@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/release/registry-framework.js

@@ -0,0 +1,279 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createGunzip } from 'node:zlib';
+import { Readable, Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { sha256File } from './portable-archive.js';
+import { list } from 'tar';
+import { parseBuildStamp } from '../shared/build-stamp.js';
+import { parseFrameworkSource } from '../shared/framework-source.js';
+import { checkoutFrameworkSource, defaultFrameworkSource, frameworkRepositoryLocation } from './framework-source.js';
+import { sourcePublication } from './source.js';
+import { withRegistryArchive } from './registry-transport.js';
+import { resolveInstalledDependency } from './package-resolution.js';
+const CORE = '@omnitron-dev/omnitron';
+const SHA = /^[a-f0-9]{40}$/;
+const packageName = (name) => /^(?:@[\w.-]+\/)?[\w.-]+$/.test(name) &&
+    name.split('/').every(part => !part.startsWith('.'));
+/** Standard npm bundle placement. Code directories cannot introduce a second
+ * dependency installation hidden below a package's publication surface. */
+function archiveSurface(relative) {
+    const parts = relative.split('/');
+    let end = 0, name;
+    while (parts[end] === 'node_modules') {
+        const first = parts[++end];
+        name = first?.startsWith('@') ? first + '/' + parts[++end] : first;
+        if (!name || !packageName(name))
+            throw Error('Invalid bundled package path: ' + relative);
+        end++;
+    }
+    const file = parts.slice(end).join('/');
+    if (!file || parts.slice(end).includes('node_modules'))
+        throw Error('Invalid bundled package surface: ' + relative);
+    return { directory: parts.slice(0, end).join('/'), file, ...(name && { name }) };
+}
+function archiveManifest(bytes, label) {
+    const value = JSON.parse(bytes?.toString('utf8') ?? '{}');
+    if (!value || typeof value.name !== 'string' || !packageName(value.name) || typeof value.version !== 'string' || !value.version)
+        throw Error('Missing or invalid package metadata: ' + label);
+    for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
+        const dependencies = value[field];
+        if (dependencies !== undefined && (!dependencies || typeof dependencies !== 'object' || Array.isArray(dependencies) ||
+            Object.entries(dependencies).some(([name, range]) => !packageName(name) || typeof range !== 'string')))
+            throw Error('Invalid package dependency metadata: ' + label);
+    }
+    return value;
+}
+/** Bind each included package to a declared edge, retaining npm's hoisted or
+ * nested resolution. The same edges can later point into a portable closure. */
+function archiveNodes(files, records, metadata) {
+    const nodes = new Map();
+    const manifests = new Map([['', metadata]]);
+    for (const [relative, evidence] of files) {
+        const { directory, file, name } = archiveSurface(relative);
+        if (!nodes.has(directory)) {
+            nodes.set(directory, { files: new Map(), dependencies: new Map() });
+            if (directory) {
+                if (nodes.size > 4096)
+                    throw Error('Bundled graph exceeds 4096 packages');
+                const manifest = archiveManifest(records.get(directory + '/package.json'), directory);
+                if (manifest.name !== name)
+                    throw Error('Bundled package identity differs from its path: ' + directory);
+                manifests.set(directory, manifest);
+            }
+        }
+        nodes.get(directory).files.set(file, evidence);
+    }
+    const declaration = metadata.bundledDependencies ?? metadata.bundleDependencies ?? [];
+    if (metadata.bundledDependencies !== undefined && metadata.bundleDependencies !== undefined)
+        throw Error('Use only one bundled dependency declaration');
+    const declared = declaration === true ? Object.keys({ ...metadata.dependencies, ...metadata.optionalDependencies })
+        : declaration === false ? [] : declaration;
+    if (!Array.isArray(declared) || new Set(declared).size !== declared.length || declared.some(name => typeof name !== 'string' || !packageName(name) ||
+        !Object.hasOwn({ ...metadata.dependencies, ...metadata.optionalDependencies }, name)))
+        throw Error('Invalid bundled dependency declaration');
+    const resolve = (directory, name) => {
+        let current = directory || '.';
+        while (true) {
+            const candidate = path.posix.join(current, 'node_modules', name);
+            if (path.posix.basename(current) !== 'node_modules' && nodes.has(candidate))
+                return candidate;
+            const parent = path.posix.dirname(current);
+            if (parent === current)
+                return undefined;
+            current = parent;
+        }
+    };
+    const visited = new Set();
+    const visit = (directory, names) => {
+        visited.add(directory);
+        for (const name of names) {
+            const target = resolve(directory, name);
+            if (target === undefined) {
+                if (!directory)
+                    throw Error('Declared bundled dependency is missing: ' + name);
+                continue; // An unbundled dependency remains part of the installed graph.
+            }
+            nodes.get(directory).dependencies.set(name, target);
+            if (visited.has(target))
+                continue;
+            const manifest = manifests.get(target);
+            visit(target, Object.keys({ ...manifest.dependencies, ...manifest.optionalDependencies, ...manifest.peerDependencies }));
+        }
+    };
+    visit('', declared);
+    if (visited.size !== nodes.size)
+        throw Error('Archive contains an undeclared bundled package');
+    // npm and pnpm mark declared binaries executable during installation.
+    for (const [directory, manifest] of manifests) {
+        const bins = typeof manifest.bin === 'string' ? [manifest.bin] : Object.values(manifest.bin ?? {});
+        for (const bin of bins) {
+            if (typeof bin !== 'string')
+                throw Error('Invalid package binary metadata: ' + directory);
+            const file = nodes.get(directory).files.get(bin.replace(/^\.\//, ''));
+            if (file)
+                file.executable = true;
+        }
+    }
+    return nodes;
+}
+function limitedBytes(maximum, digest) {
+    let total = 0;
+    return new Transform({ transform(chunk, _encoding, next) {
+            total += chunk.length;
+            if (total > maximum)
+                next(Error('Framework archive exceeds the byte limit'));
+            else {
+                digest?.update(chunk);
+                next(null, chunk);
+            }
+        } });
+}
+/** Hash the compressed archive as received. Stream its contents without
+ * extracting paths to disk or executing package lifecycle scripts. */
+async function registryArchive(pkg, options) {
+    return withRegistryArchive(pkg, options, (input, signal) => inspectFrameworkArchive(pkg, input, signal));
+}
+/** Compare the exact compressed bytes and record the installed file tree. A
+ * reproduced commit is supplied only after building a clean upstream checkout. */
+export async function inspectFrameworkArchive(pkg, input, signal, reproducedCommit) {
+    const label = pkg.name + '@' + pkg.version;
