@moinulmoin/eden 0.1.0

package/dist/eve-packaging.js

@@ -0,0 +1,2056 @@
+import { createHash, } from "node:crypto";
+import { execFile, } from "node:child_process";
+import { chmod, lstat, mkdir, readFile, readlink, readdir, realpath, writeFile, } from "node:fs/promises";
+import { promisify, } from "node:util";
+import { basename, dirname, isAbsolute, join, relative, resolve, } from "node:path";
+const execFileAsync = promisify(execFile);
+export class EvePackagingError extends Error {
+    code;
+    subject;
+    remediation;
+    constructor(options) {
+        super(options.reason);
+        this.name = "EvePackagingError";
+        this.code = options.code;
+        this.subject = options.subject;
+        this.remediation = options.remediation;
+    }
+}
+const INSTALL_COMMAND = [
+    "corepack",
+    "pnpm",
+    "install",
+    "--frozen-lockfile",
+];
+const BUILD_COMMAND = ["./node_modules/.bin/eve", "build"];
+const START_COMMAND = [
+    "./node_modules/.bin/eve",
+    "start",
+    "--host",
+    "0.0.0.0",
+    "--port",
+    "8080",
+];
+const EVE_ENTRYPOINT = ".output/server/index.mjs";
+const EVE_EXCLUDED_DIRECTORY_NAMES = new Set([
+    ".eden",
+    ".git",
+    ".hg",
+    ".next",
+    ".nuxt",
+    ".pnpm-store",
+    ".cache",
+    ".npm",
+    ".yarn",
+    ".output",
+    ".turbo",
+    ".wrangler",
+    "coverage",
+    "node_modules",
+]);
+const EVE_EXCLUDED_FILE_NAMES = new Set([
+    ".DS_Store",
+    ".npmrc",
+    ".pnpmrc",
+    ".pypirc",
+    ".bunfig.toml",
+    ".yarnrc",
+    ".yarnrc.yml",
+    "credentials.json",
+    "service-account.json",
+]);
+const EVE_COMPETING_LOCKFILES = new Set([
+    "bun.lock",
+    "bun.lockb",
+    "npm-shrinkwrap.json",
+    "package-lock.json",
+    "yarn.lock",
+]);
+const HOST_ENVIRONMENT = {
+    HOST: "0.0.0.0",
+    NITRO_HOST: "0.0.0.0",
+    PORT: "8080",
+    NITRO_PORT: "8080",
+    NODE_ENV: "production",
+};
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function jsonBytes(value) {
+    return Buffer.from(`${JSON.stringify(value)}\n`, "utf8");
+}
+function isWithin(root, candidate) {
+    const normalizedRoot = root.endsWith("/") ? root.slice(0, -1) : root;
+    return candidate === normalizedRoot ||
+        candidate.startsWith(`${normalizedRoot}/`);
+}
+function safeRelativePath(root, candidate) {
+    return relative(root, candidate).split("\\").join("/");
+}
+function isAllowedSystemAlias(path) {
+    const normalized = resolve(path);
+    return normalized === "/var" || normalized === "/tmp";
+}
+function isPathExcluded(relativePath, runtimeEnvRelativePath) {
+    const parts = relativePath.split("/");
+    const name = parts[parts.length - 1];
+    const excludedDirectory = parts.find((part) => EVE_EXCLUDED_DIRECTORY_NAMES.has(part));
+    if (excludedDirectory !== undefined) {
+        return {
+            excluded: true,
+            category: excludedDirectory === ".eden" || excludedDirectory === ".git"
+                ? "generated-state"
+                : excludedDirectory === "node_modules"
+                    ? "node_modules"
+                    : "build-cache",
+        };
+    }
+    if (runtimeEnvRelativePath !== undefined && relativePath === runtimeEnvRelativePath) {
+        return { excluded: true, category: "runtime-env" };
+    }
+    if (name !== undefined && name.startsWith(".env")) {
+        return { excluded: true, category: "runtime-env" };
+    }
+    if ((name !== undefined && EVE_EXCLUDED_FILE_NAMES.has(name)) ||
+        (name !== undefined && (name.endsWith(".pem") || name.endsWith(".key")))) {
+        return { excluded: true, category: "credentials" };
+    }
+    if (name !== undefined &&
+        (name.endsWith(".swp") || name.endsWith(".swo") || name.endsWith(".tmp"))) {
+        return { excluded: true, category: "temporary-state" };
+    }
+    return { excluded: false, category: undefined };
+}
+async function readStableFile(path, containmentRoot) {
+    const canonicalRoot = containmentRoot === undefined
+        ? undefined
+        : await realpath(containmentRoot).catch(() => undefined);
+    const parentBefore = containmentRoot === undefined
+        ? undefined
+        : await realpath(dirname(path)).catch(() => undefined);
+    if (containmentRoot !== undefined &&
+        (canonicalRoot === undefined ||
+            parentBefore === undefined ||
+            !isWithin(canonicalRoot, resolve(parentBefore)))) {
+        throw new EvePackagingError({
+            code: "SOURCE_RACE",
+            subject: safeRelativePath(containmentRoot ?? dirname(path), path),
+            reason: "The observed file parent escaped its Eden-owned containment root.",
+            remediation: "Retry only after the selected source tree is quiescent.",
+        });
+    }
+    const before = await lstat(path).catch(() => undefined);
+    if (before === undefined ||
+        !before.isFile() ||
+        before.isSymbolicLink()) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: safeRelativePath(dirname(path), path),
+            reason: "The Eve build input is missing, symlinked, or not a regular file.",
+            remediation: "Replace the input with a readable regular file inside the selected project root.",
+        });
+    }
+    const bytes = await readFile(path);
+    const secondRead = await readFile(path).catch(() => undefined);
+    const after = await lstat(path).catch(() => undefined);
+    const parentAfter = containmentRoot === undefined
+        ? undefined
+        : await realpath(dirname(path)).catch(() => undefined);
+    if (secondRead === undefined ||
+        !bytes.equals(secondRead) ||
+        after === undefined ||
+        !after.isFile() ||
+        after.isSymbolicLink() ||
+        after.dev !== before.dev ||
+        after.ino !== before.ino ||
+        after.size !== before.size ||
+        after.mode !== before.mode ||
+        (containmentRoot !== undefined && parentAfter !== parentBefore)) {
+        throw new EvePackagingError({
+            code: "SOURCE_RACE",
+            subject: basename(path),
+            reason: "An Eve build input changed while it was being observed.",
+            remediation: "Retry only after the selected project and its lockfile are quiescent.",
+        });
+    }
+    return {
+        bytes,
+        mode: before.mode & 0o777,
+        sha256: sha256(bytes),
+    };
+}
+async function captureInputs(root, runtimeConfig, artifactRoot, runtimeInputIdentity = runtimeConfig?.inputIdentity, requestedRoot = root) {
+    const runtimeEnvRelativePath = (() => {
+        if (runtimeConfig?.envFilePath === undefined)
+            return undefined;
+        const candidate = resolve(runtimeConfig.envFilePath);
+        if (isWithin(root, candidate))
+            return safeRelativePath(root, candidate);
+        if (isWithin(resolve(requestedRoot), candidate)) {
+            return safeRelativePath(resolve(requestedRoot), candidate);
+        }
+        return undefined;
+    })();
+    const files = [];
+    const excludedRelativePaths = [];
+    const visit = async (directory, relativeDirectory) => {
+        const directoryDetails = await lstat(directory).catch(() => undefined);
+        const canonicalDirectory = await realpath(directory).catch(() => undefined);
+        if (directoryDetails === undefined ||
+            !directoryDetails.isDirectory() ||
+            directoryDetails.isSymbolicLink() ||
+            canonicalDirectory === undefined ||
+            !isWithin(root, resolve(canonicalDirectory))) {
+            throw new EvePackagingError({
+                code: "SOURCE_RACE",
+                subject: relativeDirectory || ".",
+                reason: "The selected Eve source directory was replaced or escaped while it was being observed.",
+                remediation: "Retry only after the selected project tree is quiescent.",
+            });
+        }
+        const entries = await readdir(directory, { withFileTypes: true });
+        entries.sort((left, right) => left.name.localeCompare(right.name));
+        for (const entry of entries) {
+            const relativePath = relativeDirectory.length === 0
+                ? entry.name
+                : `${relativeDirectory}/${entry.name}`;
+            const candidate = join(directory, entry.name);
+            const absoluteCandidate = resolve(candidate);
+            if (isWithin(artifactRoot, absoluteCandidate)) {
+                excludedRelativePaths.push(relativePath);
+                continue;
+            }
+            const exclusion = isPathExcluded(relativePath, runtimeEnvRelativePath);
+            if (exclusion.excluded) {
+                excludedRelativePaths.push(relativePath);
+                continue;
+            }
+            if (entry.isSymbolicLink()) {
+                throw new EvePackagingError({
+                    code: relativePath === "pnpm-lock.yaml"
+                        ? "DEPENDENCY_AMBIGUITY"
+                        : "ROOT_INVALID",
+                    subject: relativePath,
+                    reason: relativePath === "pnpm-lock.yaml"
+                        ? "The root pnpm-lock.yaml must be a regular file, not a symbolic link."
+                        : "Eve build inputs may not contain symbolic links.",
+                    remediation: relativePath === "pnpm-lock.yaml"
+                        ? "Copy the matching lockfile into the selected project root and retry."
