@elpapi42/pi-fleet 0.1.0-beta.1 → 0.1.0-beta.3

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## Unreleased
+
+### Reliability
+
+- Added deterministic fault-injection coverage for receive timeout/cancellation, delivery recovery, runtime crashes, Pi RPC failures, SQLite worker/storage failures, protocol framing, command races, raw session boundaries, and public-error redaction.
+- Serialized create, send, and destroy transitions per agent so cross-command races cannot orphan or resurrect an agent generation.
+- Made SQLite-worker failures terminal for current and future calls and made send recovery safe when an operation exists but no send record was committed.
+- Redacted Pi stderr and unexpected internal exceptions from public errors while retaining stable typed error codes.
+- Contained asynchronous coordinator event/store failures by stopping the affected Pi process and rejecting waiters instead of producing unhandled promise rejections.
+- Added a nightly reliability workflow and an isolated soak suite covering 500 concurrent ordered sends and 100 name lifecycle cycles.
+- Reject invalid UTF-8 in stdin and Pi RPC stdout instead of silently replacing bytes at either protocol boundary.
+
+## 0.1.0-beta.3 — 2026-07-20
+
+Reliability fix for fresh global npm installations. No intentional CLI or agent-lifecycle contract change.
+
+### Fixed
+
+- Replaced the invalid assumption that npm recreates CI's byte-identical `node_modules` tree. Schema-3 runtime manifests retain exact hashes for Fleet-owned files, validate direct dependency name/version, derive the observed dependency-closure hash at materialization, and prove source-before, staged, and source-after closure equality before activation.
+- Made immutable runtime release paths closure-specific, so different legitimate npm dependency layouts do not collide.
+- Strengthened package testing to mutate a fresh installed dependency tree, require an operational `list`, remove the npm installation, stop the runtime, and restart through the materialized release.
+
+### Installation scope
+
+- The documented global npm installation layout, where dependencies are package-local, is supported. Arbitrarily hoisted local-prefix, pnpm, and unusual `npx` dependency layouts are not yet supported.
+- The tag workflow now performs a fresh registry-install operational `list` smoke after publishing. That smoke is a release gate and has not yet run for beta.3.
+
+## 0.1.0-beta.2 — 2026-07-20
+
+Reliability-focused beta maintenance release. No intentional product-contract changes.
+
+### Reliability
+
+- Added deterministic fault coverage and reproducible randomized lifecycle-race soak testing.
+- Fixed timeout/cancellation classification, ambiguous-delivery recovery, no-replay behavior, and coordinator/store failure containment.
+- Validated inbound protocol majors, strict and concurrent runtime materialization, and released beta.0/beta.1 CLI-runtime compatibility.
+- Added unclean SQLite `quick_check` validation, redacted error handling, fatal UTF-8 checks, process cleanup coverage, and nightly resource-stability checks.
+
+### Validation limits
+
+- Real disk exhaustion, host logout/reboot, macOS launchd/containment, and multi-hour platform resource soak remain unvalidated.
+
 ## 0.1.0-beta.1 — 2026-07-20
 
 Release-pipeline validation beta. No product-contract changes from `0.1.0-beta.0`.

package/README.md

@@ -8,7 +8,7 @@ create · send · receive · status · list · watch · destroy
 
 Fleet keeps a Pi process resident when possible, restores it from the same native Pi session when absent, accepts repeated steering input, and returns the latest assistant message after Pi becomes idle. Pi sessions remain under your control: Fleet references them but never copies or deletes them.
 
-> **Beta:** `0.1.0-beta.0` is release-validated on Linux x64 with Pi `0.80.10`. macOS, actual logout/reboot recovery, automatic upgrades, and public service-management UX are not yet release-validated.
+> **Beta:** `0.1.0-beta.3` has passed deterministic Linux x64 fault, recovery, package, compatibility, and resource-stability tests with Pi `0.80.10`. Its tag workflow additionally requires a fresh registry-install operational smoke after publication; that external check has not yet run for beta.3. Actual logout/reboot recovery, macOS launchd/containment, automatic upgrades, and public service-management UX are not yet release-validated.
