@mannyc1/ts-release 0.2.2 → 0.3.0

package/dist/bin/ts-release.js

@@ -26676,7 +26676,7 @@ var listAllAssets = fn2("GitHubReleaseSubject.listAllAssets")(function* (publica
     reason: "GitHub asset pagination exceeded the bounded full-enumeration limit."
   };
 });
-var compareReleaseMetadata = (publication, facts) => {
+var compareReleaseMetadata = (publication, facts, options = {}) => {
   const differences = [];
   if (facts.tag !== publication.tag.toString()) {
     differences.push(textDifference("release.tag", publication.tag.toString(), facts.tag));
@@ -26687,7 +26687,7 @@ var compareReleaseMetadata = (publication, facts) => {
   const expectedBody = publication.body ?? "";
   if (facts.body !== expectedBody)
     differences.push(textDifference("release.body", expectedBody, facts.body));
-  if (facts.draft !== publication.draft) {
+  if (options.ignoreDraft !== true && facts.draft !== publication.draft) {
     differences.push(scalarDifference("release.draft", publication.draft, facts.draft));
   }
   if (facts.prerelease !== publication.prerelease) {
@@ -26731,6 +26731,14 @@ var decideFor = (publication, observation, plan) => {
           })
         });
       }
+      if (plan?._tag === "PublishRelease") {
+        return NeedsMutation.make({
+          subject: publication.authority.subject,
+          precondition: MutationPrecondition.make({
+            kind: NonEmptyName.make("github-exact-draft-assets-complete")
+          })
+        });
+      }
       return ProviderBlocked.make({
         subject: publication.authority.subject,
         reason: SafeReason.make("GitHub absence carried no exact mutation plan.")
@@ -26757,7 +26765,7 @@ var appliedAttempt = (publication) => Applied.make({
   subject: publication.authority.subject,
   fact: ProviderMutationFact.make({
     subject: publication.authority.subject,
-    detail: SafeReason.make("GitHub accepted the release mutation and every planned asset upload.")
+    detail: SafeReason.make("GitHub accepted every mutation dispatched in this convergence phase; final equivalence still requires provider reobservation.")
   })
 });
 var executeMutation = (mutationHttp, operation, request, grant) => mutationHttp.execute(operation, request, grant).pipe(map5((response) => ({ _tag: "Response", response })), catch_2((error) => succeed6({ _tag: "Failure", error })));
@@ -26865,7 +26873,10 @@ var makeGithubSubjects = (bundle, publication, http, mutationHttp) => {
     if (release === undefined || !validateUploadUrl(publication, release.id, release.uploadUrl)) {
       return inconclusive(publication, "The GitHub release response omitted identity facts or carried an invalid repository-scoped upload template.");
     }
-    const releaseDifferences = compareReleaseMetadata(publication, release);
+    const stagedForPublicPromotion = publication.draft === false && release.draft === true;
+    const releaseDifferences = compareReleaseMetadata(publication, release, {
+      ignoreDraft: stagedForPublicPromotion
+    });
     if (releaseDifferences.length > 0)
       return presentDifferent(publication, releaseDifferences);
     const listed = yield* listAllAssets(publication, http, grant, release.id);
@@ -26928,6 +26939,9 @@ var makeGithubSubjects = (bundle, publication, http, mutationHttp) => {
       }
     }
     if (missingIndexes.length > 0) {
+      if (!release.draft) {
+        return presentDifferent(publication, missingIndexes.map((index) => scalarDifference(`asset.${publication.assets[index].name}.count`, 1, 0)));
+      }
       if (mutationMayStillBecomeVisible) {
         return pending(publication, "One or more intended GitHub assets are not yet visible after the accepted mutation.");
       }
@@ -26939,6 +26953,10 @@ var makeGithubSubjects = (bundle, publication, http, mutationHttp) => {
       };
       return absent(publication, "github-intended-assets-absent", "A full paginated release-asset enumeration proved at least one intended asset name absent.");
     }
+    if (stagedForPublicPromotion) {
+      mutationPlan = { _tag: "PublishRelease", releaseId: release.id };
+      return absent(publication, "github-exact-draft-assets-complete", "The exact private draft and complete asset set are ready for one final public transition.");
+    }
     return PresentEquivalent.make({ subject: publication.authority.subject });
   });
   const mutate = fn2("GitHubReleaseSubject.mutate")(function* (decision, grant) {
@@ -26949,11 +26967,11 @@ var makeGithubSubjects = (bundle, publication, http, mutationHttp) => {
     if (decision.subject !== publication.authority.subject || plan === undefined) {
       return yield* mutationFailure(publication, "The GitHub mutation decision has no matching exact observation plan.");
     }
-    const expectedDecision = plan._tag === "CreateRelease" && plan.tagAbsent ? decision._tag === "ProviderAuthorizedCreate" && decision.proof.kind === "github-authenticated-repository-and-unique-tag" : plan._tag === "CreateRelease" ? decision._tag === "NeedsMutation" && decision.precondition.kind === "github-release-absent-at-exact-tag" : decision._tag === "NeedsMutation" && decision.precondition.kind === "github-intended-assets-authoritatively-absent";
+    const expectedDecision = plan._tag === "CreateRelease" && plan.tagAbsent ? decision._tag === "ProviderAuthorizedCreate" && decision.proof.kind === "github-authenticated-repository-and-unique-tag" : plan._tag === "CreateRelease" ? decision._tag === "NeedsMutation" && decision.precondition.kind === "github-release-absent-at-exact-tag" : plan._tag === "UploadAssets" ? decision._tag === "NeedsMutation" && decision.precondition.kind === "github-intended-assets-authoritatively-absent" : decision._tag === "NeedsMutation" && decision.precondition.kind === "github-exact-draft-assets-complete";
     if (!expectedDecision) {
       return yield* mutationFailure(publication, "The GitHub mutation decision does not match its observed precondition.");
     }
-    const indexes = plan._tag === "CreateRelease" ? publication.assets.map((_, index) => index) : [...plan.assetIndexes];