+                        : "Copy the file into the selected project root and retry.",
+                });
+            }
+            if (entry.isDirectory()) {
+                await visit(candidate, relativePath);
+                continue;
+            }
+            if (!entry.isFile()) {
+                throw new EvePackagingError({
+                    code: "ROOT_INVALID",
+                    subject: relativePath,
+                    reason: "Eve build inputs may not contain devices, sockets, FIFOs, or other special files.",
+                    remediation: "Remove the special file from the selected project inputs and retry.",
+                });
+            }
+            let stable;
+            try {
+                stable = await readStableFile(candidate, root);
+            }
+            catch (error) {
+                if (relativePath === "pnpm-lock.yaml" &&
+                    error instanceof EvePackagingError &&
+                    error.code === "ROOT_INVALID") {
+                    throw new EvePackagingError({
+                        code: "DEPENDENCY_AMBIGUITY",
+                        subject: relativePath,
+                        reason: "The root pnpm-lock.yaml is unreadable or changed while it was observed.",
+                        remediation: "Provide one readable regular lockfile generated by the declared exact pnpm version.",
+                    });
+                }
+                throw error;
+            }
+            files.push({
+                relativePath,
+                sha256: stable.sha256,
+                byteLength: stable.bytes.byteLength,
+                mode: stable.mode,
+                bytes: stable.bytes,
+            });
+        }
+    };
+    await visit(root, "");
+    files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+    excludedRelativePaths.sort();
+    const sourceDigest = sha256(jsonBytes({
+        files: files.map((file) => ({
+            relativePath: file.relativePath,
+            sha256: file.sha256,
+            byteLength: file.byteLength,
+            mode: file.mode,
+        })),
+        runtimeConfigInputIdentity: runtimeInputIdentity,
+    }));
+    return {
+        files,
+        excludedRelativePaths,
+        sourceDigest,
+    };
+}
+function sourceInputsEqual(left, right) {
+    if (left.sourceDigest !== right.sourceDigest)
+        return false;
+    if (left.files.length !== right.files.length)
+        return false;
+    return left.files.every((file, index) => {
+        const other = right.files[index];
+        return other !== undefined &&
+            file.relativePath === other.relativePath &&
+            file.sha256 === other.sha256 &&
+            file.byteLength === other.byteLength &&
+            file.mode === other.mode;
+    });
+}
+function parsePnpmVersion(packageManager) {
+    if (typeof packageManager !== "string") {
+        throw new EvePackagingError({
+            code: "UNSUPPORTED_TOOLCHAIN",
+            subject: "package.json.packageManager",
+            reason: "The Eve MVP requires packageManager to pin an exact pnpm version.",
+            remediation: 'Set package.json.packageManager to an exact value such as "pnpm@11.21.0".',
+        });
+    }
+    const match = /^pnpm@((?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*))$/u.exec(packageManager);
+    if (match === null) {
+        throw new EvePackagingError({
+            code: "UNSUPPORTED_TOOLCHAIN",
+            subject: "package.json.packageManager",
+            reason: "The Eve MVP supports only an exact pnpm@<major>.<minor>.<patch> pin.",
+            remediation: 'Replace ranges, tags, and other package managers with an exact pnpm pin.',
+        });
+    }
+    return match[1];
+}
+function lockfileMajor(lockfile) {
+    const text = lockfile.toString("utf8");
+    const match = /^\s*lockfileVersion:\s*['"]?([0-9]+)(?:\.[0-9]+)?['"]?\s*$/mu.exec(text);
+    return match === null ? undefined : Number(match[1]);
+}
+function lockfileMatchesPnpm(version, lockfile) {
+    const [majorText] = version.split(".");
+    const pnpmMajor = Number(majorText);
+    const declaredLockfileMajor = lockfileMajor(lockfile);
+    if (declaredLockfileMajor === undefined)
+        return false;
+    if (pnpmMajor >= 9)
+        return declaredLockfileMajor === 9;
+    if (pnpmMajor >= 7)
+        return declaredLockfileMajor === 6;
+    return declaredLockfileMajor === 5;
+}
+function packageJsonObject(bytes) {
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "package.json",
+            reason: "The selected package.json is not valid JSON.",
+            remediation: "Fix package.json and retry with the same explicit project root.",
+        });
+    }
+    if (typeof parsed !== "object" ||
+        parsed === null ||
+        Array.isArray(parsed)) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "package.json",
+            reason: "The selected package.json must contain a JSON object.",
+            remediation: "Provide a regular Eve project manifest with a non-empty name.",
+        });
+    }
+    return parsed;
+}
+function validateProjectContract(inputs) {
+    const packageFile = inputs.files.find((file) => file.relativePath === "package.json");
+    if (packageFile === undefined) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "package.json",
+            reason: "The selected Eve project root must contain a regular package.json.",
+            remediation: "Select the actual Eve application root instead of an ancestor or nested directory.",
+        });
+    }
+    const packageValue = packageJsonObject(packageFile.bytes);
+    const projectId = packageValue.name;
+    if (typeof projectId !== "string" || projectId.trim().length === 0) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "package.json.name",
+            reason: "The selected package.json must define a non-empty project identity.",
+            remediation: "Add a non-empty package.json name and retry.",
+        });
+    }
+    const packageManagerVersion = parsePnpmVersion(packageValue.packageManager);
+    const lockFiles = inputs.files.filter((file) => file.relativePath === "pnpm-lock.yaml" ||
+        file.relativePath.endsWith("/pnpm-lock.yaml"));
+    if (lockFiles.length !== 1 || lockFiles[0]?.relativePath !== "pnpm-lock.yaml") {
+        throw new EvePackagingError({
+            code: "DEPENDENCY_AMBIGUITY",
+            subject: "pnpm-lock.yaml",
+            reason: "The selected Eve root must contain exactly one regular root pnpm-lock.yaml.",
+            remediation: "Remove competing or nested lockfiles and retry with the matching root lockfile.",
+        });
+    }
+    const competing = inputs.files.find((file) => EVE_COMPETING_LOCKFILES.has(basename(file.relativePath)));
+    if (competing !== undefined) {
+        throw new EvePackagingError({
+            code: "DEPENDENCY_AMBIGUITY",
+            subject: competing.relativePath,
+            reason: "A competing package-manager lockfile was found at the selected Eve root.",
+            remediation: "Keep only the pinned pnpm toolchain and its matching root lockfile.",
+        });
+    }
+    const lockfile = lockFiles[0];
+    if (lockfile === undefined || !lockfileMatchesPnpm(packageManagerVersion, lockfile.bytes)) {
+        throw new EvePackagingError({
+            code: "DEPENDENCY_AMBIGUITY",
+            subject: "pnpm-lock.yaml",
+            reason: "The root pnpm-lock.yaml is malformed or does not match the exact packageManager pin.",
+            remediation: "Regenerate the lockfile with the declared pnpm version, without changing it during packaging.",
+        });
+    }
+    return {
+        projectId,
+        packageManagerVersion,
+        packageJsonSha256: packageFile.sha256,
+        lockfileSha256: lockfile.sha256,
+        lockfileBytes: lockfile.bytes,
+    };
+}
+async function assertCanonicalRoot(projectRoot) {
+    if (typeof projectRoot !== "string" || projectRoot.length === 0) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "project",
+            reason: "The Eve project root must be an explicit non-empty path.",
+            remediation: "Pass the canonical application directory explicitly.",
+        });
+    }
+    const requestedRoot = isAbsolute(projectRoot)
+        ? resolve(projectRoot)
+        : resolve(process.cwd(), projectRoot);
+    const details = await lstat(requestedRoot).catch(() => undefined);
+    if (details === undefined ||
+        !details.isDirectory() ||
+        details.isSymbolicLink()) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "project",
+            reason: "The selected Eve project root must be an existing canonical directory.",
+            remediation: "Pass the actual readable application directory, not a file, symlink, ancestor, or missing path.",
+        });
+    }
+    const canonicalRoot = await realpath(requestedRoot).catch(() => undefined);
+    if (canonicalRoot === undefined) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "project",
+            reason: "The selected Eve project root is not canonical.",
+            remediation: "Resolve the path and pass the real directory explicitly.",
+        });
+    }
+    await readdir(canonicalRoot).catch(() => {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "project",
+            reason: "The selected Eve project root is not readable.",
+            remediation: "Grant read access to the explicit project root and retry.",
+        });
+    });
+    return { requestedRoot, canonicalRoot };
+}
+async function assertRequiredRootInputs(root) {
+    const packageDetails = await lstat(join(root, "package.json")).catch(() => undefined);
+    if (packageDetails === undefined ||
+        !packageDetails.isFile() ||
+        packageDetails.isSymbolicLink()) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "package.json",
+            reason: "The selected Eve root must contain a regular package.json before any build input is walked.",
+            remediation: "Select the actual Eve application root instead of an ancestor or nested directory.",
+        });
+    }
+}
+async function prepareOutputParentChain(path) {
+    const absolute = resolve(path);
+    const parts = absolute.split("/").filter(Boolean);
+    let current = absolute.startsWith("/") ? "/" : "";
+    let missingStart = parts.length;
+    for (const [index, part] of parts.entries()) {
+        const candidate = current === "/" ? `/${part}` : join(current, part);
+        const details = await lstat(candidate).catch(() => undefined);
+        if (details === undefined) {
+            missingStart = index;
+            break;
+        }
+        if (details.isSymbolicLink()) {
+            if (!isAllowedSystemAlias(candidate)) {
+                throw new EvePackagingError({
+                    code: "ROOT_INVALID",
+                    subject: path,
+                    reason: "The Eden-owned artifact parent contains an unsafe symbolic link.",
+                    remediation: "Use a regular artifact directory and retry.",
+                });
+            }
+            current = candidate;
+            continue;
+        }
+        if (!details.isDirectory()) {
+            throw new EvePackagingError({
+                code: "ROOT_INVALID",
+                subject: path,
+                reason: "The Eden-owned artifact parent is not a directory.",
+                remediation: "Choose a writable regular artifact parent and retry.",
+            });
+        }
+        current = candidate;
+    }
+    const canonicalBase = await realpath(current).catch(() => undefined);
+    if (canonicalBase === undefined) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: path,
+            reason: "The Eden-owned artifact parent could not be resolved safely.",
+            remediation: "Choose a writable artifact parent and retry.",
+        });
+    }
