@intentic/machine 1.337.0 → 1.339.0

package/dist/keyring/service.js

@@ -0,0 +1,258 @@
+import { existsSync } from "node:fs";
+import { chmod, copyFile, link, readdir, rename, rm } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { pollUntil } from "@intentic/base/async";
+import { repoRoot } from "@intentic/constants/node";
+import { errorMessage } from "@intentic/base/errors";
+import { renameOver } from "@intentic/base/fs";
+import { runBounded } from "@intentic/base/process";
+import { askKeyring, currentSid, isHardened, keyringPaths, KeyringUnavailable, realRunner } from "@intentic/keyring";
+import { autostart, explain, livePid, spawnDetached, stopProcess } from "@intentic/local-agent";
+import { DEV_VERSION } from "@intentic/sandbox-contract/state/versions";
+import { KEYRING_AUTOSTART, KEYRING_SESSION_AUTOSTART } from "../autostart/autostart.js";
+import { binDir } from "../config.js";
+import { askpassPath, download, keyringAssetName, keyringPath, releaseAssetUrl, renameIfPresent } from "../release.js";
+import { verifyReleaseFiles } from "../release/release-verify.js";
+import { KeyringCliError } from "./flags.js";
+const KEYRING_LAUNCHER = [keyringPath];
+const STATE_TIMEOUT_MS = 1_500;
+const START_TIMEOUT_MS = 20_000;
+const START_POLL_MS = 300;
+const STOP_TIMEOUT_MS = 5_000;
+const ELEVATED_TIMEOUT_MS = 10 * 60_000;
+export const keyringInstalled = () => existsSync(keyringPath);
+export const keyringState = async (timeoutMs = STATE_TIMEOUT_MS) => {
+    try {
+        return await askKeyring({ address: keyringPaths().address, timeoutMs }, { op: "state" });
+    }
+    catch (error) {
+        if (error instanceof KeyringUnavailable) {
+            return error;
+        }
+        throw error;
+    }
+};
+const waitForKeyring = async () => {
+    let answer;
+    await pollUntil(async () => {
+        const state = await keyringState();
+        answer = state instanceof KeyringUnavailable ? undefined : state;
+        return answer !== undefined;
+    }, { intervalMs: START_POLL_MS, timeoutMs: START_TIMEOUT_MS });
+    return answer;
+};
+export const localKeyringBuild = (from = import.meta.url) => {
+    let root;
+    try {
+        root = repoRoot(from);
+    }
+    catch {
+        return undefined;
+    }
+    const candidate = join(root, "_devices", "keyring", "dist-bin", keyringAssetName());
+    return existsSync(candidate) ? candidate : undefined;
+};
+const stagingOf = (version) => `${keyringPath}.new-${version}`;
+const sweepStaged = async (keep) => {
+    const prefix = `${basename(keyringPath)}.new-`;
+    const stale = (await readdir(binDir).catch(() => [])).filter((name) => name.startsWith(prefix) && join(binDir, name) !== keep);
+    await Promise.all(stale.map(async (name) => await rm(join(binDir, name), { force: true }).catch(() => undefined)));
+};
+export const stageKeyring = async (version, log) => {
+    const staged = stagingOf(version);
+    if (version === DEV_VERSION) {
+        const local = localKeyringBuild();
+        if (local === undefined) {
+            throw new KeyringCliError("failed", explain("There is no keyring to install.", "this intentic-machine was built from source (0.0.0), which has no release to download the keyring from, and _devices/keyring/dist-bin holds no build for this computer.", `build one with \`bash _tools/scripts/build/build-agent-binaries.sh _devices/keyring intentic-keyring <target>\` (the asset ${keyringAssetName()}), then run this again.`));
+        }
+        log(`Using the keyring built in this checkout (${local}): a from-source agent has no release to take it from.`);
+        await copyFile(local, staged);
+        await chmod(staged, 0o755);
+        return staged;
+    }
+    await sweepStaged(staged);
+    log(`Downloading intentic-keyring ${version}…`);
+    try {
+        await download(releaseAssetUrl(version, keyringAssetName()), staged, { resume: true });
+    }
+    catch (error) {
+        throw new KeyringCliError("failed", `the keyring of v${version} did not download (${errorMessage(error)}). A release from before the keyring shipped has none: \`intentic-machine upgrade\` first.`, { cause: error });
+    }
+    try {
+        await verifyReleaseFiles(version, [{ name: keyringAssetName(), path: staged }]);
+    }
+    catch (error) {
+        await rm(staged, { force: true }).catch(() => undefined);
+        throw new KeyringCliError("failed", `the downloaded keyring did not check out (${errorMessage(error)}), so it was deleted.`, { cause: error });
+    }
+    log("Checked against the release's signed SHA256SUMS.");
+    await chmod(staged, 0o755);
+    return staged;
+};
+export const linkAskpass = async () => {
+    await rm(askpassPath, { force: true }).catch(async () => await renameIfPresent(askpassPath, `${askpassPath}.old`));
+    try {
+        await link(keyringPath, askpassPath);
+        return "linked";
+    }
+    catch {
+        await copyFile(keyringPath, askpassPath);
+        await chmod(askpassPath, 0o755);
+        return "copied";
+    }
+};
+export const KEYRING_SERVICE = "IntenticKeyring";
+export const hardenedHere = async () => {
+    if (process.platform !== "win32") {
+        return false;
+    }
+    try {
+        return isHardened(await currentSid(realRunner));
+    }
+    catch {
+        return false;
+    }
+};
+const psQuoted = (text) => `'${text.replaceAll("'", "''")}'`;
+const runElevated = async (args) => {
+    const script = `$p = Start-Process -FilePath ${psQuoted(keyringPath)} -ArgumentList ${args.map(psQuoted).join(",")} -Verb RunAs -Wait -PassThru; exit $p.ExitCode`;
+    const result = await runBounded("powershell.exe", ["-NoProfile", "-Command", script], { timeoutMs: ELEVATED_TIMEOUT_MS });
+    if (result.spawnError !== undefined) {
+        throw result.spawnError;
+    }
+    if (result.exitCode !== 0) {
+        const said = result.stderr.text.trim();
+        throw new KeyringCliError(/canceled by the user/iu.test(said) ? "declined" : "failed", /canceled by the user/iu.test(said)
+            ? "Windows asked for an administrator's yes, and it was not given: nothing was changed."
+            : `\`intentic-keyring ${args.join(" ")}\` did not finish (exit ${String(result.exitCode)})${said === "" ? "" : `: ${said}`}. Its log is ${keyringPaths().log}.`);
+    }
+};
