@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/release/store.js

@@ -15,12 +15,16 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { loadAttestations } from './attest.js';
+import { readReleaseId } from '../shared/release-reading.js';
 import { releasesRoot } from './load.js';
+import { artifactReleaseContexts, isReadableReleaseManifest, MAX_RELEASE_MANIFEST_BYTES, validateReleaseOrigins } from './origin.js';
+import { assertReleaseRepositoryIdentities, RepositoryIdentityError } from './repository-identity.js';
 export { releasesRoot };
-/** `daos-202609221432-81c8a074-c64963f6` → `daos`; a name may hold dashes too. */
+/** `sample-202609221432-81c8a074-c64963f6` → `sample`; a name may hold dashes too. */
 export function projectOfId(id) {
-    return id.replace(/-\d{12}-[0-9a-f]{8}-[0-9a-f]{8}$/, '');
+    return readReleaseId(id).project;
 }
 /**
  * What a release WEIGHS, without walking the build root.
@@ -94,13 +98,14 @@ export function dirBytes(dir) {
     walk(dir);
     return bytes;
 }
-function summarise(id, dir, manifest) {
+function summarise(id, dir, manifest, manifestError) {
     const gates = manifest?.gates ?? [];
     const weight = releaseBytes(dir);
     return {
         id,
         project: projectOfId(id),
         complete: manifest !== null,
+        ...(manifestError && { manifestError }),
         builtAt: manifest?.builtAt ?? null,
         builtBy: manifest?.builtBy ?? null,
         builtWith: manifest?.builtWith?.omnitron ?? null,
@@ -115,8 +120,8 @@ function summarise(id, dir, manifest) {
             failed: gates.filter((g) => g.status === 'failed').length,
             // Only a gate that did not run. `notRun` counted everything that was
             // neither passed nor failed, so a gate that RAN and did not answer in
-            // time was reported as one that never started: daos-202609230557's
-            // `unit:paysys` timed out («ETIMEDOUT», 0 tests failed) and the list
+            // time was reported as one that never started: sample-202609230557's
+            // `unit:payments` timed out («ETIMEDOUT», 0 tests failed) and the list
             // said `notRun: 1`. `manifest.ts` keeps the three apart on purpose — a
             // timeout and a kill are the machine's verdict, an absence is nobody's —
             // and a count that merges them undoes that for every reader of JSON.
@@ -143,15 +148,63 @@ function summarise(id, dir, manifest) {
         keptSource: weight.keptSource,
     };
 }
-function readManifest(dir) {
+const INVALID_MANIFEST = 'Release metadata is invalid or unsafe; admission is refused';
+function readManifestRecord(dir) {
     const file = path.join(dir, 'manifest.json');
+    let descriptor;
     try {
-        const manifest = JSON.parse(fs.readFileSync(file, 'utf8'));
-        return manifest && typeof manifest.id === 'string' ? manifest : null;
+        if (fs.realpathSync(file) !== path.join(fs.realpathSync(path.dirname(dir)), path.basename(dir), 'manifest.json'))
+            throw Error(INVALID_MANIFEST);
+        descriptor = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+        const stat = fs.fstatSync(descriptor);
+        if (!stat.isFile() || stat.size > MAX_RELEASE_MANIFEST_BYTES)
+            throw Error(INVALID_MANIFEST);
+        const raw = fs.readFileSync(descriptor);
+        if (raw.length > MAX_RELEASE_MANIFEST_BYTES)
+            throw Error(INVALID_MANIFEST);
+        const manifest = JSON.parse(raw.toString('utf8'));
+        assertReleaseRepositoryIdentities(manifest);
+        if (!isReadableReleaseManifest(manifest) || manifest.id !== path.basename(dir))
+            throw Error(INVALID_MANIFEST);
+        // Detail returns exact embedded JSON too. Check every producer before serializing any
+        // record, even one unused by the selected stack; per-artifact error handling is too late.
+        validateReleaseOrigins(manifest);
+        return { manifest, sha256: createHash('sha256').update(raw).digest('hex') };
     }
-    catch {
-        // No manifest, or one nothing can parse: an unfinished build, listed as such.
-        return null;
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            try {
+                fs.lstatSync(file);
+            } // A dangling manifest link is unsafe metadata, not an absent build result.
+            catch (missing) {
+                if (missing.code === 'ENOENT')
+                    return { manifest: null, sha256: null };
+            }
+        }
+        return { manifest: null, sha256: null, manifestError: error instanceof RepositoryIdentityError ? error.message : INVALID_MANIFEST };
+    }
+    finally {
+        if (descriptor !== undefined)
+            fs.closeSync(descriptor);
+    }
+}
+function readManifest(dir) {
+    return readManifestRecord(dir).manifest;
+}
+/** One bounded interpretation shared by CLI JSON/text and Console detail. Archive verification
+ * remains part of loadRelease at admission; this view does not claim a process is running it. */
+export function readArtifactSources(manifest) {
+    try {
+        return artifactReleaseContexts(manifest).map(({ app, manifest: producer, artifact, chain }) => ({
+            app, state: 'recorded', releaseId: producer.id, producerApp: artifact.app,
+            project: producer.project, framework: producer.omni, via: chain,
+            ...(producer.builtWith?.target && { target: producer.builtWith.target }),
+            ...(artifact.packageSource && { packageDirectory: artifact.packageSource.directory }),
+        }));
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : 'Release provenance could not be resolved';
+        return manifest.artifacts.map(({ app }) => ({ app, state: 'invalid', reason }));
     }
 }
 /** Every release on this machine, newest build first; unfinished ones last. */
@@ -164,8 +217,11 @@ export function listReleases(root = releasesRoot()) {
         return [];
     }
     return entries
-        .filter((e) => e.isDirectory())
-        .map((e) => summarise(e.name, path.join(root, e.name), readManifest(path.join(root, e.name))))
+        .filter((e) => e.isDirectory() && isReleaseId(e.name))
+        .map((e) => {
+        const dir = path.join(root, e.name), record = readManifestRecord(dir);
+        return summarise(e.name, dir, record.manifest, record.manifestError);
+    })
         .sort((a, b) => (a.builtAt ?? '') < (b.builtAt ?? '') ? 1 : (a.builtAt ?? '') > (b.builtAt ?? '') ? -1 : a.id < b.id ? 1 : -1);
 }
 /** A release id names a directory under the root, and nothing outside it. */
@@ -173,8 +229,7 @@ function isReleaseId(id) {
     return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(id) && !id.includes('..');
 }
 /**
- * One release's manifest, unchecked — or null when there is none: not built
- * here, pruned, or a build that did not finish.
+ * One release's manifest, structurally checked — or null when absent or unsafe.
  *
  * For comparing what a release says with what another one says, which needs
  * neither the sizes of the directory nor a sha256 of its tarballs.
@@ -189,7 +244,8 @@ export function readReleaseDetail(id, root = releasesRoot()) {
     const dir = path.join(root, id);
     if (!fs.existsSync(dir))
         throw new Error(`No release '${id}' on this machine — ${dir} does not exist`);
-    const manifest = readManifest(dir);
+    const record = readManifestRecord(dir);
+    const manifest = record.manifest;
     let logs = [];
     try {
         logs = fs
@@ -200,7 +256,7 @@ export function readReleaseDetail(id, root = releasesRoot()) {
     catch {
         // A build that never reached its first step wrote no logs.
     }
-    return { ...summarise(id, dir, manifest), manifest, logs, root: dir, attestations: loadAttestations(id, root) };
+    return { ...summarise(id, dir, manifest, record.manifestError), manifest, manifestSha256: record.sha256, artifactSources: manifest ? readArtifactSources(manifest) : [], logs, root: dir, attestations: loadAttestations(id, root) };
 }
 /**
  * The tail of one of a release's logs.