 
 ## Install
 
@@ -173,9 +173,10 @@ Do not include API keys, message contents, session contents, or private paths un
 
 ## Beta limitations
 
-- Release validation currently covers Linux x64 only.
+- Current deterministic reliability and documented global-install package validation cover Linux x64 only. Arbitrarily hoisted local-prefix, pnpm, and unusual `npx` dependency layouts are not yet supported.
 - Actual logout and host reboot recovery remain unvalidated.
 - launchd and macOS descendant containment remain unvalidated.
+- Real disk-exhaustion behavior and multi-hour resource growth remain unvalidated; bounded SQLite and in-process resource tests are covered.
 - Native service install/repair/uninstall exists internally but has no supported public UX yet.
 - Runtime upgrades are not automatic; active runtimes are not silently replaced.
 - Session tails cannot promise exactly-once behavior under arbitrary external mutation.
@@ -189,12 +190,14 @@ npm run typecheck
 npm run lint
 npm run format:check
 npm test
+npm run test:faults
 npm run build
 npm run test:package
 npm run test:platform
+npm run test:soak
 ```
 
-See [`IMPLEMENTATION_PLAN.md`](./IMPLEMENTATION_PLAN.md) for architecture, completed evidence, and remaining release gates.
+See [`IMPLEMENTATION_PLAN.md`](./IMPLEMENTATION_PLAN.md) for architecture and release gates, and [`TESTING_PLAN.md`](./TESTING_PLAN.md) for failure injection, crash recovery, concurrency, privacy, and soak testing. Deterministic fault tests run in the full suite; heavier reliability checks run nightly.
 
 ## License
 

package/dist/cli-meta.json

@@ -156,7 +156,7 @@
       "format": "esm"
     },
     "src/cli/input.ts": {
-      "bytes": 824,
+      "bytes": 977,
       "imports": [],
       "format": "esm"
     },
@@ -392,7 +392,7 @@
       "format": "esm"
     },
     "src/client/socket-fleet-client.ts": {
-      "bytes": 8696,
+      "bytes": 9121,
       "imports": [
         {
           "path": "node:crypto",
@@ -423,7 +423,7 @@
       "format": "esm"
     },
     "src/platform/install/tree-integrity.ts": {
-      "bytes": 2225,
+      "bytes": 2529,
       "imports": [
         {
           "path": "node:crypto",
@@ -444,7 +444,7 @@
       "format": "esm"
     },
     "src/platform/install/runtime-release.ts": {
-      "bytes": 4620,
+      "bytes": 15742,
       "imports": [
         {
           "path": "node:crypto",
@@ -593,7 +593,7 @@
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 251175
+      "bytes": 270001
     },
     "dist/cli.mjs": {
       "imports": [
@@ -780,7 +780,7 @@
           "bytesInOutput": 140
         },
         "src/cli/input.ts": {
-          "bytesInOutput": 696
+          "bytesInOutput": 841
         },
         "src/cli/output.ts": {
           "bytesInOutput": 1016
@@ -816,7 +816,7 @@
           "bytesInOutput": 2440
         },
         "src/client/socket-fleet-client.ts": {
-          "bytesInOutput": 6835
+          "bytesInOutput": 7258
         },
         "src/protocol/version.ts": {
           "bytesInOutput": 70
@@ -828,16 +828,16 @@
           "bytesInOutput": 4658
         },
         "src/platform/install/runtime-release.ts": {
-          "bytesInOutput": 4008
+          "bytesInOutput": 13651
         },
         "src/platform/install/tree-integrity.ts": {
-          "bytesInOutput": 1879
+          "bytesInOutput": 2182
         },
         "src/platform/shared/paths.ts": {
           "bytesInOutput": 1191
         }
       },
-      "bytes": 139855
+      "bytes": 150369
     }
   }
 }

package/dist/cli.mjs

@@ -3385,7 +3385,7 @@ function splitArgv(argv) {
 
 // src/shared/product-identity.ts
 var PRODUCT_BINARY = "pifleet";