+const entryFor = (hardened, log) => autostart(hardened ? KEYRING_SESSION_AUTOSTART : KEYRING_AUTOSTART, KEYRING_LAUNCHER, log);
+export const keyringPid = async () => await livePid(keyringPaths().pid);
+export const startKeyring = async (log) => {
+    const hardened = await hardenedHere();
+    const spec = hardened ? KEYRING_SESSION_AUTOSTART : KEYRING_AUTOSTART;
+    const entry = entryFor(hardened, log);
+    const kind = await entry.register();
+    const running = await keyringState();
+    if (!(running instanceof KeyringUnavailable)) {
+        return { autostart: kind, state: running };
+    }
+    if (await entry.start()) {
+        const came = await waitForKeyring();
+        if (came !== undefined) {
+            return { autostart: kind, state: came };
+        }
+        log(`Its ${kind} entry did not start the keyring within ${START_TIMEOUT_MS / 1000} s: starting it directly.`);
+    }
+    await spawnDetached(spec.logPath, KEYRING_LAUNCHER, spec.foregroundArgs);
+    const came = await waitForKeyring();
+    if (came === undefined) {
+        throw new KeyringCliError("no-keyring", `The keyring started but its pipe did not answer within ${START_TIMEOUT_MS / 1000} s. Its log is ${spec.logPath}.`);
+    }
+    return { autostart: kind, state: came };
+};
+export const stopKeyring = async () => {
+    const pid = await keyringPid();
+    if (pid !== undefined) {
+        await stopProcess(pid, STOP_TIMEOUT_MS);
+    }
+    return pid;
+};
+export const installKeyring = async (version, log) => {
+    if (keyringInstalled()) {
+        return { path: keyringPath, fresh: false, askpass: await linkAskpass() };
+    }
+    const staged = await stageKeyring(version, log);
+    await renameOver(staged, keyringPath);
+    return { path: keyringPath, fresh: true, askpass: await linkAskpass() };
+};
+const previousOf = (path) => `${path}.previous`;
+export const upgradeKeyring = async (version, log) => {
+    if (!keyringInstalled()) {
+        throw new KeyringCliError("no-keyring", "No keyring is installed on this computer: `intentic-machine keyring setup` installs one.");
+    }
+    const before = await keyringState();
+    if (before instanceof KeyringUnavailable) {
+        throw new KeyringCliError("no-keyring", "The keyring is not running, and only a running keyring can ask you about an upgrade: `intentic-machine keyring setup` starts it.");
+    }
+    const from = before.ok ? before.state.version : "unknown";
+    if (from === version && version !== DEV_VERSION) {
+        return { ok: true, upgraded: false, from, to: version };
+    }
+    const staged = await stageKeyring(version, log);
+    log("Asking the keyring, which asks you, before anything is replaced…");
+    const consent = await askKeyring({ address: keyringPaths().address }, { op: "consent-upgrade", version });
+    if (!consent.ok) {
+        await rm(staged, { force: true }).catch(() => undefined);
+        return consent;
+    }
+    await stopKeyring();
+    await rm(previousOf(keyringPath), { force: true });
+    await renameIfPresent(keyringPath, previousOf(keyringPath));
+    await renameOver(staged, keyringPath);
+    await linkAskpass();
+    if (await hardenedHere()) {
+        log("Windows asks for an administrator's yes to put the new keyring in place for the hardened service…");
+        await runElevated(["service", "install"]);
+    }
+    try {
+        const { state } = await startKeyring(log);
+        const to = state.ok ? state.state.version : version;
+        return { ok: true, upgraded: true, from, to };
+    }
+    catch (error) {
+        log(`The new keyring did not answer (${errorMessage(error)}): putting the one before it back.`);
+        await stopKeyring();
+        await renameOver(previousOf(keyringPath), keyringPath);
+        await linkAskpass();
+        await startKeyring(log);
+        throw new KeyringCliError("failed", `The keyring ${version} did not start, so ${from} was put back and is running again.`, { cause: error });
+    }
+};
+export const hardenKeyring = async (log) => {
+    if (process.platform !== "win32") {
+        throw new KeyringCliError("unavailable", "Hardened mode is Windows-only: it moves the vault under a Windows service account the agent's own commands cannot read. Elsewhere the keyring runs as your user.");
+    }
+    if (!keyringInstalled()) {
+        throw new KeyringCliError("no-keyring", "No keyring is installed on this computer: `intentic-machine keyring setup` installs one first.");
+    }
+    await stopKeyring();
+    await entryFor(false, log).unregister();
+    log("Windows asks for an administrator's yes, once, to move the vault under the hardened keyring…");
+    await runElevated(["service", "install"]);
+    const entry = entryFor(true, log);
+    const kind = await entry.register();
+    if (!(await entry.start())) {
+        await spawnDetached(KEYRING_SESSION_AUTOSTART.logPath, KEYRING_LAUNCHER, KEYRING_SESSION_AUTOSTART.foregroundArgs);
+    }
+    if ((await waitForKeyring()) === undefined) {
+        throw new KeyringCliError("no-keyring", `The service was installed, but the keyring's pipe did not answer within ${START_TIMEOUT_MS / 1000} s. Its log is ${keyringPaths().log}.`);
+    }
+    return { service: KEYRING_SERVICE, autostart: kind };
+};
+export const uninstallKeyring = async (log) => {
+    const hardened = await hardenedHere();
+    if (hardened) {
+        log("Windows asks for an administrator's yes, once, to remove the IntenticKeyring service…");
+        await runElevated(["service", "uninstall"]);
+    }
+    await entryFor(hardened, log).unregister();
+    await stopKeyring();
+    const names = (await readdir(binDir).catch(() => [])).filter((name) => name.startsWith(basename(keyringPath)) || name.startsWith(basename(askpassPath)));
+    const outcomes = await Promise.all(names.map(async (name) => {
+        const path = join(binDir, name);
+        try {
+            await rm(path, { force: true });
+            return path;
+        }
+        catch (error) {
+            log(`Could not remove ${path} (${errorMessage(error)}): it goes once nothing runs it.`);
+            await rename(path, `${path}.old`).catch(() => undefined);
+            return undefined;
+        }
+    }));
+    const removed = outcomes.filter((path) => path !== undefined);
+    return { removed, vault: keyringPaths().dir, hardened };
+};
+//# sourceMappingURL=service.js.map