package/dist/release/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/release/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAA0B,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,CAAC;AAiExB,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,EAAE,CAAC,OAAO,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,UAAU,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;aAC5C,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;QACzB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC/B,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,8DAA8D;gBAChE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,EAAU,EAAE,GAAW,EAAE,QAAgC;IAC1E,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO;QACL,EAAE;QACF,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QACxB,QAAQ,EAAE,QAAQ,KAAK,IAAI;QAC3B,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAClC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI;QAChD,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;QAC/C,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QACzC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;QAC3C,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACrC,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;QAChG,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YACzD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YACzD,qEAAqE;YACrE,sEAAsE;YACtE,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YAC1D,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM;YAC9D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;SAC1D;QACD,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,IAAI,CAAC;YACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACvE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACrE,MAAM,EAAE,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;SAC7D;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAClC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YAC3D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;YACrB,EAAE,EAAE,CAAC,CAAC,EAAE;SACT,CAAC,CAAC;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAC;QAC9E,OAAO,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,IAAI,GAAW,YAAY,EAAE;IACxD,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC7F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnI,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAU,EAAE,IAAI,GAAW,YAAY,EAAE;IAC3E,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,EAAU,EAAE,IAAI,GAAW,YAAY,EAAE;IACzE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,uBAAuB,GAAG,iBAAiB,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,IAAI,GAA2C,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,IAAI,GAAG,EAAE;aACN,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;AAClH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,EAAU,EACV,IAAY,EACZ,KAAK,GAAG,GAAG,EACX,IAAI,GAAW,YAAY,EAAE;IAE7B,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,gBAAgB,IAAI,cAAc,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAClG,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAO,GAAmF,EAAE;IAE5F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/H,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1H,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM;QACN,OAAO;QACP,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;QAChC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/release/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAA0B,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrI,OAAO,EAAE,iCAAiC,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGtG,OAAO,EAAE,YAAY,EAAE,CAAC;AAuExB,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,UAAU,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;aAC5C,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;QACzB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC/B,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,8DAA8D;gBAChE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,EAAU,EAAE,GAAW,EAAE,QAAgC,EAAE,aAAsB;IAClG,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO;QACL,EAAE;QACF,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QACxB,QAAQ,EAAE,QAAQ,KAAK,IAAI;QAC3B,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAClC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI;QAChD,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;QAC/C,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QACzC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;QAC3C,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACrC,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;QAChG,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YACzD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YACzD,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YAC1D,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM;YAC9D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;SAC1D;QACD,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,IAAI,CAAC;YACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACvE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACrE,MAAM,EAAE,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;SAC7D;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAClC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YAC3D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;YACrB,EAAE,EAAE,CAAC,CAAC,EAAE;SACT,CAAC,CAAC;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAGD,MAAM,gBAAgB,GAAG,6DAA6D,CAAC;AAEvF,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC7C,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC;YAAE,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAChJ,UAAU,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1G,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,0BAA0B;YAAE,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,MAAM,GAAG,0BAA0B;YAAE,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,iCAAiC,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9G,sFAAsF;QACtF,0FAA0F;QAC1F,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,IAAI,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC,CAAC,2EAA2E;YACvG,OAAO,OAAO,EAAE,CAAC;gBAAC,IAAK,OAAiC,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;QACxH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;IACtI,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS;YAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED;iGACiG;AACjG,MAAM,UAAU,mBAAmB,CAAC,QAAyB;IAC3D,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9F,GAAG,EAAE,KAAK,EAAE,UAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG;YAClF,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK;YAC/D,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YACxE,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,gBAAgB,EAAE,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;SACtF,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C,CAAC;QACnG,OAAO,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,IAAI,GAAW,YAAY,EAAE;IACxD,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACvE,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnI,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAU,EAAE,IAAI,GAAW,YAAY,EAAE;IAC3E,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,EAAU,EAAE,IAAI,GAAW,YAAY,EAAE;IACzE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,uBAAuB,GAAG,iBAAiB,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,IAAI,GAA2C,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,IAAI,GAAG,EAAE;aACN,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;AACvO,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,EAAU,EACV,IAAY,EACZ,KAAK,GAAG,GAAG,EACX,IAAI,GAAW,YAAY,EAAE;IAE7B,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,gBAAgB,IAAI,cAAc,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAClG,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAO,GAAmF,EAAE;IAE5F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/H,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1H,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM;QACN,OAAO;QACP,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;QAChC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/release/target-runtime.d.ts

