@happier-dev/stack 0.1.0-preview.10.1 → 0.1.0-preview.134.1

package/node_modules/@happier-dev/release-runtime/dist/extractPlan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractPlan.d.ts","sourceRoot":"","sources":["../src/extractPlan.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAEvE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;CACpC,CAAC,GAAG,QAAQ,CAAC;IAAE,eAAe,EAAE,KAAK,GAAG,YAAY,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,CAsChF"}

package/node_modules/@happier-dev/release-runtime/dist/extractPlan.js

@@ -0,0 +1,39 @@
+export function planArchiveExtraction(params) {
+    const name = String(params.archiveName ?? '').trim();
+    const archivePath = String(params.archivePath ?? '').trim();
+    const destDir = String(params.destDir ?? '').trim();
+    const os = String(params.os ?? '').trim().toLowerCase();
+    if (!name)
+        throw new Error('[extract] archiveName is required');
+    if (!archivePath)
+        throw new Error('[extract] archivePath is required');
+    if (!destDir)
+        throw new Error('[extract] destDir is required');
+    if (os !== 'linux' && os !== 'darwin' && os !== 'windows') {
+        throw new Error(`[extract] unsupported os: ${os}`);
+    }
+    if (name.toLowerCase().endsWith('.zip')) {
+        if (os !== 'windows') {
+            throw new Error(`[extract] .zip archives are supported only on windows (got ${os})`);
+        }
+        const command = `Expand-Archive -LiteralPath "${archivePath}" -DestinationPath "${destDir}" -Force`;
+        return {
+            requiredCommand: 'powershell',
+            command: {
+                cmd: 'powershell',
+                args: ['-NoProfile', '-Command', command],
+            },
+        };
+    }
+    if (name.toLowerCase().endsWith('.tar.gz')) {
+        return {
+            requiredCommand: 'tar',
+            command: {
+                cmd: 'tar',
+                args: ['-xzf', archivePath, '-C', destDir],
+            },
+        };
+    }
+    throw new Error(`[extract] unsupported archive extension: ${name}`);
+}
+//# sourceMappingURL=extractPlan.js.map

package/node_modules/@happier-dev/release-runtime/dist/extractPlan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractPlan.js","sourceRoot":"","sources":["../src/extractPlan.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,qBAAqB,CAAC,MAKpC;IACA,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAExD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAChE,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/D,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8DAA8D,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,OAAO,GAAG,gCAAgC,WAAW,uBAAuB,OAAO,UAAU,CAAC;QACpG,OAAO;YACL,eAAe,EAAE,YAAY;YAC7B,OAAO,EAAE;gBACP,GAAG,EAAE,YAAY;gBACjB,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC;aAC1C;SACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,eAAe,EAAE,KAAK;YACtB,OAAO,EAAE;gBACP,GAAG,EAAE,KAAK;gBACV,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC;aAC3C;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/node_modules/@happier-dev/release-runtime/dist/github.d.ts

@@ -0,0 +1,20 @@
+type FetchImpl = typeof fetch;
+export declare function fetchGitHubReleaseByTag(params: Readonly<{
+    githubRepo: string;
+    tag: string;
+    userAgent?: string;
+    githubToken?: string;
+    fetchImpl?: FetchImpl;
+}>): Promise<unknown>;
+export declare function fetchFirstGitHubReleaseByTags(params: Readonly<{
+    githubRepo: string;
+    tags: string[];
+    userAgent?: string;
+    githubToken?: string;
+    fetchImpl?: FetchImpl;
+}>): Promise<Readonly<{
+    tag: string;
+    release: unknown;
+}>>;
+export {};
+//# sourceMappingURL=github.d.ts.map

package/node_modules/@happier-dev/release-runtime/dist/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../src/github.ts"],"names":[],"mappings":"AAAA,KAAK,SAAS,GAAG,OAAO,KAAK,CAAC;AAiB9B,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBpB;AAED,wBAAsB,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CA0BxD"}