package/dist/keyring/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/keyring/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAwB,kBAAkB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC3I,OAAO,EAAsB,SAAS,EAAoB,OAAO,EAAE,OAAO,EAAY,aAAa,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAChJ,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AAExE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAQ7C,MAAM,gBAAgB,GAAgB,CAAC,WAAW,CAAC,CAAC;AAGpD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AAExC,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAY,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAKvE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,SAAS,GAAW,gBAAgB,EAAoD,EAAE;IACzH,IAAI,CAAC;QACD,OAAO,MAAM,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,IAA6C,EAAE;IACvE,IAAI,MAAsC,CAAC;IAC3C,MAAM,SAAS,CACX,KAAK,IAAI,EAAE;QACP,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;QACnC,MAAM,GAAG,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QACjE,OAAO,MAAM,KAAK,SAAS,CAAC;IAChC,CAAC,EACD,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAC7D,CAAC;IACF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAI,GAAW,OAAO,IAAI,CAAC,GAAG,EAAsB,EAAE;IACpF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACD,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACpF,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC,CAAC;AAIF,MAAM,SAAS,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,WAAW,QAAQ,OAAO,EAAE,CAAC;AAE/E,MAAM,WAAW,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;IACtD,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC;IAE/C,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAE/H,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACvH,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,OAAe,EAAE,GAAQ,EAAmB,EAAE;IAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,eAAe,CACrB,QAAQ,EACR,OAAO,CACH,iCAAiC,EACjC,yKAAyK,EACzK,8HAA8H,gBAAgB,EAAE,yBAAyB,CAC5K,CACJ,CAAC;QACN,CAAC;QACD,GAAG,CAAC,6CAA6C,KAAK,wDAAwD,CAAC,CAAC;QAChH,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1B,GAAG,CAAC,gCAAgC,OAAO,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC;QACD,MAAM,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACrB,QAAQ,EACR,mBAAmB,OAAO,sBAAsB,YAAY,CAAC,KAAK,CAAC,4FAA4F,EAC/J,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;IACN,CAAC;IACD,IAAI,CAAC;QACD,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAGb,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,6CAA6C,YAAY,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACnJ,CAAC;IACD,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,IAAkC,EAAE;IAGhE,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,GAAG,WAAW,MAAM,CAAC,CAAC,CAAC;IACnH,IAAI,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QAEL,MAAM,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACzC,MAAM,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,QAAQ,CAAC;IACpB,CAAC;AACL,CAAC,CAAC;AAKF,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAMjD,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,IAAsB,EAAE;IACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAG7E,MAAM,WAAW,GAAG,KAAK,EAAE,IAAuB,EAAiB,EAAE;IACjE,MAAM,MAAM,GAAG,gCAAgC,QAAQ,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gDAAgD,CAAC;IACnK,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC1H,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,eAAe,CACrB,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAC3D,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,CAAC,CAAC,sFAAsF;YACxF,CAAC,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,gBAAgB,YAAY,EAAE,CAAC,GAAG,GAAG,CACtK,CAAC;IACN,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,QAAQ,GAAG,CAAC,QAAiB,EAAE,GAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;AAG7I,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,IAAiC,EAAE,CAAC,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;AAMrG,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,GAAQ,EAAsF,EAAE;IAC/H,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;IACrC,IAAI,CAAC,CAAC,OAAO,YAAY,kBAAkB,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QACD,GAAG,CAAC,OAAO,IAAI,2CAA2C,gBAAgB,GAAG,IAAI,2BAA2B,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,0DAA0D,gBAAgB,GAAG,IAAI,kBAAkB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IAChK,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,IAAiC,EAAE;IAC/D,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC,CAAC;AAeF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,OAAe,EAAE,GAAQ,EAA6B,EAAE;IACzF,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAC;AAC5E,CAAC,CAAC;AAQF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,IAAI,WAAW,CAAC;AAOhE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,OAAe,EAAE,GAAQ,EAA2B,EAAE;IACvF,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,0FAA0F,CAAC,CAAC;IACxI,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,IAAI,MAAM,YAAY,kBAAkB,EAAE,CAAC;QACvC,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,kIAAkI,CAAC,CAAC;IAChL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChD,GAAG,CAAC,kEAAkE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAEd,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,eAAe,CAAC,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5D,MAAM,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,MAAM,WAAW,EAAE,CAAC;IACpB,IAAI,MAAM,YAAY,EAAE,EAAE,CAAC;QAEvB,GAAG,CAAC,mGAAmG,CAAC,CAAC;QACzG,MAAM,WAAW,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,GAAG,CAAC,mCAAmC,YAAY,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAChG,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,eAAe,OAAO,sBAAsB,IAAI,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACjJ,CAAC;AACL,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAQ,EAA4E,EAAE;IACtH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CACrB,aAAa,EACb,kKAAkK,CACrK,CAAC;IACN,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,gGAAgG,CAAC,CAAC;IAC9I,CAAC;IAID,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;IACxC,GAAG,CAAC,8FAA8F,CAAC,CAAC;IACpG,MAAM,WAAW,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,2EAA2E,gBAAgB,GAAG,IAAI,kBAAkB,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IACvL,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAQ,EAAwG,EAAE;IACrJ,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACX,GAAG,CAAC,uFAAuF,CAAC,CAAC;QAC7F,MAAM,WAAW,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,WAAW,EAAE,CAAC;IAEpB,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACzJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,GAAG,CAAC,oBAAoB,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAExF,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC,CAAC,CACL,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC5D,CAAC,CAAC"}

