@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/release/definition-inputs.js

@@ -5,12 +5,11 @@
  * infrastructure, what each app declares it needs — is still read from the
  * project directory on the master. So admission refused a release unless the
  * whole working tree equalled its commit: on 2026-09-24 every deployment of
- * daos/test froze the shared checkout for three sessions, and a colleague's
+ * sample/test froze the shared checkout for three sessions, and a colleague's
  * edit to a file no deployment reads twice sent a release back to its build.
  *
  * What the definition actually reads is knowable:
- *   - `omnitron.config.*` and every file it imports relatively — the config
- *     loader bundles exactly that graph;
+ *   - `omnitron.config.*` and its relative import graph;
  *   - each app's bootstrap and every file IT imports relatively — the
  *     bootstrap loader bundles exactly that graph (non-relative imports stay
  *     external, as they do there);
@@ -29,25 +28,37 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
 import { CONFIG_FILE_NAMES } from '../config/loader.js';
-/** Paths relative to the project root, sorted, each once. */
+import { isSafeRelativePath } from '../infrastructure/config-payload.js';
+/** A partial source comparison must never hide inputs outside its Git boundary. */
+export class UnverifiableDefinitionInputError extends Error {
+    name = 'UnverifiableDefinitionInputError';
+}
+/** Paths relative to the configuration root, including siblings in the same repository. */
 export async function definitionInputs(projectPath, bootstraps, 
 /** Directories shipped to nodes, as declared — relative to the project, or absolute. */
 shipped = []) {
     const root = fs.realpathSync(projectPath);
+    const git = async (...args) => (await promisify(execFile)('git', args, { cwd: root, maxBuffer: 16 * 1024 * 1024 })).stdout;
+    const repository = fs.realpathSync((await git('rev-parse', '--show-toplevel')).trimEnd());
+    const inside = (file) => {
+        const relative = path.relative(repository, file);
+        return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+    };
     const configFile = CONFIG_FILE_NAMES.map((name) => path.join(root, name)).find((p) => fs.existsSync(p));
     const entries = [
         ...(configFile ? [configFile] : []),
         ...bootstraps.map((b) => path.resolve(root, b)),
     ];
-    if (entries.length === 0)
-        return [];
     for (const entry of entries) {
         if (!fs.existsSync(entry))
             throw new Error(`a definition entry is missing from the working tree: ${path.relative(root, entry)}`);
     }
     const esbuild = await import('esbuild');
-    const result = await esbuild.build({
+    const result = entries.length ? await esbuild.build({
         entryPoints: entries,
         absWorkingDir: root,
         bundle: true,
@@ -62,15 +73,85 @@ shipped = []) {
             {
                 name: 'externalize-non-relative',
                 setup(build) {
-                    build.onResolve({ filter: /^[^./]/ }, (args) => ({ path: args.path, external: true }));
+                    build.onResolve({ filter: /^[^./]/ }, (args) => args.path.startsWith('file:')
+                        ? { path: fileURLToPath(args.path) } : { path: args.path, external: true });
                 },
             },
         ],
-    });
-    const inputs = new Set(Object.keys(result.metafile.inputs).map((p) => path.normalize(p)));
+    }) : undefined;
+    const inputs = new Set(Object.keys(result?.metafile?.inputs ?? {}).map((p) => path.relative(root, path.resolve(root, p))));
+    const index = (await git('ls-files', '--stage', '--full-name', '-z', '--', ':(top,glob)**')).split('\0').filter(Boolean);
+    const trackedLinks = new Set(index.filter(entry => entry.startsWith('120000 ')).map(entry => path.join(repository, entry.slice(entry.indexOf('\t') + 1))));
+    const followed = new Set();
+    const linkedTargets = new Set();
+    const checkedLinks = new Set();
+    function bindPath(file, record = true) {
+        if (!inside(file) || !inside(fs.realpathSync(file)))
+            throw new UnverifiableDefinitionInputError(`A deployment input is outside the source repository: ${path.relative(root, file)}`);
+        let cursor = repository;
+        let throughLink = false;
+        for (const segment of path.relative(repository, file).split(path.sep).filter(Boolean)) {
+            cursor = path.join(cursor, segment);
+            if (fs.lstatSync(cursor).isSymbolicLink()) {
+                throughLink = true;
+                if (!trackedLinks.has(cursor))
+                    throw new UnverifiableDefinitionInputError(`A deployment input uses an untracked symbolic link: ${path.relative(root, cursor)}`);
+                if (!inside(fs.realpathSync(cursor)))
+                    throw new UnverifiableDefinitionInputError('A deployment symbolic link leaves the source repository');
+                inputs.add(path.relative(root, cursor));
+                if (!checkedLinks.has(cursor)) {
+                    checkedLinks.add(cursor);
+                    bindPath(path.resolve(path.dirname(cursor), fs.readlinkSync(cursor)), false);
+                }
+            }
+        }
+        const physical = fs.realpathSync(file);
+        if (record) {
+            inputs.add(path.relative(root, physical));
+            followed.add(path.relative(root, file));
+            if (throughLink)
+                linkedTargets.add(path.relative(root, physical));
+        }
+    }
+    for (const input of [...inputs])
+        bindPath(path.resolve(root, input));
+    for (const entry of entries)
+        bindPath(entry);
+    // The normal metafile identifies physical sources. Ask esbuild's own resolver
+    // for each original edge with links preserved, rooted at its physical importer.