+    const archiveHash = createHash('sha512');
+    const files = new Map();
+    const records = new Map();
+    const seen = new Set();
+    const tar = list({ strict: true, onReadEntry(entry) {
+            if (entry.type === 'Directory')
+                return;
+            const relative = entry.path.slice('package/'.length);
+            if (entry.type !== 'File' || !entry.path.startsWith('package/') || relative.includes('\\') ||
+                relative.split('/').some(part => !part || part === '.' || part === '..') ||
+                seen.has(relative) || seen.size >= 50_000) {
+                tar.abort(Error('Unexpected or duplicate npm archive entry in ' + label + ': ' + entry.path));
+                return;
+            }
+            seen.add(relative);
+            let surface;
+            try {
+                surface = archiveSurface(relative);
+            }
+            catch (error) {
+                tar.abort(error);
+                return;
+            }
+            const hash = createHash('sha256');
+            const metadataEntry = surface.file === 'package.json' || relative === 'dist/BUILD.json';
+            if (metadataEntry && entry.size > 1024 * 1024) {
+                tar.abort(Error('Oversized package metadata: ' + label));
+                return;
+            }
+            const chunks = [];
+            entry.on('data', (chunk) => { hash.update(chunk); if (metadataEntry)
+                chunks.push(chunk); });
+            entry.on('end', () => {
+                files.set(relative, { digest: hash.digest('hex'), size: entry.size, executable: Boolean((entry.mode ?? 0) & 0o111) });
+                if (metadataEntry)
+                    records.set(relative, Buffer.concat(chunks));
+            });
+        } });
+    await pipeline(input, limitedBytes(64 * 1024 * 1024, archiveHash), createGunzip(), limitedBytes(256 * 1024 * 1024), tar, { signal });
+    if ('sha512-' + archiveHash.digest('base64') !== pkg.integrity)
+        throw Error('Framework archive differs from the committed SHA-512: ' + label);
+    const metadata = archiveManifest(records.get('package.json'), label);
+    if (metadata?.name !== pkg.name || metadata.version !== pkg.version)
+        throw Error('Framework archive name or version differs from the lockfile: ' + label);
+    const commit = reproducedCommit ?? metadata.gitHead;
+    if (typeof commit !== 'string' || !SHA.test(commit))
+        throw Error('No exact source commit in the npm archive for ' + label + '; use a release with a packed gitHead or a linked checkout');
+    if (metadata.gitHead !== undefined && metadata.gitHead !== commit)
+        throw Error('Framework archive names a different Git commit: ' + label);
+    if (pkg.name === CORE) {
+        const stamp = parseBuildStamp(JSON.parse(records.get('dist/BUILD.json')?.toString('utf8') ?? 'null'));
+        if (stamp?.commit !== commit || stamp.dirty !== false || stamp.timeBasis !== 'source')
+            throw Error('The Omnitron build stamp does not confirm its clean release commit: ' + label);
+    }
+    const nodes = archiveNodes(files, records, metadata);
+    return { commit, files, nodes, ...(metadata.repository !== undefined && { repository: metadata.repository }) };
+}
+/** Compare real files in the installation or staged artifact with the archive.
+ * Its node_modules edges are checked separately by the closure graph. */
+async function verifyTree(root, files) {
+    let count = 0;
+    async function visit(subdir) {
+        for (const item of await fs.readdir(path.join(root, subdir), { withFileTypes: true })) {
+            if (!subdir && item.name === 'node_modules')
+                continue;
+            const name = path.posix.join(subdir, item.name);
+            if (item.isDirectory()) {
+                await visit(name);
+                continue;
+            }
+            const expected = files.get(name), location = path.join(root, name);
+            const stat = await fs.lstat(location);
+            if (!stat.isFile() || !expected || stat.size !== expected.size ||
+                (process.platform !== 'win32' && Boolean(stat.mode & 0o111) !== expected.executable) ||
+                await sha256File(location) !== expected.digest)
+                throw Error('Installed framework file differs from its verified archive: ' + location);
+            count++;
+        }
+    }
+    await visit('');
+    if (count !== files.size)
+        throw Error('Installed framework is missing files from its verified archive: ' + root);
+}
+export async function resolveRegistryFramework(packages, options) {
+    const verified = new Map();
+    let commit;
+    for (const pkg of packages) {
+        const archive = await registryArchive(pkg, options);
+        if (commit && archive.commit !== commit)
+            throw Error('Registry framework packages were built from different commits: ' + pkg.name);
+        commit = archive.commit;
+        verified.set(pkg.name, archive);
+    }
+    if (!commit || !verified.has(CORE))
+        throw Error('The lockfile lacks an attested Omnitron package');
+    if (options.requestedCommit !== undefined && options.requestedCommit !== commit)
+        throw Error('--omni-commit must match the full registry source commit ' + commit);
+    const selected = options.frameworkSource !== undefined ? parseFrameworkSource(options.frameworkSource) : defaultFrameworkSource(verified.get(CORE).repository);
+    options.sourcePhase?.(selected, commit);
+    let source;
+    if (selected.ref) {
+        source = await checkoutFrameworkSource(path.join(options.scratch, 'source-proof'), {
+            source: selected, commit, sourceBase: options.sourceBase, env: options.env, run: options.run,
+            ...(options.signal && { signal: options.signal }),
+        });
+    }
+    else {
+        source = { repo: selected.repository, commit, onRemote: await sourcePublication(options.checkout, frameworkRepositoryLocation(selected.repository, options.sourceBase), commit, { ...(options.signal && { signal: options.signal }) }) };
+    }
+    return verifiedFramework({ ...source, registry: { packages } }, verified);
+}
+export function verifiedFramework(source, verified) {
+    return {
+        source,
+        async verifyPackage(name, directory) {
+            const evidence = verified.get(name);
+            if (!evidence)
+                throw Error('Framework package is absent from the verified framework lock: ' + name);
+            const visited = new Set();
+            const verify = async (installed, packed) => {
+                const real = await fs.realpath(installed), identity = packed + '\0' + real;
+                if (visited.has(identity))
+                    return;
+                visited.add(identity);
+                const node = evidence.nodes.get(packed);
+                await verifyTree(real, node.files);
+                for (const [dependency, target] of node.dependencies) {
+                    const resolved = await resolveInstalledDependency(real, dependency);
+                    if (!resolved)
+                        throw Error('Installed bundled dependency is missing: ' + dependency);
+                    await verify(resolved, target);
+                }
+            };
+            await verify(directory, '');
+        },
+    };
+}
+//# sourceMappingURL=registry-framework.js.map

