@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/release/builder.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The decisions of a release build that do not need a disk.
+ *
+ * `commands/release.ts` clones, installs, runs and packs; everything it then
+ * has to CONCLUDE — what the release is called, what each gate said, what
+ * the manifest records — is here, where it can be checked without a
+ * forty-minute build.
+ */
+import type { GateOutcome, ReleaseManifest, ReleaseSource } from './manifest.js';
+/** `daos-202609221432-81c8a074-c64963f6`: what, when (UTC), from which two commits. */
+export declare function releaseId(project: string, at: Date, projectCommit: string, omniCommit: string): string;
+/**
+ * What the gates said, from `gates.mjs --json`.
+ *
+ * The script prints one JSON object as its last line. No such line is not
+ * "no gates failed" — it is one outcome, `not-run`, under the name `gates`,
+ * with the reason; a release that then requires any gate is refused by its
+ * absence. An outcome word this does not know is `not-run` too, named in the
+ * detail: a status nobody recognises must not read as a pass.
+ */
+export declare function gateOutcomesFromGates(stdout: string, exitCode: number | null): GateOutcome[];
+export interface ManifestInput {
+    readonly id: string;
+    readonly project: ReleaseSource;
+    readonly omni: ReleaseSource;
+    readonly artifacts: ReadonlyArray<{
+        app: string;
+        version: string;
+        tarballSha256?: string;
+        size: number;
+        checksum?: string;
+    }>;
+    readonly artifactFailures: ReadonlyArray<{
+        app: string;
+        error: string;
+    }>;
+    readonly gates: readonly GateOutcome[];
+    readonly omnitron: string;
+    readonly packages: ReadonlyArray<{
+        name: string;
+        distBuiltAt: string;
+    }>;
+    readonly machine?: ReleaseManifest['machine'];
+    readonly builtAt: Date;
+    readonly builtBy: string;
+    readonly statics?: ReleaseManifest['statics'];
+    readonly migrations?: ReleaseManifest['migrations'];
+}
+/**
+ * The manifest, from what the build produced.
+ *
+ * An artifact without a tarball checksum is not dropped and not given a
+ * made-up one: its sha256 is written empty, and `decideRelease` refuses it
+ * by name — "carries no usable checksum" — which is the truth about it.
+ */
+export declare function assembleManifest(input: ManifestInput): ReleaseManifest;
+//# sourceMappingURL=builder.d.ts.map

package/dist/release/builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/release/builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAmB,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAElG,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGtG;AAmBD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,EAAE,CAgD5F;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7H,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAsBtE"}