+    // This binds a logical link without changing the graph's import semantics or
+    // reimplementing extension/package resolution.
+    if (result) {
+        try {
+            await esbuild.build({
+                stdin: { contents: '', resolveDir: root }, absWorkingDir: root,
+                write: false, platform: 'node', preserveSymlinks: true, logLevel: 'silent',
+                plugins: [{ name: 'verify-source-links', setup(build) {
+                            build.onStart(async () => {
+                                for (const [importer, source] of Object.entries(result.metafile.inputs)) {
+                                    for (const dependency of source.imports) {
+                                        if (dependency.external || !dependency.original)
+                                            continue;
+                                        const physicalImporter = path.resolve(root, importer);
+                                        const original = dependency.original.startsWith('file:') ? fileURLToPath(dependency.original) : dependency.original;
+                                        const resolved = await build.resolve(original, { importer: physicalImporter, resolveDir: path.dirname(physicalImporter), kind: dependency.kind });
+                                        if (resolved.errors.length || resolved.namespace !== 'file' || fs.realpathSync(resolved.path) !== fs.realpathSync(path.resolve(root, dependency.path)))
+                                            throw new UnverifiableDefinitionInputError('A deployment import changed while its source links were being verified');
+                                        bindPath(resolved.path);
+                                    }
+                                }
+                            });
+                        } }],
+            });
+        }
+        catch (error) {
+            throw new UnverifiableDefinitionInputError('Deployment source links could not be verified', { cause: error });
+        }
+    }
+    const imported = [...new Set([...inputs, ...followed])];
     const stacksFile = path.join(root, 'omnitron.stacks.json');
     if (fs.existsSync(stacksFile))
-        inputs.add('omnitron.stacks.json');
+        bindPath(stacksFile);
     for (const bootstrap of bootstraps) {
         const configDir = path.join(path.resolve(path.dirname(path.resolve(root, bootstrap)), '..'), 'config');
         let names = [];
@@ -81,10 +162,60 @@ shipped = []) {
             // An app without a config directory declares nothing by path.
         }
         for (const name of names)
-            inputs.add(path.relative(root, path.join(configDir, name)));
+            bindPath(path.join(configDir, name));
+    }
+    for (const dir of shipped) {
+        const base = path.resolve(root, dir);
+        bindPath(base);
+        // Match the actual payload reader: safe directories are traversed; file
+        // symlinks are dereferenced. A directory link is not a readable payload file.
+        const walk = (directory, prefix = '') => {
+            for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+                const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+                if (!isSafeRelativePath(relative))
+                    continue;
+                const file = path.join(directory, entry.name);
+                if (entry.isDirectory())
+                    walk(file, relative);
+                else if (entry.isSymbolicLink()) {
+                    bindPath(file);
+                    if (!fs.statSync(file).isFile())
+                        throw new UnverifiableDefinitionInputError('A shipped symbolic link must resolve to a file');
+                }
+            }
+        };
+        walk(base);
+    }
+    for (const input of inputs) {
+        const file = path.resolve(root, input);
+        if (!inside(file) || (fs.existsSync(file) && !inside(fs.realpathSync(file))))
+            throw new UnverifiableDefinitionInputError(`A deployment input is outside the source repository: ${input}`);
+    }
+    for (const entry of index) {
+        if (entry.startsWith('160000 ')) {
+            const submodule = path.join(repository, entry.slice(entry.indexOf('\t') + 1));
+            if ([...inputs].some(input => {
+                const relative = path.relative(submodule, path.resolve(root, input));
+                return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+            }))
+                throw new UnverifiableDefinitionInputError('Deployment source inside a Git submodule requires its own verified source binding');
+        }
+    }
+    // Imported ignored source has no commit identity. Machine-local secrets read
+    // explicitly by configuration remain runtime inputs, rather than code imports.
+    const commitBound = [...new Set([...imported, ...linkedTargets])];
+    if (commitBound.length) {
+        try {
+            const ignored = await git('--literal-pathspecs', 'ls-files', '--others', '--ignored', '--exclude-standard', '-z', '--', ...commitBound);
+            if (ignored)
+                throw new UnverifiableDefinitionInputError(`A deployment input is ignored by Git: ${ignored.split('\0')[0]}`);
+        }
+        catch (error) {
+            if (error instanceof UnverifiableDefinitionInputError)
+                throw error;
+            throw new UnverifiableDefinitionInputError('Deployment inputs could not be checked against the source repository', { cause: error });
+        }
     }
-    for (const dir of shipped)
-        inputs.add(path.relative(root, path.resolve(root, dir)));
-    return [...inputs].filter((p) => p !== '' && !p.startsWith('..') && !path.isAbsolute(p)).sort();
+    return [...inputs].sort();
 }
 //# sourceMappingURL=definition-inputs.js.map