+    if (missingStart === parts.length)
+        return canonicalBase;
+    let created = canonicalBase;
+    for (const part of parts.slice(missingStart)) {
+        created = join(created, part);
+        await mkdir(created);
+        const details = await lstat(created).catch(() => undefined);
+        const canonicalCreated = await realpath(created).catch(() => undefined);
+        if (details === undefined ||
+            !details.isDirectory() ||
+            details.isSymbolicLink() ||
+            canonicalCreated !== created) {
+            throw new EvePackagingError({
+                code: "ROOT_INVALID",
+                subject: path,
+                reason: "The Eden-owned artifact parent could not be created as regular directories.",
+                remediation: "Choose a writable artifact parent and retry.",
+            });
+        }
+    }
+    return created;
+}
+async function createGenerationRoot(artifactRoot, projectRoot) {
+    const generationRoot = resolve(artifactRoot);
+    if (generationRoot === projectRoot) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "artifactRoot",
+            reason: "Generated Eve artifacts may not overwrite the selected project root.",
+            remediation: "Use a new Eden-owned generation directory outside authored source.",
+        });
+    }
+    if (isWithin(projectRoot, generationRoot)) {
+        const first = safeRelativePath(projectRoot, generationRoot).split("/")[0];
+        if (first !== ".eden") {
+            throw new EvePackagingError({
+                code: "ROOT_INVALID",
+                subject: "artifactRoot",
+                reason: "Generated Eve artifacts may only be nested under the project-local .eden directory.",
+                remediation: "Use .eden/eve-deploy/generations/<new-id> or an external Eden-owned directory.",
+            });
+        }
+    }
+    const parent = dirname(generationRoot);
+    const canonicalParent = await prepareOutputParentChain(parent);
+    const canonicalGenerationRoot = join(canonicalParent, basename(generationRoot));
+    if (isWithin(projectRoot, canonicalGenerationRoot)) {
+        const first = safeRelativePath(projectRoot, canonicalGenerationRoot).split("/")[0];
+        if (first !== ".eden") {
+            throw new EvePackagingError({
+                code: "ROOT_INVALID",
+                subject: "artifactRoot",
+                reason: "The resolved Eden artifact path would overwrite authored project files.",
+                remediation: "Use a generation directory under .eden or outside the canonical project root.",
+            });
+        }
+    }
+    const existing = await lstat(canonicalGenerationRoot).catch(() => undefined);
+    if (existing !== undefined) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "artifactRoot",
+            reason: "The requested Eve generation directory already exists.",
+            remediation: "Create a new generation directory and preserve the prior generation.",
+        });
+    }
+    const parentBeforeCreate = await realpath(canonicalParent).catch(() => undefined);
+    if (parentBeforeCreate !== canonicalParent) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "artifactRoot",
+            reason: "The Eden-owned artifact parent changed before generation creation.",
+            remediation: "Use a stable regular artifact parent and retry.",
+        });
+    }
+    await mkdir(canonicalGenerationRoot);
+    const parentAfterCreate = await realpath(canonicalParent).catch(() => undefined);
+    if (parentAfterCreate !== canonicalParent) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "artifactRoot",
+            reason: "The Eden-owned artifact parent changed during generation creation.",
+            remediation: "Use a stable regular artifact parent and retry.",
+        });
+    }
+    const created = await lstat(canonicalGenerationRoot).catch(() => undefined);
+    if (created === undefined ||
+        !created.isDirectory() ||
+        created.isSymbolicLink()) {
+        throw new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "artifactRoot",
+            reason: "The Eden-owned generation directory could not be created safely.",
+            remediation: "Choose a writable regular directory and retry.",
+        });
+    }
+    return canonicalGenerationRoot;
+}
+async function ensureSnapshotDirectory(snapshotRoot, directory) {
+    const relativeDirectory = safeRelativePath(snapshotRoot, resolve(directory));
+    if (relativeDirectory === ".." ||
+        relativeDirectory.startsWith("../") ||
+        relativeDirectory.includes("/../")) {
+        throw new EvePackagingError({
+            code: "SOURCE_RACE",
+            subject: relativeDirectory,
+            reason: "The immutable Eve snapshot directory escaped its Eden-owned root.",
+            remediation: "Discard the mixed-generation candidate and retry from a clean snapshot.",
+        });
+    }
+    const rootDetails = await lstat(snapshotRoot).catch(() => undefined);
+    const rootCanonical = await realpath(snapshotRoot).catch(() => undefined);
+    if (rootDetails === undefined ||
+        !rootDetails.isDirectory() ||
+        rootDetails.isSymbolicLink() ||
+        rootCanonical === undefined ||
+        !isWithin(snapshotRoot, resolve(rootCanonical))) {
+        throw new EvePackagingError({
+            code: "SOURCE_RACE",
+            subject: ".",
+            reason: "The immutable Eve snapshot root was replaced or escaped during creation.",
+            remediation: "Discard the mixed-generation candidate and retry from a clean snapshot.",
+        });
+    }
+    let current = snapshotRoot;
+    let currentCanonical = rootCanonical;
+    for (const part of relativeDirectory.split("/").filter(Boolean)) {
+        const currentObserved = await realpath(current).catch(() => undefined);
+        if (currentObserved !== currentCanonical) {
+            throw new EvePackagingError({
+                code: "SOURCE_RACE",
+                subject: safeRelativePath(snapshotRoot, current),
+                reason: "The immutable Eve snapshot parent was replaced during creation.",
+                remediation: "Discard the mixed-generation candidate and retry from a clean snapshot.",
+            });
+        }
+        const next = join(current, part);
+        const expectedCanonical = join(currentCanonical, part);
+        const existing = await lstat(next).catch(() => undefined);
+        if (existing === undefined) {
+            await mkdir(next);
+        }
+        const details = await lstat(next).catch(() => undefined);
+        const canonical = await realpath(next).catch(() => undefined);
+        if (details === undefined ||
+            !details.isDirectory() ||
+            details.isSymbolicLink() ||
+            canonical === undefined ||
+            canonical !== expectedCanonical ||
+            !isWithin(rootCanonical, resolve(canonical))) {
+            throw new EvePackagingError({
+                code: "SOURCE_RACE",
+                subject: safeRelativePath(snapshotRoot, next),
+                reason: "The immutable Eve snapshot directory was replaced or escaped during creation.",
+                remediation: "Discard the mixed-generation candidate and retry from a clean snapshot.",
+            });
+        }
+        current = next;
+        currentCanonical = canonical;
+    }
+}
+async function copySnapshot(snapshotRoot, inputs) {
+    for (const file of inputs.files) {
+        const destination = join(snapshotRoot, file.relativePath);
+        const parent = dirname(destination);
+        await ensureSnapshotDirectory(snapshotRoot, parent);
+        const canonicalRoot = await realpath(snapshotRoot).catch(() => undefined);
+        const canonicalParent = await realpath(parent).catch(() => undefined);
+        if (canonicalRoot === undefined ||
+            canonicalParent === undefined ||
+            !isWithin(canonicalRoot, resolve(canonicalParent))) {
+            throw new EvePackagingError({
+                code: "SOURCE_RACE",
+                subject: file.relativePath,
+                reason: "The immutable Eve snapshot parent could not be proven contained before writing.",
+                remediation: "Discard the mixed-generation candidate and retry from a clean snapshot.",
+            });
+        }
+        await writeFile(destination, file.bytes, {
+            flag: "wx",
+            mode: file.mode,
+        });
+        const afterParent = await realpath(parent).catch(() => undefined);
+        if (afterParent !== canonicalParent) {
+            throw new EvePackagingError({
+                code: "SOURCE_RACE",
+                subject: file.relativePath,
+                reason: "The immutable Eve snapshot parent changed during writing.",
+                remediation: "Discard the mixed-generation candidate and retry from a clean snapshot.",
+            });
+        }
+        await chmod(destination, file.mode).catch(() => undefined);
+        const copied = await readStableFile(destination, snapshotRoot);
+        if (copied.sha256 !== file.sha256 || copied.bytes.byteLength !== file.byteLength) {
+            throw new EvePackagingError({
+                code: "SOURCE_RACE",
+                subject: file.relativePath,
+                reason: "The immutable Eve snapshot did not retain the observed input bytes.",
+                remediation: "Retry after the selected project is quiescent.",
+            });
+        }
+    }
+}
+async function verifySnapshotInputs(snapshotRoot, inputs) {
+    const generatedRoots = new Set([".dockerignore", ".output", "node_modules"]);
+    const observedInputPaths = [];
+    const visit = async (directory, relativeDirectory) => {
+        const directoryDetails = await lstat(directory).catch(() => undefined);
+        const directoryCanonical = await realpath(directory).catch(() => undefined);
+        if (directoryDetails === undefined ||
+            !directoryDetails.isDirectory() ||
+            directoryDetails.isSymbolicLink() ||
+            directoryCanonical === undefined ||
+            !isWithin(snapshotRoot, resolve(directoryCanonical))) {
+            throw new EvePackagingError({
+                code: "SOURCE_RACE",
+                subject: relativeDirectory || ".",
+                reason: "The immutable Eve snapshot directory escaped or changed during verification.",
+                remediation: "Discard the mixed-generation candidate and retry from quiescent source bytes.",
+            });
+        }
+        const entries = await readdir(directory, { withFileTypes: true });
+        entries.sort((left, right) => left.name.localeCompare(right.name));
+        for (const entry of entries) {
+            const relativePath = relativeDirectory.length === 0
+                ? entry.name
+                : `${relativeDirectory}/${entry.name}`;
+            const firstSegment = relativePath.split("/")[0];
+            if (firstSegment !== undefined && generatedRoots.has(firstSegment)) {
+                continue;
+            }
+            const candidate = join(directory, entry.name);
+            if (entry.isSymbolicLink() || !entry.isDirectory()) {
+                if (!entry.isFile() || entry.isSymbolicLink()) {
+                    throw new EvePackagingError({
+                        code: "SOURCE_RACE",
+                        subject: relativePath,
+                        reason: "The immutable Eve snapshot gained an unsafe or unsupported input.",
+                        remediation: "Discard the mixed-generation candidate and retry from quiescent source bytes.",
+                    });
+                }
+                observedInputPaths.push(relativePath);
+                continue;
+            }
+            await visit(candidate, relativePath);
+        }
+    };
+    await visit(snapshotRoot, "");
