@lamentis/naome 1.2.0 → 1.3.0

package/installer/harness-file-ops.js

@@ -0,0 +1,140 @@
+import {
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join, relative } from "node:path";
+
+import { archiveUpgradePath, hasSymlinkInTargetPath } from "./filesystem.js";
+import { hasGeneratedIntegrity, machineFileHash } from "./native.js";
+import { printError } from "./output.js";
+
+export function ensureTemplateFile(ctx, relativePath) {
+  const sourcePath = join(ctx.templateRoot, relativePath);
+  const targetPath = join(ctx.targetRoot, relativePath);
+
+  if (hasSymlinkInTargetPath(ctx, relativePath)) {
+    printError(ctx, `NAOME cannot write ${relativePath} safely.`);
+    console.error(`${relativePath} must be a regular file or must not exist.`);
+    process.exit(1);
+  }
+
+  if (existsSync(targetPath)) {
+    if (!lstatSync(targetPath).isFile()) {
+      printError(ctx, `NAOME cannot write ${relativePath} because that path is not a file.`);
+      process.exit(1);
+    }
+
+    ctx.skipped.push(relativePath);
+    return;
+  }
+
+  mkdirSync(dirname(targetPath), { recursive: true });
+  copyFileSync(sourcePath, targetPath);
+  ctx.installed.push(relativePath);
+}
+
+export function removeBranchControlledHookShim(ctx, relativePath, archiveDirName) {
+  const targetPath = join(ctx.targetRoot, relativePath);
+  if (!existsSync(targetPath)) {
+    ctx.skipped.push(relativePath);
+    return;
+  }
+
+  if (hasSymlinkInTargetPath(ctx, relativePath) || !lstatSync(targetPath).isFile()) {
+    ctx.skipped.push(relativePath);
+    ctx.unsafeSkipped.push(relativePath);
+    return;
+  }
+
+  const archivePath = archiveUpgradePath(ctx, archiveDirName, relativePath);
+  mkdirSync(dirname(archivePath), { recursive: true });
+  copyFileSync(targetPath, archivePath);
+  unlinkSync(targetPath);
+  ctx.updated.push(relativePath);
+  ctx.archived.push({ from: relativePath, to: relative(ctx.targetRoot, archivePath) });
+}
+
+export function replaceHarnessFile(ctx, relativePath, archiveDirName) {
+  const sourcePath = join(ctx.templateRoot, relativePath);
+  const targetPath = join(ctx.targetRoot, relativePath);
+
+  if (hasSymlinkInTargetPath(ctx, relativePath)) {
+    printError(ctx, `NAOME cannot update ${relativePath} safely.`);
+    console.error(`${relativePath} must be a regular file or must not exist.`);
+    process.exit(1);
+  }
+
+  if (!existsSync(targetPath)) {
+    mkdirSync(dirname(targetPath), { recursive: true });
+    copyFileSync(sourcePath, targetPath);
+    ctx.installed.push(relativePath);
+    return;
+  }
+
+  if (!lstatSync(targetPath).isFile()) {
+    printError(ctx, `NAOME cannot update ${relativePath} because that path is not a file.`);
+    process.exit(1);
+  }
+
+  replaceChangedHarnessFile(ctx, relativePath, archiveDirName, sourcePath, targetPath);
+}
+
+export function ensureNaomeIgnore(ctx) {
+  const relativePath = ".naomeignore";
+  const sourcePath = join(ctx.templateRoot, relativePath);
+  const targetPath = join(ctx.targetRoot, relativePath);
+
+  if (hasSymlinkInTargetPath(ctx, relativePath)) {
+    printError(ctx, "NAOME cannot write .naomeignore safely.");
+    console.error(".naomeignore must be a regular file or must not exist.");
+    process.exit(1);
+  }
+
+  if (!existsSync(targetPath)) {
+    copyFileSync(sourcePath, targetPath);
+    ctx.installed.push(relativePath);
+    return;
+  }
+
+  if (!lstatSync(targetPath).isFile()) {
+    printError(ctx, "NAOME cannot update .naomeignore because that path is not a file.");
+    process.exit(1);
+  }
+
+  const content = readFileSync(targetPath, "utf8");
+  if (content.split(/\r?\n/).some((line) => line.trim() === ".naome/archive/")) {
+    ctx.skipped.push(relativePath);
+    return;
+  }
+
+  writeFileSync(targetPath, `${content.trimEnd()}\n\n.naome/archive/\n`);
+  ctx.updated.push(relativePath);
+}
+
+function replaceChangedHarnessFile(ctx, relativePath, archiveDirName, sourcePath, targetPath) {
+  const nextContent = readFileSync(sourcePath);
+  const currentContent = readFileSync(targetPath);
+  if (currentContent.equals(nextContent) || unchangedMachineHash(ctx, relativePath, currentContent, nextContent)) {
+    ctx.skipped.push(relativePath);
+    return;
+  }
+
+  const archivePath = archiveUpgradePath(ctx, archiveDirName, relativePath);
+  mkdirSync(dirname(archivePath), { recursive: true });
+  copyFileSync(targetPath, archivePath);
+  writeFileSync(targetPath, nextContent);
+  ctx.updated.push(relativePath);
+  ctx.archived.push({ from: relativePath, to: relative(ctx.targetRoot, archivePath) });
+}
+
+function unchangedMachineHash(ctx, relativePath, currentContent, nextContent) {
+  return (
+    !hasGeneratedIntegrity(ctx, relativePath) &&
+    machineFileHash(ctx, relativePath, currentContent) === machineFileHash(ctx, relativePath, nextContent)
+  );
+}