package/dist/release/registry-framework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-framework.js","sourceRoot":"","sources":["../../src/release/registry-framework.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAG3D,OAAO,EAAE,oBAAoB,EAAwB,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,2BAA2B,EAAsB,MAAM,uBAAuB,CAAC;AACzI,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAiC,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,IAAI,GAAG,wBAAwB,CAAC;AACtC,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAS7B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAEvD;2EAC2E;AAC3E,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,EAAE,IAAwB,CAAC;IACtC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACnE,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,gCAAgC,GAAG,QAAQ,CAAC,CAAC;QAC1F,GAAG,EAAE,CAAC;IACR,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,MAAM,KAAK,CAAC,mCAAmC,GAAG,QAAQ,CAAC,CAAC;IACpH,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAoB,CAAC;IAC7E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;QAC7H,MAAM,KAAK,CAAC,uCAAuC,GAAG,KAAK,CAAC,CAAC;IAC/D,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,CAAU,EAAE,CAAC;QAC1F,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YAC/G,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;YACxG,MAAM,KAAK,CAAC,uCAAuC,GAAG,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;gFACgF;AAChF,SAAS,YAAY,CAAC,KAAgC,EAAE,OAA4B,EAAE,QAAyB;IAC7G,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,CAA0B,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QACzC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACpE,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI;oBAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBAC1E,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,eAAe,CAAC,EAAE,SAAS,CAAC,CAAC;gBACtF,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;oBAAE,MAAM,KAAK,CAAC,kDAAkD,GAAG,SAAS,CAAC,CAAC;gBACxG,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,mBAAmB,IAAI,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACtF,IAAI,QAAQ,CAAC,mBAAmB,KAAK,SAAS,IAAI,QAAQ,CAAC,kBAAkB,KAAK,SAAS;QACzF,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACjH,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjG,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAC9C,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACrF,MAAM,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAsB,EAAE;QACtE,IAAI,OAAO,GAAG,SAAS,IAAI,GAAG,CAAC;QAC/B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,cAAc,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YACzC,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAE,KAAe,EAAE,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,SAAS;oBAAE,MAAM,KAAK,CAAC,0CAA0C,GAAG,IAAI,CAAC,CAAC;gBAC/E,SAAS,CAAC,+DAA+D;YAC3E,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,SAAS;YAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;YACxC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,oBAAoB,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACpB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/F,sEAAsE;IACtE,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACnG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC,mCAAmC,GAAG,SAAS,CAAC,CAAC;YAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YACvE,IAAI,IAAI;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAMD,SAAS,YAAY,CAAC,OAAe,EAAE,MAAsC;IAC3E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,SAAS,CAAC,EAAE,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,IAAI;YAC7D,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,OAAO;gBAAE,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;iBACxE,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC,EAAE,CAAC,CAAC;AACP,CAAC;AAED;sEACsE;AACtE,KAAK,UAAU,eAAe,CAAC,GAAoB,EAAE,OAAiC;IACpF,OAAO,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED;kFACkF;AAClF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAoB,EAAE,KAAe,EAAE,MAAoB,EAAE,gBAAyB;IAEtF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;IAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK;YAChD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO;YACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACtF,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;gBACxE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,+CAA+C,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAC,OAAO;YACxG,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnB,IAAI,OAA0C,CAAC;YAC/C,IAAI,CAAC;gBAAC,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;YAC3C,OAAO,KAAK,EAAE,CAAC;gBAAC,GAAG,CAAC,KAAK,CAAC,KAAc,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACpD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,QAAQ,KAAK,iBAAiB,CAAC;YACxF,IAAI,aAAa,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,8BAA8B,GAAG,KAAK,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACpH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,aAAa;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpG,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACnB,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtH,IAAI,aAAa;oBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,CAAC,CAAC;IACL,MAAM,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,YAAY,EAAE,EAC/E,YAAY,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,IAAI,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,SAAS;QAAE,MAAM,KAAK,CAAC,wDAAwD,GAAG,KAAK,CAAC,CAAC;IAC9I,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,QAAQ,EAAE,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;QACjE,MAAM,KAAK,CAAC,+DAA+D,GAAG,KAAK,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,gBAAgB,IAAI,QAAQ,CAAC,OAAO,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QACjD,MAAM,KAAK,CAAC,gDAAgD,GAAG,KAAK,GAAG,4DAA4D,CAAC,CAAC;IACvI,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM;QAC/D,MAAM,KAAK,CAAC,kDAAkD,GAAG,KAAK,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;QACtG,IAAI,KAAK,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnF,MAAM,KAAK,CAAC,sEAAsE,GAAG,KAAK,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;AACjH,CAAC;AAED;yEACyE;AACzE,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAgC;IACtE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,UAAU,KAAK,CAAC,MAAc;QACjC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACtF,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;gBAC1D,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC;gBACpF,MAAM,UAAU,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,MAAM;gBAChD,MAAM,KAAK,CAAC,8DAA8D,GAAG,QAAQ,CAAC,CAAC;YACzF,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,kEAAkE,GAAG,IAAI,CAAC,CAAC;AACnH,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,QAA2B,EAAE,OAAiC;IAC3G,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,IAAI,MAA0B,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,KAAK,CAAC,iEAAiE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACnI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACnG,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,MAAM;QAAE,MAAM,KAAK,CAAC,2DAA2D,GAAG,MAAM,CAAC,CAAC;IACnK,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,UAAU,CAAC,CAAC;IAChK,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,MAAqB,CAAC;IAC1B,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE;YACjF,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG;YAC5F,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAC9F,2BAA2B,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3I,CAAC;IACD,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,QAA8C;IACrG,OAAO;QACL,MAAM;QACN,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS;YACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ;gBAAE,MAAM,KAAK,CAAC,gEAAgE,GAAG,IAAI,CAAC,CAAC;YACpG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;YAClC,MAAM,MAAM,GAAG,KAAK,EAAE,SAAiB,EAAE,MAAc,EAAiB,EAAE;gBACxE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;gBAC3E,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,OAAO;gBAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;gBACzC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnC,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBACrD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;oBACpE,IAAI,CAAC,QAAQ;wBAAE,MAAM,KAAK,CAAC,2CAA2C,GAAG,UAAU,CAAC,CAAC;oBACrF,MAAM,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC,CAAC;YACF,MAAM,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/release/registry-transport.d.ts