@@ -0,0 +1,19 @@
+export interface TargetRuntime {
+    platform: string;
+    arch: string;
+    node: string;
+    abi: string;
+    /** Bind the executable as well as its reported version. */
+    executableSha256: string;
+    libc: string | null;
+}
+/** Compare all fields, including the actual executable; a version string alone
+ * cannot establish native-addon or sealed-runtime compatibility. */
+export declare function assertReleaseTarget(expected: TargetRuntime | undefined, actual: TargetRuntime | undefined): void;
+/** Only explicitly recorded resource settings can be inherited by a release.
+ * Node preloads, loaders, arbitrary V8 options and module search paths cannot. */
+export declare function releaseNodeOptions(value: unknown): string;
+export declare function releaseOptionsForEnv(env?: Readonly<Record<string, unknown>>): string;
+/** Self-contained: run this under the node binary of the actual execution owner. */
+export declare function targetRuntime(): Promise<TargetRuntime>;
+//# sourceMappingURL=target-runtime.d.ts.map

package/dist/release/target-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-runtime.d.ts","sourceRoot":"","sources":["../../src/release/target-runtime.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;oEACoE;AACpE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,GAAG,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI,CAUhH;AAED;kFACkF;AAClF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKzD;AAED,wBAAgB,oBAAoB,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAGpF;AAED,oFAAoF;AACpF,wBAAsB,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAQ5D"}