package/dist/release/definition-inputs.js.map

@@ -1 +1 @@
-{"version":3,"file":"definition-inputs.js","sourceRoot":"","sources":["../../src/release/definition-inputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,UAA6B;AAC7B,wFAAwF;AACxF,OAAO,GAAsB,EAAE;IAE/B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;KAChD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;QACjC,WAAW,EAAE,OAAO;QACpB,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC;QACtD,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,0BAA0B;gBAChC,KAAK,CAAC,KAAK;oBACT,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACzF,CAAC;aACF;SACF;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAElG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAElE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvG,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,OAAO;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAEpF,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClG,CAAC"}
+{"version":3,"file":"definition-inputs.js","sourceRoot":"","sources":["../../src/release/definition-inputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,mFAAmF;AACnF,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,IAAI,GAAG,kCAAkC,CAAC;CACpD;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,UAA6B;AAC7B,wFAAwF;AACxF,OAAO,GAAsB,EAAE;IAE/B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,IAAc,EAAE,EAAE,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACrI,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,OAAO,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClG,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;KAChD,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC;QAClD,WAAW,EAAE,OAAO;QACpB,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC;QACtD,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,0BAA0B;gBAChC,KAAK,CAAC,KAAK;oBACT,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChF,CAAC;aACF;SACF;KACF,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEf,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnI,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3J,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAM,GAAG,IAAI;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,IAAI,gCAAgC,CAAC,wDAAwD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClI,IAAI,MAAM,GAAG,UAAU,CAAC;QACxB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACtF,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,WAAW,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,gCAAgC,CAAC,uDAAuD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;oBAAE,MAAM,IAAI,gCAAgC,CAAC,yDAAyD,CAAC,CAAC;gBAC5I,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9B,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACzB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC1C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACxC,IAAI,WAAW;gBAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,gFAAgF;IAChF,6EAA6E;IAC7E,+CAA+C;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,CAAC;gBAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI;gBAC9D,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ;gBAC1E,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,CAAC,KAAK;4BAClD,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;gCACvB,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oCACxE,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wCACxC,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ;4CAAE,SAAS;wCAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;wCACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;wCACpH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;wCAClJ,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;4CACpJ,MAAM,IAAI,gCAAgC,CAAC,wEAAwE,CAAC,CAAC;wCACvH,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oCAC1B,CAAC;gCACH,CAAC;4BACH,CAAC,CAAC,CAAC;wBACL,CAAC,EAAE,CAAC;aACL,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gCAAgC,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEpD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvG,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,wEAAwE;QACxE,8EAA8E;QAC9E,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE;YAC9C,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACjE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC9C,IAAI,KAAK,CAAC,WAAW,EAAE;oBAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;qBACzC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;oBAChC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACf,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;wBAAE,MAAM,IAAI,gCAAgC,CAAC,gDAAgD,CAAC,CAAC;gBAChI,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1E,MAAM,IAAI,gCAAgC,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrE,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvH,CAAC,CAAC;gBAAE,MAAM,IAAI,gCAAgC,CAAC,mFAAmF,CAAC,CAAC;QACtI,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,qBAAqB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC;YACxI,IAAI,OAAO;gBAAE,MAAM,IAAI,gCAAgC,CAAC,yCAAyC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gCAAgC;gBAAE,MAAM,KAAK,CAAC;YACnE,MAAM,IAAI,gCAAgC,CAAC,sEAAsE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/release/framework-source.d.ts

@@ -0,0 +1,22 @@
+import { type FrameworkSource } from '../shared/framework-source.js';
+import type { ReleaseSource } from './manifest.js';
+export type FrameworkStep = (command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv) => Promise<void>;
+/** Read only committed project metadata, supplied by the build's exact Git snapshot. */
+export declare function projectFrameworkSource(manifest: unknown, override?: unknown): FrameworkSource | undefined;
+/** A legacy package may omit repository metadata. The packager's own declared
+ * package metadata is the compatibility default, not a provider encoded in code. */
+export declare function defaultFrameworkSource(repository?: unknown): FrameworkSource;
+/** Preserve recorded identity while resolving local inputs against the selected project. */
+export declare function frameworkRepositoryLocation(repository: string, projectDirectory: string): string;
+export declare function requireFrameworkRef(checkout: string, source: FrameworkSource, commit: string, location: string, signal?: AbortSignal): Promise<void>;
+/** One source-selection path for linked SDKs, archive reproduction and an explicit
+ * registry ref constraint. The clone is visible in the build's normal progress/logs. */
+export declare function checkoutFrameworkSource(destination: string, options: {
+    source: FrameworkSource;
+    commit: string;
+    sourceBase: string;
+    env: NodeJS.ProcessEnv;
+    run: FrameworkStep;
+    signal?: AbortSignal;
+}): Promise<ReleaseSource>;
+//# sourceMappingURL=framework-source.d.ts.map

package/dist/release/framework-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-source.d.ts","sourceRoot":"","sources":["../../src/release/framework-source.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqD,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGxH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpH,wFAAwF;AACxF,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAOzG;AAED;oFACoF;AACpF,wBAAgB,sBAAsB,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,eAAe,CAO5E;AAED,4FAA4F;AAC5F,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAGhG;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EACjG,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvD;AAED;wFACwF;AACxF,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;IAC1E,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACpF,GAAG,EAAE,aAAa,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC1C,GAAG,OAAO,CAAC,aAAa,CAAC,CAYzB"}