@@ -0,0 +1,27 @@
+import { type Readable } from 'node:stream';
+import type { RegistryPackage } from './layout.js';
+export interface RegistryTransportOptions {
+    /** The exact clean checkout also used by the ordinary frozen install. */
+    checkout: string;
+    env: NodeJS.ProcessEnv;
+    scratch: string;
+    signal?: AbortSignal;
+}
+export type RegistryFailure = 'environment' | 'configuration' | 'authentication' | 'metadata' | 'http' | 'network' | 'worker' | 'timeout' | 'cancelled';
+/** Deliberately excludes URLs, configuration, helper output and raw causes. */
+export declare class RegistryTransportError extends Error {
+    readonly category: RegistryFailure;
+    readonly status?: number | undefined;
+    readonly code = "REGISTRY_ARCHIVE_UNAVAILABLE";
+    constructor(category: RegistryFailure, status?: number | undefined);
+}
+/** pnpm's configuration reader and token helpers run in the build environment,
+ * never by changing the daemon's cwd/env. Xec owns cancellation and the process
+ * tree. Only archive bytes leave stdout; the caller remains the SHA-512 and
+ * archive-layout authority. No package or pnpmfile hooks are executed.
+ * Xec 0.11.2 merges ambient environment keys rather than replacing them. Until
+ * it exposes replacement semantics, refuse an environment that needs to remove
+ * a key: otherwise a rejected loader/configuration variable would be restored.
+ * As elsewhere in the daemon, concurrent mutation of process.env is unsupported. */
+export declare function withRegistryArchive<T>(pkg: RegistryPackage, options: RegistryTransportOptions, consume: (stream: Readable, signal: AbortSignal) => Promise<T>): Promise<T>;
+//# sourceMappingURL=registry-transport.d.ts.map