package/installer/harness-files.js

@@ -0,0 +1,56 @@
+import {
+  ensureNaomeIgnore,
+  ensureTemplateFile,
+  removeBranchControlledHookShim,
+  replaceHarnessFile,
+} from "./harness-file-ops.js";
+
+export {
+  ensureBuiltInVerificationChecks,
+  ensureTestingProofHarnessSections,
+} from "./harness-verification.js";
+
+export function ensureCoreHarnessFiles(ctx, archiveDirName) {
+  ensureNaomeIgnore(ctx);
+  ensureTemplateFile(ctx, ".naome/verification.json");
+  replaceHarnessFile(ctx, "AGENTS.md", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/index.md", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/first-run.md", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/agent-workflow.md", archiveDirName);
+  ensureTemplateFile(ctx, "docs/naome/security.md");
+  replaceHarnessFile(ctx, "docs/naome/upgrade.md", archiveDirName);
+}
+
+export function ensureRepositoryStructurePolicyFiles(ctx) {
+  ensureTemplateFile(ctx, ".naome/repository-structure.json");
+  ensureTemplateFile(ctx, "docs/naome/repository-structure.md");
+}
+
+export function ensureTaskControlHarnessFiles(ctx, archiveDirName) {
+  ensureTemplateFile(ctx, ".naome/task-state.json");
+  replaceHarnessFile(ctx, ".naome/task-contract.schema.json", archiveDirName);
+  replaceHarnessFile(ctx, ".naome/bin/check-task-state.js", archiveDirName);
+  replaceHarnessFile(ctx, "AGENTS.md", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/index.md", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/agent-workflow.md", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/execution.md", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/upgrade.md", archiveDirName);
+}
+
+export function ensureHarnessHealthFiles(ctx, archiveDirName) {
+  replaceHarnessFile(ctx, "AGENTS.md", archiveDirName);
+  replaceHarnessFile(ctx, ".naome/package.json", archiveDirName);
+  replaceHarnessFile(ctx, ".naome/bin/naome.js", archiveDirName);
+  replaceHarnessFile(ctx, ".naome/bin/check-task-state.js", archiveDirName);
+  replaceHarnessFile(ctx, ".naome/bin/check-harness-health.js", archiveDirName);
+  removeBranchControlledHookShim(ctx, ".naome/git-hooks/pre-commit", archiveDirName);
+  removeBranchControlledHookShim(ctx, ".naome/git-hooks/pre-push", archiveDirName);
+  replaceHarnessFile(ctx, ".naome/task-contract.schema.json", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/index.md", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/first-run.md", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/agent-workflow.md", archiveDirName);
+  replaceHarnessFile(ctx, "docs/naome/execution.md", archiveDirName);
+  ensureTemplateFile(ctx, "docs/naome/security.md");
+  replaceHarnessFile(ctx, "docs/naome/upgrade.md", archiveDirName);
+  ensureNaomeIgnore(ctx);
+}