+    const indexes = plan._tag === "CreateRelease" ? publication.assets.map((_, index) => index) : plan._tag === "UploadAssets" ? [...plan.assetIndexes] : [];
     const bytesByIndex = new Map;
     for (const index of indexes) {
       const asset = publication.assets[index];
@@ -26975,7 +26993,7 @@ var makeGithubSubjects = (bundle, publication, http, mutationHttp) => {
       decision
     };
     let acceptedWrites = 0;
-    const dispatch = fn2("GitHubReleaseSubject.dispatch")(function* (request) {
+    const dispatch = fn2("GitHubReleaseSubject.dispatch")(function* (request, acceptedStatus) {
       const exchange = yield* executeMutation(mutationHttp, operation, request, grant);
       if (exchange._tag === "Failure") {
         if (acceptedWrites > 0 || exchange.error.commitment === "unknown") {
@@ -26983,12 +27001,13 @@ var makeGithubSubjects = (bundle, publication, http, mutationHttp) => {
         }
         return yield* mutationFailure(publication, "The authorized GitHub HTTP boundary rejected mutation before dispatch.", "before-dispatch");
       }
-      if (exchange.response.status === 201) {
+      if (exchange.response.status === acceptedStatus) {
         acceptedWrites += 1;
         return { _tag: "Accepted", response: exchange.response };
       }
       return { _tag: "Attempt", attempt: unknownAttempt(publication, `GitHub returned conservative mutation status ${exchange.response.status}; exact outcome requires reobservation.`) };
     });
+    let releaseId;
     let uploadUrl;
     if (plan._tag === "CreateRelease") {
       const body = JSON.stringify({
@@ -26996,7 +27015,7 @@ var makeGithubSubjects = (bundle, publication, http, mutationHttp) => {
         target_commitish: publication.targetCommit.toString(),
         name: publication.title.toString(),
         body: publication.body ?? "",
-        draft: publication.draft,
+        draft: true,
         prerelease: publication.prerelease
       });
       const created = yield* dispatch({
@@ -27008,20 +27027,24 @@ var makeGithubSubjects = (bundle, publication, http, mutationHttp) => {
           "content-length": String(new TextEncoder().encode(body).length)
         },
         body
-      });
+      }, 201);
       if (created._tag === "Attempt")
         return created.attempt;
       const facts = releaseFacts(parseJson2(created.response.body));
-      if (facts === undefined || !validateUploadUrl(publication, facts.id, facts.uploadUrl) || compareReleaseMetadata(publication, facts).length > 0) {
+      if (facts === undefined || facts.draft !== true || !validateUploadUrl(publication, facts.id, facts.uploadUrl) || compareReleaseMetadata(publication, facts, { ignoreDraft: publication.draft === false }).length > 0) {
         return unknownAttempt(publication, "GitHub accepted release creation but its response did not establish the exact release identity and repository-scoped upload template.");
       }
+      releaseId = facts.id;
       uploadUrl = facts.uploadUrl;
-    } else {
+    } else if (plan._tag === "UploadAssets") {
+      releaseId = plan.releaseId;
       uploadUrl = plan.uploadUrl;
+    } else {
+      releaseId = plan.releaseId;
     }
     for (const index of indexes) {
       const bytes = bytesByIndex.get(index);
-      const uploaded = yield* dispatch(uploadRequest(publication, uploadUrl, index, bytes));
+      const uploaded = yield* dispatch(uploadRequest(publication, uploadUrl, index, bytes), 201);
       if (uploaded._tag === "Attempt")
         return uploaded.attempt;
       const intended = publication.assets[index];
@@ -27030,6 +27053,25 @@ var makeGithubSubjects = (bundle, publication, http, mutationHttp) => {
         return unknownAttempt(publication, "GitHub accepted an asset upload but its response did not establish the exact uploaded asset identity.");
       }
     }
+    if (plan._tag === "PublishRelease") {
+      const body = JSON.stringify({ draft: false });
+      const published = yield* dispatch({
+        method: "PATCH",
+        url: `${publication.authority.audience}/releases/${releaseId}`,
+        headers: {
+          ...githubJsonHeaders,
+          "content-type": "application/json",
+          "content-length": String(new TextEncoder().encode(body).length)
+        },
+        body
+      }, 200);
+      if (published._tag === "Attempt")
+        return published.attempt;
+      const facts = releaseFacts(parseJson2(published.response.body));
+      if (facts === undefined || facts.id !== releaseId || facts.draft !== false || !validateUploadUrl(publication, releaseId, facts.uploadUrl) || compareReleaseMetadata(publication, facts).length > 0) {
+        return unknownAttempt(publication, "GitHub accepted final release publication but its response did not establish the exact public release identity.");
+      }
+    }
     return appliedAttempt(publication);
   });
   return [{
@@ -29922,8 +29964,8 @@ var contributeSourceArtifacts = (config, _context) => {
           cwd,
           inputs,
           outputs: [
-            output(preparation.outputs[0].id, preparation.outputs[0].path, preparation.outputs[0].kind ?? "file", preparation.outputs[0].mediaType),
-            ...preparation.outputs.slice(1).map((item) => output(item.id, item.path, item.kind ?? "file", item.mediaType))
+            output(preparation.outputs[0].id, render(preparation.outputs[0].path, config), preparation.outputs[0].kind ?? "file", preparation.outputs[0].mediaType),
+            ...preparation.outputs.slice(1).map((item) => output(item.id, render(item.path, config), item.kind ?? "file", item.mediaType))
           ]
         }));
       else
@@ -31452,17 +31494,15 @@ import {
   existsSync as existsSync4,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync4,
-  mkdtempSync,
   readFileSync as readFileSync4,
   readdirSync as readdirSync3,
   realpathSync as realpathSync4,
   rmSync as rmSync2
 } from "node:fs";
 import { basename as basename3, isAbsolute as isAbsolute3, join as join7, relative as relative3, resolve as resolve5, sep as sep3 } from "node:path";
-import { tmpdir as tmpdir2 } from "node:os";
 