package/node_modules/@happier-dev/release-runtime/dist/github.js

@@ -0,0 +1,60 @@
+function buildGitHubReleaseTagUrl(githubRepo, tag) {
+    const repo = String(githubRepo ?? '').trim();
+    const t = String(tag ?? '').trim();
+    if (!repo)
+        throw new Error('[github] githubRepo is required');
+    if (!t)
+        throw new Error('[github] tag is required');
+    return `https://api.github.com/repos/${repo}/releases/tags/${encodeURIComponent(t)}`;
+}
+function createHttpError(message, status) {
+    const err = new Error(message);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    err.status = status;
+    return err;
+}
+export async function fetchGitHubReleaseByTag(params) {
+    const userAgent = String(params.userAgent ?? '').trim() || 'happier-release-runtime';
+    const token = String(params.githubToken ?? '').trim();
+    const fetchImpl = params.fetchImpl ?? fetch;
+    const url = buildGitHubReleaseTagUrl(params.githubRepo, params.tag);
+    const headers = {
+        'user-agent': userAgent,
+        accept: 'application/vnd.github+json',
+    };
+    if (token)
+        headers.authorization = `Bearer ${token}`;
+    const response = await fetchImpl(url, { headers });
+    if (!response.ok) {
+        throw createHttpError(`[github] failed to resolve release tag ${params.tag} (${response.status})`, response.status);
+    }
+    return response.json();
+}
+export async function fetchFirstGitHubReleaseByTags(params) {
+    const tags = Array.isArray(params.tags) ? params.tags : [];
+    for (const tag of tags) {
+        try {
+            // eslint-disable-next-line no-await-in-loop
+            const release = await fetchGitHubReleaseByTag({
+                githubRepo: params.githubRepo,
+                tag,
+                userAgent: params.userAgent,
+                githubToken: params.githubToken,
+                fetchImpl: params.fetchImpl,
+            });
+            return { tag, release };
+        }
+        catch (e) {
+            const status = typeof e === 'object' && e != null && 'status' in e
+                ? Number(
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                e.status)
+                : NaN;
+            if (status === 404)
+                continue;
+            throw e;
+        }
+    }
+    throw createHttpError('[github] no matching release tags found', 404);
+}
+//# sourceMappingURL=github.js.map

package/node_modules/@happier-dev/release-runtime/dist/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../src/github.ts"],"names":[],"mappings":"AAEA,SAAS,wBAAwB,CAAC,UAAkB,EAAE,GAAW;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpD,OAAO,gCAAgC,IAAI,kBAAkB,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,8DAA8D;IAC7D,GAAW,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAM5C;IACA,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,yBAAyB,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,SAAS,GAAc,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IAEvD,MAAM,GAAG,GAAG,wBAAwB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,OAAO,GAA2B;QACtC,YAAY,EAAE,SAAS;QACvB,MAAM,EAAE,6BAA6B;KACtC,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,eAAe,CAAC,0CAA0C,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,MAMlD;IACA,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,4CAA4C;YAC5C,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;gBAC5C,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,GAAG;gBACH,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GACV,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC;gBACjD,CAAC,CAAC,MAAM;gBACJ,8DAA8D;gBAC7D,CAAS,CAAC,MAAM,CAClB;gBACH,CAAC,CAAC,GAAG,CAAC;YACV,IAAI,MAAM,KAAK,GAAG;gBAAE,SAAS;YAC7B,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,MAAM,eAAe,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC"}

package/node_modules/@happier-dev/release-runtime/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { DEFAULT_MINISIGN_PUBLIC_KEY, verifyMinisign } from './minisign.js';
+export { lookupSha256 } from './checksums.js';
+export { resolveReleaseAssetBundle } from './assets.js';
+export { planArchiveExtraction } from './extractPlan.js';
+export { downloadVerifiedReleaseAssetBundle } from './verifiedDownload.js';
+export { fetchGitHubReleaseByTag, fetchFirstGitHubReleaseByTags } from './github.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@happier-dev/release-runtime/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC"}

package/node_modules/@happier-dev/release-runtime/dist/index.js

@@ -0,0 +1,7 @@
+export { DEFAULT_MINISIGN_PUBLIC_KEY, verifyMinisign } from './minisign.js';
+export { lookupSha256 } from './checksums.js';
+export { resolveReleaseAssetBundle } from './assets.js';
+export { planArchiveExtraction } from './extractPlan.js';
+export { downloadVerifiedReleaseAssetBundle } from './verifiedDownload.js';
+export { fetchGitHubReleaseByTag, fetchFirstGitHubReleaseByTags } from './github.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@happier-dev/release-runtime/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC"}