package/dist/release/builder.js

@@ -0,0 +1,120 @@
+/**
+ * The decisions of a release build that do not need a disk.
+ *
+ * `commands/release.ts` clones, installs, runs and packs; everything it then
+ * has to CONCLUDE — what the release is called, what each gate said, what
+ * the manifest records — is here, where it can be checked without a
+ * forty-minute build.
+ */
+/** `daos-202609221432-81c8a074-c64963f6`: what, when (UTC), from which two commits. */
+export function releaseId(project, at, projectCommit, omniCommit) {
+    const stamp = at.toISOString().replace(/[-:T]/g, '').slice(0, 12);
+    return `${project}-${stamp}-${projectCommit.slice(0, 8)}-${omniCommit.slice(0, 8)}`;
+}
+const OUTCOMES = {
+    passed: 'passed',
+    failed: 'failed',
+    'timed-out': 'timed-out',
+    killed: 'killed',
+    'not-run': 'not-run',
+};
+/** The mark `gates.mjs` prints on each gate's own line as it lands. */
+const MARKS = {
+    PASS: 'passed',
+    FAIL: 'failed',
+    TIME: 'timed-out',
+    KILL: 'killed',
+    NRUN: 'not-run',
+};
+/**
+ * What the gates said, from `gates.mjs --json`.
+ *
+ * The script prints one JSON object as its last line. No such line is not
+ * "no gates failed" — it is one outcome, `not-run`, under the name `gates`,
+ * with the reason; a release that then requires any gate is refused by its
+ * absence. An outcome word this does not know is `not-run` too, named in the
+ * detail: a status nobody recognises must not read as a pass.
+ */
+export function gateOutcomesFromGates(stdout, exitCode) {
+    const lines = stdout.split('\n').map((l) => l.trim()).filter(Boolean);
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i];
+        if (!line.startsWith('{'))
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!parsed || !Array.isArray(parsed.gates))
+            continue;
+        return parsed.gates.map((g) => {
+            const name = String(g['name'] ?? '(unnamed)');
+            const word = String(g['outcome'] ?? '');
+            const status = OUTCOMES[word];
+            const detail = typeof g['detail'] === 'string' ? g['detail'] : undefined;
+            const ms = typeof g['ms'] === 'number' ? g['ms'] : undefined;
+            return {
+                name,
+                status: status ?? 'not-run',
+                ...(status ? (detail ? { detail } : {}) : { detail: `unrecognised outcome '${word}'${detail ? ` — ${detail}` : ''}` }),
+                ...(ms !== undefined ? { durationMs: ms } : {}),
+            };
+        });
+    }
+    // No result object: the script was stopped, or died, before its last line.
+    // The verdicts that had landed are still in their own lines — `PASS  scans
+    // 138s  69 of 69` — and a tally over nothing but the missing object said
+    // «gates: 0 of 1 passed» of two builds stopped on 2026-09-25 after six and
+    // seven gates had reported. They are kept; the missing result stays a
+    // `not-run` of its own, so what landed never reads as the whole run.
+    const landed = [];
+    for (const line of lines) {
+        const m = /^(PASS|FAIL|TIME|KILL|NRUN)\s+(\S+)\s+(\d+)s(?:\s+(.*))?$/.exec(line);
+        if (!m)
+            continue;
+        landed.push({ name: m[2], status: MARKS[m[1]], durationMs: Number(m[3]) * 1000, ...(m[4] ? { detail: m[4] } : {}) });
+    }
+    return [
+        ...landed,
+        {
+            name: 'gates',
+            status: 'not-run',
+            detail: `the gates script printed no result object (exit ${exitCode === null ? 'by signal' : exitCode})` +
+                (landed.length > 0 ? `; ${landed.length} gate(s) had reported before it did` : ''),
+        },
+    ];
+}
+/**
+ * The manifest, from what the build produced.
+ *
+ * An artifact without a tarball checksum is not dropped and not given a
+ * made-up one: its sha256 is written empty, and `decideRelease` refuses it
+ * by name — "carries no usable checksum" — which is the truth about it.
+ */
+export function assembleManifest(input) {
+    const artifacts = input.artifacts.map((a) => ({
+        app: a.app,
+        version: a.version,
+        sha256: a.tarballSha256 ?? '',
+        bytes: a.size,
+        ...(a.checksum ? { inputs: a.checksum } : {}),
+    }));
+    return {
+        id: input.id,
+        project: input.project,
+        omni: input.omni,
+        artifacts,
+        ...(input.artifactFailures.length > 0 ? { artifactFailures: input.artifactFailures } : {}),
+        gates: input.gates,
+        ...(input.machine ? { machine: input.machine } : {}),
+        builtWith: { omnitron: input.omnitron, packages: input.packages },
+        builtAt: input.builtAt.toISOString(),
+        builtBy: input.builtBy,
+        ...(input.statics ? { statics: input.statics } : {}),
+        ...(input.migrations ? { migrations: input.migrations } : {}),
+    };
+}
+//# sourceMappingURL=builder.js.map