package/dist/release/target-runtime.js

@@ -0,0 +1,41 @@
+/** Compare all fields, including the actual executable; a version string alone
+ * cannot establish native-addon or sealed-runtime compatibility. */
+export function assertReleaseTarget(expected, actual) {
+    const keys = ['platform', 'arch', 'node', 'abi', 'executableSha256', 'libc'];
+    for (const [label, value] of [['release', expected], ['execution owner', actual]]) {
+        if (!value || typeof value !== 'object' || Array.isArray(value) ||
+            keys.some(key => key === 'libc' && value[key] === null ? false : typeof value[key] !== 'string' || !value[key]) ||
+            !/^[a-f0-9]{64}$/.test(value.executableSha256))
+            throw Error('The ' + label + ' has no complete verified execution target');
+    }
+    const changed = keys.filter(key => expected[key] !== actual[key]);
+    if (changed.length)
+        throw Error('Execution owner does not match the recorded release target: ' + changed.join(', ') + '. Build for this owner\'s Node image or prepare an owner transition and rollback.');
+}
+/** Only explicitly recorded resource settings can be inherited by a release.
+ * Node preloads, loaders, arbitrary V8 options and module search paths cannot. */
+export function releaseNodeOptions(value) {
+    if (value == null || value === '')
+        return '';
+    if (typeof value !== 'string' || !/^--max-old-space-size=[1-9][0-9]{0,6}$/.test(value) ||
+        Number(value.split('=')[1]) > 1_048_576)
+        throw Error('Release NODE_OPTIONS permits only --max-old-space-size=<MiB> (1–1048576)');
+    return value;
+}
+export function releaseOptionsForEnv(env) {
+    if (env?.['NODE_PATH'])
+        throw Error('A release cannot extend NODE_PATH');
+    return releaseNodeOptions(env?.['NODE_OPTIONS']);
+}
+/** Self-contained: run this under the node binary of the actual execution owner. */
+export async function targetRuntime() {
+    const { createHash } = await import('node:crypto');
+    const { createReadStream } = await import('node:fs');
+    const hash = createHash('sha256');
+    for await (const part of createReadStream(process.execPath))
+        hash.update(part);
+    const header = process.report?.getReport()?.header;
+    return { platform: process.platform, arch: process.arch, node: process.version, abi: process.versions.modules,
+        executableSha256: hash.digest('hex'), libc: process.platform === 'linux' ? header?.glibcVersionRuntime ?? 'non-glibc' : null };
+}
+//# sourceMappingURL=target-runtime.js.map

package/dist/release/target-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-runtime.js","sourceRoot":"","sources":["../../src/release/target-runtime.ts"],"names":[],"mappings":"AAUA;oEACoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,QAAmC,EAAE,MAAiC;IACxG,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAU,CAAC;IACtF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAU,EAAE,CAAC;QAC3F,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/G,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAChD,MAAM,KAAK,CAAC,MAAM,GAAG,KAAK,GAAG,4CAA4C,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,QAAS,CAAC,GAAG,CAAC,KAAK,MAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,8DAA8D,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,mFAAmF,CAAC,CAAC;AAC7M,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC;QAClF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS;QAAE,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACrI,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAuC;IAC1E,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC;QAAE,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzE,OAAO,kBAAkB,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAgE,EAAE,MAAM,CAAC;IAClH,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;QAC3G,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnI,CAAC"}

package/dist/release/vendored-framework.d.ts

@@ -0,0 +1,28 @@
+import type { VendoredPackage } from './layout.js';
+import { type FrameworkStep } from './framework-source.js';
+import { type FrameworkSource } from '../shared/framework-source.js';
+export declare function requireFrameworkCommit(value: string | undefined): string;
+/** Check the Git blob, not a mutable file beside the worktree or metadata supplied by a consumer. */
+export declare function verifyCommittedArchive(projectDir: string, projectCommit: string, pkg: VendoredPackage, signal?: AbortSignal): Promise<NonSharedBuffer>;
+export declare function vendoredFrameworkSource(packages: readonly VendoredPackage[], options: {
+    projectDir: string;
+    projectCommit: string;
+    frameworkCommit: string;
+    frameworkSource?: FrameworkSource;
+    signal?: AbortSignal;
+}): Promise<FrameworkSource>;
+interface Reproduction {
+    readonly projectDir: string;
+    readonly projectCommit: string;
+    readonly frameworkCommit: string;
+    readonly frameworkSource: FrameworkSource;
+    readonly sourceBase: string;
+    readonly scratch: string;
+    readonly env: NodeJS.ProcessEnv;
+    readonly run: FrameworkStep;
+    readonly signal?: AbortSignal;
+}
+/** Rebuild before the application install or any of its gates can execute. */
+export declare function reproduceVendoredFramework(packages: readonly VendoredPackage[], options: Reproduction): Promise<import("./registry-framework.js").RegistryFramework>;
+export {};
+//# sourceMappingURL=vendored-framework.d.ts.map