package/node_modules/@happier-dev/release-runtime/dist/minisign.d.ts

@@ -0,0 +1,7 @@
+export declare const DEFAULT_MINISIGN_PUBLIC_KEY = "untrusted comment: minisign public key 91AE28177BF6E43C\nRWQ85PZ7FyiukYbL3qv/bKnwgbT68wLVzotapeMFIb8n+c7pBQ7U8W2t\n";
+export declare function verifyMinisign(params: Readonly<{
+    message: Buffer;
+    pubkeyFile: string;
+    sigFile: string;
+}>): boolean;
+//# sourceMappingURL=minisign.d.ts.map

package/node_modules/@happier-dev/release-runtime/dist/minisign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minisign.d.ts","sourceRoot":"","sources":["../src/minisign.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,2BAA2B,wHAEvC,CAAC;AAmEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,OAAO,CAiClH"}

package/node_modules/@happier-dev/release-runtime/dist/minisign.js

@@ -0,0 +1,92 @@
+import { createHash, createPublicKey, verify } from 'node:crypto';
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+export const DEFAULT_MINISIGN_PUBLIC_KEY = `untrusted comment: minisign public key 91AE28177BF6E43C
+RWQ85PZ7FyiukYbL3qv/bKnwgbT68wLVzotapeMFIb8n+c7pBQ7U8W2t
+`;
+function decodeBase64Line(line, expectedBytes) {
+    const bytes = Buffer.from(String(line ?? '').trim(), 'base64');
+    if (expectedBytes != null && bytes.length !== expectedBytes) {
+        throw new Error(`[minisign] expected ${expectedBytes} bytes, got ${bytes.length}`);
+    }
+    return bytes;
+}
+function parseMinisignPublicKeyFile(pubkeyFile) {
+    const lines = String(pubkeyFile ?? '')
+        .split('\n')
+        .map((l) => l.trim())
+        .filter(Boolean);
+    if (lines.length < 2)
+        throw new Error('[minisign] invalid public key file');
+    const payload = lines[lines.length - 1] ?? '';
+    const bytes = decodeBase64Line(payload, 42);
+    const signatureAlgorithm = bytes.subarray(0, 2);
+    const keyId = bytes.subarray(2, 10);
+    const rawPublicKey = bytes.subarray(10, 42);
+    return { signatureAlgorithm, keyId, rawPublicKey };
+}
+function parseMinisignSignatureFile(sigFile) {
+    const lines = String(sigFile ?? '').split('\n');
+    if (lines.length < 4)
+        throw new Error('[minisign] invalid signature file');
+    const untrustedPayload = String(lines[1] ?? '').trim();
+    const trustedComment = String(lines[2] ?? '');
+    const globalPayload = String(lines[3] ?? '').trim();
+    const untrustedBytes = decodeBase64Line(untrustedPayload, 74);
+    const signatureAlgorithm = untrustedBytes.subarray(0, 2);
+    const keyId = untrustedBytes.subarray(2, 10);
+    const signature = untrustedBytes.subarray(10, 74);
+    const globalSignature = decodeBase64Line(globalPayload, 64);
+    if (!trustedComment.startsWith('trusted comment: ')) {
+        throw new Error('[minisign] unexpected trusted comment format');
+    }
+    const trustedSuffix = Buffer.from(trustedComment.slice('trusted comment: '.length), 'utf-8');
+    return { signatureAlgorithm, keyId, signature, trustedSuffix, globalSignature };
+}
+function createEd25519PublicKey(rawPublicKey) {
+    if (!Buffer.isBuffer(rawPublicKey) || rawPublicKey.length !== 32) {
+        throw new Error('[minisign] invalid Ed25519 public key length');
+    }
+    const spki = Buffer.concat([ED25519_SPKI_PREFIX, rawPublicKey]);
+    return createPublicKey({ key: spki, format: 'der', type: 'spki' });
+}
+function bytesEqual(a, b) {
+    if (!a || !b)
+        return false;
+    if (a.length !== b.length)
+        return false;
+    return Buffer.compare(a, b) === 0;
+}
+export function verifyMinisign(params) {
+    try {
+        const bin = Buffer.isBuffer(params.message) ? params.message : Buffer.from(params.message ?? '');
+        const pubkey = parseMinisignPublicKeyFile(params.pubkeyFile);
+        const sig = parseMinisignSignatureFile(params.sigFile);
+        if (!bytesEqual(pubkey.signatureAlgorithm, Buffer.from('Ed'))) {
+            throw new Error('[minisign] incompatible public key signature algorithm');
+        }
+        if (!bytesEqual(pubkey.keyId, sig.keyId)) {
+            throw new Error('[minisign] incompatible key identifiers');
+        }
+        let prehashed = false;
+        if (bytesEqual(sig.signatureAlgorithm, Buffer.from('Ed'))) {
+            prehashed = false;
+        }
+        else if (bytesEqual(sig.signatureAlgorithm, Buffer.from('ED'))) {
+            prehashed = true;
+        }
+        else {
+            throw new Error('[minisign] unsupported signature algorithm');
+        }
+        const publicKey = createEd25519PublicKey(pubkey.rawPublicKey);
+        const payload = prehashed ? createHash('blake2b512').update(bin).digest() : bin;
+        const okSig = verify(null, payload, publicKey, sig.signature);
+        if (!okSig)
+            return false;
+        const okGlobal = verify(null, Buffer.concat([sig.signature, sig.trustedSuffix]), publicKey, sig.globalSignature);
+        return okGlobal;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=minisign.js.map