package/dist/release/builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../src/release/builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,EAAQ,EAAE,aAAqB,EAAE,UAAkB;IAC5F,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,GAAG,OAAO,IAAI,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,QAAQ,GAA0C;IACtD,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,WAAW;IACxB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,SAAS;CACrB,CAAC;AAEF,uEAAuE;AACvE,MAAM,KAAK,GAA0C;IACnD,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,QAAuB;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,IAAI,MAAkC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,SAAS;QACtD,OAAQ,MAAM,CAAC,KAAwC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM,IAAI,SAAS;gBAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;gBACtH,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,2DAA2D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,CAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO;QACL,GAAG,MAAM;QACT;YACE,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,SAAS;YACjB,MAAM,EACJ,mDAAmD,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,GAAG;gBAChG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,qCAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF;KACF,CAAC;AACJ,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAoB;IACnD,MAAM,SAAS,GAAsB,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,aAAa,IAAI,EAAE;QAC7B,KAAK,EAAE,CAAC,CAAC,IAAI;QACb,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS;QACT,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;QACjE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC"}

package/dist/release/daemon-omni.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The omni a deployed application runs.
+ *
+ * A release carries its omni packages — `vendor/*.tgz`, built from the omni
+ * commit its gates ran against — and the node sets them aside: after
+ * `npm install`, the remote deployer links every `@omnitron-dev/*` of the
+ * application to the node DAEMON's own (step 5a in `remote-deployer.service`),
+ * because the application is loaded into the daemon's process and titan has
+ * to be one physical copy there. So the omni an application runs is the
+ * daemon's, whatever the release says.
+ *
+ * On daos/test (2026-09-25) a release gated on omni de454a80 ran under a
+ * daemon built from 311bddb1: the two titan fixes it was built to ship were
+ * not there, the scheduler went on skipping the fires the release had fixed,
+ * and its attestation vouched for code the node was not running.
+ *
+ * Admission therefore asks each node's daemon which omni it was built from,
+ * and a release goes only where that is the release's own.
+ */
+/** What one node's daemon said about itself. */
+export interface DaemonAnswer {
+    readonly host: string;
+    /** `OmnitronDaemon.ping().version`, or null when the node did not answer. */
+    readonly version: string | null;
+    readonly error?: string;
+}
+/**
+ * The omni commit a daemon's version names: `0.2.0+local.<sha>.<stamp>` (see
+ * `localVersion`) → `<sha>`. Null when it names none — a version from a
+ * registry, or a bundle built outside a repository (`nocommit`).
+ */
+export declare function commitOfDaemonVersion(version: string | null | undefined): string | null;
+/**
+ * Why a release gated on `releaseOmni` may not run under these daemons — or
+ * null when every one of them was built from that commit.
+ *
+ * A node that did not answer is a refusal, not a pass: what it runs is exactly
+ * what cannot be vouched for.
+ */
+export declare function refuseForeignOmni(releaseOmni: string, daemons: readonly DaemonAnswer[]): string | null;
+//# sourceMappingURL=daemon-omni.d.ts.map

package/dist/release/daemon-omni.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-omni.d.ts","sourceRoot":"","sources":["../../src/release/daemon-omni.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGvF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAsBtG"}