 // src/drivers/archive.ts
-import { gzipSync } from "node:zlib";
+import { deflateRawSync, gzipSync } from "node:zlib";
 var text = (value3) => new TextEncoder().encode(value3);
 var concat = (parts) => {
   const output2 = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
@@ -31495,38 +31535,40 @@ var crc322 = (data) => {
     crc = crc >>> 8 ^ crcTable2[(crc ^ byte) & 255];
   return (crc ^ 4294967295) >>> 0;
 };
-var zip3 = (entries) => {
+var zip3 = (entries, compression = "store") => {
   const bodies = [];
   const central = [];
   let offset = 0;
   for (const entry of entries) {
     const name = text(entry.path);
     const crc = crc322(entry.data);
+    const method = compression === "deflate" ? 8 : 0;
+    const body = compression === "deflate" ? new Uint8Array(deflateRawSync(entry.data, { level: 9 })) : entry.data;
     const local = concat([
       integer(4, 67324752),
       integer(2, 20),
       integer(2, 2048),
-      integer(2, 0),
+      integer(2, method),
       integer(2, 0),
       integer(2, 0),
       integer(4, crc),
-      integer(4, entry.data.length),
+      integer(4, body.length),
       integer(4, entry.data.length),
       integer(2, name.length),
       integer(2, 0),
       name
     ]);
-    bodies.push(local, entry.data);
+    bodies.push(local, body);
     central.push(concat([
       integer(4, 33639248),
       integer(2, 788),
       integer(2, 20),
       integer(2, 2048),
-      integer(2, 0),
+      integer(2, method),
       integer(2, 0),
       integer(2, 0),
       integer(4, crc),
-      integer(4, entry.data.length),
+      integer(4, body.length),
       integer(4, entry.data.length),
       integer(2, name.length),
       integer(2, 0),
@@ -31537,7 +31579,7 @@ var zip3 = (entries) => {
       integer(4, offset),
       name
     ]));
-    offset += local.length + entry.data.length;
+    offset += local.length + body.length;
   }
   const directory = concat(central);
   return concat([
@@ -31599,11 +31641,13 @@ import {
   fsyncSync,
   lstatSync,
   mkdirSync,
+  mkdtempSync,
   openSync,
   readFileSync,
   realpathSync,
   writeFileSync
 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
 import { join as join4 } from "node:path";
 
 // src/drivers/contain.ts
@@ -31615,6 +31659,7 @@ var contained = (root, path) => {
 