package/node_modules/@happier-dev/release-runtime/dist/minisign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minisign.js","sourceRoot":"","sources":["../src/minisign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,2BAA2B,GAAG;;CAE1C,CAAC;AAEF,SAAS,gBAAgB,CAAC,IAAY,EAAE,aAAsB;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,aAAa,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,uBAAuB,aAAa,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,UAAkB;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;SACnC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,kBAAkB,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IAOjD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAE3E,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpD,MAAM,cAAc,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAElD,MAAM,eAAe,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAE5D,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IAE7F,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,sBAAsB,CAAC,YAAoB;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA0E;IACvG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1D,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;aAAM,IAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjE,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAEhF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QACjH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/node_modules/@happier-dev/release-runtime/dist/verifiedDownload.d.ts

@@ -0,0 +1,26 @@
+type ReleaseAsset = Readonly<{
+    name: string;
+    url: string;
+}>;
+export type ReleaseAssetBundle = Readonly<{
+    version: string;
+    archive: ReleaseAsset;
+    checksums: ReleaseAsset;
+    checksumsSig: ReleaseAsset;
+}>;
+export declare function downloadVerifiedReleaseAssetBundle(params: Readonly<{
+    bundle: ReleaseAssetBundle;
+    destDir: string;
+    pubkeyFile: string;
+    userAgent?: string;
+}>): Promise<Readonly<{
+    version: string;
+    archiveName: string;
+    archivePath: string;
+    source: {
+        archiveUrl: string;
+        checksumsUrl: string;
+    };
+}>>;
+export {};
+//# sourceMappingURL=verifiedDownload.d.ts.map

package/node_modules/@happier-dev/release-runtime/dist/verifiedDownload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedDownload.d.ts","sourceRoot":"","sources":["../src/verifiedDownload.ts"],"names":[],"mappings":"AAOA,KAAK,YAAY,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5D,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,YAAY,CAAC;IACxB,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC,CAAC;AAmBH,wBAAsB,kCAAkC,CAAC,MAAM,EAAE,QAAQ,CAAC;IACxE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD,CAAC,CAAC,CAgCF"}