package/dist/machine-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-id.d.ts","sourceRoot":"","sources":["../src/machine-id.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,aAAa,QAA8B,CAAC;AAGzD,eAAO,MAAM,cAAc,wBAAwB,CAAC;AAwBpD,eAAO,MAAM,SAAS,SAAS,MAAM,CAAC,UAAU,SAAsB,MAAM,KAAmB,MAe9F,CAAC"}
+{"version":3,"file":"machine-id.d.ts","sourceRoot":"","sources":["../src/machine-id.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,aAAa,QAA8B,CAAC;AAGzD,eAAO,MAAM,cAAc,wBAAwB,CAAC;AAsBpD,eAAO,MAAM,SAAS,SAAS,MAAM,CAAC,UAAU,SAAsB,MAAM,KAAmB,MAe9F,CAAC"}

package/dist/machine-id.js

@@ -1,8 +1,9 @@
 import { randomUUID } from "node:crypto";
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { undefinedIfMissing } from "@intentic/base/errors";
-import { MachineIdSchema } from "@intentic/sandbox-contract";
+import { writeFileAtomicSync } from "@intentic/base/fs";
+import { MachineIdSchema } from "@intentic/sandbox-contract/schemas/hosts";
 import { baseDir } from "./config.js";
 export const machineIdPath = join(baseDir, "machine-id");
 export const MACHINE_ID_ENV = "INTENTIC_MACHINE_ID";
@@ -17,9 +18,7 @@ const read = (path) => {
 };
 const write = (path, id) => {
     mkdirSync(dirname(path), { recursive: true });
-    const part = `${path}.part`;
-    writeFileSync(part, `${id}\n`, { mode: 0o644 });
-    renameSync(part, path);
+    writeFileAtomicSync(path, `${id}\n`, 0o644);
 };
 export const machineId = (env = process.env, path = machineIdPath) => {
     const handed = valid(env[MACHINE_ID_ENV]);

package/dist/machine-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"machine-id.js","sourceRoot":"","sources":["../src/machine-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAOtC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAGzD,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAsB,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAG/G,MAAM,IAAI,GAAG,CAAC,IAAY,EAAsB,EAAE;IAC9C,IAAI,CAAC;QACD,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAU,EAAQ,EAAE;IAC7C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,CAAC;IAC5B,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAKF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,IAAI,GAAW,aAAa,EAAU,EAAE;IACpG,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,UAAU,EAAE,EAAE,CAAC;IACnC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
+{"version":3,"file":"machine-id.js","sourceRoot":"","sources":["../src/machine-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAOtC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAGzD,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAsB,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAG/G,MAAM,IAAI,GAAG,CAAC,IAAY,EAAsB,EAAE;IAC9C,IAAI,CAAC;QACD,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAU,EAAQ,EAAE;IAC7C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC,CAAC;AAKF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,IAAI,GAAW,aAAa,EAAU,EAAE;IACpG,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,UAAU,EAAE,EAAE,CAAC;IACnC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/release/release-signature.d.ts

@@ -0,0 +1,17 @@
+import { type KeyObject } from "node:crypto";
+export interface MinisignPublicKey {
+    readonly keyId: string;
+    readonly key: KeyObject;
+}
+export interface MinisignSignature {
+    readonly algorithm: "Ed" | "ED";
+    readonly keyId: string;
+    readonly signature: Buffer;
+    readonly trustedComment: string;
+    readonly globalSignature: Buffer;
+}
+export declare const parsePublicKey: (text: string) => MinisignPublicKey;
+export declare const parseSignature: (text: string) => MinisignSignature;
+export declare const verifyMinisign: (data: Uint8Array, signature: MinisignSignature, publicKey: MinisignPublicKey) => string;
+export declare const verifySignedSums: (sums: Uint8Array, signatureText: string, publicKeyText: string, version: string) => void;
+//# sourceMappingURL=release-signature.d.ts.map

package/dist/release/release-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-signature.d.ts","sourceRoot":"","sources":["../../src/release/release-signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,SAAS,EAAU,MAAM,aAAa,CAAC;AAYlF,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CAC3B;AAGD,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CACpC;AAwBD,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,iBAQ7C,CAAC;AAGF,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,iBA0B7C,CAAC;AAMF,eAAO,MAAM,cAAc,SAAU,UAAU,aAAa,iBAAiB,aAAa,iBAAiB,KAAG,MAa7G,CAAC;AAiBF,eAAO,MAAM,gBAAgB,SAAU,UAAU,iBAAiB,MAAM,iBAAiB,MAAM,WAAW,MAAM,KAAG,IAQlH,CAAC"}