package/dist/release/vendored-framework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendored-framework.d.ts","sourceRoot":"","sources":["../../src/release/vendored-framework.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EAAmD,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAO3F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGxE;AAMD,qGAAqG;AACrG,wBAAsB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,4BAWjI;AAED,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,EAAE,OAAO,EAAE;IAC3F,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC7H,GAAG,OAAO,CAAC,eAAe,CAAC,CAO3B;AAED,UAAU,YAAY;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,8EAA8E;AAC9E,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,EAAE,OAAO,EAAE,YAAY,gEAmB3G"}

package/dist/release/vendored-framework.js

@@ -0,0 +1,98 @@
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+import { promisify } from 'node:util';
+import { directoryOf, readWorkspace } from '../services/bundle-builder.js';
+import { normalizePackedWorkspace } from './portable-archive.js';
+import { inspectFrameworkArchive, verifiedFramework } from './registry-framework.js';
+import { checkoutFrameworkSource, defaultFrameworkSource } from './framework-source.js';
+import { parseFrameworkSource } from '../shared/framework-source.js';
+const exec = promisify(execFile);
+const SHA = /^[0-9a-f]{40}$/;
+const ARCHIVE_LIMIT = 64 * 1024 * 1024;
+export function requireFrameworkCommit(value) {
+    if (!value || !SHA.test(value))
+        throw Error('Vendored framework archives require --omni-commit with the full upstream Git commit to reproduce');
+    return value;
+}
+function git(directory, args, signal) {
+    return exec('git', ['--no-replace-objects', '--literal-pathspecs', ...args], { cwd: directory, signal });
+}
+/** Check the Git blob, not a mutable file beside the worktree or metadata supplied by a consumer. */
+export async function verifyCommittedArchive(projectDir, projectCommit, pkg, signal) {
+    const { stdout } = await git(projectDir, ['ls-tree', '-z', projectCommit, '--', pkg.file], signal);
+    const entry = /^(100644|100755) blob ([0-9a-f]{40,64})\t([^\0]+)\0$/.exec(stdout);
+    if (!entry || entry[3] !== pkg.file)
+        throw Error('Framework archive is not a committed regular file: ' + pkg.file);
+    const object = entry[2];
+    const size = Number((await git(projectDir, ['cat-file', '-s', object], signal)).stdout.trim());
+    if (!Number.isSafeInteger(size) || size <= 0 || size > ARCHIVE_LIMIT)
+        throw Error('Invalid framework archive size: ' + pkg.file);
+    const blob = await exec('git', ['--no-replace-objects', 'cat-file', 'blob', object], { cwd: projectDir, encoding: 'buffer', maxBuffer: ARCHIVE_LIMIT, signal });
+    if ('sha512-' + createHash('sha512').update(blob.stdout).digest('base64') !== pkg.integrity)
+        throw Error('Committed framework archive differs from its lockfile SHA-512: ' + pkg.file);
+    return blob.stdout;
+}
+export async function vendoredFrameworkSource(packages, options) {
+    if (options.frameworkSource !== undefined)
+        return parseFrameworkSource(options.frameworkSource);
+    const core = packages.find(pkg => pkg.name === '@omnitron-dev/omnitron');
+    if (!core)
+        throw Error('The lockfile lacks a verifiable Omnitron archive');
+    const bytes = await verifyCommittedArchive(options.projectDir, options.projectCommit, core, options.signal);
+    const metadata = await inspectFrameworkArchive(core, Readable.from(bytes), options.signal, requireFrameworkCommit(options.frameworkCommit));
+    return defaultFrameworkSource(metadata.repository);
+}
+/** Rebuild before the application install or any of its gates can execute. */
+export async function reproduceVendoredFramework(packages, options) {
+    const { projectDir, projectCommit, scratch, run, signal } = options;
+    const commit = requireFrameworkCommit(options.frameworkCommit);
+    for (const pkg of packages)
+        await verifyCommittedArchive(projectDir, projectCommit, pkg, signal);
+    const source = path.join(scratch, 'upstream');
+    await fs.mkdir(scratch, { recursive: true });
+    const env = { ...options.env, GIT_NO_REPLACE_OBJECTS: '1', GIT_TERMINAL_PROMPT: '0', TZ: 'UTC', CI: '1', TURBO_TELEMETRY_DISABLED: '1' };
+    delete env['TURBO_TOKEN'];
+    delete env['TURBO_TEAM'];
+    const identity = await checkoutFrameworkSource(source, { source: options.frameworkSource, commit, sourceBase: options.sourceBase,
+        env, run, ...(signal && { signal }) });
+    const epoch = (await git(source, ['show', '-s', '--format=%ct', 'HEAD'], signal)).stdout.trim();
+    const buildEnv = { ...env, SOURCE_DATE_EPOCH: epoch, TURBO_FORCE: 'true', TURBO_CONCURRENCY: '3' };
+    await run('pnpm', ['install', '--frozen-lockfile'], source, buildEnv);
+    // The selected source owns its complete build contract, including auxiliary
+    // declaration passes. Reimplementing only its Turbo "build" task changes SDK bytes.
+    await run('pnpm', ['run', 'build'], source, buildEnv);
+    return verifyReproducedFramework(packages, source, identity, scratch, run, buildEnv, signal);
+}
+/** Only the byte-identical result of packing a clean build is used to verify installed and staged files. */
+async function verifyReproducedFramework(packages, source, identity, scratch, run, env, signal) {
+    const commit = identity.commit;
+    const workspace = readWorkspace(source);
+    const verified = new Map();
+    const { stdout } = await git(source, ['show', '-s', '--format=%H %T', 'HEAD'], signal);
+    const [head, tree] = stdout.trim().split(' ');
+    if (head !== commit || !tree || !SHA.test(tree))
+        throw Error('The rebuilt framework checkout differs from the requested commit');
+    const archive = path.join(scratch, 'workspace.tgz');
+    for (const pkg of packages) {
+        const manifest = workspace.get(pkg.name);
+        if (!manifest || manifest.version !== pkg.version)
+            throw Error('No matching workspace package at the framework commit: ' + pkg.name);
+        await run('pnpm', ['pack', '--out', archive], directoryOf(manifest), env);
+        await normalizePackedWorkspace(archive);
+        try {
+            verified.set(pkg.name, await inspectFrameworkArchive(pkg, createReadStream(archive), signal, commit));
+        }
+        finally {
+            await fs.rm(archive, { force: true });
+        }
+    }
+    if ((await git(source, ['rev-parse', 'HEAD'], signal)).stdout.trim() !== commit ||
+        (await git(source, ['status', '--porcelain'], signal)).stdout.trim())
+        throw Error('The framework checkout changed during the build or pack');
+    return verifiedFramework({ ...identity, reproduced: { tree, packages } }, verified);
+}
+//# sourceMappingURL=vendored-framework.js.map