package/dist/release/daemon-omni.js

@@ -0,0 +1,59 @@
+/**
+ * The omni a deployed application runs.
+ *
+ * A release carries its omni packages — `vendor/*.tgz`, built from the omni
+ * commit its gates ran against — and the node sets them aside: after
+ * `npm install`, the remote deployer links every `@omnitron-dev/*` of the
+ * application to the node DAEMON's own (step 5a in `remote-deployer.service`),
+ * because the application is loaded into the daemon's process and titan has
+ * to be one physical copy there. So the omni an application runs is the
+ * daemon's, whatever the release says.
+ *
+ * On daos/test (2026-09-25) a release gated on omni de454a80 ran under a
+ * daemon built from 311bddb1: the two titan fixes it was built to ship were
+ * not there, the scheduler went on skipping the fires the release had fixed,
+ * and its attestation vouched for code the node was not running.
+ *
+ * Admission therefore asks each node's daemon which omni it was built from,
+ * and a release goes only where that is the release's own.
+ */
+/**
+ * The omni commit a daemon's version names: `0.2.0+local.<sha>.<stamp>` (see
+ * `localVersion`) → `<sha>`. Null when it names none — a version from a
+ * registry, or a bundle built outside a repository (`nocommit`).
+ */
+export function commitOfDaemonVersion(version) {
+    const m = /\+local\.([0-9a-f]{7,40})\.\d+$/i.exec(version ?? '');
+    return m ? m[1].toLowerCase() : null;
+}
+/**
+ * Why a release gated on `releaseOmni` may not run under these daemons — or
+ * null when every one of them was built from that commit.
+ *
+ * A node that did not answer is a refusal, not a pass: what it runs is exactly
+ * what cannot be vouched for.
+ */
+export function refuseForeignOmni(releaseOmni, daemons) {
+    const wanted = releaseOmni.toLowerCase();
+    const reasons = [];
+    for (const d of daemons) {
+        if (d.error !== undefined || d.version === null) {
+            reasons.push(`${d.host} did not say which omni its daemon runs${d.error ? ` (${d.error})` : ''}`);
+            continue;
+        }
+        const sha = commitOfDaemonVersion(d.version);
+        if (!sha) {
+            reasons.push(`${d.host}'s daemon ${d.version} names no omni commit`);
+        }
+        else if (!wanted.startsWith(sha)) {
+            reasons.push(`${d.host}'s daemon runs omni ${sha.slice(0, 8)} (${d.version})`);
+        }
+    }
+    if (reasons.length === 0)
+        return null;
+    const short = wanted.slice(0, 8);
+    return (`${reasons.join('; ')} — an application on a node loads the daemon's @omnitron-dev packages, not the ` +
+        `release's, and this release was gated on omni ${short}. Upgrade the node from omni ${short} ` +
+        `(\`omnitron fleet upgrade <node>\`), or build the release with \`--omni-commit\` set to the daemon's`);
+}
+//# sourceMappingURL=daemon-omni.js.map

package/dist/release/daemon-omni.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-omni.js","sourceRoot":"","sources":["../../src/release/daemon-omni.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAUH;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAkC;IACtE,MAAM,CAAC,GAAG,kCAAkC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,OAAgC;IACrF,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,0CAA0C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,OAAO,uBAAuB,CAAC,CAAC;QACvE,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,uBAAuB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,OAAO,CACL,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iFAAiF;QACtG,iDAAiD,KAAK,gCAAgC,KAAK,GAAG;QAC9F,sGAAsG,CACvG,CAAC;AACJ,CAAC"}

package/dist/release/definition-inputs.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The files a deployment reads from the project's working tree.
+ *
+ * A release carries its artifacts; the stack DEFINITION — which apps, which
+ * infrastructure, what each app declares it needs — is still read from the
+ * project directory on the master. So admission refused a release unless the
+ * whole working tree equalled its commit: on 2026-09-24 every deployment of
+ * daos/test froze the shared checkout for three sessions, and a colleague's
+ * edit to a file no deployment reads twice sent a release back to its build.
+ *
+ * What the definition actually reads is knowable:
+ *   - `omnitron.config.*` and every file it imports relatively — the config
+ *     loader bundles exactly that graph;
+ *   - each app's bootstrap and every file IT imports relatively — the
+ *     bootstrap loader bundles exactly that graph (non-relative imports stay
+ *     external, as they do there);
+ *   - `omnitron.stacks.json`, read by path;
+ *   - each app's `config/*.json`, read by path (`default.json`'s `omnitron`
+ *     section is what the master reads; the rest are included so a config
+ *     edit never passes unseen);
+ *   - each directory the deployment ships to its nodes (`shippedDirsOf`) —
+ *     the gateway's nginx tree, a service's scripts — whole: a directory is a
+ *     pathspec to git, so every file under it is compared.
+ * Machine-local files the config reads by path are gitignored, and so are not
+ * the commit's business either way.
+ *
+ * The graph is taken from the working tree. A change that alters the graph
+ * — an import added or removed — changes a file already in it, so it is seen.
+ */
+/** Paths relative to the project root, sorted, each once. */
+export declare function definitionInputs(projectPath: string, bootstraps: readonly string[], 
+/** Directories shipped to nodes, as declared — relative to the project, or absolute. */
+shipped?: readonly string[]): Promise<string[]>;
+//# sourceMappingURL=definition-inputs.d.ts.map

