@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/release/build-run.js

@@ -20,7 +20,18 @@ import { promisify } from 'node:util';
 import { OMNITRON_HOME } from '../config/defaults.js';
 import { ProjectRegistry } from '../project/registry.js';
 import { assembleManifest, gateOutcomesFromGates, releaseId } from './builder.js';
-import { planBuildRoot, readLinkLayout, resolveCheckouts } from './layout.js';
+import { planBuildRoot, readFrameworkLayout, resolveCheckouts } from './layout.js';
+import { assertReleaseId } from './load.js';
+import { releaseWorkspaceDirectory } from './workspace-source.js';
+import { readPackageGates, runPackageGates } from './package-gates.js';
+import { resolveRegistryFramework } from './registry-framework.js';
+import { reproduceVendoredFramework, requireFrameworkCommit, vendoredFrameworkSource } from './vendored-framework.js';
+import { checkoutFrameworkSource, projectFrameworkSource } from './framework-source.js';
+import { OWN_BUILD } from '../shared/build-stamp.js';
+import { importReleaseArtifacts } from './import-artifacts.js';
+import { MAX_RELEASE_MANIFEST_BYTES, validateReleaseOrigins } from './origin.js';
+import { readReleaseSource } from './source.js';
+export { readReleaseSource } from './source.js';
 const exec = promisify(execFile);
 const MINUTE = 60_000;
 /** Environment names a build request may set, and those it may never. */
@@ -46,6 +57,10 @@ const ENV_FORBIDDEN = new Set([
  * and the operator has no way to see that the variable never arrived.
  */
 export function checkedEnv(env) {
+    if (env !== undefined && (env === null || typeof env !== 'object' || Array.isArray(env) ||
+        ![Object.prototype, null].includes(Object.getPrototypeOf(env)))) {
+        throw new Error('Build environment must be an object of variable names and string values');
+    }
     const out = {};
     for (const [key, value] of Object.entries(env ?? {})) {
         if (!ENV_NAME.test(key))
@@ -74,6 +89,8 @@ async function git(args, cwd) {
  * leaves them holding ports and files.
  */
 function runStep(cmd, args, opts) {
+    if (opts.signal?.aborted)
+        return Promise.reject(new Error('The build was stopped'));
     return new Promise((resolve) => {
         const out = fs.createWriteStream(opts.logFile, { flags: 'a' });
         out.write(`$ ${cmd} ${args.join(' ')}\n  (in ${opts.cwd})\n`);
@@ -125,24 +142,11 @@ function tail(file, lines = 12) {
 /** A step that must succeed for there to be a release at all. */
 async function must(what, run, logFile) {
     const r = await run;
-    if (r.code !== 0) {
+    if (r.code !== 0 || r.timedOut) {
         throw new Error(`${what} failed (${r.timedOut ? 'timed out' : `exit ${r.code === null ? 'by signal' : r.code}`}) — ${logFile}\n${tail(logFile)}`);
     }
     return r;
 }
-async function sourceOf(checkout, commit) {
-    const repo = await git(['remote', 'get-url', 'origin'], checkout).catch(() => '(no origin)');
-    let onRemote;
-    try {
-        const remotes = await git(['branch', '-r', '--contains', commit], checkout);
-        const any = await git(['branch', '-r'], checkout);
-        onRemote = any.length === 0 ? null : remotes.length > 0;
-    }
-    catch {
-        onRemote = null;
-    }
-    return { repo, commit, onRemote };
-}
 /**
  * Every `@omnitron-dev/*` the install linked, and those that resolve outside
  * the omni clone. Zero links is its own refusal: an install that linked
@@ -190,6 +194,10 @@ function distBuiltAt(dir) {
 }
 /** The omnitron doing the packing, by version and the checkout it runs from. */
 export async function ownIdentity() {
+    if (OWN_BUILD) {
+        const { CLI_VERSION } = await import('../config/defaults.js');
+        return `${CLI_VERSION} from omni@${OWN_BUILD.commit}${OWN_BUILD.dirty ? '+dirty' : ''}`;
+    }
