@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/release/attest.js

@@ -0,0 +1,199 @@
+/**
+ * What a stack measured about a release, after it was carrying it.
+ *
+ * Some checks cannot run in a clean clone. Revocation, token binding, the
+ * paywall, a dead-drop location — these exercise a DEPLOYED system, and
+ * there is nowhere to run them before a stack is carrying the release. So
+ * they are attached to the pair (release, stack) rather than to the build,
+ * and production asks for them by name: `verifiedOn` in a stack's release
+ * policy is «another stack ran these against this release and they passed».
+ *
+ * The producer lives in the project (`scripts/attest.mjs` in sample) and
+ * prints one JSON object as its last line, in the same five outcome words
+ * the gates use. This file is the receiving half: it decides whether the
+ * object is about the release and the stack it claims, and refuses in the
+ * four ways it can be wrong.
+ *
+ * Refusing rather than storing-and-warning is the point. An attestation that
+ * is kept is later read as evidence by `decideStackRelease`, which cannot
+ * re-examine where it came from; everything that makes it trustworthy has to
+ * be decided here, once, at the door.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { releasesRoot } from './load.js';
+/** The producer's five words, and nothing else. */
+const OUTCOMES = {
+    passed: 'passed',
+    failed: 'failed',
+    'timed-out': 'timed-out',
+    killed: 'killed',
+    'not-run': 'not-run',
+};
+/** The producer's `cleanup`, keeping only what has the shape above. */
+export function cleanupOf(raw) {
+    if (!raw || typeof raw !== 'object')
+        return undefined;
+    const c = raw;
+    if (!('run' in c) || (c['run'] !== null && typeof c['run'] !== 'string'))
+        return undefined;
+    const counts = (x) => x && typeof x === 'object'
+        ? Object.fromEntries(Object.entries(x).filter((e) => typeof e[1] === 'number' && Number.isFinite(e[1])))
+        : undefined;
+    const removed = counts(c['removed']);
+    const retired = counts(c['retired']);
+    const leftBehind = Array.isArray(c['leftBehind'])
+        ? c['leftBehind']
+            .filter((l) => !!l && typeof l === 'object')
+            .map((l) => ({ what: String(l.what), why: Array.isArray(l.why) ? l.why.map(String) : [] }))
+        : undefined;
+    return {
+        run: c['run'],
+        ...(removed ? { removed } : {}),
+        ...(retired ? { retired } : {}),
+        ...(leftBehind ? { leftBehind } : {}),
+        ...(typeof c['failed'] === 'string' ? { failed: c['failed'] } : {}),
+        ...(typeof c['notRun'] === 'string' ? { notRun: c['notRun'] } : {}),
+    };
+}
+/**
+ * The last JSON object on stdout, as the gates' reader takes it.
+ *
+ * One object, one line, and the human words go to stderr — the same contract
+ * `gates.mjs --json` keeps, so both readers can be wrong in only one way.
+ */
+export function parseAttestation(stdout) {
+    const lines = stdout.split('\n').map((l) => l.trim()).filter(Boolean);
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i];
+        if (!line.startsWith('{'))
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (parsed && typeof parsed === 'object')
+                return parsed;
+        }
+        catch {
+            continue;
+        }
+    }
+    throw new Error('The attestation printed no JSON object on its last line — nothing was measured, so nothing is stored');
+}
+/**
+ * How much of a probe's own output is kept: the END of it, where a probe
+ * says what it found. Enough for a table of findings; not a log.
+ */
+export const OUTPUT_TAIL_CHARS = 4096;
+/** A probe's outcome, with an unrecognised word recorded as not-run and named. */
+function outcomeOf(probe) {
+    const name = String(probe['name'] ?? '(unnamed)');
+    const word = String(probe['outcome'] ?? '');
+    const status = OUTCOMES[word];
+    const detail = typeof probe['detail'] === 'string' ? probe['detail'] : undefined;
+    const ms = typeof probe['ms'] === 'number' ? probe['ms'] : undefined;
+    const printed = typeof probe['output'] === 'string' ? probe['output'].trimEnd() : '';
+    const output = printed.length > OUTPUT_TAIL_CHARS ? `…${printed.slice(-OUTPUT_TAIL_CHARS)}` : printed;
+    return {
+        name,
+        status: status ?? 'not-run',
+        ...(status ? (detail ? { detail } : {}) : { detail: `unrecognised outcome '${word}'${detail ? ` — ${detail}` : ''}` }),
+        ...(output ? { output } : {}),
+        ...(ms !== undefined ? { durationMs: ms } : {}),
+    };
+}
+/**
+ * Take one attestation for a release, or say why not.