package/dist/release/framework-source.js

@@ -0,0 +1,54 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { frameworkRepositoryMetadata, parseFrameworkSource } from '../shared/framework-source.js';
+import { networkRepository, sourceRefContains } from './source.js';
+import { sourcePublication } from './source.js';
+/** Read only committed project metadata, supplied by the build's exact Git snapshot. */
+export function projectFrameworkSource(manifest, override) {
+    if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest))
+        throw Error('Committed package.json must be an object');
+    const project = manifest;
+    if (project.omnitron !== undefined && (!project.omnitron || typeof project.omnitron !== 'object' || Array.isArray(project.omnitron)))
+        throw Error('Committed package.json omnitron configuration must be an object');
+    const selected = override === undefined ? project.omnitron?.framework : override;
+    return selected === undefined ? undefined : parseFrameworkSource(selected);
+}
+/** A legacy package may omit repository metadata. The packager's own declared
+ * package metadata is the compatibility default, not a provider encoded in code. */
+export function defaultFrameworkSource(repository) {
+    const declared = frameworkRepositoryMetadata(repository);
+    if (declared)
+        return parseFrameworkSource({ repository: declared });
+    const own = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+    const fallback = frameworkRepositoryMetadata(own.repository);
+    if (!fallback)
+        throw Error('Configure omnitron.framework.repository; the framework package has no repository metadata');
+    return parseFrameworkSource({ repository: fallback });
+}
+/** Preserve recorded identity while resolving local inputs against the selected project. */
+export function frameworkRepositoryLocation(repository, projectDirectory) {
+    if (networkRepository(repository) || repository.startsWith('file://'))
+        return repository.replace(/^git\+(?=(?:https?|ssh):\/\/)/, '');
+    return repository.startsWith('~/') ? path.join(os.homedir(), repository.slice(2)) : path.resolve(projectDirectory, repository);
+}
+export async function requireFrameworkRef(checkout, source, commit, location, signal) {
+    if (source.ref && await sourceRefContains(checkout, location, commit, source.ref, signal) !== true)
+        throw Error('The selected framework ref does not prove the requested commit; verify source access and the exact ref');
+}
+/** One source-selection path for linked SDKs, archive reproduction and an explicit
+ * registry ref constraint. The clone is visible in the build's normal progress/logs. */
+export async function checkoutFrameworkSource(destination, options) {
+    const { commit, sourceBase, signal, run } = options;
+    const source = parseFrameworkSource(options.source);
+    const location = frameworkRepositoryLocation(source.repository, sourceBase);
+    const env = { ...options.env, GIT_NO_REPLACE_OBJECTS: '1', GIT_TERMINAL_PROMPT: '0' };
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    signal?.throwIfAborted();
+    await run('git', ['clone', '--no-checkout', '--', location, destination], path.dirname(destination), env);
+    await run('git', ['checkout', '--detach', commit], destination, env);
+    await requireFrameworkRef(destination, source, commit, location, signal);
+    return { repo: source.repository, commit, ...(source.ref && { ref: source.ref }),
+        onRemote: await sourcePublication(destination, location, commit, { ...(source.ref && { ref: source.ref }), ...(signal && { signal }) }) };
+}
+//# sourceMappingURL=framework-source.js.map

package/dist/release/framework-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-source.js","sourceRoot":"","sources":["../../src/release/framework-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAwB,MAAM,+BAA+B,CAAC;AACxH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKhD,wFAAwF;AACxF,MAAM,UAAU,sBAAsB,CAAC,QAAiB,EAAE,QAAkB;IAC1E,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAClI,MAAM,OAAO,GAAG,QAAkD,CAAC;IACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClI,MAAM,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjF,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,UAAoB;IACzD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,QAAQ;QAAE,OAAO,oBAAoB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAA6B,CAAC;IAC5H,MAAM,QAAQ,GAAG,2BAA2B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,2FAA2F,CAAC,CAAC;IACxH,OAAO,oBAAoB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,UAAkB,EAAE,gBAAwB;IACtF,IAAI,iBAAiB,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;IACtI,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,MAAuB,EAAE,MAAc,EACjG,QAAgB,EAAE,MAAoB;IACtC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI;QAChG,MAAM,KAAK,CAAC,wGAAwG,CAAC,CAAC;AAC1H,CAAC;AAED;wFACwF;AACxF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,WAAmB,EAAE,OAGlE;IACC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;IACtF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1G,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAC9E,QAAQ,EAAE,MAAM,iBAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9I,CAAC"}

package/dist/release/frozen-installation.d.ts

@@ -0,0 +1,23 @@
+import { type TargetRuntime } from './target-runtime.js';
+import { type ReleaseArtifactOrigin } from './installed-origin.js';
+import type { ReleaseLaunch } from './manifest.js';
+/** Validate manifest data before any destination is created or archive is transferred. */
+export declare function assertFrozenLaunch(launch: ReleaseLaunch | undefined, origin?: ReleaseArtifactOrigin): asserts launch is ReleaseLaunch;
+export declare function frozenMember(root: string, relative: string): Promise<string>;
+/** A fresh directory, no special files, hardlinks, path aliases or writes through a symlink. */
+export declare function extractFrozenArchive(archive: string, directory: string): Promise<void>;
+export declare function assertFrozenDirectory(dir: string): Promise<void>;
+/** The packed application owns every dependency and its bootstrap adapter. The
+ * execution owner supplies the exact Node image, lifecycle and authorization. */
+export declare function verifyFrozenApplication(root: string, launch: ReleaseLaunch, runtime: TargetRuntime, nodeOptions: string): Promise<string>;
+/** Immutable payload proof does not require or execute a JavaScript launch entry. */
+export declare function verifyFrozenPayload(root: string, closureSha256: string, runtime: TargetRuntime, nodeOptions?: string): Promise<void>;
+/** A receipt is operational evidence, never a trusted member of a build archive. */
+export declare function assertNoReleaseMetadata(root: string): Promise<void>;
+/** Execute the same archive and closure checks on the receiving host. No package
+ * installation, graph rebinding or application module evaluation is performed. */
+export declare function installFrozenApplicationCommand(directory: string, archiveName: string, launch: ReleaseLaunch, origin: ReleaseArtifactOrigin, owner: {
+    root: string;
+    executable: string;
+}, nodeOptions: string, controlPackage: string): string;
+//# sourceMappingURL=frozen-installation.d.ts.map