     const { findWorkspaceRoot, describeTree } = await import('../services/bundle-builder.js');
     const root = findWorkspaceRoot(path.dirname(fileURLToPath(import.meta.url)));
     if (!root)
@@ -240,7 +248,7 @@ async function buildStaticsFor(stack, projectDir, config, releaseRoot, logFile,
     const stackConfig = { ...userStacks, ...(config.stacks ?? {}) }[stack];
     if (!stackConfig)
         throw new Error(`There is no stack '${stack}' at this commit`);
-    const { mergeInfrastructure } = await import('../services/project.service.js');
+    const { mergeInfrastructure } = await import('../infrastructure/merge-config.js');
     const infra = mergeInfrastructure(config, stackConfig);
     const gateway = infra?.services?.['gateway']?.config ?? infra?.gateway;
     const staticDir = gateway?.staticDir;
@@ -381,7 +389,7 @@ export function systemTempRoot(platform = process.platform) {
  *
  * Test runners, and the tools under them, write into TMPDIR and do not always
  * take it back. vitest 5.0.0 left `$TMPDIR/<nanoid>/ssr` behind on EVERY run
- * (patched in omni and daos since), and a gate killed at its timeout cleans
+ * (patched in omni and sample since), and a gate killed at its timeout cleans
  * nothing at all. The master's TMPDIR is `~/.tmp`, which nothing clears:
  * measured 2026-09-29, 16 443 of those directories, 112 GB, from every suite
  * and every release gate since 2026-09-11 — and the Docker engine stopped
@@ -402,6 +410,9 @@ async function buildRelease(projectName, options, onPhase, where) {
     const started = Date.now();
     const extra = checkedEnv(options.env);
     const env = buildEnv({ ...process.env, ...extra });
+    // Native install scripts and compilation must use the same Node that fingerprints the closure.
+    const bin = path.dirname(process.execPath);
+    env['PATH'] = [bin, ...(env['PATH'] ?? '').split(path.delimiter).filter(dir => dir && dir !== bin)].join(path.delimiter);
     const signal = options.signal;
     const ctx = { env, ...(signal ? { signal } : {}) };
     const step = (cmd, args, opts) => runStep(cmd, args, { ...opts, env, ...(signal ? { signal } : {}) });
@@ -422,33 +433,92 @@ async function buildRelease(projectName, options, onPhase, where) {
     }
     let id = null;
     const say = (phase, percent, more = {}) => onPhase({ phase, percent, at: new Date().toISOString(), ...(id ? { releaseId: id } : {}), ...more });
-    say('reading both commits', 2);
+    const announceFramework = (source, commit) => say(`framework source: ${source.repository}${source.ref ? ' [' + source.ref + ']' : ''} @ ${commit}`, 2);
+    say('reading project and framework sources', 2);
     const projectSha = await git(['rev-parse', '--verify', `${options.projectCommit ?? 'HEAD'}^{commit}`], project.path);
-    // The lockfile AT THE COMMIT: the working tree's may differ, and it is the
-    // commit's that the clone will install from.
-    const layout = readLinkLayout(await git(['show', `${projectSha}:pnpm-lock.yaml`], project.path));
-    if ('refusal' in layout)
-        throw new Error(`Cannot lay out ${projectName} at ${projectSha.slice(0, 8)}: ${layout.refusal}`);
-    const { projectReal: projectPath, omniPath } = resolveCheckouts(project.path, layout);
-    if (!fs.existsSync(path.join(omniPath, '.git'))) {
-        throw new Error(`The lockfile's links point at ${omniPath}, and there is no omni checkout there.`);
-    }
-    const omniSha = await git(['rev-parse', '--verify', `${options.omniCommit ?? 'HEAD'}^{commit}`], omniPath);
-    id = releaseId(projectName, new Date(), projectSha, omniSha);
-    // Said BEFORE the directory exists, so that from the moment there is
-    // anything on disk under this name, the service watching these phases can
-    // name it — and `prune` can refuse to delete a build in progress.