package/dist/release/definition-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition-inputs.d.ts","sourceRoot":"","sources":["../../src/release/definition-inputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAOH,6DAA6D;AAC7D,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,SAAS,MAAM,EAAE;AAC7B,wFAAwF;AACxF,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC,CAqDnB"}

package/dist/release/definition-inputs.js

@@ -0,0 +1,90 @@
+/**
+ * The files a deployment reads from the project's working tree.
+ *
+ * A release carries its artifacts; the stack DEFINITION — which apps, which
+ * infrastructure, what each app declares it needs — is still read from the
+ * project directory on the master. So admission refused a release unless the
+ * whole working tree equalled its commit: on 2026-09-24 every deployment of
+ * daos/test froze the shared checkout for three sessions, and a colleague's
+ * edit to a file no deployment reads twice sent a release back to its build.
+ *
+ * What the definition actually reads is knowable:
+ *   - `omnitron.config.*` and every file it imports relatively — the config
+ *     loader bundles exactly that graph;
+ *   - each app's bootstrap and every file IT imports relatively — the
+ *     bootstrap loader bundles exactly that graph (non-relative imports stay
+ *     external, as they do there);
+ *   - `omnitron.stacks.json`, read by path;
+ *   - each app's `config/*.json`, read by path (`default.json`'s `omnitron`
+ *     section is what the master reads; the rest are included so a config
+ *     edit never passes unseen);
+ *   - each directory the deployment ships to its nodes (`shippedDirsOf`) —
+ *     the gateway's nginx tree, a service's scripts — whole: a directory is a
+ *     pathspec to git, so every file under it is compared.
+ * Machine-local files the config reads by path are gitignored, and so are not
+ * the commit's business either way.
+ *
+ * The graph is taken from the working tree. A change that alters the graph
+ * — an import added or removed — changes a file already in it, so it is seen.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { CONFIG_FILE_NAMES } from '../config/loader.js';
+/** Paths relative to the project root, sorted, each once. */
+export async function definitionInputs(projectPath, bootstraps, 
+/** Directories shipped to nodes, as declared — relative to the project, or absolute. */
+shipped = []) {
+    const root = fs.realpathSync(projectPath);
+    const configFile = CONFIG_FILE_NAMES.map((name) => path.join(root, name)).find((p) => fs.existsSync(p));
+    const entries = [
+        ...(configFile ? [configFile] : []),
+        ...bootstraps.map((b) => path.resolve(root, b)),
+    ];
+    if (entries.length === 0)
+        return [];
+    for (const entry of entries) {
+        if (!fs.existsSync(entry))
+            throw new Error(`a definition entry is missing from the working tree: ${path.relative(root, entry)}`);
+    }
+    const esbuild = await import('esbuild');
+    const result = await esbuild.build({
+        entryPoints: entries,
+        absWorkingDir: root,
+        bundle: true,
+        write: false,
+        metafile: true,
+        outdir: path.join(root, '.omnitron-definition-inputs'),
+        platform: 'node',
+        format: 'esm',
+        target: 'node22',
+        logLevel: 'silent',
+        plugins: [
+            {
+                name: 'externalize-non-relative',
+                setup(build) {
+                    build.onResolve({ filter: /^[^./]/ }, (args) => ({ path: args.path, external: true }));
+                },
+            },
+        ],
+    });
+    const inputs = new Set(Object.keys(result.metafile.inputs).map((p) => path.normalize(p)));
+    const stacksFile = path.join(root, 'omnitron.stacks.json');
+    if (fs.existsSync(stacksFile))
+        inputs.add('omnitron.stacks.json');
+    for (const bootstrap of bootstraps) {
+        const configDir = path.join(path.resolve(path.dirname(path.resolve(root, bootstrap)), '..'), 'config');
+        let names = [];
+        try {
+            names = fs.readdirSync(configDir).filter((n) => n.endsWith('.json'));
+        }
+        catch {
+            // An app without a config directory declares nothing by path.
+        }
+        for (const name of names)
+            inputs.add(path.relative(root, path.join(configDir, name)));
+    }
+    for (const dir of shipped)
+        inputs.add(path.relative(root, path.resolve(root, dir)));
+    return [...inputs].filter((p) => p !== '' && !p.startsWith('..') && !path.isAbsolute(p)).sort();
+}
+//# sourceMappingURL=definition-inputs.js.map