-var PRODUCT_VERSION = "0.1.0-beta.1";
+var PRODUCT_VERSION = "0.1.0-beta.3";
 
 // src/cli/commands/create.ts
 import { resolve } from "node:path";
@@ -3408,7 +3408,13 @@ async function resolveMessageInput(value, stdin, maxBytes = DEFAULT_MAX_INPUT_BY
     if (bytes > maxBytes) throw new Error(`stdin exceeds the ${maxBytes}-byte limit`);
     chunks.push(buffer);
   }
-  return requireContent(Buffer.concat(chunks).toString("utf8"));
+  let decoded;
+  try {
+    decoded = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+  } catch {
+    throw new Error("stdin must be valid UTF-8");
+  }
+  return requireContent(decoded);
 }
 function requireContent(value) {
   if (value.trim().length === 0) throw new Error("message must not be empty or whitespace-only");
@@ -3693,6 +3699,13 @@ var SocketFleetClient = class {
     try {
       for await (const frame of frames) {
         if (!isRecord(frame) || frame.requestId !== requestId) continue;
+        if (frame.v !== PROTOCOL_VERSION) {
+          yield err({
+            code: "protocol_error",
+            message: "Runtime protocol version is incompatible with this client."
+          });
+          return;
+        }
         if (frame.stream === "ready") continue;
         if (frame.stream === "end") {
           endedExplicitly = true;
@@ -3746,6 +3759,12 @@ var SocketFleetClient = class {
       if (!isRecord(frame) || frame.requestId !== requestId || typeof frame.ok !== "boolean") {
         return err({ code: "protocol_error", message: "Invalid runtime response." });
       }
+      if (frame.v !== PROTOCOL_VERSION) {
+        return err({
+          code: "protocol_error",
+          message: "Runtime protocol version is incompatible with this client."
+        });
+      }
       if (frame.ok) return ok(frame.result);
       if (isErrorRecord(frame.error)) return err(frame.error);
       return err({ code: "protocol_error", message: "Runtime returned an invalid error." });
@@ -3888,12 +3907,12 @@ import { promisify } from "node:util";
 
 // src/platform/install/runtime-release.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { chmod, cp, lstat as lstat2, mkdir, readFile as readFile2, rename, rm, stat as stat2 } from "node:fs/promises";
-import { join as join2, resolve as resolve3, sep as sep2 } from "node:path";
+import { chmod, cp, lstat as lstat2, mkdir, readFile as readFile2, rename, rm, writeFile } from "node:fs/promises";
+import { join as join2, posix, resolve as resolve3, sep as sep2 } from "node:path";
 
 // src/platform/install/tree-integrity.ts
 import { createHash } from "node:crypto";
-import { lstat, readFile, readdir, stat } from "node:fs/promises";
+import { lstat, readFile, readdir, realpath, stat } from "node:fs/promises";
 import { join, relative, resolve as resolve2, sep } from "node:path";
 async function hashDirectoryTree(root, manifestPath) {
   const resolvedRoot = resolve2(root);
@@ -3933,6 +3952,14 @@ async function collectFiles(root, directory) {
     if (!info.isFile()) {
       throw new Error(`Runtime dependency tree contains an unsupported entry: ${absolutePath}`);
     }
+    if (linkInfo.isSymbolicLink()) {
+      const target = await realpath(absolutePath);
+      if (target !== root && !target.startsWith(`${root}${sep}`)) {
+        throw new Error(
+          `Runtime dependency tree contains an external file symlink: ${absolutePath}`
+        );
+      }
+    }
     const relativePath = relative(root, absolutePath).split(sep).join("/");
     if (relativePath.length === 0 || relativePath.startsWith("../")) {
       throw new Error(`Runtime dependency path escapes its root: ${absolutePath}`);