package/dist/release/release-signature.js

@@ -0,0 +1,78 @@
+import { createHash, createPublicKey, verify } from "node:crypto";
+const UNTRUSTED = "untrusted comment:";
+const TRUSTED = "trusted comment: ";
+const minisignLines = (text) => {
+    const trimmed = text.trim();
+    if (!trimmed.startsWith(UNTRUSTED) && /^[A-Za-z0-9+/=\s]+$/.test(trimmed)) {
+        const decoded = Buffer.from(trimmed, "base64").toString("utf8");
+        if (decoded.startsWith(UNTRUSTED)) {
+            return decoded.trim().split(/\r?\n/);
+        }
+    }
+    return trimmed.split(/\r?\n/);
+};
+const keyIdOf = (bytes) => Buffer.from([...bytes].toReversed())
+    .toString("hex")
+    .toUpperCase();
+export const parsePublicKey = (text) => {
+    const keyLine = minisignLines(text).find((line) => line.trim() !== "" && !line.startsWith(UNTRUSTED)) ?? "";
+    const raw = Buffer.from(keyLine.trim(), "base64");
+    if (raw.length !== 42 || raw.toString("latin1", 0, 2) !== "Ed") {
+        throw new Error("not a minisign Ed25519 public key");
+    }
+    const key = createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: raw.subarray(10).toString("base64url") }, format: "jwk" });
+    return { keyId: keyIdOf(raw.subarray(2, 10)), key };
+};
+export const parseSignature = (text) => {
+    const [untrusted, signatureLine, trusted, globalLine] = minisignLines(text);
+    if (untrusted?.startsWith(UNTRUSTED) !== true ||
+        trusted?.startsWith(TRUSTED) !== true ||
+        signatureLine === undefined ||
+        globalLine === undefined) {
+        throw new Error("not a minisign signature: it needs an untrusted comment, a signature, a trusted comment and a global signature");
+    }
+    const raw = Buffer.from(signatureLine.trim(), "base64");
+    const algorithm = raw.toString("latin1", 0, 2);
+    if (raw.length !== 74 || (algorithm !== "Ed" && algorithm !== "ED")) {
+        throw new Error(`not a minisign Ed25519 signature (algorithm "${algorithm}", ${raw.length} bytes)`);
+    }
+    const globalSignature = Buffer.from(globalLine.trim(), "base64");
+    if (globalSignature.length !== 64) {
+        throw new Error(`the global signature is ${globalSignature.length} bytes, not 64`);
+    }
+    return {
+        algorithm,
+        keyId: keyIdOf(raw.subarray(2, 10)),
+        signature: raw.subarray(10),
+        trustedComment: trusted.slice(TRUSTED.length),
+        globalSignature,
+    };
+};
+export const verifyMinisign = (data, signature, publicKey) => {
+    if (signature.keyId !== publicKey.keyId) {
+        throw new Error(`it is signed by key ${signature.keyId}, not the release key ${publicKey.keyId}`);
+    }
+    const signed = signature.algorithm === "ED" ? createHash("blake2b512").update(data).digest() : data;
+    if (!verify(null, signed, publicKey.key, signature.signature)) {
+        throw new Error("the signature does not match the file");
+    }
+    const comment = Buffer.concat([signature.signature, Buffer.from(signature.trustedComment, "utf8")]);
+    if (!verify(null, comment, publicKey.key, signature.globalSignature)) {
+        throw new Error("the signature over the trusted comment does not match");
+    }
+    return signature.trustedComment;
+};
+const commentFields = (comment) => new Map(comment.split("\t").map((field) => {
+    const colon = field.indexOf(":");
+    return colon === -1 ? [field, ""] : [field.slice(0, colon), field.slice(colon + 1)];
+}));
+export const verifySignedSums = (sums, signatureText, publicKeyText, version) => {
+    const fields = commentFields(verifyMinisign(sums, parseSignature(signatureText), parsePublicKey(publicKeyText)));
+    if (fields.get("file") !== "SHA256SUMS") {
+        throw new Error(`the signature is for ${fields.get("file") ?? "a file it does not name"}, not SHA256SUMS`);
+    }
+    if (fields.get("version") !== version) {
+        throw new Error(`the signature is for release ${fields.get("version") ?? "(none named)"}, not ${version}`);
+    }
+};
+//# sourceMappingURL=release-signature.js.map

package/dist/release/release-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-signature.js","sourceRoot":"","sources":["../../src/release/release-signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAkB,MAAM,EAAE,MAAM,aAAa,CAAC;AA0BlF,MAAM,SAAS,GAAG,oBAAoB,CAAC;AACvC,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAIpC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAY,EAAE;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAU,EAAE,CAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;KAC/B,QAAQ,CAAC,KAAK,CAAC;KACf,WAAW,EAAE,CAAC;AAGvB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAqB,EAAE;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5G,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/H,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;AACxD,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAqB,EAAE;IAC9D,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5E,IACI,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI;QACzC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI;QACrC,aAAa,KAAK,SAAS;QAC3B,UAAU,KAAK,SAAS,EAC1B,CAAC;QACC,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,gDAAgD,SAAS,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjE,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,2BAA2B,eAAe,CAAC,MAAM,gBAAgB,CAAC,CAAC;IACvF,CAAC;IACD,OAAO;QACH,SAAS;QACT,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC7C,eAAe;KAClB,CAAC;AACN,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAgB,EAAE,SAA4B,EAAE,SAA4B,EAAU,EAAE;IACnH,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,CAAC,KAAK,yBAAyB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACpG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,SAAS,CAAC,cAAc,CAAC;AACpC,CAAC,CAAC;AAGF,MAAM,aAAa,GAAG,CAAC,OAAe,EAAuB,EAAE,CAC3D,IAAI,GAAG,CACH,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC,CACL,CAAC;AAQN,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAgB,EAAE,aAAqB,EAAE,aAAqB,EAAE,OAAe,EAAQ,EAAE;IACtH,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACjH,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,yBAAyB,kBAAkB,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,cAAc,SAAS,OAAO,EAAE,CAAC,CAAC;IAC/G,CAAC;AACL,CAAC,CAAC"}