+    const expectedInputPaths = inputs.files.map((file) => file.relativePath).sort();
+    observedInputPaths.sort();
+    if (observedInputPaths.length !== expectedInputPaths.length ||
+        observedInputPaths.some((path, index) => path !== expectedInputPaths[index])) {
+        throw new EvePackagingError({
+            code: "SOURCE_RACE",
+            subject: "snapshot input set",
+            reason: "The immutable Eve snapshot gained or lost authored input paths during installation or build.",
+            remediation: "Discard the mixed-generation candidate and retry from quiescent source bytes.",
+        });
+    }
+    for (const file of inputs.files) {
+        try {
+            const observed = await readStableFile(join(snapshotRoot, file.relativePath), snapshotRoot);
+            if (observed.sha256 !== file.sha256 ||
+                observed.bytes.byteLength !== file.byteLength ||
+                observed.mode !== file.mode) {
+                throw new EvePackagingError({
+                    code: "SOURCE_RACE",
+                    subject: file.relativePath,
+                    reason: "The immutable Eve snapshot changed during installation or build.",
+                    remediation: "Discard the mixed-generation candidate and retry from quiescent source bytes.",
+                });
+            }
+        }
+        catch (error) {
+            if (error instanceof EvePackagingError) {
+                if (error.code === "SOURCE_RACE")
+                    throw error;
+                throw new EvePackagingError({
+                    code: "SOURCE_RACE",
+                    subject: file.relativePath,
+                    reason: "The immutable Eve snapshot changed during installation or build.",
+                    remediation: "Discard the mixed-generation candidate and retry from quiescent source bytes.",
+                });
+            }
+            throw error;
+        }
+    }
+}
+async function snapshotDigest(snapshotRoot) {
+    const files = [];
+    const visit = async (directory, relativeDirectory) => {
+        const directoryDetails = await lstat(directory).catch(() => undefined);
+        const directoryCanonical = await realpath(directory).catch(() => undefined);
+        if (directoryDetails === undefined ||
+            !directoryDetails.isDirectory() ||
+            directoryDetails.isSymbolicLink() ||
+            directoryCanonical === undefined ||
+            !isWithin(snapshotRoot, resolve(directoryCanonical))) {
+            throw new EvePackagingError({
+                code: "SOURCE_RACE",
+                subject: relativeDirectory || ".",
+                reason: "The immutable Eve snapshot directory escaped or changed during digest capture.",
+                remediation: "Discard the mixed-generation candidate and retry from a clean project snapshot.",
+            });
+        }
+        const entries = await readdir(directory, { withFileTypes: true });
+        entries.sort((left, right) => left.name.localeCompare(right.name));
+        for (const entry of entries) {
+            const relativePath = relativeDirectory.length === 0
+                ? entry.name
+                : `${relativeDirectory}/${entry.name}`;
+            const candidate = join(directory, entry.name);
+            if (entry.isSymbolicLink()) {
+                const resolved = await realpath(candidate).catch(() => undefined);
+                if (resolved === undefined ||
+                    !isWithin(snapshotRoot, resolve(resolved))) {
+                    throw new EvePackagingError({
+                        code: "SOURCE_RACE",
+                        subject: relativePath,
+                        reason: "The immutable Eve snapshot contains a symbolic link that escapes its dependency tree.",
+                        remediation: "Discard the candidate and retry from a clean project snapshot.",
+                    });
+                }
+                files.push({
+                    relativePath,
+                    sha256: `link:${await readlink(candidate)}`,
+                    byteLength: 0,
+                });
+                continue;
+            }
+            if (entry.isDirectory()) {
+                await visit(candidate, relativePath);
+                continue;
+            }
+            if (!entry.isFile()) {
+                throw new EvePackagingError({
+                    code: "SOURCE_RACE",
+                    subject: relativePath,
+                    reason: "The immutable Eve snapshot contains an unsupported file type.",
+                    remediation: "Discard the candidate and retry from a regular-file project tree.",
+                });
+            }
+            const stable = await readStableFile(candidate, snapshotRoot);
+            files.push({
+                relativePath,
+                sha256: stable.sha256,
+                byteLength: stable.bytes.byteLength,
+            });
+        }
+    };
+    await visit(snapshotRoot, "");
+    return sha256(jsonBytes(files));
+}
+async function writeJson(path, value) {
+    await writeFile(path, jsonBytes(value), {
+        flag: "wx",
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+async function writeDockerBuildFiles(options) {
+    if (!/^sha256:[0-9a-f]{64}$/u.test(options.nodeImage.digest) ||
+        !/^node:24\.17\.0(?:-[a-z0-9][a-z0-9._-]*)?$/u.test(options.nodeImage.reference)) {
+        throw new EvePackagingError({
+            code: "DOCKER_PLATFORM_BLOCKED",
+            subject: "node-24-image",
+            reason: "The Linux/amd64 builder requires an immutable Node 24 image digest.",
+            remediation: "Supply a verified Node 24 image reference and sha256 digest.",
+        });
+    }
+    const image = `${options.nodeImage.reference}@${options.nodeImage.digest}`;
+    const dockerfile = `# syntax=docker/dockerfile:1
+FROM --platform=linux/amd64 ${image} AS builder
+WORKDIR /workspace
+COPY package.json pnpm-lock.yaml ./
+RUN corepack enable \\
+  && corepack prepare pnpm@${options.packageManagerVersion} --activate \\
+  && test "$(corepack pnpm --version)" = "${options.packageManagerVersion}" \\
+  && test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f1)" = "${options.lockfileSha256}" \\
+  && corepack pnpm install --frozen-lockfile --config.node-linker=hoisted
+RUN test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f1)" = "${options.lockfileSha256}"
+COPY . ./
+RUN test -x ./node_modules/.bin/eve \\
+  && ./node_modules/.bin/eve build
+
+FROM builder AS runtime-deps
+RUN rm -rf node_modules \\
+  && corepack pnpm install --frozen-lockfile --prod --config.node-linker=hoisted \\
+  && for l in node_modules/.bin/*; do t=$(readlink "$l") || continue; case "$t" in /*) ln -sfn "$(realpath --relative-to=node_modules/.bin "$t")" "$l" ;; esac; done
+
+FROM --platform=linux/amd64 ${image} AS runtime
+WORKDIR /app
+ENV HOST=0.0.0.0 \\
+    NITRO_HOST=0.0.0.0 \\
+    PORT=8080 \\
+    NITRO_PORT=8080 \\
+    NODE_ENV=production
+COPY --from=builder /workspace/.output /app/.output
+COPY --from=runtime-deps /workspace/node_modules /app/node_modules
+EXPOSE 8080
+ENTRYPOINT ["./node_modules/.bin/eve", "start", "--host", "0.0.0.0", "--port", "8080"]
+`;
+    const dockerignore = `node_modules
+.output
+.eden
+.git
+.env*
+.npmrc
+.yarnrc*
+*.pem
+*.key
+`;
+    await writeFile(options.dockerfilePath, dockerfile, {
+        flag: "wx",
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    await writeFile(join(options.snapshotRoot, ".dockerignore"), dockerignore, {
+        flag: "wx",
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+async function resolveProjectLocalEve(snapshotRoot) {
+    const binPath = join(snapshotRoot, "node_modules/.bin/eve");
+    const binDetails = await lstat(binPath).catch(() => undefined);
+    if (binDetails === undefined ||
+        (!binDetails.isFile() && !binDetails.isSymbolicLink())) {
+        throw new EvePackagingError({
+            code: "DEPENDENCY_AMBIGUITY",
+            subject: "node_modules/.bin/eve",
+            reason: "The installed project-local Eve executable is missing.",
+            remediation: "Declare Eve in the project dependencies and use the frozen pnpm install.",
+        });
+    }
+    const resolved = await realpath(binPath).catch(() => undefined);
+    const nodeModulesRoot = resolve(join(snapshotRoot, "node_modules"));
+    if (resolved === undefined ||
+        !isWithin(nodeModulesRoot, resolve(resolved))) {
+        throw new EvePackagingError({
+            code: "DEPENDENCY_AMBIGUITY",
+            subject: "node_modules/.bin/eve",
+            reason: "The Eve executable resolves outside the isolated project dependency tree.",
+            remediation: "Remove the global or escaping Eve executable and install Eve locally.",
+        });
+    }
+    const resolvedDetails = await lstat(resolved).catch(() => undefined);
+    if (resolvedDetails === undefined ||
+        !resolvedDetails.isFile() ||
+        (resolvedDetails.mode & 0o111) === 0) {
+        throw new EvePackagingError({
+            code: "DEPENDENCY_AMBIGUITY",
+            subject: "node_modules/.bin/eve",
+            reason: "The project-local Eve executable is not a readable executable file.",
+            remediation: "Install a regular executable Eve package through the pinned lockfile and retry.",
+        });
+    }
+    let current = dirname(resolved);
+    while (isWithin(nodeModulesRoot, current) && current !== nodeModulesRoot) {
+        const packagePath = join(current, "package.json");
+        const packageDetails = await lstat(packagePath).catch(() => undefined);
+        if (packageDetails?.isFile() === true && !packageDetails.isSymbolicLink()) {
+            let packageValue;
+            try {
+                packageValue = JSON.parse((await readFile(packagePath)).toString("utf8"));
+            }
+            catch {
+                packageValue = undefined;
+            }
+            if (typeof packageValue === "object" &&
+                packageValue !== null &&
+                !Array.isArray(packageValue) &&
+                packageValue.name === "eve" &&
+                typeof packageValue.version === "string" &&
+                packageValue.version.length > 0) {
+                return {
+                    version: packageValue.version,
+                    path: "node_modules/.bin/eve",
+                };
+            }
+        }
+        current = dirname(current);
+    }
+    const directPackagePath = await realpath(join(nodeModulesRoot, "eve", "package.json")).catch(() => undefined);
+    if (directPackagePath !== undefined &&
+        isWithin(nodeModulesRoot, directPackagePath)) {
+        let directValue;
+        try {
+            directValue = JSON.parse((await readFile(directPackagePath)).toString("utf8"));
+        }
+        catch {
+            directValue = undefined;
+        }
+        if (typeof directValue === "object" &&
+            directValue !== null &&
+            !Array.isArray(directValue) &&
+            directValue.name === "eve" &&
+            typeof directValue.version ===
+                "string" &&
+            directValue.version.length > 0) {
+            return {
+                version: directValue.version,
+                path: "node_modules/.bin/eve",
+            };
+        }
+    }
+    throw new EvePackagingError({
+        code: "DEPENDENCY_AMBIGUITY",
+        subject: "node_modules/.bin/eve",
+        reason: "The project-local Eve executable has no readable installed package version.",
+        remediation: "Install Eve through the pinned lockfile and retry.",
+    });
+}
+async function scanGeneratedOutput(snapshotRoot) {
+    const readGeneratedFile = async (path, subject) => {
+        try {
+            return await readStableFile(path, snapshotRoot);
+        }
+        catch {
+            throw new EvePackagingError({