@@ -3943,18 +3970,41 @@ async function collectFiles(root, directory) {
 }
 
 // src/platform/install/runtime-release.ts
+var requiredRuntimeArtifacts = /* @__PURE__ */ new Set([
+  "package.json",
+  "bin/pifleet.mjs",
+  "bin/pifleet-runtime.mjs",
+  "dist/cli.mjs",
+  "dist/runtime.mjs",
+  "dist/sqlite-worker.mjs"
+]);
+var dependencyTreePath = "node_modules";
 async function materializeRuntime(options) {
   const sourceRoot = resolve3(options.sourceRoot);
+  const manifestBytes = await readFile2(join2(sourceRoot, "dist", "runtime-manifest.json"));
+  const sourceManifest = await parseRuntimeManifest(manifestBytes, sourceRoot);
+  if (sourceManifest.closure !== void 0) {
+    await verifyRuntime(sourceRoot);
+    return sourceRoot;
+  }
+  await verifyRuntimeFiles(sourceRoot, sourceManifest);
+  await verifyDependencyIdentities(sourceRoot, sourceManifest.dependencies);
+  const sourceTreeRoot = resolveInside(sourceRoot, dependencyTreePath);
+  const sourceTreeBefore = await hashDirectoryTree(sourceTreeRoot, dependencyTreePath);
+  const sourceManifestSha256 = createHash2("sha256").update(manifestBytes).digest("hex");
+  const materializedManifest = {
+    ...sourceManifest,
+    closure: { sourceManifestSha256, tree: sourceTreeBefore }
+  };
+  const materializedManifestBytes = serializeManifest(materializedManifest);
+  const closureHash = createHash2("sha256").update(sourceManifestSha256).update("\0").update(JSON.stringify(sourceTreeBefore)).digest("hex").slice(0, 16);
   const applicationRoot = resolve3(options.applicationRoot);
   await ensurePrivateDirectory(applicationRoot);
-  const manifestBytes = await readFile2(join2(sourceRoot, "dist", "runtime-manifest.json"));
-  const manifest = JSON.parse(manifestBytes.toString("utf8"));
-  const manifestHash = createHash2("sha256").update(manifestBytes).digest("hex").slice(0, 16);
   const releasesRoot = join2(applicationRoot, "releases");
   await ensurePrivateDirectory(releasesRoot);
-  const destination = join2(releasesRoot, `${manifest.package.version}-${manifestHash}`);
+  const destination = join2(releasesRoot, `${sourceManifest.package.version}-${closureHash}`);
   if (await pathExists(destination)) {
-    await verifyRuntime(destination, manifest);
+    await verifyExpectedRuntime(destination, materializedManifest, materializedManifestBytes);
     return destination;
   }
   const staging = join2(releasesRoot, `.staging-${randomUUID2()}`);
@@ -3964,31 +4014,77 @@ async function materializeRuntime(options) {
       recursive: true,
       dereference: true
     });
-    await cp(join2(sourceRoot, "bin"), join2(staging, "bin"), { recursive: true, dereference: true });
+    await cp(join2(sourceRoot, "bin"), join2(staging, "bin"), {
+      recursive: true,
+      dereference: true
+    });
     await cp(join2(sourceRoot, "package.json"), join2(staging, "package.json"));
-    for (const tree of manifest.trees) {
-      const source = resolveInside(sourceRoot, tree.path);
-      const destination2 = resolveInside(staging, tree.path);
-      await mkdir(resolve3(destination2, ".."), { recursive: true, mode: 448 });
-      await cp(source, destination2, { recursive: true, dereference: true });
-    }
-    await verifyRuntime(staging, manifest);
+    await cp(sourceTreeRoot, join2(staging, dependencyTreePath), {
+      recursive: true,
+      dereference: true
+    });
+    await options.hooks?.afterDependencyCopy?.();
+    const stagedTree = await hashDirectoryTree(
+      join2(staging, dependencyTreePath),
+      dependencyTreePath
+    );
+    assertSameTree(sourceTreeBefore, stagedTree, "copied dependency closure");
+    const sourceTreeAfter = await hashDirectoryTree(sourceTreeRoot, dependencyTreePath);