+    env['SOURCE_DATE_EPOCH'] = await git(['show', '-s', '--format=%ct', projectSha], project.path);
+    const projectPath = fs.realpathSync(project.path);
+    const repositoryPath = fs.realpathSync(await git(['rev-parse', '--show-toplevel'], projectPath));
+    const projectSource = await readReleaseSource(repositoryPath, projectSha);
+    const projectPrefix = path.relative(repositoryPath, projectPath).split(path.sep).join('/');
+    const workspace = await releaseWorkspaceDirectory(repositoryPath, projectSha, projectPrefix);
+    const workspacePath = path.join(repositoryPath, workspace);
+    const lockPath = path.posix.join(workspace, 'pnpm-lock.yaml');
+    const layout = readFrameworkLayout(await git(['show', `${projectSha}:${lockPath}`], repositoryPath));
+    let selectedSource = projectFrameworkSource(JSON.parse(await git(['show', `${projectSha}:${path.posix.join(workspace, 'package.json')}`], repositoryPath)), options.frameworkSource);
+    let checkout;
+    let pristineProject;
+    let registry;
+    let omniSource;
+    if (layout.kind === 'linked') {
+        const { omniPath } = resolveCheckouts(workspacePath, layout.layout);
+        if (selectedSource && options.omniCommit !== undefined && !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(options.omniCommit))
+            throw Error('An explicit framework repository requires a full --omni-commit, not a revision from another checkout');
+        if (!(selectedSource && options.omniCommit !== undefined) && !fs.existsSync(path.join(omniPath, '.git')))
+            throw Error('No linked omni checkout at ' + omniPath + '; choose a framework repository and its full commit');
+        const sha = selectedSource && options.omniCommit !== undefined ? options.omniCommit
+            : await git(['rev-parse', '--verify', `${options.omniCommit ?? 'HEAD'}^{commit}`], omniPath);
+        checkout = { path: omniPath, sha, layout: layout.layout, ...(selectedSource && { source: selectedSource }) };
+        omniSource = selectedSource ? { repo: selectedSource.repository, commit: sha, ...(selectedSource.ref && { ref: selectedSource.ref }) }
+            : await readReleaseSource(omniPath, sha);
+    }
+    else if (layout.kind === 'vendored') {
+        // Reserve the release ID. The verified source replaces this before a manifest is written.
+        const commit = requireFrameworkCommit(options.omniCommit);
+        selectedSource = await vendoredFrameworkSource(layout.packages, { projectDir: workspacePath, projectCommit: projectSha,
+            frameworkCommit: commit, ...(selectedSource && { frameworkSource: selectedSource }), ...(signal && { signal }) });
+        omniSource = { repo: selectedSource.repository, commit, ...(selectedSource.ref && { ref: selectedSource.ref }) };
+    }
+    else {
+        // Registry configuration belongs to the same committed checkout used by install.
+        // Its gitHead determines the release ID, so prepare this one clone before naming it.
+        where.tmp = makeBuildTempDir();
+        env['TMPDIR'] = where.tmp;
+        pristineProject = path.join(where.tmp, 'project');
+        const preflightLog = path.join(where.tmp, 'registry.log');
+        say('preparing the committed project registry configuration', 2);
+        await must('project clone', step('git', ['clone', '--quiet', '--shared', '--no-checkout', '--', repositoryPath, pristineProject], { cwd: where.tmp, logFile: preflightLog, timeoutMs: 10 * MINUTE }), preflightLog);
+        await must('project checkout', step('git', ['checkout', '--quiet', '--detach', projectSha], { cwd: pristineProject, logFile: preflightLog, timeoutMs: 10 * MINUTE }), preflightLog);
+        say(`verifying ${layout.packages.length} framework archives against the project lockfile`, 2);
+        registry = await resolveRegistryFramework(layout.packages, {
+            checkout: path.join(pristineProject, workspace), env, scratch: path.join(where.tmp, 'registry'), sourceBase: workspacePath,
+            ...(options.omniCommit !== undefined && { requestedCommit: options.omniCommit }), ...(selectedSource && { frameworkSource: selectedSource }),
+            ...(signal && { signal }), sourcePhase: announceFramework,
+            run: async (command, args, cwd, toolEnv) => must('framework source verification', runStep(command, args, { cwd, env: toolEnv, logFile: preflightLog, timeoutMs: 3 * MINUTE, ...(signal && { signal }) }), preflightLog).then(() => { }),
+        });
+        omniSource = registry.source;
+    }
+    if (layout.kind !== 'registry')
+        announceFramework({ repository: omniSource.repo, ...(selectedSource?.ref && { ref: selectedSource.ref }) }, omniSource.commit);
+    id = releaseId(projectName, new Date(), projectSha, omniSource.commit);
+    assertReleaseId(id);
+    const releasesDirectory = path.join(OMNITRON_HOME, 'releases');
+    fs.mkdirSync(releasesDirectory, { recursive: true });
+    let releaseRoot = path.join(releasesDirectory, id);
+    // A second build in the same minute must never overwrite another run's
+    // logs/manifest, or remove its source directory when cleanup runs.