package/dist/release/definition-inputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition-inputs.js","sourceRoot":"","sources":["../../src/release/definition-inputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,UAA6B;AAC7B,wFAAwF;AACxF,OAAO,GAAsB,EAAE;IAE/B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;KAChD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;QACjC,WAAW,EAAE,OAAO;QACpB,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC;QACtD,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,0BAA0B;gBAChC,KAAK,CAAC,KAAK;oBACT,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACzF,CAAC;aACF;SACF;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAElG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAElE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvG,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,OAAO;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAEpF,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClG,CAAC"}

package/dist/release/delivered.d.ts

@@ -0,0 +1,53 @@
+/**
+ * What arrived on the node, checked against what was sent.
+ *
+ * The remote deployment scp's a tarball and unpacks it on the next line.
+ * There is a `.artifact-sha256` beside it that reads like the missing check
+ * and is not one: it records `artifact.checksum`, the hash of the build
+ * INPUTS — the app's sources plus its vendored dependencies — so the NEXT
+ * deployment can tell whether it has anything to do. It is written after the
+ * unpack, and it is compared against the next build's inputs rather than
+ * against the bytes on disk. Nothing, anywhere, asks whether the file that
+ * landed is the file that left.
+ *
+ * TWO NUMBERS, not one. A zero-length file with the right sum is impossible;
+ * a truncated one with the wrong sum is ordinary, and «sha mismatch» alone
+ * does not say whether anything arrived at all. `release/manifest.ts` states
+ * the rule for a release artifact; this is where it meets the only moment the
+ * bytes actually cross a machine boundary.
+ *
+ * AND THE CHECK MUST BE ABLE TO RUN. `sha256sum` is coreutils, `shasum` is
+ * perl, and a node can have either or neither. A probe that cannot compute
+ * the sum REFUSES: an unverifiable transfer is the thing this exists to
+ * catch, not an exemption from it.
+ */
+/** What the master knows about the file it sent. */
+export interface ExpectedDelivery {
+    readonly sha256: string;
+    readonly bytes: number;
+}
+/** What the node was able to say about the file it has. */
+export interface DeliveredProbe {
+    readonly sha256: string | null;
+    readonly bytes: number | null;
+}
+export type DeliveryVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    because: string;
+};
+/**
+ * Ask the node for the sum and the size of one file, in that order, one per
+ * line.
+ *
+ * Both tools print `<hash>  <path>`; `cut` takes the hash. Neither present
+ * means the first line is empty, which `parseDeliveredProbe` reports as «no
+ * sum» rather than as a sum of nothing. `wc -c <` rather than `wc -c` so the
+ * output is the number alone.
+ */
+export declare function deliveredProbeCommand(remoteFile: string): string;
+/** Read the two lines back, tolerating a node that printed the whole tool line. */
+export declare function parseDeliveredProbe(stdout: string): DeliveredProbe;
+export declare function checkDelivered(expected: ExpectedDelivery, delivered: DeliveredProbe): DeliveryVerdict;
+//# sourceMappingURL=delivered.d.ts.map

package/dist/release/delivered.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivered.d.ts","sourceRoot":"","sources":["../../src/release/delivered.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAO5E;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAQhE;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAWlE;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,GAAG,eAAe,CA+BrG"}