+    assertSameTree(sourceTreeBefore, sourceTreeAfter, "source dependency closure");
+    await writeFile(join2(staging, "dist", "runtime-manifest.json"), materializedManifestBytes);
+    await verifyExpectedRuntime(staging, materializedManifest, materializedManifestBytes);
     await chmod(staging, 448);
-    await rename(staging, destination);
+    try {
+      await rename(staging, destination);
+    } catch (error) {
+      if (!isDestinationRace(error) || !await pathExists(destination)) throw error;
+      await verifyExpectedRuntime(destination, materializedManifest, materializedManifestBytes);
+    }
     return destination;
-  } catch (error) {
+  } finally {
     await rm(staging, { recursive: true, force: true });
-    throw error;
   }
 }
-async function verifyRuntime(root, manifest) {
-  const expected = manifest ?? JSON.parse(
-    await readFile2(join2(root, "dist", "runtime-manifest.json"), "utf8")
-  );
+async function verifyRuntime(root) {
   const resolvedRoot = resolve3(root);
-  for (const file of expected.files) {
-    const path2 = resolveInside(resolvedRoot, file.path);
-    const info = await stat2(path2);
+  const manifestBytes = await readFile2(join2(resolvedRoot, "dist", "runtime-manifest.json"));
+  const manifest = await parseRuntimeManifest(manifestBytes, resolvedRoot);
+  if (manifest.closure === void 0) {
+    throw new Error("Runtime release manifest is missing its materialized closure");
+  }
+  await verifyRuntimeFiles(resolvedRoot, manifest);
+  await verifyDependencyIdentities(resolvedRoot, manifest.dependencies);
+  const actualTree = await hashDirectoryTree(
+    resolveInside(resolvedRoot, dependencyTreePath),
+    dependencyTreePath
+  );
+  assertSameTree(manifest.closure.tree, actualTree, "materialized dependency closure");
+}
+async function verifyExpectedRuntime(root, expected, expectedBytes) {
+  const manifestPath = join2(root, "dist", "runtime-manifest.json");
+  const actualBytes = await readFile2(manifestPath);
+  if (!actualBytes.equals(expectedBytes)) {
+    throw new Error("Materialized runtime manifest does not match the expected closure");
+  }
+  const actual = await parseRuntimeManifest(actualBytes, root);
+  if (actual.closure === void 0 || expected.closure === void 0) {
+    throw new Error("Materialized runtime manifest is missing its closure");
+  }
+  await verifyRuntimeFiles(root, actual);
+  await verifyDependencyIdentities(root, actual.dependencies);
+  const actualTree = await hashDirectoryTree(
+    resolveInside(root, dependencyTreePath),
+    dependencyTreePath
+  );
+  assertSameTree(expected.closure.tree, actualTree, "materialized dependency closure");
+}
+async function verifyRuntimeFiles(root, manifest) {
+  for (const file of manifest.files) {
+    const path2 = resolveInside(root, file.path);
+    const info = await lstat2(path2);
+    if (info.isSymbolicLink()) {
+      throw new Error(`Runtime artifact ${file.path} must not be a symbolic link`);
+    }
     if (!info.isFile() || info.size !== file.bytes) {
       throw new Error(`Runtime artifact ${file.path} has changed`);
     }
@@ -3997,21 +4093,154 @@ async function verifyRuntime(root, manifest) {
       throw new Error(`Runtime artifact ${file.path} failed verification`);
     }
   }
-  for (const expectedTree of expected.trees) {
-    const treeRoot = resolveInside(resolvedRoot, expectedTree.path);
-    const actualTree = await hashDirectoryTree(treeRoot, expectedTree.path);
-    if (actualTree.files !== expectedTree.files || actualTree.bytes !== expectedTree.bytes || actualTree.sha256 !== expectedTree.sha256) {
-      throw new Error(`Runtime dependency tree ${expectedTree.path} failed verification`);