 // src/drivers/workspace.ts
 var fail12 = (reason2) => DriverError.make({ reason: reason2, commitment: "before-commit" });
+var makeCanonicalTemporaryDirectory = (prefix) => realpathSync(mkdtempSync(join4(realpathSync(tmpdir2()), prefix)));
 var secureRead = (root, path) => {
   let current = root;
   for (const part of path.split(/[\\/]+/u)) {
@@ -31893,9 +31938,11 @@ var causeReason = (cause) => typeof cause === "object" && cause !== null && ("re
 var canonicalDirectory = (directory) => {
   if (!existsSync2(directory))
     mkdirSync2(directory, { recursive: true, mode: 448 });
-  const real = realpathSync2(directory);
-  if (real !== directory)
+  if (lstatSync2(directory).isSymbolicLink())
     fail13("Prepared store root must not be a symlink.");
+  const real = realpathSync2(directory);
+  if (!lstatSync2(real).isDirectory())
+    fail13("Prepared store root must be a directory.");
   return real;
 };
 var syncDirectory = (directory) => {
@@ -31944,20 +31991,20 @@ var validatePublications = (manifest, artifacts) => {
   }
 };
 var readBundle = (directory) => {
-  const real = realpathSync2(directory);
-  if (real !== directory || lstatSync2(directory).isSymbolicLink())
+  if (lstatSync2(directory).isSymbolicLink())
     fail13("Prepared bundle directory must not be a symlink.");
-  const bytes = secureRead(directory, "prepared-release.json").bytes;
+  const real = realpathSync2(directory);
+  const bytes = secureRead(real, "prepared-release.json").bytes;
   const manifest = decodePreparedRelease(bytes);
   if (manifest.kind !== "complete")
     fail13("Prepared store refuses every unknown or partial bundle kind.");
   const manifestDigest = sha256Digest(bytes).hex;
-  if (basename2(directory) !== manifestDigest)
+  if (basename2(real) !== manifestDigest)
     fail13("Prepared bundle directory does not match its manifest digest.");
-  const entries = readdirSync(directory, { withFileTypes: true });
+  const entries = readdirSync(real, { withFileTypes: true });
   if (entries.some((entry) => entry.name !== "prepared-release.json" && entry.name !== "blobs"))
     fail13("Prepared bundle contains an unexpected top-level entry.");
-  const blobDirectory = join5(directory, "blobs");
+  const blobDirectory = join5(real, "blobs");
   if (!existsSync2(blobDirectory) || lstatSync2(blobDirectory).isSymbolicLink() || !statSync(blobDirectory).isDirectory())
     fail13("Prepared bundle is missing its real blobs directory.");
   const artifacts = artifactsById(manifest);
@@ -31972,7 +32019,7 @@ var readBundle = (directory) => {
     fail13("Prepared bundle blob set does not match its manifest.");
   const blobs = new Map;
   for (const artifact of artifacts.values()) {
-    const blob = secureRead(directory, `blobs/${artifact.blob.hex}`).bytes;
+    const blob = secureRead(real, `blobs/${artifact.blob.hex}`).bytes;
     if (blob.length !== artifact.size || !digestEquals(sha256Digest(blob), artifact.digest))
       fail13(`Prepared blob ${artifact.id} failed size or digest verification.`);
     blobs.set(artifact.id.toString(), new Uint8Array(blob));
@@ -33001,11 +33048,11 @@ var runtimeIdentity = (bunVersion, isolation, bunCompileRuntimes, npmPack, relea
   bunCompileRuntimes: bunCompileRuntimes.length === 0 ? "not-used" : encodeCanonicalJson(bunCompileRuntimes),
   npmPack: npmPack === undefined ? "not-used" : encodeCanonicalJson(npmPack),
   releaseGraph,
-  preparer: "@mannyc1/ts-release@0.2.2"
+  preparer: "@mannyc1/ts-release@0.3.0"
 });
 var prepareRelease = fn2("prepareRelease")(function* (input) {
   const sourceRoot = input.context.workspace.toString();
-  const root = yield* attempt(() => mkdtempSync(join7(tmpdir2(), "ts-release-prepare-")));
+  const root = yield* attempt(() => makeCanonicalTemporaryDirectory("ts-release-prepare-"));
   try {
     const sourceSnapshot = yield* input.materializeSource(input.context, WorkspaceRoot.make(root)).pipe(mapError3(failure3));
     const context3 = stagedContext(input.context, root);
@@ -34666,7 +34713,6 @@ import {
   copyFileSync as copyFileSync2,
   lstatSync as lstatSync6,
   mkdirSync as mkdirSync6,
-  mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync6,
   readdirSync as readdirSync5,
   realpathSync as realpathSync7,
@@ -34674,7 +34720,6 @@ import {
   statSync as statSync3,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { tmpdir as tmpdir3 } from "node:os";
 import { delimiter, isAbsolute as isAbsolute6, join as join9, resolve as resolve7 } from "node:path";
 