package/dist/release/delivered.js

@@ -0,0 +1,81 @@
+/**
+ * What arrived on the node, checked against what was sent.
+ *
+ * The remote deployment scp's a tarball and unpacks it on the next line.
+ * There is a `.artifact-sha256` beside it that reads like the missing check
+ * and is not one: it records `artifact.checksum`, the hash of the build
+ * INPUTS — the app's sources plus its vendored dependencies — so the NEXT
+ * deployment can tell whether it has anything to do. It is written after the
+ * unpack, and it is compared against the next build's inputs rather than
+ * against the bytes on disk. Nothing, anywhere, asks whether the file that
+ * landed is the file that left.
+ *
+ * TWO NUMBERS, not one. A zero-length file with the right sum is impossible;
+ * a truncated one with the wrong sum is ordinary, and «sha mismatch» alone
+ * does not say whether anything arrived at all. `release/manifest.ts` states
+ * the rule for a release artifact; this is where it meets the only moment the
+ * bytes actually cross a machine boundary.
+ *
+ * AND THE CHECK MUST BE ABLE TO RUN. `sha256sum` is coreutils, `shasum` is
+ * perl, and a node can have either or neither. A probe that cannot compute
+ * the sum REFUSES: an unverifiable transfer is the thing this exists to
+ * catch, not an exemption from it.
+ */
+/** Escape for use inside a single-quoted shell argument. */
+function quote(s) {
+    return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+/**
+ * Ask the node for the sum and the size of one file, in that order, one per
+ * line.
+ *
+ * Both tools print `<hash>  <path>`; `cut` takes the hash. Neither present
+ * means the first line is empty, which `parseDeliveredProbe` reports as «no
+ * sum» rather than as a sum of nothing. `wc -c <` rather than `wc -c` so the
+ * output is the number alone.
+ */
+export function deliveredProbeCommand(remoteFile) {
+    const f = quote(remoteFile);
+    return (`if command -v sha256sum >/dev/null 2>&1; then sha256sum ${f} | cut -d' ' -f1; ` +
+        `elif command -v shasum >/dev/null 2>&1; then shasum -a 256 ${f} | cut -d' ' -f1; ` +
+        `else echo ''; fi; ` +
+        `wc -c < ${f} 2>/dev/null || echo ''`);
+}
+/** Read the two lines back, tolerating a node that printed the whole tool line. */
+export function parseDeliveredProbe(stdout) {
+    const lines = stdout.split('\n').map((l) => l.trim());
+    const sumLine = lines.find((l) => /^[0-9a-f]{64}\b/.test(l));
+    const sha256 = sumLine ? (sumLine.match(/^[0-9a-f]{64}/)?.[0] ?? null) : null;
+    // The size is a line that is only digits. Taken from the END, because the
+    // sum line can carry a path with digits in it.
+    const sizeLine = [...lines].reverse().find((l) => /^\d+$/.test(l));
+    const bytes = sizeLine === undefined ? null : Number(sizeLine);
+    return { sha256, bytes };
+}
+export function checkDelivered(expected, delivered) {
+    // Said first, because everything below assumes there are numbers to
+    // compare. A node that cannot answer is not a node whose file is fine.
+    if (!delivered.sha256) {
+        return {
+            ok: false,
+            because: `the node could not compute a sha256 for the artifact — neither sha256sum nor shasum ` +
+                `answered, so the transfer cannot be verified (expected ${expected.sha256}, ` +
+                `${expected.bytes} bytes)`,
+        };
+    }
+    if (delivered.sha256 === expected.sha256 && delivered.bytes === expected.bytes) {
+        return { ok: true };
+    }
+    // Both numbers in the refusal. The size is what says «a link dropped
+    // partway» as against «a different file entirely», and the operator
+    // reads the difference, not the sum.
+    const size = delivered.bytes === null
+        ? 'the node reported no size'
+        : `${delivered.bytes} bytes arrived of ${expected.bytes}`;
+    return {
+        ok: false,
+        because: `the artifact on the node is not the one that was sent: ${size}; ` +
+            `expected sha256 ${expected.sha256}, got ${delivered.sha256}`,
+    };
+}
+//# sourceMappingURL=delivered.js.map