+    try {
+        fs.mkdirSync(releaseRoot, { mode: 0o700 });
+    }
+    catch (err) {
+        if (err.code !== 'EEXIST')
+            throw err;
+        releaseRoot = fs.mkdtempSync(releaseRoot + '-');
+        id = path.basename(releaseRoot);
+    }
     say('preparing the build root', 3);
-    const releaseRoot = path.join(OMNITRON_HOME, 'releases', id);
     where.root = releaseRoot;
     // Every step from here on — clones, installs, builds, the gates — keeps its
     // temporary files where the build removes them (`makeBuildTempDir`). `env`
     // is this build's own copy (`buildEnv` above), never this process's.
-    where.tmp = makeBuildTempDir();
+    where.tmp ??= makeBuildTempDir();
     env['TMPDIR'] = where.tmp;
     const logs = path.join(releaseRoot, 'logs');
     fs.mkdirSync(logs, { recursive: true });
-    const plan = planBuildRoot(path.join(releaseRoot, 'src'), projectPath, layout);
+    if (fs.existsSync(path.join(where.tmp, 'registry.log')))
+        fs.copyFileSync(path.join(where.tmp, 'registry.log'), path.join(logs, 'registry.log'));
+    const srcRoot = path.join(releaseRoot, 'src');
+    const plan = planBuildRoot(srcRoot, workspacePath, checkout?.layout, repositoryPath);
     if ('refusal' in plan)
         throw new Error(plan.refusal);
     // Read at the START: the identity of the omnitron that packs this, not of
@@ -456,45 +526,120 @@ async function buildRelease(projectName, options, onPhase, where) {
     // release recorded a commit made while it was running.
     const omnitron = await ownIdentity();
     // 1. Clean clones of the two commits.
-    say('cloning both commits', 5);
+    say(checkout ? 'cloning project and framework commits' : 'cloning project commit', 5);
     const cloneLog = path.join(logs, 'clone.log');
-    for (const [from, sha, to] of [
-        [projectPath, projectSha, plan.projectDir],
-        [omniPath, omniSha, plan.omniDir],
-    ]) {
+    const clones = [];
+    if (pristineProject) {
+        fs.mkdirSync(path.dirname(plan.repositoryDir), { recursive: true });
+        try {
+            fs.renameSync(pristineProject, plan.repositoryDir);
+        }
+        catch (error) {
+            if (error.code !== 'EXDEV')
+                throw error;
+            fs.cpSync(pristineProject, plan.repositoryDir, { recursive: true, verbatimSymlinks: true, force: false, errorOnExist: true });
+            if (await git(['rev-parse', 'HEAD'], plan.repositoryDir) !== projectSha || await git(['status', '--porcelain'], plan.repositoryDir))
+                throw Error('The committed project clone changed while moving to the release filesystem', { cause: error });
+            fs.rmSync(pristineProject, { recursive: true });
+        }
+    }
+    else
+        clones.push([repositoryPath, projectSha, plan.repositoryDir]);
+    if (checkout && plan.omniDir && !checkout.source)
+        clones.push([checkout.path, checkout.sha, plan.omniDir]);
+    for (const [from, sha, to] of clones) {
         fs.mkdirSync(path.dirname(to), { recursive: true });
-        await must('clone', step('git', ['clone', '--quiet', '--shared', '--no-checkout', from, to], { cwd: releaseRoot, logFile: cloneLog, timeoutMs: 10 * MINUTE }), cloneLog);