 // node_modules/effect/dist/ConfigProvider.js
@@ -35252,7 +35297,7 @@ var makeRunCommand = gen2(function* () {
     const compileTarget = certifiedBunCompileTarget(command2);
     const compileRuntime = compileTarget === undefined ? undefined : yield* resolveBunCompileRuntime(compileTarget, tool);
     const compileResources = compileRuntime === undefined ? undefined : yield* acquireRelease2(sync2(() => {
-      const directory = mkdtempSync2(join9(tmpdir3(), "ts-release-bun-runtime-"));
+      const directory = makeCanonicalTemporaryDirectory("ts-release-bun-runtime-");
       const cache = join9(directory, "cache");
       mkdirSync6(cache, { mode: 448 });
       if (compileRuntime.sourcePath !== undefined) {
@@ -35266,7 +35311,7 @@ var makeRunCommand = gen2(function* () {
       rmSync3(directory, { recursive: true, force: true });
     }));
     const isolationResources = command2.network === "deny" ? yield* acquireRelease2(sync2(() => {
-      const directory = mkdtempSync2(join9(tmpdir3(), "ts-release-seccomp-"));
+      const directory = makeCanonicalTemporaryDirectory("ts-release-seccomp-");
       const helper = join9(directory, "network-deny.mjs");
       const identity2 = join9(directory, "identity.json");
       writeFileSync3(helper, networkIsolationHelperSource, { mode: 320 });
@@ -35328,8 +35373,8 @@ var makeRunCommand = gen2(function* () {
 