package/installer/harness-verification.js

@@ -0,0 +1,123 @@
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { hasSymlinkInTargetPath, removeSkipped } from "./filesystem.js";
+import { findNativeDecisionBinary, usesSourceNativeFallback } from "./native.js";
+import { printCommandFailure, printError } from "./output.js";
+
+export function ensureBuiltInVerificationChecks(ctx) {
+  const relativePath = ".naome/verification.json";
+  const targetPath = join(ctx.targetRoot, relativePath);
+
+  if (hasSymlinkInTargetPath(ctx, relativePath)) {
+    printError(ctx, "NAOME cannot update .naome/verification.json safely.");
+    console.error(".naome/verification.json must be a regular file or must not exist.");
+    process.exit(1);
+  }
+
+  ensureVerificationFileExists(ctx, relativePath, targetPath);
+  const nativePath = verificationSeederBinary(ctx);
+  const result = spawnSync(nativePath, ["seed-verification"], {
+    cwd: ctx.targetRoot,
+    encoding: "utf8",
+  });
+
+  if (result.status !== 0) {
+    printCommandFailure(ctx, "NAOME could not seed built-in verification checks.", result);
+  }
+
+  if (!result.stdout.includes("updated")) {
+    ctx.skipped.push(relativePath);
+    return;
+  }
+
+  removeSkipped(ctx, relativePath);
+  ctx.updated.push(relativePath);
+}
+
+export function ensureTestingProofHarnessSections(ctx) {
+  const relativePath = "docs/naome/testing.md";
+  const targetPath = join(ctx.targetRoot, relativePath);
+  ensureWritableTestingDoc(ctx, relativePath, targetPath);
+
+  let content = readFileSync(targetPath, "utf8");
+  const originalContent = content;
+  for (const [heading, body] of testingSections()) {
+    if (!hasMarkdownHeading(content, heading)) {
+      content = `${content.trimEnd()}\n\n${heading}\n${body}`;
+    }
+  }
+
+  if (content !== originalContent) {
+    writeFileSync(targetPath, content.endsWith("\n") ? content : `${content}\n`);
+    ctx.updated.push(relativePath);
+  } else {
+    ctx.skipped.push(relativePath);
+  }
+}
+
+function ensureVerificationFileExists(ctx, relativePath, targetPath) {
+  if (!existsSync(targetPath)) {
+    mkdirSync(dirname(targetPath), { recursive: true });
+    copyFileSync(join(ctx.templateRoot, relativePath), targetPath);
+    ctx.installed.push(relativePath);
+  }
+
+  if (!lstatSync(targetPath).isFile()) {
+    printError(ctx, "NAOME cannot update .naome/verification.json because that path is not a file.");
+    process.exit(1);
+  }
+}
+
+function verificationSeederBinary(ctx) {
+  const nativePath = usesSourceNativeFallback(ctx)
+    ? findNativeDecisionBinary(ctx)
+    : join(ctx.targetRoot, ctx.nativeBinaryRelativePath);
+  if (
+    !nativePath ||
+    !existsSync(nativePath) ||
+    (!usesSourceNativeFallback(ctx) && hasSymlinkInTargetPath(ctx, ctx.nativeBinaryRelativePath)) ||
+    !lstatSync(nativePath).isFile()
+  ) {
+    printError(ctx, "NAOME native decision binary is unavailable for verification seeding.");
+    console.error(`Expected ${ctx.nativeBinaryRelativePath} to be installed before seeding verification checks.`);
+    process.exit(1);
+  }
+  return nativePath;
+}
+
+function ensureWritableTestingDoc(ctx, relativePath, targetPath) {
+  if (hasSymlinkInTargetPath(ctx, relativePath)) {
+    printError(ctx, "NAOME cannot update docs/naome/testing.md safely.");
+    console.error("docs/naome/testing.md must be a regular file or must not exist.");
+    process.exit(1);
+  }
+
+  if (!existsSync(targetPath)) {
+    mkdirSync(dirname(targetPath), { recursive: true });
+    copyFileSync(join(ctx.templateRoot, relativePath), targetPath);
+    ctx.installed.push(relativePath);
+    return;
+  }
+
+  if (!lstatSync(targetPath).isFile()) {
+    printError(ctx, "NAOME cannot update docs/naome/testing.md because that path is not a file.");
+    process.exit(1);
+  }
+}
+
+function testingSections() {
+  return [
+    ["## Verification Map", "\n| Change type | Required proof | Command | Notes |\n|---|---|---|---|\n| Unknown | Unknown | Unknown | Fill during NAOME upgrade. |\n"],
+    ["## Known Checks", "\n| Check id | Command | Cwd | Cost | Last verified |\n|---|---|---|---|---|\n| Unknown | Unknown | Unknown | Unknown | Unknown |\n"],
+    ["## Change Type Rules", "\n| Change type | Paths | Required checks |\n|---|---|---|\n| Unknown | Unknown | Unknown |\n"],
+    ["## Release Gates", "\n| Check id | Required when |\n|---|---|\n| Unknown | Before release, when applicable. |\n"],
+    ["## Rules", "\n- Mirror durable entries in `.naome/verification.json`.\n- Use only commands proven by repository files, CI, or user confirmation.\n- Report exact commands and results. Do not claim proof that did not run.\n"],
+    ["## Evidence", "\n- Unknown.\n"],
+  ];
+}
+
+function hasMarkdownHeading(content, heading) {
+  return content.split(/\r?\n/).some((line) => line.trim() === heading);
+}