package/dist/release/registry-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-transport.d.ts","sourceRoot":"","sources":["../../src/release/registry-transport.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,WAAW,wBAAwB;IACvC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,eAAe,GAAG,gBAAgB,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAGxJ,+EAA+E;AAC/E,qBAAa,sBAAuB,SAAQ,KAAK;IAEnC,QAAQ,CAAC,QAAQ,EAAE,eAAe;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IADxE,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,YAAqB,QAAQ,EAAE,eAAe,EAAW,MAAM,CAAC,EAAE,MAAM,YAAA,EAIvE;CACF;AAYD;;;;;;;oFAOoF;AACpF,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EACvD,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7D,OAAO,CAAC,CAAC,CAAC,CA8CZ"}

package/dist/release/registry-transport.js

@@ -0,0 +1,96 @@
+import { fileURLToPath } from 'node:url';
+import { PassThrough } from 'node:stream';
+import { ExecutionEngine } from '@xec-sh/core';
+const failures = ['environment', 'configuration', 'authentication', 'metadata', 'http', 'network', 'worker', 'timeout', 'cancelled'];
+/** Deliberately excludes URLs, configuration, helper output and raw causes. */
+export class RegistryTransportError extends Error {
+    category;
+    status;
+    code = 'REGISTRY_ARCHIVE_UNAVAILABLE';
+    constructor(category, status) {
+        super(category === 'environment'
+            ? 'Framework registry download refused: the requested environment omits inherited keys, but Xec 0.11.2 cannot replace the environment. Use a clean build-controller environment.'
+            : `Framework registry download failed: ${category}${status === undefined ? '' : ` (HTTP ${status})`}`);
+        this.category = category;
+        this.status = status;
+    }
+}
+function reportedFailure(stderr) {
+    try {
+        const value = JSON.parse(stderr);
+        if (!failures.includes(value.category))
+            return undefined;
+        const status = typeof value.status === 'number' && Number.isInteger(value.status) && value.status >= 100 && value.status <= 599
+            ? value.status : undefined;
+        return new RegistryTransportError(value.category, status);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** pnpm's configuration reader and token helpers run in the build environment,
+ * never by changing the daemon's cwd/env. Xec owns cancellation and the process
+ * tree. Only archive bytes leave stdout; the caller remains the SHA-512 and
+ * archive-layout authority. No package or pnpmfile hooks are executed.
+ * Xec 0.11.2 merges ambient environment keys rather than replacing them. Until
+ * it exposes replacement semantics, refuse an environment that needs to remove
+ * a key: otherwise a rejected loader/configuration variable would be restored.
+ * As elsewhere in the daemon, concurrent mutation of process.env is unsupported. */
+export async function withRegistryArchive(pkg, options, consume) {
+    if (options.signal?.aborted)
+        throw new RegistryTransportError('cancelled');
+    if (Object.entries(process.env).some(([key, value]) => typeof value === 'string' &&
+        (!Object.hasOwn(options.env, key) || typeof options.env[key] !== 'string'))) {
+        throw new RegistryTransportError('environment');
+    }
+    const stopped = new AbortController();
+    const timeout = AbortSignal.timeout(60_000);
+    const signal = AbortSignal.any([stopped.signal, timeout, ...(options.signal ? [options.signal] : [])]);
+    const output = new PassThrough();
+    const engine = new ExecutionEngine({ adapters: { local: { killSignal: 'SIGKILL' } } });
+    const inspection = consume(output, signal);
+    // An invalid archive stops the producer as well as its stream.
+    void inspection.catch(() => { if (!output.writableEnded)
+        stopped.abort(); });
+    const execution = engine.execute({
+        command: process.execPath,
+        args: [fileURLToPath(new URL('./registry-download.js', import.meta.url))],
+        cwd: options.checkout,
+        env: Object.fromEntries(Object.entries(options.env).filter((entry) => typeof entry[1] === 'string')),
+        // Xec's timeout races process completion. Its signal path waits for close;
+        // disable the default timer so our bounded signal is the sole deadline.
+        adapter: 'local', shell: false, signal, timeout: 0, maxBuffer: 2048, nothrow: true,
+        stdin: JSON.stringify(pkg), stdout: output, stderr: 'pipe',
+    }).finally(() => { if (!output.writableEnded)
+        output.end(); });
+    try {
+        const [inspected, executed] = await Promise.allSettled([inspection, execution]);
+        if (options.signal?.aborted)
+            throw new RegistryTransportError('cancelled');
+        if (timeout.aborted)
+            throw new RegistryTransportError('timeout');
+        if (executed.status === 'fulfilled' && executed.value.exitCode !== 0) {
+            const reported = reportedFailure(executed.value.stderr);
+            if (reported)
+                throw reported;
+            // Preserve an archive validation failure that deliberately stopped Xec.
+            if (inspected.status === 'rejected' && stopped.signal.aborted)
+                throw inspected.reason;
+            throw new RegistryTransportError('worker');
+        }
+        if (executed.status === 'rejected') {
+            if (inspected.status === 'rejected' && stopped.signal.aborted)
+                throw inspected.reason;
+            throw new RegistryTransportError('worker');
+        }
+        if (inspected.status === 'rejected')
+            throw inspected.reason;
+        return inspected.value;
+    }
+    finally {
+        stopped.abort();
+        output.destroy();
+        await engine.dispose();
+    }
+}
+//# sourceMappingURL=registry-transport.js.map