+}
+async function verifyDependencyIdentities(root, dependencies) {
+  const nodeModules = resolveInside(root, dependencyTreePath);
+  const modulesInfo = await lstat2(nodeModules);
+  if (!modulesInfo.isDirectory() || modulesInfo.isSymbolicLink()) {
+    throw new Error("Runtime dependency closure must be a regular directory");
+  }
+  for (const dependency of dependencies) {
+    const packageRoot = resolveInside(root, dependency.path);
+    const packageInfo = await lstat2(packageRoot);
+    if (!packageInfo.isDirectory() || packageInfo.isSymbolicLink()) {
+      throw new Error(`Runtime dependency ${dependency.name} must be a regular directory`);
+    }
+    const packageJsonPath = join2(packageRoot, "package.json");
+    const packageJsonInfo = await lstat2(packageJsonPath);
+    if (!packageJsonInfo.isFile() || packageJsonInfo.isSymbolicLink()) {
+      throw new Error(`Runtime dependency ${dependency.name} has an unsafe package.json`);
+    }
+    const identity = await readPackageMetadata(packageRoot);
+    if (identity.name !== dependency.name || identity.version !== dependency.version) {
+      throw new Error(`Runtime dependency ${dependency.name} has an unexpected identity`);
+    }
+  }
+}
+async function parseRuntimeManifest(bytes, root) {
+  let candidate;
+  try {
+    candidate = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    throw new Error("Runtime manifest is not valid JSON");
+  }
+  await validateRuntimeManifest(candidate, root);
+  return candidate;
+}
+async function validateRuntimeManifest(candidate, root) {
+  if (!isRecord2(candidate) || candidate.schemaVersion !== 3) {
+    throw new Error("Runtime manifest has an unsupported schema version");
+  }
+  if (!isRecord2(candidate.package) || typeof candidate.package.name !== "string" || typeof candidate.package.version !== "string" || typeof candidate.managedPi !== "string") {
+    throw new Error("Runtime manifest has an invalid package identity");
+  }
+  const packageMetadata = await readPackageMetadata(root);
+  if (candidate.package.name !== packageMetadata.name || candidate.package.version !== packageMetadata.version) {
+    throw new Error("Runtime manifest package identity does not match package.json");
+  }
+  if (!Array.isArray(candidate.files) || !Array.isArray(candidate.dependencies)) {
+    throw new Error("Runtime manifest has invalid artifact lists");
+  }
+  const filePaths = /* @__PURE__ */ new Set();
+  for (const file of candidate.files) {
+    if (!isRecord2(file) || !isManifestPath(file.path) || !isValidSize(file.bytes) || !isSha256(file.sha256)) {
+      throw new Error("Runtime manifest contains an invalid artifact");
+    }
+    if (filePaths.has(file.path)) {
+      throw new Error(`Runtime manifest has duplicate path ${file.path}`);
+    }
+    filePaths.add(file.path);
+  }
+  for (const required of requiredRuntimeArtifacts) {
+    if (!filePaths.has(required)) {
+      throw new Error(`Runtime manifest is missing required artifact ${required}`);
+    }
+  }
+  const dependencyPaths = /* @__PURE__ */ new Set();
+  const dependencyNames = /* @__PURE__ */ new Set();
+  for (const dependency of candidate.dependencies) {
+    if (!isRecord2(dependency) || !isManifestPath(dependency.path) || typeof dependency.name !== "string" || dependency.name.length === 0 || typeof dependency.version !== "string" || dependency.version.length === 0 || dependency.path !== `node_modules/${dependency.name}`) {
+      throw new Error("Runtime manifest contains an invalid dependency declaration");
+    }
+    if (dependencyPaths.has(dependency.path) || dependencyNames.has(dependency.name)) {