 // src/platform/credentials.ts
 import { Buffer as Buffer2 } from "node:buffer";
-import { chmod as chmod3, copyFile as copyFile3, mkdir as mkdir2, mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
-import { tmpdir as tmpdir4 } from "node:os";
+import { chmod as chmod3, copyFile as copyFile3, mkdir as mkdir2, mkdtemp as mkdtemp2, readFile as readFile3, realpath as realpath2, rm as rm2, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
+import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename4, isAbsolute as isAbsolute7, join as join10, resolve as resolve8 } from "node:path";
 var Semver5 = __toESM(require_semver2(), 1);
 class CredentialPlatformError extends TaggedErrorClass()("CredentialPlatformError", {
@@ -35666,7 +35711,7 @@ var makeNpmUserConfigResource = (vault, temporaryRoot) => ({
     }
     yield* checkAudience(input.operation.subject, input.operation.audience, input.registryUrl);
     const token = yield* lookupToken(vault, grant.subject, grant.ref);
-    const root = temporaryRoot ?? tmpdir4();
+    const root = temporaryRoot ?? tmpdir3();
     const handle = makeNpmUserConfigHandle();
     const acquired = tryPromise2({
       try: async () => {
@@ -35674,11 +35719,20 @@ var makeNpmUserConfigResource = (vault, temporaryRoot) => ({
         const directory = await mkdtemp2(join10(root, "ts-release-npm-"));
         try {
           const path = join10(directory, "userconfig");
+          const globalConfigPath = join10(directory, "globalconfig");
           const contents = `${npmAuthLine(input.registryUrl, token)}
 ignore-scripts=true
 `;
           await writeFile3(path, contents, { mode: 384, flag: "wx" });
-          npmUserConfigs.set(handle, { directory, path, subject: input.operation.subject, grant, token });
+          await writeFile3(globalConfigPath, "", { mode: 384, flag: "wx" });
+          npmUserConfigs.set(handle, {
+            directory,
+            path,
+            globalConfigPath,
+            subject: input.operation.subject,
+            grant,
+            token
+          });
           return handle;
         } catch (cause) {
           await rm2(directory, { recursive: true, force: true });
@@ -35713,6 +35767,53 @@ var optionalPath = option2(string4("PATH")).pipe(map5(getOrUndefined), orElseSuc
   return;
 }));
 var closedBaseEnvironment = (path) => path === undefined ? {} : { PATH: path };
+var optionalReleaseHome = option2(string4("TS_RELEASE_HOME")).pipe(map5(getOrUndefined), orElseSucceed2(() => {
+  return;
+}));
+var privateTrustedNpmEnvironment = fn2("CertifiedPublisherSpawn.privateTrustedNpmEnvironment")(function* (grant) {
+  const configured = yield* optionalReleaseHome;
+  if (configured === undefined || !isAbsolute7(configured) || resolve8(configured) !== configured) {
+    return yield* new CredentialUnavailable({
+      subject: grant.subject,
+      provider: grant.provider,
+      purpose: "publish",
+      reason: "Trusted npm publishing requires one canonical absolute TS_RELEASE_HOME."
+    });
+  }
+  return yield* tryPromise2({
+    try: async () => {
+      const canonicalHome = await realpath2(configured);
+      if (canonicalHome !== configured)
+        throw new Error("TS_RELEASE_HOME is not canonical.");
+      const homeMetadata = await stat3(canonicalHome);
+      const owner = typeof process.getuid === "function" ? process.getuid() : undefined;
+      if (!homeMetadata.isDirectory() || (homeMetadata.mode & 63) !== 0 || owner !== undefined && homeMetadata.uid !== owner) {
+        throw new Error("TS_RELEASE_HOME is not one private caller-owned directory.");
+      }
+      const userConfig = join10(canonicalHome, "npm-userconfig");
+      const globalConfig = join10(canonicalHome, "npm-globalconfig");
+      for (const path of [userConfig, globalConfig]) {
+        if (await realpath2(path) !== path)
+          throw new Error("A trusted npm config path is not canonical.");
+        const metadata = await stat3(path);
+        if (!metadata.isFile() || (metadata.mode & 511) !== 384 || owner !== undefined && metadata.uid !== owner || (await readFile3(path)).length !== 0) {
+          throw new Error("A trusted npm config is not an empty private caller-owned file.");
+        }
+      }
+      return {
+        HOME: canonicalHome,
+        NPM_CONFIG_USERCONFIG: userConfig,
+        NPM_CONFIG_GLOBALCONFIG: globalConfig
+      };
+    },
+    catch: () => new CredentialUnavailable({
+      subject: grant.subject,
+      provider: grant.provider,
+      purpose: "publish",
+      reason: "Trusted npm publishing requires validated empty private npm configuration files."
+    })
+  });
+});
 var workloadEnvironment = fn2("CertifiedPublisherSpawn.workloadEnvironment")(function* (trustedWorkloads, grant) {
   if (grant.names.size !== oidcNames.length || oidcNames.some((name) => !grant.names.has(name))) {
     return yield* new CredentialStrategyUnsupported({
@@ -35732,7 +35833,11 @@ var workloadEnvironment = fn2("CertifiedPublisherSpawn.workloadEnvironment")(fun
     });
   }
   const path = yield* optionalPath;
-  const env = closedBaseEnvironment(path);
+  const privateEnvironment = yield* privateTrustedNpmEnvironment(grant);
+  const env = {
+    ...closedBaseEnvironment(path),
+    ...privateEnvironment
+  };
   for (const name of oidcNames) {
     const value3 = material.oidc.get(name);
     if (value3 === undefined) {
@@ -35878,7 +35983,9 @@ var publisherEnvironment = fn2("CertifiedPublisherSpawn.environment")(function*
     const path = yield* optionalPath;
     return {
       ...closedBaseEnvironment(path),
+      HOME: metadata.directory,
       NPM_CONFIG_USERCONFIG: metadata.path,
+      NPM_CONFIG_GLOBALCONFIG: metadata.globalConfigPath,
       NPM_CONFIG_IGNORE_SCRIPTS: "true"
     };
   }
@@ -35899,7 +36006,7 @@ var redactPublisherOutput = (value3, env, spec) => {
   return redactOutput(value3, known);
 };
 var makeNpmPublishTransport = (sourcePath, temporaryRoot) => {
-  const root = temporaryRoot ?? tmpdir4();
+  const root = temporaryRoot ?? tmpdir3();
   const acquired = tryPromise2({
     try: async () => {
       await mkdir2(root, { recursive: true, mode: 448 });
@@ -39222,7 +39329,7 @@ var makeCli = (makeApi, cwd, io) => {
 };
 
 // apps/release-ts/src/cli/node-main.ts
-var version3 = "0.2.2";
+var version3 = "0.3.0";
 var hostRefusal = unsupportedExecutionHost(process.platform);
 if (hostRefusal !== undefined) {
   console.error(hostRefusal);

package/dist/drivers/archive.d.ts

@@ -3,6 +3,7 @@ export interface ArchiveEntry {
     readonly data: Uint8Array;
     readonly mode: number;
 }
-export declare const zip: (entries: ReadonlyArray<ArchiveEntry>) => Uint8Array;
+export type ZipCompression = "store" | "deflate";
+export declare const zip: (entries: ReadonlyArray<ArchiveEntry>, compression?: ZipCompression) => Uint8Array;
 export declare const tarGz: (entries: ReadonlyArray<ArchiveEntry>) => Uint8Array;
 //# sourceMappingURL=archive.d.ts.map

package/dist/drivers/archive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../src/drivers/archive.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA8BD,eAAO,MAAM,GAAG,GAAI,SAAS,aAAa,CAAC,YAAY,CAAC,KAAG,UA4B1D,CAAA;AA6BD,eAAO,MAAM,KAAK,GAAI,SAAS,aAAa,CAAC,YAAY,CAAC,KAAG,UAQ5D,CAAA"}
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../src/drivers/archive.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA8BD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,SAAS,CAAA;AAEhD,eAAO,MAAM,GAAG,GACd,SAAS,aAAa,CAAC,YAAY,CAAC,EACpC,cAAa,cAAwB,KACpC,UAgCF,CAAA;AA6BD,eAAO,MAAM,KAAK,GAAI,SAAS,aAAa,CAAC,YAAY,CAAC,KAAG,UAQ5D,CAAA"}