package/dist/release/registry-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-transport.js","sourceRoot":"","sources":["../../src/release/registry-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAiB,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAY/C,MAAM,QAAQ,GAA+B,CAAC,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAEjK,+EAA+E;AAC/E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE1B,QAAQ;IAA4B,MAAM;IADtD,IAAI,GAAG,8BAA8B,CAAC;IAC/C,YAAqB,QAAyB,EAAW,MAAe;QACtE,KAAK,CAAC,QAAQ,KAAK,aAAa;YAC9B,CAAC,CAAC,+KAA+K;YACjL,CAAC,CAAC,uCAAuC,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;wBAHtF,QAAQ;sBAA4B,MAAM;IAI/D,CAAC;CACF;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA6C,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAA2B,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;YAC7H,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7B,OAAO,IAAI,sBAAsB,CAAC,KAAK,CAAC,QAA2B,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;oFAOoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAoB,EAAE,OAAiC,EACvD,OAA8D;IAE9D,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;QAC9E,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,+DAA+D;IAC/D,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,IAAI,EAAE,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,GAAG,EAAE,OAAO,CAAC,QAAQ;QACrB,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC/H,2EAA2E;QAC3E,wEAAwE;QACxE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;QAClF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;KAC3D,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,QAAQ;gBAAE,MAAM,QAAQ,CAAC;YAC7B,wEAAwE;YACxE,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,SAAS,CAAC,MAAM,CAAC;YACtF,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,SAAS,CAAC,MAAM,CAAC;YACtF,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,SAAS,CAAC,MAAM,CAAC;QAC5D,OAAO,SAAS,CAAC,KAAK,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/release/repository-identity.d.ts

@@ -0,0 +1,12 @@
+/** Repository names are public provenance, never a transport credential store. */
+export declare const REPOSITORY_IDENTITY_ERROR = "Release repository identity is unsafe or invalid; use a credential-free Git remote without query or fragment parameters";
+export declare class RepositoryIdentityError extends Error {
+    constructor();
+}
+/** Preserve identity bytes exactly. Credentials must live in Git's credential helper or SSH
+ * agent; stripping them here would silently change evidence already pinned by a digest. */
+export declare function isSafeRepositoryIdentity(value: unknown): value is string;
+export declare function assertRepositoryIdentity(value: unknown): asserts value is string;
+/** Also used before structural parsing, so legacy unsafe manifests receive a safe refusal. */
+export declare function assertReleaseRepositoryIdentities(value: unknown): void;
+//# sourceMappingURL=repository-identity.d.ts.map

package/dist/release/repository-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-identity.d.ts","sourceRoot":"","sources":["../../src/release/repository-identity.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,4HACqF,CAAC;AAE5H,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,cAA0F;CAC3F;AAED;2FAC2F;AAC3F,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CA2BxE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAEhF;AAED,8FAA8F;AAC9F,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAQtE"}