+                code: "UNSUPPORTED_EVE_OUTPUT",
+                subject,
+                reason: "The generated Eve output is unreadable or changed during validation.",
+                remediation: "Regenerate the Eve output inside the immutable snapshot and retry.",
+            });
+        }
+    };
+    const outputRoot = join(snapshotRoot, ".output");
+    const outputDetails = await lstat(outputRoot).catch(() => undefined);
+    const outputCanonical = await realpath(outputRoot).catch(() => undefined);
+    if (outputDetails === undefined ||
+        !outputDetails.isDirectory() ||
+        outputDetails.isSymbolicLink() ||
+        outputCanonical === undefined ||
+        !isWithin(snapshotRoot, resolve(outputCanonical))) {
+        throw new EvePackagingError({
+            code: "UNSUPPORTED_EVE_OUTPUT",
+            subject: ".output",
+            reason: "The project-local Eve build output is missing or escapes the immutable snapshot.",
+            remediation: "Regenerate .output as a regular directory inside the isolated build snapshot.",
+        });
+    }
+    const entrypoint = join(snapshotRoot, EVE_ENTRYPOINT);
+    const entryDetails = await lstat(entrypoint).catch(() => undefined);
+    if (entryDetails === undefined ||
+        !entryDetails.isFile() ||
+        entryDetails.isSymbolicLink()) {
+        throw new EvePackagingError({
+            code: "UNSUPPORTED_EVE_OUTPUT",
+            subject: EVE_ENTRYPOINT,
+            reason: "The project-local Eve build did not produce a regular Nitro server entrypoint.",
+            remediation: "Fix the project-local Eve build so .output/server/index.mjs is generated inside the snapshot.",
+        });
+    }
+    const files = [];
+    const visit = async (directory, relativeDirectory) => {
+        const directoryDetails = await lstat(directory).catch(() => undefined);
+        const directoryCanonical = await realpath(directory).catch(() => undefined);
+        if (directoryDetails === undefined ||
+            !directoryDetails.isDirectory() ||
+            directoryDetails.isSymbolicLink() ||
+            directoryCanonical === undefined ||
+            !isWithin(snapshotRoot, resolve(directoryCanonical))) {
+            throw new EvePackagingError({
+                code: "UNSUPPORTED_EVE_OUTPUT",
+                subject: `.output/${relativeDirectory}`,
+                reason: "Generated Eve output escaped or changed during validation.",
+                remediation: "Regenerate output as regular files inside the immutable build snapshot.",
+            });
+        }
+        const entries = await readdir(directory, { withFileTypes: true });
+        entries.sort((left, right) => left.name.localeCompare(right.name));
+        for (const entry of entries) {
+            const relativePath = relativeDirectory.length === 0
+                ? entry.name
+                : `${relativeDirectory}/${entry.name}`;
+            const candidate = join(directory, entry.name);
+            if (entry.isSymbolicLink()) {
+                throw new EvePackagingError({
+                    code: "UNSUPPORTED_EVE_OUTPUT",
+                    subject: `.output/${relativePath}`,
+                    reason: "Generated Eve output contains a symbolic-link escape or unsupported link.",
+                    remediation: "Regenerate output as regular files inside the immutable build snapshot.",
+                });
+            }
+            if (entry.isDirectory()) {
+                await visit(candidate, relativePath);
+                continue;
+            }
+            if (!entry.isFile()) {
+                throw new EvePackagingError({
+                    code: "UNSUPPORTED_EVE_OUTPUT",
+                    subject: `.output/${relativePath}`,
+                    reason: "Generated Eve output contains an unsupported file type.",
+                    remediation: "Remove special files from the Eve build output and retry.",
+                });
+            }
+            const stable = await readGeneratedFile(candidate, `.output/${relativePath}`);
+            files.push({
+                relativePath: `.output/${relativePath}`,
+                sha256: stable.sha256,
+                byteLength: stable.bytes.byteLength,
+            });
+        }
+    };
+    await visit(outputRoot, "");
+    const entryStable = await readGeneratedFile(entrypoint, EVE_ENTRYPOINT);
+    if (entryStable.bytes.byteLength === 0) {
+        throw new EvePackagingError({
+            code: "UNSUPPORTED_EVE_OUTPUT",
+            subject: EVE_ENTRYPOINT,
+            reason: "The project-local Eve build produced an empty Nitro server entrypoint.",
+            remediation: "Regenerate .output/server/index.mjs from the project-local Eve build.",
+        });
+    }
+    try {
+        await execFileAsync(process.execPath, ["--check", entrypoint], {
+            cwd: snapshotRoot,
+            env: {
+                PATH: process.env.PATH,
+                NODE_PATH: undefined,
+                NODE_OPTIONS: undefined,
+            },
+            maxBuffer: 1024 * 1024,
+        });
+    }
+    catch {
+        throw new EvePackagingError({
+            code: "UNSUPPORTED_EVE_OUTPUT",
+            subject: EVE_ENTRYPOINT,
+            reason: "The generated Nitro server entrypoint is not valid JavaScript.",
+            remediation: "Fix the project-local Eve build so .output/server/index.mjs passes Node syntax validation.",
+        });
+    }
+    return {
+        entrypointPath: EVE_ENTRYPOINT,
+        sha256: entryStable.sha256,
+        regularFile: true,
+        symlinkEscape: false,
+        outputDigest: sha256(jsonBytes(files)),
+        fileCount: files.length,
+    };
+}
+async function assertGeneratedTreesExcludeSecrets(snapshotRoot) {
+    const roots = [
+        join(snapshotRoot, "node_modules"),
+        join(snapshotRoot, ".output"),
+    ];
+    const visit = async (directory, relativeDirectory) => {
+        const directoryDetails = await lstat(directory).catch(() => undefined);
+        const directoryCanonical = await realpath(directory).catch(() => undefined);
+        if (directoryDetails === undefined ||
+            !directoryDetails.isDirectory() ||
+            directoryDetails.isSymbolicLink() ||
+            directoryCanonical === undefined ||
+            !isWithin(snapshotRoot, resolve(directoryCanonical))) {
+            throw new EvePackagingError({
+                code: "SECRET_EXCLUSION_FAILED",
+                subject: relativeDirectory,
+                reason: "The generated Eve runtime closure escaped or changed during secret validation.",
+                remediation: "Regenerate dependencies and output inside the immutable project snapshot.",
+            });
+        }
+        const entries = await readdir(directory, { withFileTypes: true });
+        for (const entry of entries) {
+            const relativePath = relativeDirectory.length === 0
+                ? entry.name
+                : `${relativeDirectory}/${entry.name}`;
+            const candidate = join(directory, entry.name);
+            if (entry.name.startsWith(".env") ||
+                EVE_EXCLUDED_FILE_NAMES.has(entry.name) ||
+                entry.name.endsWith(".pem") ||
+                entry.name.endsWith(".key")) {
+                throw new EvePackagingError({
+                    code: "SECRET_EXCLUSION_FAILED",
+                    subject: relativePath,
+                    reason: "The generated Eve runtime closure contains a credential or environment file.",
+                    remediation: "Remove credential material from the project dependency/output closure and retry.",
+                });
+            }
+            if (entry.isSymbolicLink()) {
+                const resolved = await realpath(candidate).catch(() => undefined);
+                if (resolved === undefined ||
+                    !isWithin(snapshotRoot, resolve(resolved))) {
+                    throw new EvePackagingError({
+                        code: "SECRET_EXCLUSION_FAILED",
+                        subject: relativePath,
+                        reason: "The generated Eve runtime closure contains an escaping symbolic link.",
+                        remediation: "Regenerate dependencies and output without links outside the immutable snapshot.",
+                    });
+                }
+                continue;
+            }
+            if (entry.isDirectory()) {
+                await visit(candidate, relativePath);
+            }
+        }
+    };
+    for (const root of roots) {
+        const details = await lstat(root).catch(() => undefined);
+        if (details?.isSymbolicLink()) {
+            throw new EvePackagingError({
+                code: "SECRET_EXCLUSION_FAILED",
+                subject: relative(snapshotRoot, root),
+                reason: "The generated Eve runtime closure root is a symbolic link.",
+                remediation: "Regenerate dependencies and output as regular directories inside the immutable snapshot.",
+            });
+        }
+        if (details?.isDirectory() === true) {
+            const canonical = await realpath(root).catch(() => undefined);
+            if (canonical === undefined ||
+                !isWithin(snapshotRoot, resolve(canonical))) {
+                throw new EvePackagingError({
+                    code: "SECRET_EXCLUSION_FAILED",
+                    subject: relative(snapshotRoot, root),
+                    reason: "The generated Eve runtime closure root escapes the immutable snapshot.",
+                    remediation: "Regenerate dependencies and output inside the isolated project snapshot.",
+                });
+            }
+            await visit(root, relative(root, root));
+        }
+    }
+}
+function safeError(error) {
+    return {
+        code: error.code,
+        subject: error.subject,
+        reason: error.message,
+        remediation: error.remediation,
+    };
+}
+function classifyDockerBuildFailure(error) {
+    const stderr = typeof error === "object" &&
+        error !== null &&
+        "stderr" in error &&
+        typeof error.stderr === "string"
+        ? error.stderr
+        : "";
+    if (/ERR_PNPM_(?:OUTDATED_LOCKFILE|LOCKFILE_MISSING_DEPENDENCY)/u.test(stderr) ||
+        /frozen-lockfile|pnpm --version/u.test(stderr)) {
+        return new EvePackagingError({
+            code: "DEPENDENCY_AMBIGUITY",
+            subject: "frozen pnpm install",
+            reason: "The isolated pinned pnpm install could not complete without changing or bypassing the lockfile.",
+            remediation: "Regenerate pnpm-lock.yaml with the declared pnpm version and retry without relaxing frozen mode.",
+        });
+    }
+    if (/node_modules\/\.bin\/eve|test -x/u.test(stderr)) {
+        return new EvePackagingError({
+            code: "DEPENDENCY_AMBIGUITY",
+            subject: "node_modules/.bin/eve",
+            reason: "The isolated build could not resolve the project-local Eve executable.",
+            remediation: "Declare Eve as a project dependency and retry with the frozen lockfile.",
+        });
+    }
+    if (/eve build/u.test(stderr)) {
+        return new EvePackagingError({
+            code: "EVE_BUILD_FAILED",
+            subject: "eve build",
+            reason: "The project-local Eve build failed inside the isolated Linux/amd64 builder.",
+            remediation: "Fix the project-local Eve build and retry without changing the authored project during packaging.",
+        });
+    }
+    return new EvePackagingError({
+        code: "DOCKER_PLATFORM_BLOCKED",
+        subject: "Docker/OrbStack",
+        reason: "The isolated Linux/amd64 Eve builder was unavailable or failed before a verified image was produced.",
+        remediation: "Start Docker/OrbStack with BuildKit and retry without changing the project inputs.",
+    });
+}