package/dist/release/delivered.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivered.js","sourceRoot":"","sources":["../../src/release/delivered.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAgBH,4DAA4D;AAC5D,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5B,OAAO,CACL,2DAA2D,CAAC,oBAAoB;QAChF,8DAA8D,CAAC,oBAAoB;QACnF,oBAAoB;QACpB,WAAW,CAAC,yBAAyB,CACtC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9E,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAA0B,EAAE,SAAyB;IAClF,oEAAoE;IACpE,uEAAuE;IACvE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,sFAAsF;gBACtF,0DAA0D,QAAQ,CAAC,MAAM,IAAI;gBAC7E,GAAG,QAAQ,CAAC,KAAK,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,qCAAqC;IACrC,MAAM,IAAI,GACR,SAAS,CAAC,KAAK,KAAK,IAAI;QACtB,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,qBAAqB,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EACL,0DAA0D,IAAI,IAAI;YAClE,mBAAmB,QAAQ,CAAC,MAAM,SAAS,SAAS,CAAC,MAAM,EAAE;KAChE,CAAC;AACJ,CAAC"}

package/dist/release/layout.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Where a release is built, so the lockfile's links land on the omni clone.
+ *
+ * Until the registry migration the project declares every omni package as a
+ * `link:` to a checkout on the developer's disk, and the lockfile records it
+ * RELATIVE to each importer — `link:../../luxquant/omnitron-dev/omni/apps/omnitron`
+ * from the project root. `pnpm install --frozen-lockfile` follows that
+ * relative path. So a clean clone of the project placed anywhere else either
+ * links nothing (measured 2026-09-22: 97 of 97 links dangling, install exit 0)
+ * or, placed at the same depth as the working checkout, links the DEVELOPER'S
+ * omni — dirty tree and all — into a build that claims to be a commit.
+ *
+ * A release is therefore built inside a root that reproduces the relative
+ * layout, with a clean clone of omni exactly where the links point. The
+ * layout is read from the lockfile rather than written down here, because the
+ * lockfile is what pnpm will follow.
+ */
+export interface LinkLayout {
+    /** omni's checkout relative to the project root, as the lockfile implies it. */
+    readonly omniRel: string;
+    /** How many directories above the project root the links climb. */
+    readonly climbs: number;
+    /** The omni workspace directories the project links, relative to omni's root. */
+    readonly linkedDirs: readonly string[];
+}
+/**
+ * Read the layout the lockfile implies, or say why there is none.
+ *
+ * A link that leaves the project root is an omni link; its target minus the
+ * trailing `packages/<name>` or `apps/<name>` is omni's root. All of them
+ * must agree on that root: links into two outside checkouts cannot be laid
+ * out by one clone, and guessing which one is "omni" would build from the
+ * wrong one.
+ */
+export declare function readLinkLayout(lockfile: string): LinkLayout | {
+    refusal: string;
+};
+/**
+ * The two checkouts inside `srcRoot`: the project where its own last
+ * `climbs` path segments put it, and omni where its links then land.
+ */
+export declare function planBuildRoot(srcRoot: string, projectPath: string, layout: LinkLayout): {
+    projectDir: string;
+    omniDir: string;
+} | {
+    refusal: string;
+};
+/**
+ * The project's real directory and the omni checkout its links point to.
+ *
+ * From the REAL path, because that is where pnpm resolves a relative link
+ * from. The registry holds `omni/internal/daos`, a symlink to
+ * `~/projects/dao/daos`; resolved from the symlink, `../../luxquant/…` named
+ * a directory that does not exist, and the first `git` run there failed with
+ * a bare `spawn git ENOENT`.
+ */
+export declare function resolveCheckouts(projectPath: string, layout: LinkLayout): {
+    projectReal: string;
+    omniPath: string;
+};
+//# sourceMappingURL=layout.d.ts.map