package/dist/release/frozen-installation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frozen-installation.d.ts","sourceRoot":"","sources":["../../src/release/frozen-installation.ts"],"names":[],"mappings":"AAYA,OAAO,EAA0D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjH,OAAO,EAA6C,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnD,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAKrI;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKlF;AAED,gGAAgG;AAChG,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B5F;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,iBAItD;AAGD;iFACiF;AACjF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU/I;AAED,qFAAqF;AACrF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB1I;AAED,oFAAoF;AACpF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzE;AAED;kFACkF;AAClF,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAC3G,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAkCjI"}

package/dist/release/frozen-installation.js

@@ -0,0 +1,159 @@
+import { constants } from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { extract, list } from 'tar';
+import { applicationBootstrapRuntime } from '../orchestrator/application-runtime.js';
+import { resolveApplicationBootstrapRuntime } from '../orchestrator/application-runtime-resolution.js';
+import { shellEscape } from '../shared/shell-escape.js';
+import { loadRuntimeExtractor } from './runtime-extractor.js';
+import { CLOSURE_FILE } from './application-closure.js';
+import { RELEASE_RECEIPT, releaseTreeDigest } from './runtime-provenance.js';
+import { assertReleaseTarget, targetRuntime, releaseNodeOptions } from './target-runtime.js';
+import { writeInstalledReleaseReceipt, validOrigin } from './installed-origin.js';
+const digest = (s) => /^[a-f0-9]{64}$/.test(s);
+const componentPath = (s) => s.length <= 4096 && !s.includes('\\') && !s.includes(':') &&
+    !s.includes('\0') && s.split('/').every(part => part && part !== '.' && part !== '..');
+const inside = (root, name) => name.startsWith(root + path.sep);
+/** Validate manifest data before any destination is created or archive is transferred. */
+export function assertFrozenLaunch(launch, origin) {
+    if (!launch || !['bootstrap', 'script'].includes(launch.mode) || typeof launch.file !== 'string' ||
+        !componentPath(launch.file) || !/\.[cm]?js$/.test(launch.file) || !digest(launch.closureSha256) ||
+        (origin && (!origin.runtimeOrigin || origin.runtimeOrigin.entry.mode !== launch.mode || origin.runtimeOrigin.entry.relativeFile !== launch.file)))
+        throw Error('Checked release lacks a valid admitted compiled launch; rebuild it before deployment');
+}
+export async function frozenMember(root, relative) {
+    if (!componentPath(relative) || !/\.[cm]?js$/.test(relative))
+        throw Error('Expected a package-relative compiled JavaScript entry: ' + relative);
+    const file = path.join(root, relative);
+    if (file !== await fs.realpath(file) || !(await fs.lstat(file)).isFile())
+        throw Error('Release entry must be a physical file: ' + relative);
+    return file;
+}
+/** A fresh directory, no special files, hardlinks, path aliases or writes through a symlink. */
+export async function extractFrozenArchive(archive, directory) {
+    let invalid, bytes = 0;
+    const names = new Map();
+    await list({ file: archive, strict: true, onReadEntry(entry) {
+            if (invalid)
+                return;
+            const name = entry.path.replace(/\/$/, ''), key = name.normalize('NFC').toLowerCase();
+            if (path.resolve(directory, name) === path.resolve(archive) || !componentPath(name) || names.has(key) || [RELEASE_RECEIPT, '.artifact-sha256'].includes(path.posix.basename(key)) ||
+                !['File', 'Directory', 'SymbolicLink'].includes(entry.type) || names.size >= 200_000 ||
+                !Number.isSafeInteger(entry.size) || entry.size < 0 || entry.size > 268_435_456 || (bytes += entry.size) > 2_147_483_648) {
+                invalid = 'Invalid release archive member: ' + name;
+                return;
+            }
+            names.set(key, entry.type);
+            if (entry.type === 'SymbolicLink') {
+                const link = entry.linkpath ?? '', resolved = path.posix.normalize(path.posix.join(path.posix.dirname(name), link));
+                if (!link || /[\\:\0]/.test(link) || path.posix.isAbsolute(link) || resolved === '..' || resolved.startsWith('../'))
+                    invalid = 'Release archive link leaves its root: ' + name;
+            }
+        } });
+    if (invalid)
+        throw Error(invalid);
+    // Entries may occur in any order. A link to an in-tree directory is fine, writing through that link is not.
+    for (const name of names.keys()) {
+        for (let p = path.posix.dirname(name); p !== '.'; p = path.posix.dirname(p)) {
+            if (names.get(p) !== 'Directory')
+                throw Error('Invalid release archive parent: ' + p);
+        }
+    }
+    await extract({ file: archive, cwd: directory, strict: true, preserveOwner: false, noChmod: false });
+}
+export async function assertFrozenDirectory(dir) {
+    const s = await fs.lstat(dir);
+    if (!s.isDirectory() || await fs.realpath(dir) !== dir || (s.mode & 0o077) || (process.getuid && s.uid !== process.getuid()))
+        throw Error('Frozen installation requires a private physical directory: ' + dir);
+}
+/** The packed application owns every dependency and its bootstrap adapter. The
+ * execution owner supplies the exact Node image, lifecycle and authorization. */
+export async function verifyFrozenApplication(root, launch, runtime, nodeOptions) {
+    assertFrozenLaunch(launch);
+    await verifyFrozenPayload(root, launch.closureSha256, runtime, nodeOptions);
+    const file = await frozenMember(root, launch.file);
+    if (launch.mode === 'bootstrap') {