package/dist/release/release-verify.d.ts

@@ -0,0 +1,11 @@
+export declare const RELEASE_PUBLIC_KEY = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEYzODRDRTZGODg4RkY5NkEKUldScStZK0liODZFODh5UWRTdmhLaCsyK09PS3dlV25XUUdQa0hiY1lUR2NGSGI3Smxaby9zRzYK";
+export declare const SIGNED_SUMS_FROM = "1.338.0";
+export declare const signatureRequired: (version: string) => boolean;
+export declare const sumsEntry: (sumsText: string, name: string) => string | undefined;
+export type FetchAsset = (url: string) => Promise<Uint8Array | undefined>;
+export interface ReleaseFile {
+    readonly name: string;
+    readonly path: string;
+}
+export declare const verifyReleaseFiles: (version: string, files: readonly ReleaseFile[], fetchOne?: FetchAsset, publicKey?: string) => Promise<"signed" | "unsigned">;
+//# sourceMappingURL=release-verify.d.ts.map

package/dist/release/release-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-verify.d.ts","sourceRoot":"","sources":["../../src/release/release-verify.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,kBAAkB,6JAC+H,CAAC;AAQ/J,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAG1C,eAAO,MAAM,iBAAiB,YAAa,MAAM,KAAG,OAA8C,CAAC;AAGnG,eAAO,MAAM,SAAS,aAAc,MAAM,QAAQ,MAAM,KAAG,MAAM,GAAG,SAQnE,CAAC;AAWF,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;AAc1E,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAeD,eAAO,MAAM,kBAAkB,YAClB,MAAM,SACR,SAAS,WAAW,EAAE,aACnB,UAAU,cACT,MAAM,KAClB,OAAO,CAAC,QAAQ,GAAG,UAAU,CA4B/B,CAAC"}

package/dist/release/release-verify.js

@@ -0,0 +1,74 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { errorMessage } from "@intentic/base/errors";
+import { isNewer } from "@intentic/sandbox-contract/state/versions";
+import { releaseAssetUrl } from "../release.js";
+import { verifySignedSums } from "./release-signature.js";
+export const RELEASE_PUBLIC_KEY = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEYzODRDRTZGODg4RkY5NkEKUldScStZK0liODZFODh5UWRTdmhLaCsyK09PS3dlV25XUUdQa0hiY1lUR2NGSGI3Smxaby9zRzYK";
+export const SIGNED_SUMS_FROM = "1.338.0";
+export const signatureRequired = (version) => !isNewer(SIGNED_SUMS_FROM, version);
+export const sumsEntry = (sumsText, name) => {
+    for (const line of sumsText.split(/\r?\n/)) {
+        const match = /^([0-9a-fA-F]{64}) [ *](?:\.\/)?(.+)$/.exec(line.trim());
+        if (match?.[2] === name) {
+            return match[1]?.toLowerCase();
+        }
+    }
+    return undefined;
+};
+const fileSha256 = async (path) => {
+    const hash = createHash("sha256");
+    for await (const chunk of createReadStream(path)) {
+        hash.update(chunk);
+    }
+    return hash.digest("hex");
+};
+const fetchAsset = async (url) => {
+    const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(60_000) });
+    if (response.status === 404) {
+        return undefined;
+    }
+    if (!response.ok) {
+        throw new Error(`${url} answered ${response.status}`);
+    }
+    return new Uint8Array(await response.arrayBuffer());
+};
+const read = async (fetchOne, version, name) => {
+    try {
+        return await fetchOne(releaseAssetUrl(version, name));
+    }
+    catch (error) {
+        throw new Error(`could not read ${name} of v${version} (${errorMessage(error)})`, { cause: error });
+    }
+};
+export const verifyReleaseFiles = async (version, files, fetchOne = fetchAsset, publicKey = RELEASE_PUBLIC_KEY) => {
+    const sums = await read(fetchOne, version, "SHA256SUMS");
+    if (sums === undefined) {
+        throw new Error(`release v${version} publishes no SHA256SUMS to check the download against`);
+    }
+    const signature = await read(fetchOne, version, "SHA256SUMS.sig");
+    if (signature !== undefined) {
+        try {
+            verifySignedSums(sums, Buffer.from(signature).toString("utf8"), publicKey, version);
+        }
+        catch (error) {
+            throw new Error(`the SHA256SUMS of v${version} is not signed by the release key: ${errorMessage(error)}`, { cause: error });
+        }
+    }
+    else if (signatureRequired(version)) {
+        throw new Error(`release v${version} carries no SHA256SUMS.sig, and every release from v${SIGNED_SUMS_FROM} on is signed`);
+    }
+    const text = Buffer.from(sums).toString("utf8");
+    for (const file of files) {
+        const expected = sumsEntry(text, file.name);
+        if (expected === undefined) {
+            throw new Error(`the SHA256SUMS of v${version} lists no ${file.name}`);
+        }
+        const actual = await fileSha256(file.path);
+        if (actual !== expected) {
+            throw new Error(`the downloaded ${file.name} is not the one v${version} published (SHA-256 ${actual}, its SHA256SUMS says ${expected})`);
+        }
+    }
+    return signature === undefined ? "unsigned" : "signed";
+};
+//# sourceMappingURL=release-verify.js.map

package/dist/release/release-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-verify.js","sourceRoot":"","sources":["../../src/release/release-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAc1D,MAAM,CAAC,MAAM,kBAAkB,GAC3B,0JAA0J,CAAC;AAQ/J,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAG1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAGnG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAsB,EAAE;IAC5E,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAmB,EAAE;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC,CAAC;AAKF,MAAM,UAAU,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC;AAQF,MAAM,IAAI,GAAG,KAAK,EAAE,QAAoB,EAAE,OAAe,EAAE,IAAY,EAAmC,EAAE;IACxG,IAAI,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,QAAQ,OAAO,KAAK,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;AACL,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACnC,OAAe,EACf,KAA6B,EAC7B,QAAQ,GAAe,UAAU,EACjC,SAAS,GAAW,kBAAkB,EACR,EAAE;IAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,wDAAwD,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC;YACD,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,sCAAsC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChI,CAAC;IACL,CAAC;SAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,uDAAuD,gBAAgB,eAAe,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,IAAI,oBAAoB,OAAO,uBAAuB,MAAM,yBAAyB,QAAQ,GAAG,CAAC,CAAC;QAC7I,CAAC;IACL,CAAC;IACD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3D,CAAC,CAAC"}