package/node_modules/@happier-dev/release-runtime/dist/verifiedDownload.js

@@ -0,0 +1,53 @@
+import { createHash } from 'node:crypto';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { lookupSha256 } from './checksums.js';
+import { verifyMinisign } from './minisign.js';
+async function fetchText(url, { userAgent = 'happier-release-runtime' } = {}) {
+    const res = await fetch(url, { headers: { 'user-agent': userAgent } });
+    if (!res.ok)
+        throw new Error(`[download] failed: ${url} (${res.status})`);
+    return res.text();
+}
+async function fetchBytes(url, { userAgent = 'happier-release-runtime' } = {}) {
+    const res = await fetch(url, { headers: { 'user-agent': userAgent } });
+    if (!res.ok)
+        throw new Error(`[download] failed: ${url} (${res.status})`);
+    const ab = await res.arrayBuffer();
+    return Buffer.from(ab);
+}
+function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+export async function downloadVerifiedReleaseAssetBundle(params) {
+    const bundle = params.bundle;
+    const destDir = String(params.destDir ?? '').trim();
+    const pubkeyFile = String(params.pubkeyFile ?? '');
+    const userAgent = String(params.userAgent ?? '').trim() || 'happier-release-runtime';
+    if (!destDir)
+        throw new Error('[download] destDir is required');
+    if (!pubkeyFile.trim())
+        throw new Error('[download] pubkeyFile is required');
+    await mkdir(destDir, { recursive: true });
+    const checksumsText = await fetchText(bundle.checksums.url, { userAgent });
+    const sigFile = await fetchText(bundle.checksumsSig.url, { userAgent });
+    const ok = verifyMinisign({ message: Buffer.from(checksumsText, 'utf-8'), pubkeyFile, sigFile });
+    if (!ok) {
+        throw new Error('[download] signature verification failed for checksums file');
+    }
+    const expected = lookupSha256({ checksumsText, filename: bundle.archive.name });
+    const bytes = await fetchBytes(bundle.archive.url, { userAgent });
+    const actual = sha256Hex(bytes);
+    if (actual !== expected) {
+        throw new Error(`[download] checksum verification failed for ${bundle.archive.name}`);
+    }
+    const archivePath = join(destDir, bundle.archive.name);
+    await writeFile(archivePath, bytes);
+    return {
+        version: String(bundle.version ?? ''),
+        archiveName: bundle.archive.name,
+        archivePath,
+        source: { archiveUrl: bundle.archive.url, checksumsUrl: bundle.checksums.url },
+    };
+}
+//# sourceMappingURL=verifiedDownload.js.map

package/node_modules/@happier-dev/release-runtime/dist/verifiedDownload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedDownload.js","sourceRoot":"","sources":["../src/verifiedDownload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAW/C,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,EAAE,SAAS,GAAG,yBAAyB,EAAE,GAAG,EAAE;IAClF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,EAAE,SAAS,GAAG,yBAAyB,EAAE,GAAG,EAAE;IACnF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,MAKvD;IAMA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,yBAAyB,CAAC;IACrF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAE7E,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QAChC,WAAW;QACX,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;KAC/E,CAAC;AACJ,CAAC"}

package/node_modules/@happier-dev/release-runtime/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@happier-dev/release-runtime",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./minisign": {
+      "types": "./dist/minisign.d.ts",
+      "default": "./dist/minisign.js"
+    },
+    "./checksums": {
+      "types": "./dist/checksums.d.ts",
+      "default": "./dist/checksums.js"
+    },
+    "./assets": {
+      "types": "./dist/assets.d.ts",
+      "default": "./dist/assets.js"
+    },
+    "./extractPlan": {
+      "types": "./dist/extractPlan.d.ts",
+      "default": "./dist/extractPlan.js"
+    },
+    "./verifiedDownload": {
+      "types": "./dist/verifiedDownload.d.ts",
+      "default": "./dist/verifiedDownload.js"
+    },
+    "./github": {
+      "types": "./dist/github.d.ts",
+      "default": "./dist/github.js"
+    }
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@happier-dev/stack",
   "type": "module",
-  "version": "0.1.0-preview.10.1",
+  "version": "0.1.0-preview.134.1",
   "repository": "happier-dev/happier",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -18,7 +18,8 @@
     "scripts/"
   ],
   "bundledDependencies": [
-    "@happier-dev/cli-common"
+    "@happier-dev/cli-common",
+    "@happier-dev/release-runtime"
   ],
   "scripts": {
     "setup": "node ./scripts/setup.mjs",
@@ -71,6 +72,7 @@
   },
   "dependencies": {
     "@happier-dev/cli-common": "0.0.0",
+    "@happier-dev/release-runtime": "0.0.0",
     "qrcode": "^1.5.4",
     "qrcode-terminal": "^0.12.0"
   }