+        const adapter = await fs.realpath(createRequire(file).resolve('@omnitron-dev/omnitron'));
+        if (!inside(root, adapter) || !inside(root, await fs.realpath(await applicationBootstrapRuntime(file, adapter))))
+            throw Error('Frozen release must supply its own aligned Omnitron adapter');
+    }
+    return file;
+}
+/** Immutable payload proof does not require or execute a JavaScript launch entry. */
+export async function verifyFrozenPayload(root, closureSha256, runtime, nodeOptions) {
+    if (!digest(closureSha256))
+        throw Error('Frozen payload requires a recorded closure digest');
+    await assertFrozenDirectory(root);
+    const handle = await fs.open(path.join(root, CLOSURE_FILE), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    let raw;
+    try {
+        const s = await handle.stat();
+        if (!s.isFile() || s.size > 2_000_000)
+            throw Error('Invalid frozen closure record');
+        raw = await handle.readFile();
+    }
+    finally {
+        await handle.close();
+    }
+    if (createHash('sha256').update(raw).digest('hex') !== closureSha256)
+        throw Error('Frozen closure differs from the admitted manifest');
+    const c = JSON.parse(raw.toString('utf8'));
+    if (c.protocol !== 1 || !digest(c.payloadSha256) || typeof c.nodeOptions !== 'string' ||
+        releaseNodeOptions(c.nodeOptions) !== c.nodeOptions || (nodeOptions !== undefined && c.nodeOptions !== nodeOptions))
+        throw Error('Frozen release closure, execution target or Node options differ from the build');
+    assertReleaseTarget(c.runtime, runtime);
+    if (await releaseTreeDigest(root, true, false, [CLOSURE_FILE]) !== c.payloadSha256)
+        throw Error('Frozen release files differ from the admitted payload');
+}
+/** A receipt is operational evidence, never a trusted member of a build archive. */
+export async function assertNoReleaseMetadata(root) {
+    for (const name of [RELEASE_RECEIPT, '.artifact-sha256']) {
+        const stat = await fs.lstat(path.join(root, name)).catch((error) => {
+            if (error.code !== 'ENOENT')
+                throw error;
+            return null;
+        });
+        if (stat)
+            throw Error('Unexpected operational metadata in frozen release: ' + name);
+    }
+}
+/** Execute the same archive and closure checks on the receiving host. No package
+ * installation, graph rebinding or application module evaluation is performed. */
+export function installFrozenApplicationCommand(directory, archiveName, launch, origin, owner, nodeOptions, controlPackage) {
+    if (!validOrigin(origin) || ![directory, owner.root, owner.executable, controlPackage].every(p => path.isAbsolute(p)) ||
+        !/^[a-zA-Z0-9._+-]+\.tar\.gz$/.test(archiveName) || archiveName.includes('..'))
+        throw Error('Verified frozen installation requires an admitted origin and physical execution owner');
+    assertFrozenLaunch(launch, origin);
+    releaseNodeOptions(nodeOptions);
+    const source = `import fsSync,{constants,createReadStream} from 'node:fs';import fs from 'node:fs/promises';
+import path from 'node:path';import {createHash} from 'node:crypto';import {createRequire} from 'node:module';
+const {list,extract}=await (${loadRuntimeExtractor.toString()})(${JSON.stringify(controlPackage)});
+const CLOSURE_FILE=${JSON.stringify(CLOSURE_FILE)},RELEASE_RECEIPT=${JSON.stringify(RELEASE_RECEIPT)};
+const digest=${digest.toString()},componentPath=${componentPath.toString()},inside=${inside.toString()};
+const assertFrozenLaunch=${assertFrozenLaunch.toString()};
+const assertFrozenDirectory=${assertFrozenDirectory.toString()},frozenMember=${frozenMember.toString()};
+const extractFrozenArchive=${extractFrozenArchive.toString()},releaseTreeDigest=${releaseTreeDigest.toString()};
+const applicationBootstrapRuntime=((fs)=>(${resolveApplicationBootstrapRuntime.toString()}))(fsSync);
+const releaseNodeOptions=${releaseNodeOptions.toString()},verifyFrozenPayload=${verifyFrozenPayload.toString()};
+const targetRuntime=${targetRuntime.toString()},assertReleaseTarget=${assertReleaseTarget.toString()},verifyFrozenApplication=${verifyFrozenApplication.toString()};
+const assertNoReleaseMetadata=${assertNoReleaseMetadata.toString()},writeInstalledReleaseReceipt=${writeInstalledReleaseReceipt.toString()};
+const root=${JSON.stringify(directory)},archive=path.join(root,${JSON.stringify(archiveName)}),origin=${JSON.stringify(origin)};
+await assertFrozenDirectory(root);await assertNoReleaseMetadata(root);
+const before=await fs.lstat(archive,{bigint:true});
+if(!before.isFile()||before.size!==BigInt(origin.artifactBytes))throw Error('Delivered frozen archive size or type differs');
+const hash=createHash('sha256');for await(const bytes of createReadStream(archive))hash.update(bytes);
+if(hash.digest('hex')!==origin.artifactSha256)throw Error('Delivered frozen archive digest differs');
+await extractFrozenArchive(archive,root);
+const after=await fs.lstat(archive,{bigint:true});
+if(before.ino!==after.ino||before.dev!==after.dev||before.ctimeNs!==after.ctimeNs)throw Error('Delivered archive changed while extracting');
+await fs.unlink(archive);await assertNoReleaseMetadata(root);
+const target=await targetRuntime();await verifyFrozenApplication(root,${JSON.stringify(launch)},target,${JSON.stringify(nodeOptions)});
+await writeInstalledReleaseReceipt(root,{version:2,root,origin,ownerPackage:await fs.realpath(${JSON.stringify(owner.root)}),target,
+nodeOptions:${JSON.stringify(nodeOptions)},treeSha256:await releaseTreeDigest(root),installedFrameworkCommit:origin.frameworkCommit,
+frameworkContentUnchanged:true,artifactPayloadUnchanged:true});
+console.log(JSON.stringify(${JSON.stringify(nodeOptions)}));`;
+    return `env -u NODE_OPTIONS -u NODE_PATH ${shellEscape(owner.executable)} --input-type=module -e ${shellEscape(source)}`;
+}
+//# sourceMappingURL=frozen-installation.js.map