package/dist/release.d.ts

@@ -3,8 +3,14 @@ export declare const osToken: () => "linux" | "darwin" | "windows";
 export declare const archToken: () => "amd64" | "arm64";
 export declare const agentPath: string;
 export declare const launcherPath: string;
+export declare const releaseAssetUrl: (version: string, name: string) => string;
+export declare const agentAssetName: () => string;
+export declare const launcherAssetName: () => string;
 export declare const agentAssetUrl: (version: string) => string;
 export declare const launcherAssetUrl: (version: string) => string;
+export declare const keyringPath: string;
+export declare const askpassPath: string;
+export declare const keyringAssetName: () => string;
 export declare const publishedVersion: () => Promise<string | undefined>;
 export declare const versionOf: (binary: string) => string | undefined;
 export interface DownloadOptions {

package/dist/release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,GAAG,QAA6C,CAAC;AAE9D,eAAO,MAAM,OAAO,QAAO,OAAO,GAAG,QAAQ,GAAG,SAQ/C,CAAC;AAEF,eAAO,MAAM,SAAS,QAAO,OAAO,GAAG,OAQtC,CAAC;AAEF,eAAO,MAAM,SAAS,QAAyC,CAAC;AAChE,eAAO,MAAM,YAAY,QAAoC,CAAC;AAK9D,eAAO,MAAM,aAAa,YAAa,MAAM,KAAG,MAA+F,CAAC;AAChJ,eAAO,MAAM,gBAAgB,YAAa,MAAM,KAAG,MAAuF,CAAC;AAG3I,eAAO,MAAM,gBAAgB,QAAa,OAAO,CAAC,MAAM,GAAG,SAAS,CAOnE,CAAC;AAMF,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,MAAM,GAAG,SAGnD,CAAC;AAGF,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnE;AA4DD,eAAO,MAAM,QAAQ,QAAe,MAAM,QAAQ,MAAM,YAAW,eAAe,KAAQ,OAAO,CAAC,IAAI,CASrG,CAAC;AAGF,eAAO,MAAM,eAAe,SAAgB,MAAM,MAAM,MAAM,KAAG,OAAO,CAAC,IAAI,CAM5E,CAAC;AAOF,eAAO,MAAM,UAAU,SAAU,MAAM,KAAG,OAAyD,CAAC;AAGpG,eAAO,MAAM,QAAQ,QAAa,OAAO,CAAC,IAAI,CAM7C,CAAC"}
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,GAAG,QAA6C,CAAC;AAE9D,eAAO,MAAM,OAAO,QAAO,OAAO,GAAG,QAAQ,GAAG,SAQ/C,CAAC;AAEF,eAAO,MAAM,SAAS,QAAO,OAAO,GAAG,OAQtC,CAAC;AAEF,eAAO,MAAM,SAAS,QAAyC,CAAC;AAChE,eAAO,MAAM,YAAY,QAAoC,CAAC;AAK9D,eAAO,MAAM,eAAe,YAAa,MAAM,QAAQ,MAAM,KAAG,MAAoD,CAAC;AAErH,eAAO,MAAM,cAAc,QAAO,MAA8D,CAAC;AACjG,eAAO,MAAM,iBAAiB,QAAO,MAAsD,CAAC;AAC5F,eAAO,MAAM,aAAa,YAAa,MAAM,KAAG,MAAoD,CAAC;AACrG,eAAO,MAAM,gBAAgB,YAAa,MAAM,KAAG,MAAuD,CAAC;AAM3G,eAAO,MAAM,WAAW,QAAyC,CAAC;AAClE,eAAO,MAAM,WAAW,QAAyC,CAAC;AAClE,eAAO,MAAM,gBAAgB,QAAO,MAA8D,CAAC;AAGnG,eAAO,MAAM,gBAAgB,QAAa,OAAO,CAAC,MAAM,GAAG,SAAS,CAOnE,CAAC;AAMF,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,MAAM,GAAG,SAGnD,CAAC;AAGF,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnE;AA4DD,eAAO,MAAM,QAAQ,QAAe,MAAM,QAAQ,MAAM,YAAW,eAAe,KAAQ,OAAO,CAAC,IAAI,CASrG,CAAC;AAGF,eAAO,MAAM,eAAe,SAAgB,MAAM,MAAM,MAAM,KAAG,OAAO,CAAC,IAAI,CAM5E,CAAC;AAQF,eAAO,MAAM,UAAU,SAAU,MAAM,KAAG,OAAyD,CAAC;AAGpG,eAAO,MAAM,QAAQ,QAAa,OAAO,CAAC,IAAI,CAM7C,CAAC"}

package/dist/release.js

@@ -27,8 +27,14 @@ export const archToken = () => {
 export const agentPath = join(binDir, `intentic-machine${exe}`);
 export const launcherPath = join(binDir, WINDOWS_LAUNCH_STUB);
 const RELEASES = "https://github.com/intentic/intentic/releases";
-export const agentAssetUrl = (version) => `${RELEASES}/download/v${version}/intentic-machine-${osToken()}-${archToken()}${exe}`;
-export const launcherAssetUrl = (version) => `${RELEASES}/download/v${version}/intentic-launch-windows-${archToken()}.exe`;
+export const releaseAssetUrl = (version, name) => `${RELEASES}/download/v${version}/${name}`;
+export const agentAssetName = () => `intentic-machine-${osToken()}-${archToken()}${exe}`;
+export const launcherAssetName = () => `intentic-launch-windows-${archToken()}.exe`;
+export const agentAssetUrl = (version) => releaseAssetUrl(version, agentAssetName());
+export const launcherAssetUrl = (version) => releaseAssetUrl(version, launcherAssetName());
+export const keyringPath = join(binDir, `intentic-keyring${exe}`);
+export const askpassPath = join(binDir, `intentic-askpass${exe}`);
+export const keyringAssetName = () => `intentic-keyring-${osToken()}-${archToken()}${exe}`;
 export const publishedVersion = async () => {
     try {
         const response = await fetch(`${RELEASES}/latest`, { method: "HEAD", redirect: "follow", signal: AbortSignal.timeout(20_000) });