package/scripts/auth.mjs

@@ -451,8 +451,9 @@ function resolveLightDirsForStack({ env, baseDir }) {
 function resolveDbProviderForLightFromEnv(env) {
   const raw = (env.HAPPIER_DB_PROVIDER ?? env.HAPPY_DB_PROVIDER ?? '').toString().trim().toLowerCase();
   if (raw === 'sqlite') return 'sqlite';
-  // Default for light flavor (embedded Postgres via pglite).
-  return 'pglite';
+  if (raw === 'pglite') return 'pglite';
+  // Default for light flavor.
+  return 'sqlite';
 }
 
 function resolveDbProviderForFullFromEnv(env) {

package/scripts/auth_copy_from_pglite_lock_in_use.integration.test.mjs

@@ -37,6 +37,7 @@ test('hstack stack auth copy-from skips pglite DB seed when lock is held by a li
       [
         `HAPPIER_STACK_STACK=${name}`,
         `HAPPIER_STACK_SERVER_COMPONENT=happier-server-light`,
+        `HAPPIER_DB_PROVIDER=pglite`,
         `HAPPIER_STACK_REPO_DIR=${repoRoot}`,
         `HAPPIER_SERVER_LIGHT_DATA_DIR=${dataDir}`,
         `HAPPIER_SERVER_LIGHT_FILES_DIR=${join(dataDir, 'files')}`,

package/scripts/auth_copy_from_runCapture.integration.test.mjs

@@ -28,7 +28,8 @@ test('hstack stack auth copy-from does not hit ReferenceError: runCapture is not
   const binDir = join(tmp, 'bin');
   await mkdir(binDir, { recursive: true });
   const yarnPath = join(binDir, 'yarn');
-  await writeFile(yarnPath, '#!/bin/bash\nexit 0\n', 'utf-8');
+  const yarnLogPath = join(tmp, 'yarn.calls.log');
+  await writeFile(yarnPath, `#!/bin/bash\necho \"$*\" >> ${JSON.stringify(yarnLogPath)}\nexit 0\n`, 'utf-8');
   await chmod(yarnPath, 0o755);
 
   const repoRoot = dirname(rootDir); // .../apps/stack -> .../ (monorepo root)
@@ -75,6 +76,12 @@ test('hstack stack auth copy-from does not hit ReferenceError: runCapture is not
     !res.stdout.includes('spawn yarn ENOENT') && !res.stderr.includes('spawn yarn ENOENT'),
     `expected yarn to be resolvable in light migrations step\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`
   );
+  const yarnCalls = await readFile(yarnLogPath, 'utf-8');
+  assert.match(
+    yarnCalls,
+    /\bmigrate:sqlite:deploy\b/,
+    `expected light auth flow without explicit DB provider to use sqlite migrations\ncalls:\n${yarnCalls}`
+  );
 });
 
 test('hstack stack auth copy-from prefers source server-scoped credential over unrelated legacy key', async (t) => {

package/scripts/build.mjs

@@ -13,6 +13,7 @@ import { getInvokedCwd, inferComponentFromCwd } from './utils/cli/cwd_scope.mjs'
 import { applyStackTauriOverrides } from './utils/tauri/stack_overrides.mjs';
 import { buildIntoTempThenReplace } from './utils/fs/atomic_dir_swap.mjs';
 import { pathExists } from './utils/fs/fs.mjs';
+import { buildStackTauriExportEnv, buildStackWebExportEnv } from './utils/ui/ui_export_env.mjs';
 
 /**
  * Build a lightweight static web UI bundle (no Expo dev server).
@@ -93,14 +94,7 @@ async function main() {
   console.log(`[local] exporting web UI to ${outDir}...`);
 