package/installer/install-plan.js

@@ -0,0 +1,66 @@
+import { spawnSync } from "node:child_process";
+
+import { findNativeDecisionBinary } from "./native.js";
+import { printCommandFailure, printError } from "./output.js";
+
+export function loadInstallPlan(ctx) {
+  if (ctx.installPlan) {
+    return ctx.installPlan;
+  }
+
+  const nativePath = findNativeDecisionBinary(ctx);
+  if (!nativePath) {
+    printError(ctx, "NAOME native installer policy is unavailable.");
+    console.error("Install Cargo or provide NAOME_NATIVE_BIN with a built naome binary, then rerun naome sync.");
+    process.exit(1);
+  }
+
+  const result = spawnSync(nativePath, ["install-plan", "--harness-version", ctx.packageVersion], {
+    cwd: ctx.targetRoot,
+    encoding: "utf8",
+  });
+
+  if (result.status !== 0) {
+    printCommandFailure(ctx, "NAOME could not load its Rust install plan.", result);
+  }
+
+  assignInstallPlan(ctx, parseInstallPlan(ctx, result.stdout));
+  return ctx.installPlan;
+}
+
+function parseInstallPlan(ctx, output) {
+  try {
+    const installPlan = JSON.parse(output);
+    assertInstallPlanArray(ctx, installPlan, "machineOwned");
+    assertInstallPlanArray(ctx, installPlan, "projectOwned");
+    assertInstallPlanArray(ctx, installPlan, "localOnlyMachineOwned");
+    assertInstallPlanArray(ctx, installPlan, "gitignoreEntries");
+    assertInstallPlanArray(ctx, installPlan, "gitExcludeEntries");
+    assertInstallPlanArray(ctx, installPlan, "gitUntrackPaths");
+    return installPlan;
+  } catch (error) {
+    printError(ctx, "NAOME Rust install plan is not valid JSON.");
+    console.error(error.message);
+    process.exit(1);
+  }
+}
+
+function assertInstallPlanArray(ctx, installPlan, key) {
+  const invalid =
+    !Array.isArray(installPlan?.[key]) ||
+    installPlan[key].some((entry) => typeof entry !== "string" || entry.length === 0);
+  if (invalid) {
+    printError(ctx, `NAOME Rust install plan has invalid ${key}.`);
+    process.exit(1);
+  }
+}
+
+function assignInstallPlan(ctx, installPlan) {
+  ctx.installPlan = installPlan;
+  ctx.machineOwnedPaths = installPlan.machineOwned;
+  ctx.projectOwnedPaths = installPlan.projectOwned;
+  ctx.localOnlyMachineOwnedPaths = installPlan.localOnlyMachineOwned;
+  ctx.localOnlyGitIgnoreEntries = installPlan.gitignoreEntries;
+  ctx.localOnlyGitExcludeEntries = installPlan.gitExcludeEntries;
+  ctx.localOnlyGitUntrackPaths = installPlan.gitUntrackPaths;
+}

