                refuse("stacked_pax_headers");
-            pending = pax(bytes);
-            offset = next;
-            continue;
-        }
-        if (type !== 0 && type !== 48 && type !== 53)
-            refuse("unsupported_entry_type");
-        const directory = type === 53;
-        if (directory && size !== 0)
-            refuse("directory_has_data");
-        const prefix = field(header.subarray(345, 500));
-        const name = field(header.subarray(0, 100));
-        const entryPath = containedPath(pending?.path ?? (prefix ? `${prefix}/${name}` : name), directory);
-        pending = null;
-        const parts = entryPath.split("/");
-        for (let index = 1; index <= parts.length; index++) {
-            const partial = parts.slice(0, index).join("/"), folded = partial.toLowerCase();
-            const previous = paths.get(folded);
-            if (previous && previous !== partial)
-                refuse("case_collision");
-            paths.set(folded, partial);
-            if (index < parts.length && kinds.get(partial) === "file")
-                refuse("file_directory_collision");
-            if (index < parts.length && !kinds.has(partial))
-                kinds.set(partial, "implicit_directory");
-        }
-        const previous = kinds.get(entryPath);
-        if (previous && !(directory && previous === "implicit_directory"))
-            refuse("duplicate_or_conflicting_entry");
-        kinds.set(entryPath, directory ? "directory" : "file");
-        if (entries.length >= limits.entries)
-            refuse("too_many_entries");
-        entries.push({ path: entryPath, kind: directory ? "directory" : "file", mode: mode & 0o111 ? 0o755 : 0o644, bytes: Buffer.from(bytes) });
-        offset = next;
-    }
-    return refuse("missing_tar_trailer");
-}