package/dist/release/vendored-framework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendored-framework.js","sourceRoot":"","sources":["../../src/release/vendored-framework.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAsB,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAwB,MAAM,+BAA+B,CAAC;AAG3F,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAC7B,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,kGAAkG,CAAC,CAAC;IAChJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,GAAG,CAAC,SAAiB,EAAE,IAAc,EAAE,MAAoB;IAClE,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAkB,EAAE,aAAqB,EAAE,GAAoB,EAAE,MAAoB;IAChI,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,sDAAsD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,aAAa;QAAE,MAAM,KAAK,CAAC,kCAAkC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAChK,IAAI,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,SAAS;QACzF,MAAM,KAAK,CAAC,iEAAiE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAoC,EAAE,OAEnF;IACC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,oBAAoB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5I,OAAO,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAcD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,QAAoC,EAAE,OAAqB;IAC1G,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACpE,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,MAAM,sBAAsB,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAAC;IAC5J,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9H,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChG,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;IACnG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtE,4EAA4E;IAC5E,oFAAoF;IACpF,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC/F,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,yBAAyB,CAAC,QAAoC,EAAE,MAAc,EAAE,QAAuB,EAAE,OAAe,EAAE,GAAkB,EAAE,GAAsB,EAAE,MAAoB;IACvM,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+D,CAAC;IACxF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACvF,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACjI,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,yDAAyD,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACrI,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxG,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QAC3E,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACtE,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACzE,OAAO,iBAAiB,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;AACtF,CAAC"}

package/dist/release/workspace-source.d.ts

@@ -0,0 +1,3 @@
+/** The registration selects a config; its nearest committed pnpm lock selects the build workspace. */
+export declare function releaseWorkspaceDirectory(repository: string, commit: string, configuration: string): Promise<string>;
+//# sourceMappingURL=workspace-source.d.ts.map

package/dist/release/workspace-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-source.d.ts","sourceRoot":"","sources":["../../src/release/workspace-source.ts"],"names":[],"mappings":"AAMA,sGAAsG;AACtG,wBAAsB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB1H"}