package/dist/release/frozen-installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frozen-installation.js","sourceRoot":"","sources":["../../src/release/frozen-installation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAAsB,MAAM,qBAAqB,CAAC;AACjH,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAA8B,MAAM,uBAAuB,CAAC;AAG9G,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvD,MAAM,aAAa,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC5F,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AACzF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhF,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,MAAiC,EAAE,MAA8B;IAClG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC5F,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/F,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;QACnJ,MAAM,KAAK,CAAC,sFAAsF,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IAC/D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,KAAK,CAAC,yDAAyD,GAAG,QAAQ,CAAC,CAAC;IAChJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;QAAE,MAAM,KAAK,CAAC,yCAAyC,GAAG,QAAQ,CAAC,CAAC;IAC5I,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,SAAiB;IAC3E,IAAI,OAA2B,EAAE,KAAK,GAAG,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK;YACzD,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACtF,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC/K,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO;gBACpF,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,WAAW,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,EAAE,CAAC;gBAC3H,OAAO,GAAG,kCAAkC,GAAG,IAAI,CAAC;gBAAC,OAAO;YAC9D,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpH,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;oBACjH,OAAO,GAAG,wCAAwC,GAAG,IAAI,CAAC;YAC9D,CAAC;QACH,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,OAAO;QAAE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,4GAA4G;IAC5G,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,WAAW;gBAAE,MAAM,KAAK,CAAC,kCAAkC,GAAG,CAAC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1H,MAAM,KAAK,CAAC,6DAA6D,GAAG,GAAG,CAAC,CAAC;AACrF,CAAC;AAGD;iFACiF;AACjF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,MAAqB,EAAE,OAAsB,EAAE,WAAmB;IAC5H,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9G,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,aAAqB,EAAE,OAAsB,EAAE,WAAoB;IACzH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC7F,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9H,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACpF,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACnC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,aAAa;QAAE,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvI,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACnF,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC;QACnH,MAAM,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAChG,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa;QAAE,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3J,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;YACxF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,IAAI;YAAE,MAAM,KAAK,CAAC,qDAAqD,GAAG,IAAI,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,+BAA+B,CAAC,SAAiB,EAAE,WAAmB,EAAE,MAAqB,EAC3G,MAA6B,EAAE,KAA2C,EAAE,WAAmB,EAAE,cAAsB;IACvH,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjH,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChF,MAAM,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACvG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG;;8BAEa,oBAAoB,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;qBAC3E,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;eACrF,MAAM,CAAC,QAAQ,EAAE,kBAAkB,aAAa,CAAC,QAAQ,EAAE,WAAW,MAAM,CAAC,QAAQ,EAAE;2BAC3E,kBAAkB,CAAC,QAAQ,EAAE;8BAC1B,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,YAAY,CAAC,QAAQ,EAAE;6BACzE,oBAAoB,CAAC,QAAQ,EAAE,sBAAsB,iBAAiB,CAAC,QAAQ,EAAE;4CAClE,kCAAkC,CAAC,QAAQ,EAAE;2BAC9D,kBAAkB,CAAC,QAAQ,EAAE,wBAAwB,mBAAmB,CAAC,QAAQ,EAAE;sBACxF,aAAa,CAAC,QAAQ,EAAE,wBAAwB,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,uBAAuB,CAAC,QAAQ,EAAE;gCAClI,uBAAuB,CAAC,QAAQ,EAAE,iCAAiC,4BAA4B,CAAC,QAAQ,EAAE;aAC7H,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;;;;;;;;;;wEAUtD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;gGACpC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;cAC5G,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;6BAEZ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC;IAC5D,OAAO,oCAAoC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,2BAA2B,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3H,CAAC"}