+        await must('clone', step('git', ['clone', '--quiet', '--shared', '--no-checkout', '--', from, to], { cwd: releaseRoot, logFile: cloneLog, timeoutMs: 10 * MINUTE }), cloneLog);
         await must('checkout', step('git', ['checkout', '--quiet', '--detach', sha], { cwd: to, logFile: cloneLog, timeoutMs: 10 * MINUTE }), cloneLog);
     }
+    if (checkout?.source && plan.omniDir)
+        omniSource = await checkoutFrameworkSource(plan.omniDir, {
+            source: checkout.source, commit: checkout.sha, sourceBase: workspacePath, env, ...(signal && { signal }),
+            run: async (command, args, cwd, toolEnv) => must('framework clone', runStep(command, args, { cwd, env: toolEnv, logFile: cloneLog, timeoutMs: 10 * MINUTE, ...(signal && { signal }) }), cloneLog).then(() => { }),
+        });
     // 2. omni: install, and build what the project links (with what those depend on).
-    stillWanted();
-    say('installing omni', 12);
-    const omniInstallLog = path.join(logs, 'install-omni.log');
-    await must('omni install', step('pnpm', ['install', '--frozen-lockfile'], { cwd: plan.omniDir, logFile: omniInstallLog, timeoutMs: 30 * MINUTE }), omniInstallLog);
-    const linked = layout.linkedDirs.map((dir) => {
-        const manifest = JSON.parse(fs.readFileSync(path.join(plan.omniDir, dir, 'package.json'), 'utf8'));
-        return { dir, name: manifest.name };
-    });
-    say(`building the ${linked.length} omni packages the project links`, 20);
-    const omniBuildLog = path.join(logs, 'build-omni.log');
-    await must('omni build', step('pnpm', ['-r', ...linked.flatMap((l) => ['--filter', `${l.name}...`]), 'run', 'build'], { cwd: plan.omniDir, logFile: omniBuildLog, timeoutMs: 60 * MINUTE }), omniBuildLog);
+    const builtPackages = [];
+    const omniDir = plan.omniDir;
+    if (checkout && omniDir) {
+        stillWanted();
+        say('installing omni', 12);
+        const omniInstallLog = path.join(logs, 'install-omni.log');
+        await must('omni install', step('pnpm', ['install', '--frozen-lockfile'], { cwd: omniDir, logFile: omniInstallLog, timeoutMs: 30 * MINUTE }), omniInstallLog);
+        const linked = checkout.layout.linkedDirs.map((dir) => {
+            const manifest = JSON.parse(fs.readFileSync(path.join(omniDir, dir, 'package.json'), 'utf8'));
+            return { dir, name: manifest.name };
+        });
+        say(`building the ${linked.length} omni packages the project links`, 20);
+        const omniBuildLog = path.join(logs, 'build-omni.log');
+        await must('omni build', step('pnpm', ['-r', ...linked.flatMap((l) => ['--filter', `${l.name}...`]), 'run', 'build'], { cwd: omniDir, logFile: omniBuildLog, timeoutMs: 60 * MINUTE }), omniBuildLog);
+        builtPackages.push(...linked.map(pkg => ({ name: pkg.name, distBuiltAt: distBuiltAt(path.join(omniDir, pkg.dir)) })));
+    }
+    if (layout.kind === 'vendored') {
+        stillWanted();
+        say(`reproducing ${layout.packages.length} framework archives from upstream commit ${omniSource.commit}`, 12);
+        const logFile = path.join(logs, 'reproduce-framework.log');
+        // A project may set environment variables for its own gates. The upstream
+        // build uses only the operator's environment and the build's private temp directory.