package/dist/release/repository-identity.js

@@ -0,0 +1,62 @@
+/** Repository names are public provenance, never a transport credential store. */
+export const REPOSITORY_IDENTITY_ERROR = 'Release repository identity is unsafe or invalid; use a credential-free Git remote without query or fragment parameters';
+export class RepositoryIdentityError extends Error {
+    constructor() { super(REPOSITORY_IDENTITY_ERROR); this.name = 'RepositoryIdentityError'; }
+}
+/** Preserve identity bytes exactly. Credentials must live in Git's credential helper or SSH
+ * agent; stripping them here would silently change evidence already pinned by a digest. */
+export function isSafeRepositoryIdentity(value) {
+    if (typeof value !== 'string' || !value || value.length > 4096 || value.trim() !== value || /\p{Cc}/u.test(value))
+        return false;
+    // Explicit paths cannot be mistaken for a URL or scp-style authority. Git permits spaces,
+    // question marks and @ in path names; they are not transport parameters in these forms.
+    if (/^(?:\/|\.\.?\/|~\/|[A-Za-z]:[\\/])/.test(value))
+        return true;
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(value)) {
+        try {
+            const url = new URL(value);
+            if (!['https:', 'http:', 'ssh:', 'git:', 'git+ssh:', 'git+https:', 'git+http:', 'file:'].includes(url.protocol) ||
+                /[?#\\]/.test(value) || url.password)
+                return false;
+            const authority = value.slice(value.indexOf('://') + 3).split('/')[0];
+            const userinfo = authority.includes('@') ? authority.slice(0, authority.lastIndexOf('@')) : '';
+            // Even an empty password separator is forbidden. HTTP tokens often occupy username.
+            if (userinfo.includes(':') || (url.username && !['ssh:', 'git+ssh:'].includes(url.protocol)))
+                return false;
+            return url.protocol === 'file:' ? !url.username : !!url.hostname;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (value.includes('://') || /^(?:https?|ssh|git|file):/i.test(value) || /^[A-Za-z][A-Za-z0-9+.-]*::/.test(value))
+        return false;
+    // Git treats a slash before the colon as a relative local path, not an scp authority.
+    if (value.includes('/') && value.indexOf('/') < value.indexOf(':'))
+        return true;
+    if (value.includes(':')) {
+        // Git's scp syntax has a username, never a password. Reject the ambiguous password form
+        // instead of treating its first colon as the host/path separator.
+        if (/[?#\\]/.test(value) || /^[^/:]+:[^/]*@[^/:]+:/.test(value))
+            return false;
+        return /^(?:[^/@:\s]+@)?(?:\[[0-9A-Fa-f:]+\]|[^/@:\s]+):.+$/.test(value);
+    }
+    return true;
+}
+export function assertRepositoryIdentity(value) {
+    if (!isSafeRepositoryIdentity(value))
+        throw new RepositoryIdentityError();
+}
+/** Also used before structural parsing, so legacy unsafe manifests receive a safe refusal. */
+export function assertReleaseRepositoryIdentities(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new RepositoryIdentityError();
+    const manifest = value;
+    for (const key of ['project', 'omni']) {
+        const source = manifest[key];
+        if (!source || typeof source !== 'object' || Array.isArray(source))
+            throw new RepositoryIdentityError();
+        assertRepositoryIdentity(source['repo']);
+    }
+}
+//# sourceMappingURL=repository-identity.js.map

package/dist/release/repository-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-identity.js","sourceRoot":"","sources":["../../src/release/repository-identity.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GACpC,yHAAyH,CAAC;AAE5H,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,gBAAgB,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC,CAAC,CAAC;CAC3F;AAED;2FAC2F;AAC3F,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChI,0FAA0F;IAC1F,wFAAwF;IACxF,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC3G,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACvD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,oFAAoF;YACpF,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3G,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChI,sFAAsF;IACtF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,wFAAwF;QACxF,kEAAkE;QAClE,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,OAAO,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;AAC5E,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;IACrG,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;QACxG,wBAAwB,CAAE,MAAkC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,CAAC;AACH,CAAC"}

package/dist/release/runtime-extractor.d.ts

@@ -0,0 +1,4 @@
+/** Embedded in both receiver commands, including commands sent to older runtimes.
+ * Keep the function self-contained: the receiver can only load its own sealed packages. */
+export declare function loadRuntimeExtractor(controlPackage: string): Promise<typeof import('tar')>;
+//# sourceMappingURL=runtime-extractor.d.ts.map

package/dist/release/runtime-extractor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-extractor.d.ts","sourceRoot":"","sources":["../../src/release/runtime-extractor.ts"],"names":[],"mappings":"AAAA;2FAC2F;AAC3F,wBAAsB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,KAAK,CAAC,CAAC,CAWhG"}