package/dist/release/import-artifacts.d.ts

@@ -0,0 +1,9 @@
+import type { IEcosystemAppEntry } from '../config/types.js';
+import { type ReleaseArtifact, type ReleaseManifestImport } from './manifest.js';
+/** Materialize exact admitted producer archives in the normal release directory.
+ * No extraction, rebuilding, dependency installation or producer application code executes. */
+export declare function importReleaseArtifacts(entries: readonly IEcosystemAppEntry[], destination: string, store?: string): Promise<{
+    artifacts: ReleaseArtifact[];
+    imports: ReleaseManifestImport[];
+}>;
+//# sourceMappingURL=import-artifacts.d.ts.map

package/dist/release/import-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-artifacts.d.ts","sourceRoot":"","sources":["../../src/release/import-artifacts.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,EAAsB,KAAK,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAIrG;+FAC+F;AAC/F,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,SAAiB,GAAG,OAAO,CAAC;IACzI,SAAS,EAAE,eAAe,EAAE,CAAC;IAAC,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAChE,CAAC,CAuCD"}

package/dist/release/import-artifacts.js

@@ -0,0 +1,60 @@
+import { constants } from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { assertReleaseId, loadRelease, releasesRoot } from './load.js';
+import { decideStackRelease } from './manifest.js';
+import { artifactReleaseContext, assertImportableArtifact, assertReleaseArtifactReference } from './origin.js';
+import { sha256File } from './portable-archive.js';
+/** Materialize exact admitted producer archives in the normal release directory.
+ * No extraction, rebuilding, dependency installation or producer application code executes. */
+export async function importReleaseArtifacts(entries, destination, store = releasesRoot()) {
+    const artifacts = [], imports = new Map(), names = new Set();
+    const directory = await fs.realpath(destination);
+    if (directory !== path.resolve(destination) || !(await fs.lstat(directory)).isDirectory())
+        throw Error('Release artifacts need a physical destination');
+    for (const entry of entries) {
+        if (entry.enabled === false)
+            continue;
+        assertReleaseId(entry.name);
+        if (names.has(entry.name))
+            throw Error('Duplicate imported application: ' + entry.name);
+        names.add(entry.name);
+        assertReleaseArtifactReference(entry.releaseFrom);
+        const ref = entry.releaseFrom;
+        if (entry.bootstrap || entry.script || entry.releaseRoot || entry.releaseEntry || (entry.watch !== undefined && entry.watch !== false))
+            throw Error('An imported application cannot override its release entry, boundary or watcher: ' + entry.name);
+        const source = await loadRelease(ref.release, store);
+        if (source.manifestSha256 !== ref.manifestSha256)
+            throw Error('Producer manifest differs from the pinned release: ' + ref.release);
+        const decision = decideStackRelease(source.manifest, undefined, [ref.app]);
+        if (decision.action === 'refuse')
+            throw Error('Cannot import ' + ref.release + '/' + ref.app + ': ' + decision.because);
+        const producer = artifactReleaseContext(source.manifest, ref.app);
+        assertImportableArtifact(producer.manifest, producer.artifact);
+        const artifact = source.manifest.artifacts.find(item => item.app === ref.app);
+        const file = source.files.find(item => item.app === ref.app);
+        // Preserve the producer's bytes exactly; JSON serialization would change its admitted digest.
+        const manifestJson = await fs.readFile(path.join(source.root, 'manifest.json'), 'utf8');
+        if (createHash('sha256').update(manifestJson).digest('hex') !== ref.manifestSha256)
+            throw Error('Producer manifest changed during import: ' + ref.release);
+        if (Buffer.byteLength(manifestJson) > 4_194_304)
+            throw Error('Producer manifest exceeds the import evidence limit');
+        const temporary = await fs.mkdtemp(path.join(directory, '.import-'));
+        try {
+            const staged = path.join(temporary, 'artifact');
+            await fs.copyFile(file.path, staged, constants.COPYFILE_EXCL | constants.COPYFILE_FICLONE);
+            if ((await fs.stat(staged)).size !== artifact.bytes || await sha256File(staged) !== artifact.sha256)
+                throw Error('Producer archive changed during import: ' + ref.app);
+            // link is atomic and refuses an existing destination; rename could overwrite a local artifact.
+            await fs.link(staged, path.join(directory, entry.name + '-' + artifact.version + '.tar.gz'));
+        }
+        finally {
+            await fs.rm(temporary, { recursive: true, force: true });
+        }
+        artifacts.push({ ...artifact, app: entry.name, origin: { ...ref } });
+        imports.set(ref.manifestSha256, { sha256: ref.manifestSha256, manifestJson });
+    }
+    return { artifacts, imports: [...imports.values()] };
+}
+//# sourceMappingURL=import-artifacts.js.map