   // Build for root hosting (the server redirects /ui -> /).
-  const env = {
-    ...process.env,
-    NODE_ENV: 'production',
-    EXPO_PUBLIC_DEBUG: '0',
-    // Leave empty for web export so the app uses window.location.origin at runtime.
-    // (Important for Tailscale: a phone loading `http://100.x.y.z:3005` must not call `http://localhost:3005`.)
-    EXPO_PUBLIC_HAPPY_SERVER_URL: '',
-  };
+  const env = buildStackWebExportEnv({ baseEnv: process.env });
 
   // Expo CLI is available via node_modules/.bin once dependencies are installed.
   await buildIntoTempThenReplace(outDir, async (tmpOutDir) => {
@@ -171,16 +165,7 @@ async function main() {
 
   console.log(`[local] exporting web UI for Tauri to ${tauriDistDir}...`);
 
-  const tauriEnv = {
-    ...process.env,
-    NODE_ENV: 'production',
-    EXPO_PUBLIC_DEBUG: '0',
-    // In Tauri, window.location.origin is a tauri:// origin, so we must hardcode the API base.
-    EXPO_PUBLIC_HAPPY_SERVER_URL: tauriServerUrl,
-    // Some parts of the app use EXPO_PUBLIC_SERVER_URL; keep them aligned.
-    EXPO_PUBLIC_SERVER_URL: tauriServerUrl,
-    // For the Tauri bundle we want root-relative assets (no /ui baseUrl), so do not set EXPO_PUBLIC_WEB_BASE_URL
-  };
+  const tauriEnv = buildStackTauriExportEnv({ baseEnv: process.env, tauriServerUrl });
   delete tauriEnv.EXPO_PUBLIC_WEB_BASE_URL;
 
   {

package/scripts/bundleWorkspaceDeps.mjs

@@ -15,6 +15,11 @@ export function bundleWorkspaceDeps(opts = {}) {
       srcDir: resolve(repoRoot, 'packages', 'cli-common'),
       destDir: resolve(stackDir, 'node_modules', '@happier-dev', 'cli-common'),
     },
+    {
+      packageName: '@happier-dev/release-runtime',
+      srcDir: resolve(repoRoot, 'packages', 'release-runtime'),
+      destDir: resolve(stackDir, 'node_modules', '@happier-dev', 'release-runtime'),
+    },
   ];
 
   bundleWorkspacePackages({ bundles });
@@ -35,4 +40,3 @@ if (invokedAsMain) {
     process.exit(1);
   }
 }
-

package/scripts/bundleWorkspaceDeps.test.mjs

@@ -14,10 +14,26 @@ function createBundleFixture(prefix = 'happy-stack-bundle-workspace-deps-') {
   const repoRoot = mkdtempSync(join(tmpdir(), prefix));
   const stackDir = resolve(repoRoot, 'apps', 'stack');
   const cliCommonDir = resolve(repoRoot, 'packages', 'cli-common');
+  const releaseRuntimeDir = resolve(repoRoot, 'packages', 'release-runtime');
   writeJson(resolve(repoRoot, 'package.json'), { name: 'repo', private: true });
   writeFileSync(resolve(repoRoot, 'yarn.lock'), '# lock\n', 'utf8');
   mkdirSync(resolve(cliCommonDir, 'dist'), { recursive: true });
+  mkdirSync(resolve(releaseRuntimeDir, 'dist'), { recursive: true });
   mkdirSync(stackDir, { recursive: true });
+
+  // bundleWorkspaceDeps also bundles @happier-dev/release-runtime. Keep a minimal, build-like
+  // workspace package present so these tests focus on bundling behavior instead of fixture setup.
+  writeJson(resolve(releaseRuntimeDir, 'package.json'), {
+    name: '@happier-dev/release-runtime',
+    version: '0.0.0',
+    type: 'module',
+    main: './dist/index.js',
+    types: './dist/index.d.ts',
+    exports: { '.': { default: './dist/index.js', types: './dist/index.d.ts' } },
+    scripts: { postinstall: 'echo should-not-run' },
+  });
+  writeFileSync(resolve(releaseRuntimeDir, 'dist', 'index.js'), 'export const release = 1;\n', 'utf8');
+
   return { repoRoot, stackDir, cliCommonDir };
 }