+        const upstreamEnv = buildEnv({ ...process.env, TMPDIR: where.tmp });
+        upstreamEnv['PATH'] = [bin, ...(upstreamEnv['PATH'] ?? '').split(path.delimiter).filter(dir => dir && dir !== bin)].join(path.delimiter);
+        registry = await reproduceVendoredFramework(layout.packages, {
+            projectDir: workspacePath, projectCommit: projectSha, frameworkCommit: omniSource.commit,
+            frameworkSource: selectedSource, sourceBase: workspacePath,
+            scratch: path.join(srcRoot, 'framework-proof'), env: upstreamEnv,
+            ...(signal ? { signal } : {}),
+            run: async (command, args, cwd, toolEnv) => {
+                stillWanted();
+                await must('reproduce framework', runStep(command, args, {
+                    cwd, env: toolEnv, logFile, timeoutMs: command === 'git' ? 10 * MINUTE : 60 * MINUTE, ...(signal ? { signal } : {}),
+                }), logFile);
+            },
+        });
+        omniSource = registry.source;
+    }
     // 3. The project: install, then prove the links landed on the clone.
     stillWanted();
     say(`installing ${projectName}`, 35);
     const projectInstallLog = path.join(logs, 'install-project.log');
     await must('project install', step('pnpm', ['install', '--frozen-lockfile'], { cwd: plan.projectDir, logFile: projectInstallLog, timeoutMs: 30 * MINUTE }), projectInstallLog);
-    const links = linkedOutside(plan.projectDir, plan.omniDir);
-    if (links.checked === 0)
-        throw new Error(`The install linked no @omnitron-dev package at all — nothing was built against omni. ${projectInstallLog}`);
-    if (links.outside.length > 0) {
-        throw new Error(`${links.outside.length} of ${links.checked} @omnitron-dev links resolve outside the omni clone, so this build would not be the commit it names:\n  ` +
-            links.outside.slice(0, 5).join('\n  '));
-    }
-    say(`${links.checked} @omnitron-dev links resolve inside the omni clone`, 42);
+    if (omniDir) {
+        const links = linkedOutside(plan.projectDir, omniDir);
+        if (links.checked === 0)
+            throw new Error(`The install linked no @omnitron-dev package at all — nothing was built against omni. ${projectInstallLog}`);
+        if (links.outside.length > 0) {
+            throw new Error(`${links.outside.length} of ${links.checked} @omnitron-dev links resolve outside the omni clone, so this build would not be the commit it names:\n  ` +
+                links.outside.slice(0, 5).join('\n  '));
+        }
+        say(`${links.checked} @omnitron-dev links resolve inside the omni clone`, 42);
+    }
+    else if (registry && layout.kind !== 'linked') {
+        const verified = new Set();
+        let coreInstalled = false;
+        const root = await fs.promises.realpath(plan.projectDir);
+        for (const importer of layout.importers) {
+            const scope = path.join(root, importer, 'node_modules', '@omnitron-dev');
+            if (!fs.existsSync(scope))
+                continue;
+            for (const name of fs.readdirSync(scope)) {
+                const directory = fs.realpathSync(path.join(scope, name));
+                if (!directory.startsWith(root + path.sep) || !path.relative(root, directory).split(path.sep).includes('node_modules'))
+                    throw Error('Framework package resolves outside the frozen installation: ' + directory);
+                const identity = name + '\0' + directory;
+                if (verified.has(identity))
+                    continue;
+                await registry.verifyPackage('@omnitron-dev/' + name, directory);
+                verified.add(identity);
+                if (name === 'omnitron')
+                    coreInstalled = true;
+            }
+        }
+        if (!coreInstalled)
+            throw Error('Declare @omnitron-dev/omnitron in a workspace importer so the frozen installation can be verified');
+        say(`${verified.size} installed framework packages match their verified archives`, 42);
+    }
     // The project's own workspace packages, before anything compiles against
-    // them. Five of daos's declare `dist/index.js` as their entry, and a clean
-    // clone has no `dist`: measured on the first release, paysys failed to
-    // build — `@daos/monero-rpc` unresolved, every callback an implicit `any` —
+    // them. Five of sample's declare `dist/index.js` as their entry, and a clean
+    // clone has no `dist`: measured on the first release, payments failed to
+    // build — `@sample/monero-rpc` unresolved, every callback an implicit `any` —
     // while the developer's tree built it from a `dist` left by some earlier
     // build. The `build` gate would have produced them as a side effect and
     // hidden the missing step; the builder does not lean on a gate's side
@@ -516,11 +661,19 @@ async function buildRelease(projectName, options, onPhase, where) {
     // five red each time and `connect ETIMEDOUT` to containers that were up.