+function blockedResult(error, extra = {}) {
+    return {
+        schemaVersion: 1,
+        worker: "eve-packaging-worker",
+        operation: "local-package",
+        status: "blocked",
+        returnCode: error.code,
+        deployable: false,
+        project: extra.project ?? null,
+        candidate: null,
+        snapshot: null,
+        toolchain: null,
+        image: null,
+        runtime: null,
+        secrets: {
+            runtimeVariableNames: [],
+            valuesRecorded: false,
+            excludedFromSnapshot: true,
+            excludedFromBuildEnvironment: true,
+            excludedFromDockerContext: true,
+            excludedFromImage: true,
+            excludedFromHistory: true,
+            excludedFromManifestsAndLogs: true,
+            redactionRegisteredBeforeChildren: false,
+        },
+        checks: extra.checks ?? [{
+                id: error.code,
+                status: "blocked",
+                subject: error.subject,
+                reason: error.message,
+                remediation: error.remediation,
+            }],
+        candidateImageId: null,
+        candidateImageRetainedLocally: false,
+        writtenPaths: extra.writtenPaths ?? [],
+        error: safeError(error),
+    };
+}
+async function currentInputIdentity(runtimeConfig) {
+    const token = (value) => {
+        if (typeof value === "string")
+            return value;
+        return value?.token;
+    };
+    if (runtimeConfig?.readInputIdentity !== undefined) {
+        return token(await runtimeConfig.readInputIdentity());
+    }
+    return token(runtimeConfig?.inputIdentity);
+}
+async function sourceRaceErrorIfChanged(root, initial, initialInputIdentity, runtimeConfig, artifactRoot, requestedRoot) {
+    const requestedDetails = await lstat(requestedRoot).catch(() => undefined);
+    const requestedCanonical = await realpath(requestedRoot).catch(() => undefined);
+    if (requestedDetails === undefined ||
+        !requestedDetails.isDirectory() ||
+        requestedDetails.isSymbolicLink() ||
+        requestedCanonical !== root) {
+        return new EvePackagingError({
+            code: "SOURCE_RACE",
+            subject: "project root",
+            reason: "The explicitly selected Eve project root changed during packaging.",
+            remediation: "Retry only after the selected canonical project root is quiescent.",
+        });
+    }
+    let latestIdentity;
+    try {
+        latestIdentity = await currentInputIdentity(runtimeConfig);
+    }
+    catch {
+        return new EvePackagingError({
+            code: "SOURCE_RACE",
+            subject: "runtime configuration identity",
+            reason: "The explicit environment identity could not be revalidated safely.",
+            remediation: "Retry after the deployment-safety runtime-config seam is stable.",
+        });
+    }
+    let latest;
+    try {
+        latest = await captureInputs(root, runtimeConfig, artifactRoot, latestIdentity, requestedRoot);
+    }
+    catch (error) {
+        if (error instanceof EvePackagingError) {
+            return new EvePackagingError({
+                code: "SOURCE_RACE",
+                subject: error.subject,
+                reason: "The selected Eve inputs changed or became unsafe during revalidation.",
+                remediation: "Retry only after the selected project and its lockfile are quiescent.",
+            });
+        }
+        return new EvePackagingError({
+            code: "SOURCE_RACE",
+            subject: "project inputs",
+            reason: "The selected Eve inputs could not be revalidated safely.",
+            remediation: "Retry only after the selected project and its lockfile are quiescent.",
+        });
+    }
+    if (initialInputIdentity !== latestIdentity ||
+        !sourceInputsEqual(initial, latest)) {
+        return new EvePackagingError({
+            code: "SOURCE_RACE",
+            subject: "project inputs",
+            reason: "The selected Eve source, lockfile, configuration, or explicit environment identity changed during packaging.",
+            remediation: "Retry only after all selected inputs are quiescent; the mixed-generation candidate was discarded.",
+        });
+    }
+    return undefined;
+}
+export async function buildEveProjectSnapshot(options) {
+    let roots;
+    let initialInputs;
+    let contract;
+    let initialRuntimeInputIdentity;
+    try {
+        roots = await assertCanonicalRoot(options.projectRoot);
+        await assertRequiredRootInputs(roots.canonicalRoot);
+        if (options.runtimeConfig !== undefined &&
+            options.runtimeConfig.redactionRegistered !== true) {
+            throw new EvePackagingError({
+                code: "SECRET_EXCLUSION_FAILED",
+                subject: "runtime configuration",
+                reason: "Runtime configuration redaction was not registered before the isolated builder would start.",
+                remediation: "Register the deployment-safety redaction handle before packaging and retry.",
+            });
+        }
+        if (options.runtimeConfig?.envFilePath !== undefined &&
+            options.runtimeConfig.inputIdentity === undefined &&
+            options.runtimeConfig.readInputIdentity === undefined) {
+            throw new EvePackagingError({
+                code: "SECRET_EXCLUSION_FAILED",
+                subject: "runtime configuration identity",
+                reason: "An explicit environment file was supplied without a deployment-safety input identity.",
+                remediation: "Pass the validated redacted environment identity from deployment-safety before packaging.",
+            });
+        }
+        const runtimeVariableNames = options.runtimeConfig?.variableNames ?? [];
+        if (runtimeVariableNames.some((name) => !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(name)) ||
+            new Set(runtimeVariableNames).size !== runtimeVariableNames.length) {
+            throw new EvePackagingError({
+                code: "SECRET_EXCLUSION_FAILED",
+                subject: "runtime variable names",
+                reason: "The runtime-config seam returned an invalid or duplicate variable name.",
+                remediation: "Return only validated non-secret environment variable names and retry.",
+            });
+        }
+        initialRuntimeInputIdentity = await currentInputIdentity(options.runtimeConfig);
+        if (options.runtimeConfig?.envFilePath !== undefined &&
+            initialRuntimeInputIdentity === undefined) {
+            throw new EvePackagingError({
+                code: "SECRET_EXCLUSION_FAILED",
+                subject: "runtime configuration identity",
+                reason: "The explicit environment file identity was unavailable.",
+                remediation: "Revalidate the redacted environment input through deployment-safety before packaging.",
+            });
+        }
+        const artifactRoot = resolve(options.artifactRoot);
+        initialInputs = await captureInputs(roots.canonicalRoot, options.runtimeConfig, artifactRoot, initialRuntimeInputIdentity, roots.requestedRoot);
+        contract = validateProjectContract(initialInputs);
+    }
+    catch (error) {
+        if (error instanceof EvePackagingError)
+            return blockedResult(error);
+        return blockedResult(new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "project",
+            reason: "The Eve project could not be inspected safely.",
+            remediation: "Retry with a readable canonical project root.",
+        }));
+    }
+    let generationRoot;
+    try {
+        generationRoot = await createGenerationRoot(options.artifactRoot, roots.canonicalRoot);
+    }
+    catch (error) {
+        if (error instanceof EvePackagingError)
+            return blockedResult(error);
+        return blockedResult(new EvePackagingError({
+            code: "ROOT_INVALID",
+            subject: "artifactRoot",
+            reason: "The Eden-owned generation directory could not be prepared safely.",
+            remediation: "Use a new writable generation directory.",
+        }));
+    }
+    const snapshotRoot = join(generationRoot, "container/snapshot");
+    const inputManifestPath = join(generationRoot, "input-manifest.json");
+    const dockerfilePath = join(generationRoot, "container/Dockerfile");
+    const writtenPaths = [
+        generationRoot,
+        inputManifestPath,
+        snapshotRoot,
+    ];
+    const runtimeVariableNames = [...(options.runtimeConfig?.variableNames ?? [])]
+        .sort();
+    let buildResult;
+    const inputManifest = {
+        version: 1,
+        requestedRoot: roots.requestedRoot,
+        canonicalRoot: roots.canonicalRoot,
+        projectId: contract.projectId,
+        packageManager: "pnpm",
+        packageManagerVersion: contract.packageManagerVersion,
+        packageJsonSha256: contract.packageJsonSha256,
+        lockfileSha256: contract.lockfileSha256,
+        sourceDigest: initialInputs.sourceDigest,
+        files: initialInputs.files.map((file) => ({
+            relativePath: file.relativePath,
+            sha256: file.sha256,
+            byteLength: file.byteLength,
+            mode: file.mode,
+        })),
+        excludedRelativePaths: initialInputs.excludedRelativePaths,
+        ...(initialRuntimeInputIdentity === undefined
+            ? {}
+            : { runtimeConfigInputIdentity: initialRuntimeInputIdentity }),
+        runtimeVariableNames,
+    };
+    const discardBuiltCandidate = async () => {
+        if (buildResult === undefined || options.builder.discard === undefined) {
+            return undefined;
+        }
+        try {
+            await options.builder.discard(buildResult);
+        }
+        catch {
+            return new EvePackagingError({
+                code: "CLEANUP_UNVERIFIED",
+                subject: "candidate image",
+                reason: "The failed Eve candidate could not be removed with exact ownership proof.",
+                remediation: "Inspect the recorded candidate image identity before retrying; no broad Docker cleanup was attempted.",
+            });
+        }
+        buildResult = undefined;
+        return undefined;
+    };
+    try {
+        await mkdir(dirname(inputManifestPath), { recursive: true });
+        await mkdir(snapshotRoot, { recursive: true });
+        await writeJson(inputManifestPath, inputManifest);
+        await copySnapshot(snapshotRoot, initialInputs);
+        const afterCopyRace = await sourceRaceErrorIfChanged(roots.canonicalRoot, initialInputs, initialRuntimeInputIdentity, options.runtimeConfig, resolve(options.artifactRoot), roots.requestedRoot);
+        if (afterCopyRace !== undefined)
+            return blockedResult(afterCopyRace, { writtenPaths });
+        const nodeImage = options.nodeImage ?? options.builder.nodeImage;
+        let actualDockerfilePath;
+        if (nodeImage !== undefined) {
+            await writeDockerBuildFiles({
+                snapshotRoot,
+                dockerfilePath,
+                nodeImage,
+                packageManagerVersion: contract.packageManagerVersion,
+                lockfileSha256: contract.lockfileSha256,
+            });
+            actualDockerfilePath = dockerfilePath;
+            writtenPaths.push(dockerfilePath, join(snapshotRoot, ".dockerignore"));
+        }
+        buildResult = await options.builder.build({
+            generationRoot,
+            snapshotRoot,
+            inputManifestPath,
+            dockerfilePath: actualDockerfilePath,
+            packageManagerVersion: contract.packageManagerVersion,
+            installCommand: INSTALL_COMMAND,
+            buildCommand: BUILD_COMMAND,
+            platform: "linux/amd64",
+            sourceDigest: initialInputs.sourceDigest,
+            buildContext: "immutable-snapshot",
+        });