package/dist/drivers/archive.js

@@ -1,4 +1,4 @@
-import { gzipSync } from "node:zlib";
+import { deflateRawSync, gzipSync } from "node:zlib";
 const text = (value) => new TextEncoder().encode(value);
 const concat = (parts) => {
     const output = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
@@ -31,27 +31,31 @@ const crc32 = (data) => {
         crc = (crc >>> 8) ^ crcTable[(crc ^ byte) & 0xff];
     return (crc ^ 0xffffffff) >>> 0;
 };
-export const zip = (entries) => {
+export const zip = (entries, compression = "store") => {
     const bodies = [];
     const central = [];
     let offset = 0;
     for (const entry of entries) {
         const name = text(entry.path);
         const crc = crc32(entry.data);
+        const method = compression === "deflate" ? 8 : 0;
+        const body = compression === "deflate"
+            ? new Uint8Array(deflateRawSync(entry.data, { level: 9 }))
+            : entry.data;
         const local = concat([
-            integer(4, 0x04034b50), integer(2, 20), integer(2, 0x0800), integer(2, 0),
-            integer(2, 0), integer(2, 0), integer(4, crc), integer(4, entry.data.length),
+            integer(4, 0x04034b50), integer(2, 20), integer(2, 0x0800), integer(2, method),
+            integer(2, 0), integer(2, 0), integer(4, crc), integer(4, body.length),
             integer(4, entry.data.length), integer(2, name.length), integer(2, 0), name
         ]);
-        bodies.push(local, entry.data);
+        bodies.push(local, body);
         central.push(concat([
             integer(4, 0x02014b50), integer(2, 0x0314), integer(2, 20), integer(2, 0x0800),
-            integer(2, 0), integer(2, 0), integer(2, 0), integer(4, crc),
-            integer(4, entry.data.length), integer(4, entry.data.length), integer(2, name.length),
+            integer(2, method), integer(2, 0), integer(2, 0), integer(4, crc),
+            integer(4, body.length), integer(4, entry.data.length), integer(2, name.length),
             integer(2, 0), integer(2, 0), integer(2, 0), integer(2, 0),
             integer(4, entry.mode << 16), integer(4, offset), name
         ]));
-        offset += local.length + entry.data.length;
+        offset += local.length + body.length;
     }
     const directory = concat(central);
     return concat([