package/dist/release/workspace-source.js

@@ -0,0 +1,33 @@
+import { execFile } from 'node:child_process';
+import path from 'node:path';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+/** The registration selects a config; its nearest committed pnpm lock selects the build workspace. */
+export async function releaseWorkspaceDirectory(repository, commit, configuration) {
+    if (!/^[a-f0-9]{40}$/.test(commit) || (configuration && (configuration.includes('\\') ||
+        configuration.split('/').some(s => !s || s === '.' || s === '..'))))
+        throw Error('Invalid release source location');
+    const candidates = [];
+    for (let dir = configuration;; dir = path.posix.dirname(dir) === '.' ? '' : path.posix.dirname(dir)) {
+        candidates.push(path.posix.join(dir, 'pnpm-lock.yaml'));
+        if (!dir)
+            break;
+    }
+    const { stdout } = await exec('git', ['--literal-pathspecs', 'ls-tree', '-z', '--full-tree', commit, '--', ...candidates], { cwd: repository });
+    const blobs = stdout.split('\0').filter(Boolean).map(line => {
+        const tab = line.indexOf('\t');
+        return [line.slice(tab + 1), line.slice(0, tab)];
+    });
+    const files = new Map(blobs);
+    for (const file of candidates) {
+        const object = files.get(file);
+        if (object === undefined)
+            continue;
+        if (!/^100(?:644|755) blob [a-f0-9]{40}$/.test(object))
+            throw Error('Release lock must be a regular committed file: ' + file);
+        const dir = path.posix.dirname(file);
+        return dir === '.' ? '' : dir;
+    }
+    throw Error('No committed pnpm-lock.yaml for configuration ' + (configuration || '.') + ' at ' + commit);
+}
+//# sourceMappingURL=workspace-source.js.map

package/dist/release/workspace-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-source.js","sourceRoot":"","sources":["../../src/release/workspace-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,MAAc,EAAE,aAAqB;IACvG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnF,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtH,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,KAAK,IAAI,GAAG,GAAG,aAAa,GAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,MAAM;IAClB,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAChJ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAU,CAAC;IAC5F,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,iDAAiD,GAAG,IAAI,CAAC,CAAC;QAC9H,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAChC,CAAC;IACD,MAAM,KAAK,CAAC,gDAAgD,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;AAC3G,CAAC"}

package/dist/runtime/context.d.ts

@@ -0,0 +1,29 @@
+import { type Token } from '@omnitron-dev/titan/nexus';
+import { type ArtifactIdentity } from './identity.js';
+export type InstalledRuntimeContext = Readonly<{
+    state: 'verified';
+    basis: 'verified-installed-runtime';
+    producer: ArtifactIdentity;
+    consumer: Readonly<{
+        releaseId: string;
+        manifestSha256: string;
+        app: string;
+    }>;
+    entry: Readonly<{
+        relativeFile: string;
+        mode: 'bootstrap' | 'script';
+    }>;
+    payloadSha256: string;
+    executableSha256: string;
+    observedAt: string;
+    ownerAttestation: null;
+}> | Readonly<{
+    state: 'unavailable';
+    reason: string;
+}>;
+export declare const RUNTIME_CONTEXT: Token<InstalledRuntimeContext>;
+/** Startup evidence for this physical compiled entry, not owner or continuous-memory attestation. */
+export declare function verifyInstalledRuntime(entry: URL): Promise<InstalledRuntimeContext>;
+/** A bootstrap child may load only compiled code from the same checked closure. */
+export declare function assertInstalledRuntimeModule(context: InstalledRuntimeContext, entry: URL, module: URL): Promise<void>;
+//# sourceMappingURL=context.d.ts.map

package/dist/runtime/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/runtime/context.ts"],"names":[],"mappings":"AAGA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAKpE,OAAO,EAAE,KAAK,gBAAgB,EAAyD,MAAM,eAAe,CAAC;AAE7G,MAAM,MAAM,uBAAuB,GAC/B,QAAQ,CAAC;IACP,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,4BAA4B,CAAC;IACpC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,EAAE,QAAQ,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAA;KAAE,CAAC,CAAC;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,IAAI,CAAC;CACxB,CAAC,GACF,QAAQ,CAAC;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACvD,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,uBAAuB,CACO,CAAC;AAEnE,qGAAqG;AACrG,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAkFzF;AAED,mFAAmF;AACnF,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,GAAG,GACV,OAAO,CAAC,IAAI,CAAC,CAsBf"}