     // Recording the load turns the next hour in a diff into one glance.
     const loadAtGateStart = os.loadavg();
+    const packageGates = readPackageGates(plan.projectDir);
     let gates;
     if (options.skipGates) {
         gates = [{ name: 'gates', status: 'not-run', detail: 'skipped by --skip-gates' }];
         say('gates skipped — recorded as not-run', 80, { gates });
     }
+    else if (packageGates) {
+        say('running the workspace release gates', 50);
+        gates = await runPackageGates(packageGates, (name, index) => step('pnpm', ['run', name], {
+            cwd: plan.projectDir, logFile: path.join(logs, 'gate-' + index + '-' + name.replaceAll(':', '_') + '.log'), timeoutMs: 120 * MINUTE,
+        }), signal);
+        say(`gates: ${gates.filter(g => g.status === 'passed').length} of ${gates.length} passed`, 80, { gates });
+    }
     else if (!fs.existsSync(path.join(plan.projectDir, 'scripts', 'gates.mjs'))) {
         gates = [{ name: 'gates', status: 'not-run', detail: `scripts/gates.mjs does not exist at ${projectSha.slice(0, 8)}` }];
         say('no gates script at this commit — recorded as not-run', 80, { gates });
@@ -534,7 +687,7 @@ async function buildRelease(projectName, options, onPhase, where) {
             logFile: gatesLog,
             timeoutMs: 120 * MINUTE,
         });
-        gates = gateOutcomesFromGates(r.stdout, r.code);
+        gates = gateOutcomesFromGates(r.stdout, r.code, r.timedOut ? 'timed-out' : signal?.aborted || r.code === null ? 'killed' : undefined);
         const passed = gates.filter((g) => g.status === 'passed').length;
         say(`gates: ${passed} of ${gates.length} passed`, 80, { gates });
     }
@@ -553,17 +706,36 @@ async function buildRelease(projectName, options, onPhase, where) {
     const artifactsLog = path.join(logs, 'artifacts.log');
     const { loadEcosystemConfig } = await import('../config/loader.js');
     const { ArtifactBuilder } = await import('../project/artifact-builder.js');
-    const config = await loadEcosystemConfig(plan.projectDir);
-    const apps = config.apps.filter((a) => a.enabled !== false);
+    const configDirectory = path.join(plan.repositoryDir, projectPrefix);
+    const config = await loadEcosystemConfig(configDirectory, 'release');
+    const { releaseBuildEntries } = await import('./artifact-volumes.js');
+    const apps = releaseBuildEntries(config);
+    const { declaredMigrationPrograms } = await import('./migration-programs.js');
+    const migrationPrograms = declaredMigrationPrograms(config, options.forStack);
     const builder = new ArtifactBuilder(plan.projectDir, path.join(releaseRoot, 'artifacts'), {
         info: (msg) => fs.appendFileSync(artifactsLog, `${msg}\n`),
     });
-    const packed = await builder.buildAll(apps);
+    let integrityFailure;
+    const imported = await importReleaseArtifacts(apps.filter(app => app.releaseFrom), path.join(releaseRoot, 'artifacts'));
+    const releaseCheckouts = [plan.repositoryDir, ...(plan.omniDir ? [plan.omniDir] : [])];
+    const packed = await builder.buildAll(apps.filter(app => !app.releaseFrom), { releaseCheckouts, env, migrationPrograms,
+        ...(registry && { verifyFrameworkPackage: async (name, directory) => {
+                try {
+                    await registry.verifyPackage(name, directory);
+                }
+                catch (error) {
+                    integrityFailure = error;
+                    throw error;
+                }
+            } }),
+    });
+    if (integrityFailure)
+        throw integrityFailure;
     // 6. The static bundle, for the stack named — built in the clone.