package/installer/main.js

@@ -0,0 +1,25 @@
+import { createInstallerContext } from "./context.js";
+import { assertTemplateRoot } from "./filesystem.js";
+import { configureGitHooks, ensureExecutableMachineOwnedFiles } from "./git-local.js";
+import { loadInstallPlan } from "./install-plan.js";
+import { readExistingInstall } from "./manifest-state.js";
+import { printHeader, printSummary } from "./output.js";
+import { runExistingInstall, runFreshInstall } from "./flows.js";
+
+export async function runNaomeNodeCli() {
+  const ctx = createInstallerContext();
+  assertTemplateRoot(ctx);
+  loadInstallPlan(ctx);
+
+  printHeader(ctx);
+  const existingInstall = readExistingInstall(ctx);
+  if (existingInstall) {
+    runExistingInstall(ctx, existingInstall);
+  } else {
+    await runFreshInstall(ctx);
+  }
+
+  ensureExecutableMachineOwnedFiles(ctx);
+  configureGitHooks(ctx);
+  printSummary(ctx, existingInstall);
+}

package/installer/manifest-state.js

@@ -0,0 +1,167 @@
+import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { hasSymlinkInTargetPath } from "./filesystem.js";
+import { installedNativeBinaryHash, templateIntegrity, usesSourceNativeFallback } from "./native.js";
+import { printError } from "./output.js";
+import { isVersion } from "./version.js";
+
+export function readExistingInstall(ctx) {
+  const manifestPath = join(ctx.targetRoot, ".naome", "manifest.json");
+  if (!existsSync(manifestPath)) {
+    return null;
+  }
+
+  if (hasSymlinkInTargetPath(ctx, ".naome/manifest.json")) {
+    printError(ctx, "NAOME cannot read .naome/manifest.json safely.");
+    console.error(".naome/manifest.json must be a regular file.");
+    process.exit(1);
+  }
+
+  const manifest = readJsonFile(ctx, manifestPath, "NAOME manifest is not valid JSON.");
+  if (!isVersion(manifest.harnessVersion)) {
+    printError(ctx, "NAOME manifest has no valid harnessVersion.");
+    console.error(".naome/manifest.json must contain a semver harnessVersion.");
+    process.exit(1);
+  }
+
+  return { manifest, version: manifest.harnessVersion };
+}
+
+export function readUpgradeState(ctx) {
+  const relativePath = ".naome/upgrade-state.json";
+  const targetPath = join(ctx.targetRoot, relativePath);
+
+  if (!existsSync(targetPath)) {
+    return null;
+  }
+
+  if (hasSymlinkInTargetPath(ctx, relativePath)) {
+    printError(ctx, "NAOME cannot read .naome/upgrade-state.json safely.");
+    process.exit(1);
+  }
+
+  return readJsonFile(ctx, targetPath, "NAOME upgrade state is not valid JSON.");
+}
+
+export function patchManifestDate(ctx) {
+  const relativePath = ".naome/manifest.json";
+  const manifestPath = join(ctx.targetRoot, relativePath);
+  if (
+    !existsSync(manifestPath) ||
+    ctx.skipped.includes(relativePath) ||
+    hasSymlinkInTargetPath(ctx, relativePath)
+  ) {
+    return;
+  }
+
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  applyManifestHealthMetadata(ctx, manifest);
+  manifest.installedAt = new Date().toISOString();
+  writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+}
+
+export function refreshManifestHealthMetadata(ctx) {
+  const relativePath = ".naome/manifest.json";
+  const targetPath = join(ctx.targetRoot, relativePath);
+
+  if (hasSymlinkInTargetPath(ctx, relativePath)) {
+    printError(ctx, "NAOME cannot write .naome/manifest.json safely.");
+    console.error(".naome/manifest.json must be a regular file.");
+    process.exit(1);
+  }
+
+  if (!existsSync(targetPath) || !lstatSync(targetPath).isFile()) {
+    printError(ctx, "NAOME cannot write .naome/manifest.json because that path is not a file.");
+    process.exit(1);
+  }
+
+  const manifest = JSON.parse(readFileSync(targetPath, "utf8"));
+  const originalContent = JSON.stringify(manifest, null, 2);
+  applyManifestHealthMetadata(ctx, manifest);
+  const nextContent = JSON.stringify(manifest, null, 2);
+
+  if (nextContent === originalContent) {
+    ctx.skipped.push(relativePath);
+    return;
+  }
+
+  writeFileSync(targetPath, `${nextContent}\n`);
+  ctx.updated.push(relativePath);
+}
+
+export function ensureCompleteUpgradeState(ctx, fromVersion = null) {
+  const existingUpgradeState = readUpgradeState(ctx);
+  if (
+    existingUpgradeState?.status === "complete" &&
+    existingUpgradeState?.toVersion === ctx.packageVersion &&
+    (fromVersion === null || existingUpgradeState?.fromVersion === fromVersion) &&
+    Array.isArray(existingUpgradeState.pending) &&
+    existingUpgradeState.pending.length === 0 &&
+    Array.isArray(existingUpgradeState.completed)
+  ) {
+    ctx.skipped.push(".naome/upgrade-state.json");
+    return;
+  }
+
+  writeUpgradeState(ctx, {
+    status: "complete",
+    fromVersion,
+    toVersion: ctx.packageVersion,
+    pending: [],
+    completed: [],
+    updatedAt: new Date().toISOString(),
+  });
+}
+
+function applyManifestHealthMetadata(ctx, manifest) {
+  manifest.harnessVersion = ctx.packageVersion;
+  manifest.machineOwned = [...ctx.machineOwnedPaths];
+  manifest.projectOwned = ctx.projectOwnedPaths;
+  manifest.integrity = templateIntegrity(ctx);
+
+  const nativeHash = installedNativeBinaryHash(ctx);
+  if (!usesSourceNativeFallback(ctx) && nativeHash) {
+    if (!manifest.machineOwned.includes(ctx.nativeBinaryRelativePath)) {
+      manifest.machineOwned.push(ctx.nativeBinaryRelativePath);
+    }
+    manifest.integrity[ctx.nativeBinaryRelativePath] = `sha256:${nativeHash}`;
+  }
+}
+
+function writeUpgradeState(ctx, state) {
+  const relativePath = ".naome/upgrade-state.json";
+  const targetPath = join(ctx.targetRoot, relativePath);
+  assertWritableUpgradeStatePath(ctx);
+
+  mkdirSync(dirname(targetPath), { recursive: true });
+  writeFileSync(targetPath, `${JSON.stringify(state, null, 2)}\n`);
+  ctx.updated.push(relativePath);
+}
+
+function assertWritableUpgradeStatePath(ctx) {
+  const relativePath = ".naome/upgrade-state.json";
+  const targetPath = join(ctx.targetRoot, relativePath);
+
+  if (hasSymlinkInTargetPath(ctx, relativePath)) {
+    printError(ctx, "NAOME cannot write .naome/upgrade-state.json safely.");
+    console.error(".naome/upgrade-state.json must be a regular file or must not exist.");
+    process.exit(1);
+  }
+
+  if (existsSync(targetPath) && !lstatSync(targetPath).isFile()) {
+    printError(ctx, "NAOME cannot write .naome/upgrade-state.json because that path is not a file.");
+    console.error(".naome/upgrade-state.json must be a regular file or must not exist.");
+    process.exit(1);
+  }
+}
+
+function readJsonFile(ctx, path, message) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    printError(ctx, message);
+    console.error(error.message);
+    process.exit(1);
+  }
+}