+        if (buildResult.imageId !== undefined &&
+            buildResult.imagePlatform !== "linux/amd64") {
+            throw new EvePackagingError({
+                code: "DOCKER_PLATFORM_BLOCKED",
+                subject: "linux/amd64 image",
+                reason: "The builder returned an image without verified linux/amd64 metadata.",
+                remediation: "Inspect the final image and return its verified Linux/amd64 identity.",
+            });
+        }
+        try {
+            await verifySnapshotInputs(snapshotRoot, initialInputs);
+        }
+        catch (error) {
+            const cleanupError = await discardBuiltCandidate();
+            if (cleanupError !== undefined)
+                return blockedResult(cleanupError, { writtenPaths });
+            if (error instanceof EvePackagingError) {
+                return blockedResult(error, { writtenPaths });
+            }
+            throw error;
+        }
+        const afterBuildRace = await sourceRaceErrorIfChanged(roots.canonicalRoot, initialInputs, initialRuntimeInputIdentity, options.runtimeConfig, resolve(options.artifactRoot), roots.requestedRoot);
+        if (afterBuildRace !== undefined) {
+            const cleanupError = await discardBuiltCandidate();
+            return blockedResult(cleanupError ?? afterBuildRace, { writtenPaths });
+        }
+        const snapshotLockfile = await readStableFile(join(snapshotRoot, "pnpm-lock.yaml"), snapshotRoot);
+        if (snapshotLockfile.sha256 !== contract.lockfileSha256 ||
+            !snapshotLockfile.bytes.equals(contract.lockfileBytes)) {
+            const dependencyError = new EvePackagingError({
+                code: "DEPENDENCY_AMBIGUITY",
+                subject: "pnpm-lock.yaml",
+                reason: "The frozen install changed the captured lockfile bytes.",
+                remediation: "Use the exact declared pnpm version with pnpm install --frozen-lockfile.",
+            });
+            const cleanupError = await discardBuiltCandidate();
+            return blockedResult(cleanupError ?? dependencyError, { writtenPaths });
+        }
+        const eve = await resolveProjectLocalEve(snapshotRoot);
+        const output = await scanGeneratedOutput(snapshotRoot);
+        await assertGeneratedTreesExcludeSecrets(snapshotRoot);
+        const snapshotSourceDigest = await snapshotDigest(snapshotRoot);
+        const runtimeManifestPath = join(generationRoot, "runtime-manifest.json");
+        await writeJson(runtimeManifestPath, {
+            version: 1,
+            generationId: basename(generationRoot),
+            packageManager: "pnpm",
+            packageManagerVersion: contract.packageManagerVersion,
+            installCommand: INSTALL_COMMAND,
+            buildCommand: BUILD_COMMAND,
+            startCommand: START_COMMAND,
+            sourceDigest: initialInputs.sourceDigest,
+            snapshotDigest: snapshotSourceDigest,
+            generatedOutput: output,
+            artifactPath: EVE_ENTRYPOINT,
+            platform: "linux/amd64",
+            runtimeVariableNames,
+        });
+        writtenPaths.push(runtimeManifestPath);
+        let image = null;
+        if (buildResult.imageId !== undefined) {
+            image = {
+                dockerfilePath: actualDockerfilePath ?? null,
+                platform: "linux/amd64",
+                builderImage: nodeImage === undefined
+                    ? null
+                    : `${nodeImage.reference}@${nodeImage.digest}`,
+                runtimeImage: nodeImage === undefined
+                    ? null
+                    : `${nodeImage.reference}@${nodeImage.digest}`,
+                imageId: buildResult.imageId,
+                imageReference: buildResult.imageReference ?? null,
+                imageDigest: buildResult.imageDigest ?? buildResult.imageId,
+                launchCommand: START_COMMAND,
+                workingDirectory: "/app",
+                hostEnvironment: HOST_ENVIRONMENT,
+                generatedOutput: output,
+            };
+        }
+        const snapshot = {
+            generationId: basename(generationRoot),
+            path: snapshotRoot,
+            sha256: snapshotSourceDigest,
+            includedFileCount: initialInputs.files.length,
+            excludedCategories: [...new Set(initialInputs.excludedRelativePaths.map((path) => isPathExcluded(path, undefined).category ?? "generated-state"))].sort(),
+            sourceRaceChecked: true,
+        };
+        if ((buildResult.imageId !== undefined &&
+            !/^sha256:[0-9a-f]{64}$/u.test(buildResult.imageId)) ||
+            (buildResult.imageId !== undefined &&
+                buildResult.imagePlatform !== "linux/amd64")) {
+            const imageError = new EvePackagingError({
+                code: "DOCKER_PLATFORM_BLOCKED",
+                subject: "linux/amd64 image",
+                reason: "The local Eve image metadata was present but did not include a verified Linux/amd64 identity.",
+                remediation: "Inspect the image identity or return the build candidate to the image-runtime worker.",
+            });
+            const cleanupError = await discardBuiltCandidate();
+            return blockedResult(cleanupError ?? imageError, { writtenPaths });
+        }
+        const project = {
+            requestedRoot: roots.requestedRoot,
+            canonicalRoot: roots.canonicalRoot,
+            projectId: contract.projectId,
+            packageJson: {
+                path: "package.json",
+                sha256: contract.packageJsonSha256,
+            },
+            lockfile: {
+                path: "pnpm-lock.yaml",
+                sha256: contract.lockfileSha256,
+            },
+            sourceDigest: initialInputs.sourceDigest,
+            inputManifestPath,
+        };
+        const candidate = {
+            generationId: basename(generationRoot),
+            generationRoot,
+            snapshotRoot,
+            inputManifestPath,
+            packageManager: "pnpm",
+            packageManagerVersion: contract.packageManagerVersion,
+            installCommand: INSTALL_COMMAND,
+            buildCommand: BUILD_COMMAND,
+            eveExecutable: "node_modules/.bin/eve",
+            eveVersion: eve.version,
+            packageJsonSha256: contract.packageJsonSha256,
+            lockfileSha256: contract.lockfileSha256,
+            sourceDigest: initialInputs.sourceDigest,
+            snapshotDigest: snapshotSourceDigest,
+            generatedOutput: output,
+            ...(initialRuntimeInputIdentity === undefined
+                ? {}
+                : { runtimeConfigInputIdentity: initialRuntimeInputIdentity }),
+            runtimeVariableNames,
+        };
+        const handoffRace = await sourceRaceErrorIfChanged(roots.canonicalRoot, initialInputs, initialRuntimeInputIdentity, options.runtimeConfig, resolve(options.artifactRoot), roots.requestedRoot);
+        if (handoffRace !== undefined) {
+            const cleanupError = await discardBuiltCandidate();
+            return blockedResult(cleanupError ?? handoffRace, { writtenPaths });
+        }
+        return {
+            schemaVersion: 1,
+            worker: "eve-packaging-worker",
+            operation: "local-package",
+            status: "ready",
+            returnCode: "EVE_PACKAGE_READY",
+            deployable: true,
+            project,
+            snapshot,
+            toolchain: {
+                nodeVersion: "24.17.0",
+                packageManager: "pnpm",
+                packageManagerVersion: contract.packageManagerVersion,
+                installCommand: INSTALL_COMMAND,
+                buildCommand: BUILD_COMMAND,
+                startCommand: START_COMMAND,
+                eveExecutable: eve.path,
+                eveVersion: eve.version,
+                lockfileUnchanged: true,
+                nativeBuildPlatform: "linux/amd64",
+            },
+            image,
+            candidate,
+            runtime: null,
+            secrets: {
+                runtimeVariableNames,
+                valuesRecorded: false,
+                excludedFromSnapshot: true,
+                excludedFromBuildEnvironment: true,
+                excludedFromDockerContext: true,
+                excludedFromImage: true,
+                excludedFromHistory: true,
+                excludedFromManifestsAndLogs: true,
+                redactionRegisteredBeforeChildren: options.runtimeConfig?.redactionRegistered ?? false,
+            },
+            checks: [
+                {
+                    id: "VAL-CLI-004",
+                    status: "pass",
+                    subject: "project-root",
+                    reason: "The explicit project root is canonical and readable.",
+                    remediation: null,
+                },
+                {
+                    id: "VAL-BUILD-001",
+                    status: "pass",
+                    subject: "package-manager",
+                    reason: "The exact pnpm pin and one matching regular root lockfile were verified.",
+                    remediation: null,
+                },
+                {
+                    id: "VAL-BUILD-002",
+                    status: "pass",
+                    subject: "frozen-install",
+                    reason: "The isolated builder was given the exact frozen install command.",
+                    remediation: null,
+                },
+                {
+                    id: "VAL-BUILD-003",
+                    status: "pass",
+                    subject: "immutable-snapshot",
+                    reason: "The build consumed one Eden-owned snapshot and source races were checked.",
+                    remediation: null,
+                },
+                {
+                    id: "VAL-BUILD-004",
+                    status: "pass",
+                    subject: "project-local-eve",
+                    reason: "The resolved Eve executable is inside the isolated project dependency tree.",
+                    remediation: null,
+                },
+            ],
+            candidateImageId: buildResult.imageId ?? null,
+            candidateImageRetainedLocally: buildResult.imageId !== undefined,
+            writtenPaths,
+            error: null,
+        };
+    }
+    catch (error) {
+        const cleanupError = await discardBuiltCandidate();
+        if (cleanupError !== undefined) {
+            return blockedResult(cleanupError, { writtenPaths });
+        }
+        if (error instanceof EvePackagingError) {
+            return blockedResult(error, { writtenPaths });
+        }
+        return blockedResult(new EvePackagingError({
+            code: "EVE_BUILD_FAILED",
+            subject: "eve build",
+            reason: "The project-local Eve build did not complete successfully.",
+            remediation: "Inspect the project-local Eve build in the isolated builder and retry after fixing it.",
+        }), { writtenPaths });
+    }
+}
+export async function revalidateEveProjectCandidateInputs(candidate, runtimeConfig) {
+    const fail = () => {
+        throw new EvePackagingError({
+            code: "SOURCE_RACE",
+            subject: "project inputs",
+            reason: "The selected Eve source, lockfile, configuration, or explicit environment identity changed after the candidate was built.",
+            remediation: "Discard the stale candidate and retry only after all selected inputs are quiescent.",
+        });
+    };
+    let manifestValue;
+    try {
+        manifestValue = JSON.parse(await readFile(candidate.inputManifestPath, "utf8"));
+    }
+    catch {
+        fail();
+    }
+    if (typeof manifestValue !== "object" ||
+        manifestValue === null ||
+        Array.isArray(manifestValue)) {
+        fail();
+    }
+    const manifest = manifestValue;
+    if (typeof manifest.requestedRoot !== "string" ||