package/dist/release.js.map

@@ -1 +1 @@
-{"version":3,"file":"release.js","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAItD,MAAM,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAE9D,MAAM,CAAC,MAAM,OAAO,GAAG,GAAmC,EAAE;IACxD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,QAAQ,0DAA0D,CAAC,CAAC;AACpI,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,GAAsB,EAAE;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,IAAI,0DAA0D,CAAC,CAAC;AACpH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAE9D,MAAM,QAAQ,GAAG,+CAA+C,CAAC;AAGjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,QAAQ,cAAc,OAAO,qBAAqB,OAAO,EAAE,IAAI,SAAS,EAAE,GAAG,GAAG,EAAE,CAAC;AAChJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,QAAQ,cAAc,OAAO,4BAA4B,SAAS,EAAE,MAAM,CAAC;AAG3I,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,IAAiC,EAAE;IACpE,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChI,OAAO,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAGhC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAsB,EAAE;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7H,CAAC,CAAC;AAQF,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAY,EAAmB,EAAE;IACrD,IAAI,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,YAAY,GAAG,KAAK,EACtB,GAAW,EACX,IAAY,EAC2G,EAAE;IACzH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AAC5G,CAAC,CAAC;AAGF,MAAM,SAAS,GAAG,KAAK,EACnB,IAAiB,EACjB,IAAgC,EAChC,IAAY,EACZ,KAAa,EACb,UAAyC,EAC5B,EAAE;IACf,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC;QACD,SAAS,CAAC;YAEN,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM;YACV,CAAC;YACD,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACnC,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAE3B,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,IAAY,EAAE,OAAO,GAAoB,EAAE,EAAiB,EAAE;IACtG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;IACX,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;AACtG,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAAE,EAAU,EAAiB,EAAE;IAC7E,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;QAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AAKF,MAAM,QAAQ,GAAG,CAAC,mCAAmC,EAAE,qCAAqC,EAAE,0BAA0B,EAAE,oBAAoB,CAAC,CAAC;AAEhJ,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAGpG,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;IAC9C,IAAI,CAAC,MAAM,aAAa,CAAC,eAAe,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO;IACX,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC1I,CAAC,CAAC"}
+{"version":3,"file":"release.js","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAItD,MAAM,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAE9D,MAAM,CAAC,MAAM,OAAO,GAAG,GAAmC,EAAE;IACxD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,QAAQ,0DAA0D,CAAC,CAAC;AACpI,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,GAAsB,EAAE;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,IAAI,0DAA0D,CAAC,CAAC;AACpH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAE9D,MAAM,QAAQ,GAAG,+CAA+C,CAAC;AAGjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,IAAY,EAAU,EAAE,CAAC,GAAG,QAAQ,cAAc,OAAO,IAAI,IAAI,EAAE,CAAC;AAErH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,oBAAoB,OAAO,EAAE,IAAI,SAAS,EAAE,GAAG,GAAG,EAAE,CAAC;AACjG,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,2BAA2B,SAAS,EAAE,MAAM,CAAC;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;AACrG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAM3G,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,oBAAoB,OAAO,EAAE,IAAI,SAAS,EAAE,GAAG,GAAG,EAAE,CAAC;AAGnG,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,IAAiC,EAAE;IACpE,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChI,OAAO,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAGhC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAsB,EAAE;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7H,CAAC,CAAC;AAQF,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAY,EAAmB,EAAE;IACrD,IAAI,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,YAAY,GAAG,KAAK,EACtB,GAAW,EACX,IAAY,EAC2G,EAAE;IACzH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AAC5G,CAAC,CAAC;AAGF,MAAM,SAAS,GAAG,KAAK,EACnB,IAAiB,EACjB,IAAgC,EAChC,IAAY,EACZ,KAAa,EACb,UAAyC,EAC5B,EAAE;IACf,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC;QACD,SAAS,CAAC;YAEN,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM;YACV,CAAC;YACD,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACnC,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAE3B,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,IAAY,EAAE,OAAO,GAAoB,EAAE,EAAiB,EAAE;IACtG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;IACX,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;AACtG,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAAE,EAAU,EAAiB,EAAE;IAC7E,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;QAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AAMF,MAAM,QAAQ,GAAG,CAAC,mCAAmC,EAAE,qCAAqC,EAAE,0BAA0B,EAAE,oBAAoB,CAAC,CAAC;AAEhJ,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAGpG,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;IAC9C,IAAI,CAAC,MAAM,aAAa,CAAC,eAAe,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO;IACX,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC1I,CAAC,CAAC"}

package/dist/resident/handover.d.ts

@@ -0,0 +1,19 @@
+export declare const handoverPath: string;
+export declare const HANDOVER_FRESH_MS = 60000;
+export declare const HANDOVER_WAIT_MS: number;
+interface AskedOptions {
+    readonly path?: string;
+    readonly now?: () => number;
+    readonly alive?: (pid: number) => boolean;
+}
+export declare const handoverAsked: ({ path, now, alive }?: AskedOptions) => Promise<boolean>;
+interface AskOptions {
+    readonly holderNow: () => Promise<number | undefined>;
+    readonly stop: (pid: number) => Promise<void>;
+    readonly path?: string;
+    readonly waitMs?: number;
+    readonly pollMs?: number;
+}
+export declare const askHandover: (holder: number, { holderNow, stop, path, waitMs, pollMs }: AskOptions) => Promise<"left" | "stopped">;
+export {};
+//# sourceMappingURL=handover.d.ts.map