+ *
+ * Four refusals, each naming what was wrong:
+ *   - it is about another stack, or another release;
+ *   - the producer claimed it ran on the node and could not confirm it —
+ *     `onNode.matched === false` means the addresses it saw are not the
+ *     stack's, so what it measured was somebody's laptop;
+ *   - it finished before the deployment it claims to be about;
+ *   - it carries no probes at all.
+ */
+export async function storeAttestation(releaseId, stack, stdout, options = {}) {
+    const root = options.root ?? releasesRoot();
+    const dir = path.join(root, releaseId);
+    if (!fs.existsSync(path.join(dir, 'manifest.json'))) {
+        throw new Error(`No release '${releaseId}' on this machine — there is nothing for an attestation to be about`);
+    }
+    const raw = parseAttestation(stdout);
+    if (typeof raw.stack !== 'string' || raw.stack !== stack) {
+        throw new Error(`Refusing this attestation: it is about stack '${String(raw.stack ?? '(none named)')}' and was offered for '${stack}'`);
+    }
+    if (raw.release !== undefined && raw.release !== null && raw.release !== releaseId) {
+        throw new Error(`Refusing this attestation: it names release '${String(raw.release)}' and was offered for '${releaseId}'. ` +
+            `An attestation is about one build; what it measured was not this one.`);
+    }
+    if (!Array.isArray(raw.probes) || raw.probes.length === 0) {
+        throw new Error('Refusing this attestation: it carries no probes, so it measured nothing');
+    }
+    const claimed = raw.onNode?.claimed === true;
+    const matched = typeof raw.onNode?.matched === 'boolean' ? raw.onNode.matched : null;
+    const hosts = Array.isArray(raw.onNode?.hosts) ? raw.onNode.hosts.map(String) : [];
+    if (claimed && matched === false) {
+        throw new Error(`Refusing this attestation: it was produced with --on-node and the producer could not confirm it ran on one — ` +
+            `the addresses it saw (${hosts.join(', ') || 'none'}) are not the stack's. On --on-node the probes reach ` +
+            `localhost and the stack's containers, so run elsewhere they measured the machine they ran on.`);
+    }
+    const at = typeof raw.at === 'string' ? raw.at : new Date().toISOString();
+    if (options.deployedAt && Date.parse(at) < Date.parse(options.deployedAt)) {
+        throw new Error(`Refusing this attestation: it finished ${at}, and ${stack} last took this release ${options.deployedAt} — ` +
+            `it measured a system that has since been replaced.`);
+    }
+    const gates = raw.probes.map(outcomeOf);
+    const cleanup = cleanupOf(raw.cleanup);
+    const attestation = {
+        stack,
+        release: releaseId,
+        gates,
+        at,
+        onNode: { claimed, hosts, matched },
+        storedAt: new Date().toISOString(),
+        ...(cleanup ? { cleanup } : {}),
+        ...(typeof raw.legalTextsUnread === 'string' ? { legalTextsUnread: raw.legalTextsUnread } : {}),
+    };
+    const target = path.join(dir, 'attestations');
+    fs.mkdirSync(target, { recursive: true });
+    // The stack names the file: one attestation per stack, and a newer run
+    // replaces an older one — the question is «what does test say about this
+    // release NOW», not «what did it once say».
+    const file = path.join(target, `${stack.replace(/[^A-Za-z0-9._-]/g, '_')}.json`);
+    fs.writeFileSync(file, `${JSON.stringify(attestation, null, 2)}\n`);
+    return { path: file, attestation };
+}
+/**
+ * Every attestation stored for a release.
+ *
+ * Read by `admitRelease` and handed to `decideStackRelease` as its fourth
+ * argument — the one that was always `[]` until something started writing
+ * these, which is why a stack declaring `verifiedOn` refused every release
+ * forever.
+ */
+export function loadAttestations(releaseId, root = releasesRoot()) {
+    const dir = path.join(root, releaseId, 'attestations');
+    let names;
+    try {
+        names = fs.readdirSync(dir).filter((n) => n.endsWith('.json'));
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of names) {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8'));
+            // A file that does not name this release is not read as evidence for
+            // it, whatever its name says — the same rule the door applied.
+            if (parsed?.release === releaseId && typeof parsed.stack === 'string' && Array.isArray(parsed.gates)) {
+                out.push(parsed);
+            }
+        }
+        catch {
+            // Unreadable: absent, which is a refusal rather than a pass.