package/dist/services/release-cache.js

@@ -1,142 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { createHash } from "node:crypto";
-import { AppError } from "../shared/errors.js";
-import { inspectReleaseArchive } from "./release-archive.js";
-import { verifyReleaseArchive } from "./release-manifest.js";
-import { acquireInstallationLock } from "./installation-lock.js";
-import { hybridDigest } from "./hybrid-contracts.js";
-const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
-function refuse(reason) {
-    throw new AppError("cache_integrity", "Release cache cannot be published", 1, { reason, phase: "cache_publication", effect: "no_effect", help: "setup" });
-}
-function directory(target) {
-    if (fs.existsSync(target)) {
-        if (!fs.lstatSync(target).isDirectory())
-            refuse("unsafe_cache_directory");
-        return;
-    }
-    const parent = path.dirname(target);
-    if (parent !== target)
-        directory(parent);
-    fs.mkdirSync(target, { mode: 0o700 });
-}
-function write(target, bytes, mode) {
-    const fd = fs.openSync(target, "wx", mode);
-    try {
-        fs.writeFileSync(fd, bytes);
-        fs.fchmodSync(fd, mode);
-        fs.fsyncSync(fd);
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-}
-function retained(target, archive, entries) {
-    if (!fs.lstatSync(target).isDirectory())
-        refuse("unsafe_retained_cache");
-    const archiveFile = path.join(target, "archive.tgz");
-    if (!fs.lstatSync(archiveFile).isFile())
-        refuse("unsafe_retained_cache");
-    if (fs.readdirSync(target).sort().join("/") !== "archive.tgz/payload/receipt.json")
-        refuse("retained_cache_changed");
-    const marker = path.join(target, "receipt.json"), payload = path.join(target, "payload");
-    if (!fs.lstatSync(marker).isFile() || fs.readFileSync(marker, "utf8") !== JSON.stringify({ sha256: archive.sha256, bytes: archive.bytes }))
-        refuse("same_version_different_bytes");
-    verifyReleaseArchive(archive, fs.readFileSync(archiveFile));
-    const expected = new Map();
-    const directories = new Set();
-    for (const entry of entries) {
-        expected.set(entry.path, entry);
-        const parts = entry.path.split("/");
-        for (let index = 1; index < parts.length; index++)
-            directories.add(parts.slice(0, index).join("/"));
-    }
-    const seen = new Set();
-    const visit = (root, relative) => {
-        if (!fs.lstatSync(root).isDirectory())
-            refuse("unsafe_retained_cache");
-        for (const name of fs.readdirSync(root)) {
-            const logical = relative ? `${relative}/${name}` : name, full = path.join(root, name), stat = fs.lstatSync(full);
-            const entry = expected.get(logical);
-            if (stat.isDirectory()) {
-                if (entry?.kind === "file" || (!entry && !directories.has(logical)))
-                    refuse("retained_cache_changed");
-                if (entry)
-                    seen.add(logical);
-                visit(full, logical);
-            }
-            else {
-                if (!stat.isFile() || entry?.kind !== "file" || stat.size !== entry.bytes.length || digest(fs.readFileSync(full)) !== digest(entry.bytes) || (stat.mode & 0o111) !== (entry.mode & 0o111))
-                    refuse("retained_cache_changed");
-                seen.add(logical);
-            }
-        }
-    };
-    visit(payload, "");
-    if (seen.size !== entries.length)
-        refuse("retained_cache_changed");
-}
-/** Verify retained compressed and expanded bytes without executing or activating them. */
-export function verifyPublishedReleaseCache(target, archive) {
-    if (!fs.lstatSync(target).isDirectory())
-        refuse("unsafe_retained_cache");
-    const archiveFile = path.join(target, "archive.tgz");
-    if (!fs.lstatSync(archiveFile).isFile())
-        refuse("unsafe_retained_cache");
-    retained(target, archive, inspectReleaseArchive(archive, fs.readFileSync(archiveFile)));
-}
-/** Home-only immutable publication. It never activates a version or changes RUN bindings. */
-export function publishReleaseCache(home, kind, version, archive, compressed) {
-    if (kind !== "canon" && kind !== "engine")
-        refuse("invalid_artifact_kind");
-    if (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?$/.test(version))
-        refuse("invalid_version");
-    const entries = inspectReleaseArchive(archive, compressed);
-    const parent = path.join(path.resolve(home), "release-cache", kind), target = path.join(parent, version);
-    for (const candidate of [path.resolve(home), path.join(path.resolve(home), "release-cache"), parent]) {
-        if (fs.existsSync(candidate) && !fs.lstatSync(candidate).isDirectory())
-            refuse("unsafe_cache_directory");
-    }
-    // Validate before creating even the home, including on replay.
-    if (fs.existsSync(target)) {
-        directory(parent);
-        retained(target, archive, entries);
-        return { root: target, replayed: true };
-    }
-    directory(parent);
-    const lock = `${target}.lock`;
-    const lease = acquireInstallationLock(lock, hybridDigest({ kind, version, archive }));
-    let staging = null;
-    try {
-        if (fs.existsSync(target)) {
-            retained(target, archive, entries);
-            return { root: target, replayed: true };
-        }
-        staging = path.join(parent, `.staging-${lease.token}`);
-        fs.mkdirSync(staging, { mode: 0o700 });
-        const payload = path.join(staging, "payload");
-        fs.mkdirSync(payload, { mode: 0o700 });
-        for (const entry of entries) {
-            const destination = path.join(payload, entry.path);
-            if (entry.kind === "directory")
-                directory(destination);
-            else {
-                directory(path.dirname(destination));
-                write(destination, entry.bytes, entry.mode);
-            }
-        }
-        write(path.join(staging, "receipt.json"), Buffer.from(JSON.stringify({ sha256: archive.sha256, bytes: archive.bytes })), 0o600);
-        write(path.join(staging, "archive.tgz"), compressed, 0o600);
-        retained(staging, archive, entries);
-        fs.renameSync(staging, target);
-        staging = null;
-        return { root: target, replayed: false };
-    }
-    finally {
-        // Only the unique staging directory and lock acquired by this call are owned here.
-        if (staging)
-            fs.rmSync(staging, { recursive: true, force: true });
-        lease.release();
-    }
-}

package/dist/services/release-compatibility.js

@@ -1,18 +0,0 @@
-import semver from "semver";
-import { AppError } from "../shared/errors.js";
-/** Registered catalog format revisions; these do not establish harness/model availability. */
-export const installedCatalogVersions = Object.freeze({ harness: "1.0.0", model: "1.0.0", flow: "1.0.0" });
-/** Compatibility comes from the installed consumer/catalog policy, never from release claims. */
-export function createReleaseCompatibility(policy) {
-    if (!["stable", "preview", "development"].includes(policy.channel) || !semver.valid(policy.routerVersion) ||
-        ["harness", "model", "flow"].some(family => !semver.valid(policy.catalogVersions[family]))) {
-        throw new AppError("release_compatibility", "Installed release compatibility policy is invalid", 1, { phase: "release_admission", effect: "no_effect", help: "setup" });
-    }
-    const routerVersion = policy.routerVersion;
-    return {
-        channel: policy.channel,
-        catalogVersions: { ...policy.catalogVersions },
-        routerCompatible: minimum => Boolean(semver.valid(minimum)) && semver.gte(routerVersion, minimum),
-        engineCompatible: (version, range) => Boolean(semver.valid(version) && semver.validRange(range)) && semver.satisfies(version, range)
-    };
-}