package/installer/native-build.js

@@ -0,0 +1,24 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, lstatSync } from "node:fs";
+import { join } from "node:path";
+
+export function buildNativeDecisionBinary(ctx) {
+  const manifestPath = join(ctx.packageRoot, "Cargo.toml");
+  if (!existsSync(manifestPath)) {
+    return null;
+  }
+
+  const result = spawnSync(
+    "cargo",
+    ["build", "--release", "--manifest-path", manifestPath, "-p", "naome-cli"],
+    { cwd: ctx.packageRoot, encoding: "utf8" },
+  );
+
+  if (result.status !== 0) {
+    ctx.skipped.push("native decision binary build");
+    return null;
+  }
+
+  const builtPath = join(ctx.packageRoot, "target", "release", ctx.nativeBinaryName);
+  return existsSync(builtPath) && lstatSync(builtPath).isFile() ? builtPath : null;
+}

package/installer/native-format.js

@@ -0,0 +1,6 @@
+export function formatExpectedIntegrityBlock(integrity) {
+  const entries = Object.entries(integrity)
+    .map(([relativePath, expectedHash]) => `  ${JSON.stringify(relativePath)}: ${JSON.stringify(expectedHash)}`)
+    .join(",\n");
+  return `const expectedMachineOwnedIntegrity = Object.freeze({\n${entries}\n});\n`;
+}