+        typeof manifest.canonicalRoot !== "string" ||
+        typeof manifest.sourceDigest !== "string" ||
+        typeof manifest.packageJsonSha256 !== "string" ||
+        typeof manifest.lockfileSha256 !== "string") {
+        fail();
+    }
+    const requestedRoot = manifest.requestedRoot;
+    const canonicalRoot = manifest.canonicalRoot;
+    const sourceDigest = manifest.sourceDigest;
+    const packageJsonSha256 = manifest.packageJsonSha256;
+    const lockfileSha256 = manifest.lockfileSha256;
+    const requestedDetails = await lstat(requestedRoot).catch(() => undefined);
+    const requestedCanonical = await realpath(requestedRoot).catch(() => undefined);
+    if (requestedDetails === undefined ||
+        !requestedDetails.isDirectory() ||
+        requestedDetails.isSymbolicLink() ||
+        requestedCanonical !== canonicalRoot) {
+        fail();
+    }
+    const latestIdentity = await currentInputIdentity(runtimeConfig).catch(() => undefined);
+    const expectedIdentity = candidate.runtimeConfigInputIdentity;
+    if (latestIdentity !== expectedIdentity ||
+        (typeof manifest.runtimeConfigInputIdentity === "string" &&
+            latestIdentity !== manifest.runtimeConfigInputIdentity)) {
+        fail();
+    }
+    let latest;
+    try {
+        latest = await captureInputs(canonicalRoot, runtimeConfig, resolve(candidate.generationRoot), latestIdentity, requestedRoot);
+    }
+    catch {
+        fail();
+    }
+    const observedLatest = latest ?? fail();
+    const packageFile = observedLatest.files.find((file) => file.relativePath === "package.json");
+    const lockfile = observedLatest.files.find((file) => file.relativePath === "pnpm-lock.yaml");
+    if (packageFile === undefined ||
+        lockfile === undefined ||
+        packageFile.sha256 !== candidate.packageJsonSha256 ||
+        packageFile.sha256 !== packageJsonSha256 ||
+        lockfile.sha256 !== candidate.lockfileSha256 ||
+        lockfile.sha256 !== lockfileSha256 ||
+        observedLatest.sourceDigest !== candidate.sourceDigest ||
+        observedLatest.sourceDigest !== sourceDigest) {
+        fail();
+    }
+    let latestSnapshotDigest;
+    try {
+        latestSnapshotDigest = await snapshotDigest(candidate.snapshotRoot);
+    }
+    catch {
+        fail();
+    }
+    if (latestSnapshotDigest === undefined ||
+        latestSnapshotDigest !== candidate.snapshotDigest) {
+        fail();
+    }
+}
+async function dockerIdentityAbsent(dockerCommand, args, options) {
+    try {
+        const result = await execFileAsync(dockerCommand, [...args], options);
+        return result.stdout.trim().length === 0;
+    }
+    catch (error) {
+        const stderr = typeof error === "object" &&
+            error !== null &&
+            "stderr" in error &&
+            typeof error.stderr === "string"
+            ? error.stderr
+            : "";
+        return /(?:no such|not found|does not exist)/iu.test(stderr);
+    }
+}
+export function createDockerEveProjectBuilder(options) {
+    const dockerCommand = options.dockerCommand ?? "docker";
+    return {
+        nodeImage: options.nodeImage,
+        async build(request) {
+            if (request.dockerfilePath === undefined) {
+                throw new EvePackagingError({
+                    code: "DOCKER_PLATFORM_BLOCKED",
+                    subject: "Dockerfile",
+                    reason: "The isolated Docker builder requires a generated pinned Dockerfile.",
+                    remediation: "Supply a verified Node 24 image and use the generated packaging context.",
+                });
+            }
+            const imageIdFile = join(request.generationRoot, "image-id");
+            const safeEnv = {
+                PATH: process.env.PATH,
+                HOME: process.env.HOME,
+                TMPDIR: process.env.TMPDIR,
+                LANG: process.env.LANG,
+                LC_ALL: process.env.LC_ALL,
+                DOCKER_HOST: process.env.DOCKER_HOST,
+                DOCKER_CONTEXT: process.env.DOCKER_CONTEXT,
+            };
+            let containerId;
+            let imageBuilt = false;
+            let retainImage = false;
+            let builtImageId;
+            const cleanupOwnedResources = async () => {
+                let cleanupFailed = false;
+                if (containerId !== undefined) {
+                    await execFileAsync(dockerCommand, ["rm", "--force", containerId], { env: safeEnv, cwd: request.generationRoot }).catch(() => {
+                        cleanupFailed = true;
+                    });
+                    const containerAbsent = await dockerIdentityAbsent(dockerCommand, ["container", "inspect", containerId, "--format", "{{.Id}}"], { env: safeEnv, cwd: request.generationRoot });
+                    if (!containerAbsent) {
+                        cleanupFailed = true;
+                    }
+                }
+                if (imageBuilt && !retainImage && builtImageId === undefined) {
+                    cleanupFailed = true;
+                }
+                else if (imageBuilt && !retainImage && builtImageId !== undefined) {
+                    await execFileAsync(dockerCommand, ["image", "rm", "--force", builtImageId], { env: safeEnv, cwd: request.generationRoot }).catch(() => {
+                        cleanupFailed = true;
+                    });
+                    const imageAbsent = await dockerIdentityAbsent(dockerCommand, ["image", "inspect", builtImageId, "--format", "{{.Id}}"], { env: safeEnv, cwd: request.generationRoot });
+                    if (!imageAbsent) {
+                        cleanupFailed = true;
+                    }
+                }
+                return cleanupFailed;
+            };
+            try {
+                await execFileAsync(dockerCommand, ["version", "--format", "{{.Server.Version}}"], { env: safeEnv, cwd: request.generationRoot });
+                await execFileAsync(dockerCommand, [
+                    "build",
+                    "--platform=linux/amd64",
+                    "--file",
+                    request.dockerfilePath,
+                    "--iidfile",
+                    imageIdFile,
+                    request.snapshotRoot,
+                ], { env: safeEnv, cwd: request.generationRoot, maxBuffer: 1024 * 1024 });
+                imageBuilt = true;
+                builtImageId = (await readFile(imageIdFile, "utf8")).trim();
+                if (!/^sha256:[0-9a-f]{64}$/u.test(builtImageId)) {
+                    throw new EvePackagingError({
+                        code: "DOCKER_PLATFORM_BLOCKED",
+                        subject: "image identity",
+                        reason: "Docker did not return a verifiable immutable image identity.",
+                        remediation: "Use a BuildKit Docker/OrbStack builder that supports an iidfile.",
+                    });
+                }
+                const imageDetails = await execFileAsync(dockerCommand, [
+                    "image",
+                    "inspect",
+                    builtImageId,
+                    "--format",
+                    "{{.Id}} {{.Os}} {{.Architecture}}",
+                ], { env: safeEnv, cwd: request.generationRoot });
+                const [imageId, os, architecture] = imageDetails.stdout.trim().split(/\s+/u);
+                if (imageId === undefined ||
+                    imageId !== builtImageId ||
+                    os !== "linux" ||
+                    architecture !== "amd64") {
+                    throw new EvePackagingError({
+                        code: "DOCKER_PLATFORM_BLOCKED",
+                        subject: "linux/amd64 image",
+                        reason: "The built Eve image did not report the required Linux/amd64 platform.",
+                        remediation: "Use a Docker/OrbStack builder that can produce and run linux/amd64 images.",
+                    });
+                }
+                const created = await execFileAsync(dockerCommand, ["create", builtImageId], { env: safeEnv, cwd: request.generationRoot });
+                containerId = created.stdout.trim();
+                if (!/^[a-f0-9]+$/u.test(containerId)) {
+                    throw new EvePackagingError({
+                        code: "DOCKER_PLATFORM_BLOCKED",
+                        subject: "build container",
+                        reason: "The isolated Eve build container identity could not be verified.",
+                        remediation: "Retry with a Docker daemon that returns a stable container identity.",
+                    });
+                }
+                await execFileAsync(dockerCommand, ["cp", `${containerId}:/app/.output`, join(request.snapshotRoot, ".output")], { env: safeEnv, cwd: request.generationRoot });
+                await execFileAsync(dockerCommand, ["cp", `${containerId}:/app/node_modules`, join(request.snapshotRoot, "node_modules")], { env: safeEnv, cwd: request.generationRoot });
+                const result = {
+                    imageId: builtImageId,
+                    imagePlatform: "linux/amd64",
+                    imageReference: builtImageId,
+                    imageDigest: builtImageId,
+                };
+                retainImage = true;
+                if (await cleanupOwnedResources()) {
+                    throw new EvePackagingError({
+                        code: "CLEANUP_UNVERIFIED",
+                        subject: "Docker build resources",
+                        reason: "Owned Docker cleanup could not be verified after the Eve build attempt.",
+                        remediation: "Inspect only the recorded container identity before retrying; no broad Docker cleanup was attempted.",
+                    });
+                }
+                return result;
+            }
+            catch (error) {
+                if (await cleanupOwnedResources()) {
+                    throw new EvePackagingError({
+                        code: "CLEANUP_UNVERIFIED",
+                        subject: "Docker build resources",
+                        reason: "Owned Docker cleanup could not be verified after the Eve build attempt.",
+                        remediation: "Inspect only the recorded image and container identities before retrying; no broad Docker cleanup was attempted.",
+                    });
+                }
+                if (error instanceof EvePackagingError)
+                    throw error;
+                throw classifyDockerBuildFailure(error);
+            }
+        },
+        async discard(result) {
+            const imageReference = result.imageReference;
+            if (imageReference === undefined)
+                return;
+            const safeEnv = {
+                PATH: process.env.PATH,
+                HOME: process.env.HOME,
+                TMPDIR: process.env.TMPDIR,
+                LANG: process.env.LANG,
+                LC_ALL: process.env.LC_ALL,
+                DOCKER_HOST: process.env.DOCKER_HOST,
+                DOCKER_CONTEXT: process.env.DOCKER_CONTEXT,
+            };
+            await execFileAsync(dockerCommand, ["image", "rm", "--force", imageReference], { env: safeEnv });
+            const remainingImage = await execFileAsync(dockerCommand, ["image", "inspect", imageReference, "--format", "{{.Id}}"], { env: safeEnv }).catch(() => undefined);
+            if (remainingImage !== undefined && remainingImage.stdout.trim().length > 0) {
+                throw new EvePackagingError({
+                    code: "CLEANUP_UNVERIFIED",
+                    subject: imageReference,
+                    reason: "The failed Eve image remained after exact cleanup.",
+                    remediation: "Inspect the exact image identity manually; do not run broad Docker cleanup.",
+                });
+            }
+        },
+    };
+}
+//# sourceMappingURL=eve-packaging.js.map