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=attest.js.map

package/dist/release/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../src/release/attest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,mDAAmD;AACnD,MAAM,QAAQ,GAA0C;IACtD,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,WAAW;IACxB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,SAAS;CACrB,CAAC;AAuDF,uEAAuE;AACvE,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3F,MAAM,MAAM,GAAG,CAAC,CAAU,EAAsC,EAAE,CAChE,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QACxB,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,EAAyB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAChF,CACF;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC,CAAE,CAAC,CAAC,YAAY,CAAe;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAwC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;aACjF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,GAAG,EAAE,CAAC,CAAC,KAAK,CAAkB;QAC9B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;YAClD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;AAC1H,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAEtC,kFAAkF;AAClF,SAAS,SAAS,CAAC,KAA8B;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACtG,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,MAAM,IAAI,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACtH,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,KAAa,EACb,MAAc,EACd,OAAO,GAAkB,EAAE;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,eAAe,SAAS,qEAAqE,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAErC,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,cAAc,CAAC,0BAA0B,KAAK,GAAG,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,0BAA0B,SAAS,KAAK;YACzG,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,IAAI,OAAO,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,+GAA+G;YAC7G,yBAAyB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,uDAAuD;YAC1G,+FAA+F,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1E,IAAI,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CACb,0CAA0C,EAAE,SAAS,KAAK,2BAA2B,OAAO,CAAC,UAAU,KAAK;YAC1G,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAI,GAAG,CAAC,MAAyC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,WAAW,GAAsB;QACrC,KAAK;QACL,OAAO,EAAE,SAAS;QAClB,KAAK;QACL,EAAE;QACF,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;QACnC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC9C,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,uEAAuE;IACvE,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACjF,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,IAAI,GAAW,YAAY,EAAE;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAsB,CAAC;YAC9F,qEAAqE;YACrE,+DAA+D;YAC/D,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/release/build-run.d.ts

@@ -0,0 +1,151 @@
+/**
+ * Building a release, without a terminal.
+ *
+ * The work is the same whoever asked for it — the CLI, or the console through
+ * the daemon — and it takes fifteen minutes, so it reports where it is rather
+ * than going quiet. `commands/release.ts` turns these phases into lines;
+ * `services/release.rpc-service.ts` keeps the last one per build and serves it
+ * to the console, which is how an operator watching a browser tab sees the
+ * same thing an operator watching a terminal does.
+ *
+ * What a release IS, and why it is built from clean clones of two commits, is
+ * in `release/manifest.ts` and `release/layout.ts`.
+ */
+import type { GateOutcome, ReleaseManifest } from './manifest.js';
+export interface ReleaseBuildOptions {
+    /** The project commit to build; default: the project checkout's HEAD. */
+    projectCommit?: string;
+    /** The omni commit to build; default: the omni checkout's HEAD. */
+    omniCommit?: string;
+    /** Keep the clones after a successful build. */
+    keepSource?: boolean;
+    /** Record every gate as not-run instead of running them — for a look, never for a stack. */
+    skipGates?: boolean;
+    /**
+     * Build the static bundle this stack's gateway serves, with this stack's
+     * `staticEnv`, into the release. A frontend bakes its environment in, so the
+     * bundle belongs to a stack; a stack that serves one refuses a release
+     * without it.
+     */
+    forStack?: string;
+    /**
+     * Extra environment for every step.
+     *
+     * The gates need what the developer's shell had — sample's want
+     * `TEST_DATABASE__PORT` — and a daemon started by launchd has none of it.
+     * Only `[A-Z][A-Z0-9_]*` names are taken, and never one that changes what
+     * an interpreter LOADS (`PATH`, `NODE_OPTIONS`, `LD_PRELOAD`…): a build
+     * request is permission to build this project, not to run something else
+     * as the daemon's user.
+     */
+    env?: Record<string, string>;
+    /** Stop the build: the running step's process group is ended. */
+    signal?: AbortSignal;
+}
+/**
+ * The caller's environment, checked.
+ *
+ * Refuses rather than dropping: a gate that needed `TEST_DATABASE__PORT` and
+ * silently did not get it fails fifteen minutes later with a database error,
+ * and the operator has no way to see that the variable never arrived.
+ */
+export declare function checkedEnv(env: Record<string, string> | undefined): Record<string, string>;
+/** Where a build has got to. One sentence, one number, and the time. */
+export interface BuildPhase {
+    readonly phase: string;
+    readonly percent: number;
+    readonly at: string;
+    /** Known once the commits are resolved. */
+    readonly releaseId?: string;
+    /** Filled the moment the gates answer, so the console can show them running. */
+    readonly gates?: readonly GateOutcome[];
+}
+export interface BuildOutcome {
+    readonly id: string;
+    readonly root: string;
+    readonly manifestPath: string;
+    readonly manifest: ReleaseManifest;
+    readonly durationMs: number;
+}
+/** The omnitron doing the packing, by version and the checkout it runs from. */
+export declare function ownIdentity(): Promise<string>;
+/**
+ * The PATH a build runs with.