package/dist/runtime/context.js

@@ -0,0 +1,111 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createToken } from '@omnitron-dev/titan/nexus';
+import { readInstalledReleaseReceipt, validRuntimeOrigin } from '../release/installed-origin.js';
+import { releaseTreeDigest } from '../release/runtime-provenance.js';
+import { releaseNodeOptions, targetRuntime } from '../release/target-runtime.js';
+import { parseArtifactIdentity, RuntimeOriginVerificationError } from './identity.js';
+export const RUNTIME_CONTEXT = createToken('omnitron.runtime-context');
+/** Startup evidence for this physical compiled entry, not owner or continuous-memory attestation. */
+export async function verifyInstalledRuntime(entry) {
+    try {
+        if (!(entry instanceof URL) || entry.protocol !== 'file:' || entry.search || entry.hash)
+            throw Error('Expected the actual compiled entry file URL');
+        const file = fileURLToPath(entry);
+        let root, directory = path.dirname(file);
+        for (;;) {
+            const exists = await fs.lstat(path.join(directory, '.omnitron-release.json')).then(() => true, (e) => {
+                if (e.code === 'ENOENT')
+                    return false;
+                throw e;
+            });
+            if (exists) {
+                if (root)
+                    throw Error('Ambiguous nested installed-origin receipts');
+                root = directory;
+            }
+            const parent = path.dirname(directory);
+            if (parent === directory)
+                break;
+            directory = parent;
+        }
+        if (!root)
+            return Object.freeze({ state: 'unavailable', reason: 'No admitted runtime origin is recorded for this entry' });
+        if (!/\.[cm]?js$/.test(file) || (await fs.realpath(file)) !== file || !(await fs.lstat(file)).isFile())
+            throw Error('Runtime entry must be a physical compiled file');
+        const r = await readInstalledReleaseReceipt(root), origin = r.origin.runtimeOrigin;
+        if (r.artifactPayloadUnchanged !== true ||
+            r.frameworkContentUnchanged !== true ||
+            r.installedFrameworkCommit !== r.origin.frameworkCommit)
+            throw Error('Installed runtime binding changed');
+        if (origin === undefined)
+            return Object.freeze({ state: 'unavailable', reason: 'Legacy installation has no runtime-origin contract' });
+        if (r.version !== 2 || !validRuntimeOrigin(origin))
+            throw Error('Invalid installed runtime-origin contract');
+        if (process.env['NODE_PATH'])
+            throw Error('Runtime extends NODE_PATH');
+        const nodeOptions = releaseNodeOptions(process.env['NODE_OPTIONS']);
+        // No inherited loader/preload can be represented by a permitted resource setting.
+        if (process.execArgv.some((arg) => arg !== nodeOptions || !/^--max-old-space-size=[1-9][0-9]{0,6}$/.test(arg)))
+            throw Error('Runtime command-line options are outside the verified installation');
+        if (path.join(root, origin.entry.relativeFile) !== file)
+            throw Error('Runtime entry differs from the admitted compiled entry');
+        if (r.nodeOptions !== nodeOptions ||
+            r.artifactPayloadUnchanged !== true ||
+            r.frameworkContentUnchanged !== true ||
+            r.installedFrameworkCommit !== r.origin.frameworkCommit)
+            throw Error('Installed runtime binding changed');
+        const target = await targetRuntime();
+        if (!r.target || Object.entries(target).some(([k, v]) => r.target[k] !== v))
+            throw Error('Runtime executable differs from the admitted target');
+        if ((await releaseTreeDigest(root)) !== r.treeSha256)
+            throw Error('Installed runtime payload changed');
+        return Object.freeze({
+            state: 'verified',
+            basis: 'verified-installed-runtime',
+            producer: parseArtifactIdentity({
+                releaseId: r.origin.releaseId,
+                manifestSha256: r.origin.manifestSha256,
+                artifactSha256: r.origin.artifactSha256,
+                producerApp: origin.producerApp,
+                projectCommit: origin.projectCommit,
+                frameworkCommit: r.origin.frameworkCommit,
+            }),
+            consumer: Object.freeze({ ...origin.consumer }),
+            entry: Object.freeze({ ...origin.entry }),
+            payloadSha256: r.treeSha256,
+            executableSha256: target.executableSha256,
+            observedAt: new Date().toISOString(),
+            ownerAttestation: null,
+        });
+    }
+    catch (error) {
+        if (error instanceof RuntimeOriginVerificationError)
+            throw error;
+        throw new RuntimeOriginVerificationError(error instanceof Error ? error.message : 'Runtime origin verification failed', { cause: error });
+    }
+}
+/** A bootstrap child may load only compiled code from the same checked closure. */
+export async function assertInstalledRuntimeModule(context, entry, module) {
+    if (context.state !== 'verified')
+        return;
+    try {
+        const entryPath = fileURLToPath(entry);
+        let root = entryPath;
+        for (const _ of context.entry.relativeFile.split('/'))
+            root = path.dirname(root);
+        if (path.join(root, context.entry.relativeFile) !== entryPath ||
+            module.protocol !== 'file:' ||
+            module.search ||
+            module.hash)
+            throw Error('Runtime module does not belong to the admitted entry');
+        const file = await fs.realpath(fileURLToPath(module));
+        if (!file.startsWith(root + path.sep) || !/\.[cm]?js$/.test(file) || !(await fs.lstat(file)).isFile())
+            throw Error('Runtime module is outside the installed compiled closure');
+    }
+    catch (error) {
+        throw new RuntimeOriginVerificationError(error instanceof Error ? error.message : 'Runtime module verification failed', { cause: error });
+    }
+}
+//# sourceMappingURL=context.js.map