     let statics = null;
     if (options.forStack) {
         say(`building the static bundle for ${options.forStack}`, 92, { gates });
-        statics = await buildStaticsFor(options.forStack, plan.projectDir, config, releaseRoot, path.join(logs, 'statics.log'), ctx);
+        statics = await buildStaticsFor(options.forStack, configDirectory, config, releaseRoot, path.join(logs, 'statics.log'), ctx);
         say(statics
             ? `static bundle: ${statics.files} files, ${(statics.bytes / 1024 / 1024).toFixed(1)} MB`
             : `${options.forStack} serves no static bundle`, 96, { gates });
@@ -581,29 +753,44 @@ async function buildRelease(projectName, options, onPhase, where) {
     }
     // 7. The manifest — with the migrations the release carries, from the clone
     // of its commit, so admission can refuse one that ran and changed.
-    const { migrationDigests } = await import('./migrations.js');
-    const migrations = await migrationDigests(plan.projectDir);
+    const { releaseMigrationSources } = await import('./migrations.js');
+    const packageDirectories = packed.built.map(artifact => {
+        if (artifact.sourceDirectory === undefined)
+            throw Error('Missing checked package directory for ' + artifact.app);
+        return artifact.sourceDirectory;
+    });
+    const programs = packed.built.flatMap((artifact, i) => (artifact.migrationPrograms ?? [])
+        .map(program => ({ ...program, directory: packageDirectories[i] })));
+    const { migrations, packages } = await releaseMigrationSources(plan.projectDir, projectSha, packageDirectories, programs);
     const manifest = assembleManifest({
         id,
-        project: await sourceOf(projectPath, projectSha),
-        omni: await sourceOf(omniPath, omniSha),
-        artifacts: packed.built,
+        project: { ...projectSource, ...(projectPrefix ? { directory: projectPrefix } : {}),
+            ...(workspace !== projectPrefix && { workspace }) },
+        omni: omniSource,
+        artifacts: packed.built.map((artifact, i) => ({ ...artifact, packageSource: packages.get(packageDirectories[i]) })),
+        target: await (await import('./target-runtime.js')).targetRuntime(),
         artifactFailures: packed.failed,
+        importedArtifacts: imported.artifacts,
+        imports: imported.imports,
         gates,
         omnitron,
-        packages: linked.map((l) => ({ name: l.name, distBuiltAt: distBuiltAt(path.join(plan.omniDir, l.dir)) })),
+        packages: builtPackages,
         machine,
         builtAt: new Date(),
         builtBy: `${os.userInfo().username}@${os.hostname()}`,
         ...(statics ? { statics } : {}),
-        ...(Object.keys(migrations).length > 0 ? { migrations } : {}),
+        migrations,
     });
+    validateReleaseOrigins(manifest);
     const manifestPath = path.join(releaseRoot, 'manifest.json');
-    fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+    const manifestJson = `${JSON.stringify(manifest, null, 2)}\n`;
+    if (Buffer.byteLength(manifestJson) > MAX_RELEASE_MANIFEST_BYTES)
+        throw Error('Release manifest exceeds 8 MiB');
+    fs.writeFileSync(manifestPath, manifestJson);
     if (!options.keepSource)
         fs.rmSync(path.join(releaseRoot, 'src'), { recursive: true, force: true });
     const passed = gates.filter((g) => g.status === 'passed').length;
-    say(`release ${id} — ${passed} of ${gates.length} gates passed, ${packed.built.length} artifact(s)`, 100, { gates });
+    say(`release ${id} — ${passed} of ${gates.length} gates passed, ${manifest.artifacts.length} artifact(s)`, 100, { gates });
     return { id, root: releaseRoot, manifestPath, manifest, durationMs: Date.now() - started };
 }
 //# sourceMappingURL=build-run.js.map