+ *
+ * A daemon started by launchd inherits the SYSTEM path — six directories,
+ * none of them pnpm's. pnpm installs itself into `PNPM_HOME`
+ * (`~/Library/pnpm` on macOS, `~/.local/share/pnpm` under XDG), which is on
+ * the developer's shell PATH and on nobody else's; corepack's shims sit
+ * beside the running node. The daemon runs as the SAME USER, so the tool is
+ * on the machine and only the PATH is narrower — measured on this master,
+ * where the console's Build button was disabled with «pnpm is not on the
+ * daemon's PATH» while `pnpm` worked in every terminal on it.
+ *
+ * Appended, never prepended: a `pnpm` the operator put on the PATH
+ * deliberately still wins over one this function guessed at.
+ */
+export declare function buildEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * The programs a build spawns, found on the PATH it will use.
+ *
+ * A daemon started by launchd inherits a PATH of four directories, and
+ * `pnpm` is in none of them. Without this the build would clone for a minute
+ * and then die with `spawn pnpm ENOENT` at step two — true, and no help at
+ * all about WHERE it looked. Checked before anything is cloned, named
+ * together rather than one per attempt.
+ */
+export declare function missingTools(env: NodeJS.ProcessEnv, tools?: readonly string[]): string[];
+/**
+ * Build a release, reporting each phase.
+ *
+ * Throws with the failing step's words and the log that holds the rest.
+ *
+ * The build root (`src/`: both clones with their `node_modules`, about 2 GB)
+ * goes when the build ends however it ends — passed, failed, or stopped —
+ * unless `--keep-source`. It used to stay after a throw «because a failed
+ * build is evidence»; nothing ever removed it after that, and on 2026-09-25
+ * six of them held 12 GB on a disk at 100 % whose fsyncs had reached 29 s.
+ * The evidence is the logs, which stay; the clones are two commits anyone
+ * can check out again, and `--keep-source` keeps them for the one who wants
+ * to look inside.
+ */
+export declare function runReleaseBuild(projectName: string, options: ReleaseBuildOptions, onPhase?: (phase: BuildPhase) => void): Promise<BuildOutcome>;
+/**
+ * Run `build`; if it throws once it has named its release root, take that
+ * root's `src/` with it — unless the caller keeps it. The logs beside it
+ * stay. A build that throws before it has a root has nothing to take.
+ *
+ * The children's temporary directory (`where.tmp`, see `makeBuildTempDir`)
+ * goes however the build ends, `--keep-source` or not: it is what the tools
+ * under the gates left, not the commits being built.
+ */
+export declare function withBuildRootGoneOnFailure<T>(keepSource: boolean | undefined, build: (where: {
+    root?: string;
+    tmp?: string;
+}) => Promise<T>): Promise<T>;
+/**
+ * The system's own temporary directory — the one the system clears by
+ * itself — whatever TMPDIR this process was started with.
+ */
+export declare function systemTempRoot(platform?: NodeJS.Platform): string;
+/**
+ * A temporary directory for everything a build runs: TMPDIR for every step.
+ *
+ * Test runners, and the tools under them, write into TMPDIR and do not always
+ * take it back. vitest 5.0.0 left `$TMPDIR/<nanoid>/ssr` behind on EVERY run
+ * (patched in omni and sample since), and a gate killed at its timeout cleans
+ * nothing at all. The master's TMPDIR is `~/.tmp`, which nothing clears:
+ * measured 2026-09-29, 16 443 of those directories, 112 GB, from every suite
+ * and every release gate since 2026-09-11 — and the Docker engine stopped
+ * with the disk at 99 %.
+ *
+ * So a build gives its children a directory of its own and removes it when it
+ * ends, however it ends (`withBuildRootGoneOnFailure`). It is made under the
+ * system's own temporary directory, not TMPDIR, because a build whose process
+ * is killed outright runs no cleanup, and its files must not stay for good
+ * either. And it is short on purpose: a unix socket's path is limited to 104
+ * bytes on macOS, tests make sockets under TMPDIR, and the build root's own
+ * path is already longer than half of that.
+ */
+export declare function makeBuildTempDir(root?: string): string;
+//# sourceMappingURL=build-run.d.ts.map

package/dist/release/build-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-run.d.ts","sourceRoot":"","sources":["../../src/release/build-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAiB,MAAM,eAAe,CAAC;AAKjF,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAkBD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa1F;AAED,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAsID,gFAAgF;AAChF,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAanD;AAwED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAwBlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,GAAE,SAAS,MAAM,EAA4B,GAAG,MAAM,EAAE,CAajH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAe,GAC9C,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAAC,CAAC,EAChD,UAAU,EAAE,OAAO,GAAG,SAAS,EAC/B,KAAK,EAAE,CAAC,KAAK,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5D,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,CAEnF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAyB,GAAG,MAAM,CAExE"}