package/dist/drivers/archive.js.map

@@ -1 +1 @@
-{"version":3,"file":"archive.js","sourceRoot":"","sources":["../../src/drivers/archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAOpC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,MAAM,MAAM,GAAG,CAAC,KAAgC,EAAc,EAAE;IAC9D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;IACpF,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AACD,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,KAAa,EAAc,EAAE;IAC3D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,KAAK,KAAK,CAAC;QAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;;QAC1C,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IACnC,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;IACxD,IAAI,GAAG,GAAG,KAAK,CAAA;IACf,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAA;AAClB,CAAC,CAAC,CAAA;AACF,MAAM,KAAK,GAAG,CAAC,IAAgB,EAAU,EAAE;IACzC,IAAI,GAAG,GAAG,UAAU,CAAA;IACpB,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAE,CAAA;IAC3E,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC,CAAA;AACD,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,OAAoC,EAAc,EAAE;IACtE,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC;YACnB,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YACzE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5E,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI;SAC5E,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAClB,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;YAC9E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC;YAC5D,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC;YACrF,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI;SACvD,CAAC,CAAC,CAAA;QACH,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;IAC5C,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,MAAM,CAAC;QACZ,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC;QACpF,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,KAAK,GAAG,CAAC,MAAkB,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa,EAAQ,EAAE;IACxF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IACzB,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAA;IAChF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAC3B,CAAC,CAAA;AACD,MAAM,KAAK,GAAG,CAAC,MAAkB,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa,EAAQ,EAAE;IACxF,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC9E,MAAM,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAA;AACpC,CAAC,CAAA;AACD,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAc,EAAE;IACpD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IAClC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAA;IACzC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACxB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACxB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACzC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACzB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;IAClB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAC3B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAClE,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AACD,6EAA6E;AAC7E,8EAA8E;AAC9E,yDAAyD;AACzD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAoC,EAAc,EAAE;IACxE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACvE,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI;QAC5B,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;KAClF,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClD,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACpB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IAChB,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../../src/drivers/archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAOpD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,MAAM,MAAM,GAAG,CAAC,KAAgC,EAAc,EAAE;IAC9D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;IACpF,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AACD,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,KAAa,EAAc,EAAE;IAC3D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,KAAK,KAAK,CAAC;QAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;;QAC1C,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IACnC,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;IACxD,IAAI,GAAG,GAAG,KAAK,CAAA;IACf,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAA;AAClB,CAAC,CAAC,CAAA;AACF,MAAM,KAAK,GAAG,CAAC,IAAgB,EAAU,EAAE;IACzC,IAAI,GAAG,GAAG,UAAU,CAAA;IACpB,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAE,CAAA;IAC3E,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC,CAAA;AAGD,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,OAAoC,EACpC,cAA8B,OAAO,EACzB,EAAE;IACd,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,MAAM,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAChD,MAAM,IAAI,GAAG,WAAW,KAAK,SAAS;YACpC,CAAC,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,CAAA;QACd,MAAM,KAAK,GAAG,MAAM,CAAC;YACnB,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;YAC9E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC;YACtE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI;SAC5E,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACxB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAClB,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;YAC9E,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC;YACjE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC;YAC/E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI;SACvD,CAAC,CAAC,CAAA;QACH,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IACtC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,MAAM,CAAC;QACZ,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC;QACpF,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,KAAK,GAAG,CAAC,MAAkB,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa,EAAQ,EAAE;IACxF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IACzB,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAA;IAChF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAC3B,CAAC,CAAA;AACD,MAAM,KAAK,GAAG,CAAC,MAAkB,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa,EAAQ,EAAE;IACxF,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC9E,MAAM,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAA;AACpC,CAAC,CAAA;AACD,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAc,EAAE;IACpD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IAClC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAA;IACzC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACxB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACxB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACzC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACzB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;IAClB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAC3B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAClE,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AACD,6EAA6E;AAC7E,8EAA8E;AAC9E,yDAAyD;AACzD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAoC,EAAc,EAAE;IACxE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACvE,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI;QAC5B,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;KAClF,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClD,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACpB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IAChB,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/dist/drivers/process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/drivers/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AAuBjF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,oCAAoC,CAAA;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAC/C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAA;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAA;IACtD,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,kBAAkB,CAAA;IAC5F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,yBAAyB,CAAA;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAID,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAC5E,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAA;CACvD,CAAA;AACD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAC3D,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD;8DAC0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC;iFAC6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAAA;CACzC,KAAK,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;AAoJhD,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,CAuH7E,CAAA"}
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/drivers/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AAqBjF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAGzC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,oCAAoC,CAAA;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAC/C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAA;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAA;IACtD,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,kBAAkB,CAAA;IAC5F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,yBAAyB,CAAA;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAID,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAC5E,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAA;CACvD,CAAA;AACD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAC3D,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD;8DAC0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC;iFAC6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAAA;CACzC,KAAK,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;AAoJhD,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,CAuH7E,CAAA"}

package/dist/drivers/process.js

@@ -3,14 +3,14 @@ import * as Stream from "effect/Stream";
 import * as ChildProcess from "effect/unstable/process/ChildProcess";
 import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
 import { createHash } from "node:crypto";
-import { accessSync, chmodSync, constants, copyFileSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { accessSync, chmodSync, constants, copyFileSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { delimiter, isAbsolute, join, resolve } from "node:path";
 import { readEnvironment, readOptionalEnv } from "./environment.js";
 import { redactOutput, redactProtocolOutput } from "./redact.js";
 import { networkIsolationHelperSource } from "./seccomp-helper-source.js";
 import { failure } from "./utils.js";
 import { DriverError } from "./errors.js";
+import { makeCanonicalTemporaryDirectory } from "./workspace.js";
 const helperDigest = createHash("sha256").update(networkIsolationHelperSource).digest("hex");
 const collect = (stream) => Stream.mkString(Stream.decodeText(stream));
 const executableIdentity = (command, cwd, path) => {
@@ -169,7 +169,7 @@ export const makeRunCommand = Effect.gen(function* () {
         const compileResources = compileRuntime === undefined
             ? undefined
             : yield* Effect.acquireRelease(Effect.sync(() => {
-                const directory = mkdtempSync(join(tmpdir(), "ts-release-bun-runtime-"));
+                const directory = makeCanonicalTemporaryDirectory("ts-release-bun-runtime-");
                 const cache = join(directory, "cache");
                 mkdirSync(cache, { mode: 0o700 });
                 if (compileRuntime.sourcePath !== undefined) {
@@ -184,7 +184,7 @@ export const makeRunCommand = Effect.gen(function* () {
             }));
         const isolationResources = command.network === "deny"
             ? yield* Effect.acquireRelease(Effect.sync(() => {
-                const directory = mkdtempSync(join(tmpdir(), "ts-release-seccomp-"));
+                const directory = makeCanonicalTemporaryDirectory("ts-release-seccomp-");
                 const helper = join(directory, "network-deny.mjs");
                 const identity = join(directory, "identity.json");
                 writeFileSync(helper, networkIsolationHelperSource, { mode: 0o500 });