package/dist/release/runtime-extractor.js

@@ -0,0 +1,15 @@
+/** Embedded in both receiver commands, including commands sent to older runtimes.
+ * Keep the function self-contained: the receiver can only load its own sealed packages. */
+export async function loadRuntimeExtractor(controlPackage) {
+    const fs = await import('node:fs/promises');
+    const path = await import('node:path');
+    const { createRequire } = await import('node:module');
+    const runtime = path.resolve(controlPackage, '../..');
+    const direct = await fs.realpath(path.join(controlPackage, 'node_modules', 'tar'));
+    const request = createRequire(path.join(controlPackage, 'package.json'));
+    const entry = await fs.realpath(request.resolve('tar'));
+    if (!direct.startsWith(runtime + path.sep) || !entry.startsWith(direct + path.sep))
+        throw Error('Archive extractor is outside its direct dependency in the attested runtime');
+    return request(entry);
+}
+//# sourceMappingURL=runtime-extractor.js.map

package/dist/release/runtime-extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-extractor.js","sourceRoot":"","sources":["../../src/release/runtime-extractor.ts"],"names":[],"mappings":"AAAA;2FAC2F;AAC3F,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,cAAsB;IAC/D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;QAChF,MAAM,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC,KAAK,CAAyB,CAAC;AAChD,CAAC"}

package/dist/release/runtime-provenance.d.ts

@@ -0,0 +1,40 @@
+import { type ReleaseArtifactOrigin } from './installed-origin.js';
+export { validOrigin } from './installed-origin.js';
+export type { ReleaseArtifactOrigin } from './installed-origin.js';
+import type { IEcosystemAppEntry, RuntimeReleaseEvidence } from '../config/types.js';
+export declare const RELEASE_RECEIPT = ".omnitron-release.json";
+/** Self-contained so exactly this implementation also seals the remote candidate. */
+export declare function releaseTreeDigest(directory: string, portable?: boolean, skipDependencies?: boolean, excludedRootEntries?: readonly string[]): Promise<string>;
+/** Compare package bytes and resolution edges, independent of installation paths. */
+export declare function frameworkDependencyGraph(application: string, selected?: Readonly<Record<string, string>>): Promise<{
+    roots: Record<string, number>;
+    graph: {
+        name: string;
+        version: string;
+        content: string;
+        dependencies: Record<string, number | null>;
+    }[];
+    directories: string[];
+    sha256: string;
+}>;
+export declare function frameworkDependencyDigest(application: string, selected?: Readonly<Record<string, string>>): Promise<string>;
+export declare function frameworkGraphCommandSource(): string;
+export declare function frameworkDigestCommand(application: string): string;
+/** Dependency installers may add locks, but must not silently rewrite the shipped payload. */
+export declare function artifactPayloadDigestCommand(application: string, archiveName: string): string;
+/** Called only after checked delivery and dependency installation in a new directory. */
+export declare function sealReleaseArtifactCommand(directory: string, origin: ReleaseArtifactOrigin, installedFrameworkCommit: string, frameworkContentUnchanged: boolean, artifactPayloadUnchanged: boolean, launch?: {
+    nodeOptions: string;
+    executable: string;
+    ownerPackage: string;
+}): string;
+/** The old input marker is only a performance hint. Reuse also requires this
+ * exact installed receipt, unchanged bytes and the current execution binding. */
+export declare function installedReleaseCheckCommand(directory: string, origin: ReleaseArtifactOrigin, owner: {
+    root: string;
+    executable: string;
+    commit: string;
+}, nodeOptions: string): string;
+/** A fresh launch may verify a receipt; a surviving legacy process may not. */
+export declare function verifyLaunchRelease(entry: IEcosystemAppEntry, launchId: string, executionPaths?: readonly string[]): Promise<RuntimeReleaseEvidence>;
+//# sourceMappingURL=runtime-provenance.d.ts.map

package/dist/release/runtime-provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-provenance.d.ts","sourceRoot":"","sources":["../../src/release/runtime-provenance.ts"],"names":[],"mappings":"AAMA,OAAO,EAA0E,KAAK,qBAAqB,EAAgC,MAAM,uBAAuB,CAAC;AACzK,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAErF,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,qFAAqF;AACrF,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,UAAQ,EAAE,gBAAgB,UAAQ,EAAE,mBAAmB,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA+CnK;AAED,qFAAqF;AACrF,wBAAsB,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;;;cAIlF,MAAM;iBAAW,MAAM;iBAAW,MAAM;sBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;;;;GA0BjH;AAED,wBAAsB,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjI;AAGD,wBAAgB,2BAA2B,IAAI,MAAM,CAGpD;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,8FAA8F;AAC9F,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAG7F;AAED,yFAAyF;AACzF,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,wBAAwB,EAAE,OAAO,EAClM,MAAM,CAAC,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAYpF;AAED;iFACiF;AACjF,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAavL;AAED,+EAA+E;AAC/E,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAoD9J"}