+      throw new Error(`Runtime manifest has duplicate dependency ${dependency.name}`);
+    }
+    dependencyPaths.add(dependency.path);
+    dependencyNames.add(dependency.name);
+  }
+  const expectedDependencies = packageMetadata.dependencies;
+  if (dependencyNames.size !== Object.keys(expectedDependencies).length || [...dependencyNames].some(
+    (name) => expectedDependencies[name] !== candidate.dependencies.find(
+      (dependency) => dependency.name === name
+    )?.version
+  )) {
+    throw new Error("Runtime manifest dependencies do not match package.json");
+  }
+  for (const filePath of filePaths) {
+    for (const dependencyPath of dependencyPaths) {
+      if (filePath === dependencyPath || filePath.startsWith(`${dependencyPath}/`) || dependencyPath.startsWith(`${filePath}/`)) {
+        throw new Error(`Runtime manifest has overlapping paths ${filePath} and ${dependencyPath}`);
+      }
+    }
+  }
+  if (candidate.closure !== void 0) {
+    if (!isRecord2(candidate.closure) || !isSha256(candidate.closure.sourceManifestSha256) || !isTreeIntegrity(candidate.closure.tree) || candidate.closure.tree.path !== dependencyTreePath) {
+      throw new Error("Runtime manifest contains an invalid materialized closure");
     }
   }
 }
+async function readPackageMetadata(root) {
+  let candidate;
+  try {
+    candidate = JSON.parse(await readFile2(join2(root, "package.json"), "utf8"));
+  } catch {
+    throw new Error("Runtime package.json is not valid JSON");
+  }
+  if (!isRecord2(candidate) || typeof candidate.name !== "string" || typeof candidate.version !== "string" || candidate.dependencies !== void 0 && !isRecord2(candidate.dependencies) || isRecord2(candidate.dependencies) && Object.values(candidate.dependencies).some((version) => typeof version !== "string")) {
+    throw new Error("Runtime package.json has invalid package metadata");
+  }
+  return {
+    name: candidate.name,
+    version: candidate.version,
+    dependencies: isRecord2(candidate.dependencies) ? candidate.dependencies : {}
+  };
+}
+function serializeManifest(manifest) {
+  return Buffer.from(`${JSON.stringify(manifest, null, 2)}
+`);
+}
+function assertSameTree(expected, actual, label) {
+  if (expected.path !== actual.path || expected.files !== actual.files || expected.bytes !== actual.bytes || expected.sha256 !== actual.sha256) {
+    throw new Error(`Runtime ${label} changed during materialization`);
+  }
+}
 function resolveInside(root, path2) {
+  if (!isManifestPath(path2)) throw new Error(`Runtime manifest contains an unsafe path ${path2}`);
   const resolved = resolve3(root, path2);
   if (!resolved.startsWith(`${root}${sep2}`)) {
     throw new Error(`Runtime manifest contains an unsafe path ${path2}`);
   }
   return resolved;
 }
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+function isManifestPath(value) {
+  return typeof value === "string" && value.length > 0 && !value.includes("\\") && !value.startsWith("/") && posix.normalize(value) === value && value.split("/").every((part) => part.length > 0 && part !== "." && part !== "..");
+}
+function isValidSize(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isSha256(value) {
+  return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+function isTreeIntegrity(value) {
+  return isRecord2(value) && isManifestPath(value.path) && isValidSize(value.files) && isValidSize(value.bytes) && isSha256(value.sha256);
+}
+function isDestinationRace(error) {
+  const code = error.code;
+  return code === "EEXIST" || code === "ENOTEMPTY";
+}
 async function ensurePrivateDirectory(path2) {
   await mkdir(path2, { recursive: true, mode: 448 });
   const info = await lstat2(path2);