@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/release/import-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-artifacts.js","sourceRoot":"","sources":["../../src/release/import-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAoD,MAAM,eAAe,CAAC;AACrG,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC/G,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD;+FAC+F;AAC/F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAsC,EAAE,WAAmB,EAAE,KAAK,GAAG,YAAY,EAAE;IAG9H,MAAM,SAAS,GAAsB,EAAE,EAAE,OAAO,GAAG,IAAI,GAAG,EAAiC,EAAE,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IACvH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACxJ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;YAAE,SAAS;QACtC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,kCAAkC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxF,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,8BAA8B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC;QAC9B,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC;YACpI,MAAM,KAAK,CAAC,kFAAkF,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG,CAAC,cAAc;YAAE,MAAM,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACnI,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxH,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAClE,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAE,CAAC;QAC9D,8FAA8F;QAC9F,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;QACxF,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,cAAc;YAChF,MAAM,KAAK,CAAC,2CAA2C,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACpH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAChD,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,aAAa,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAC3F,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM;gBACjG,MAAM,KAAK,CAAC,0CAA0C,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACpE,+FAA+F;YAC/F,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC;QAC/F,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QACvE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/release/infrastructure.d.ts

@@ -0,0 +1,6 @@
+import { type DeclaredConfig } from '../project/declared-config.js';
+import type { LoadedRelease } from './load.js';
+/** Read only regular, uniquely named declaration inputs from the very bytes whose digest
+ * was admitted. Application JavaScript is never imported and the rest of the config stays private. */
+export declare function readArchiveInfrastructure(release: LoadedRelease, app: string): Promise<DeclaredConfig>;
+//# sourceMappingURL=infrastructure.d.ts.map

package/dist/release/infrastructure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infrastructure.d.ts","sourceRoot":"","sources":["../../src/release/infrastructure.ts"],"names":[],"mappings":"AAMA,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAI/C;sGACsG;AACtG,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAqD5G"}

package/dist/release/infrastructure.js

@@ -0,0 +1,74 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { once } from 'node:events';
+import { list } from 'tar';
+import { parseDeclaredConfig } from '../project/declared-config.js';
+const canonical = 'config/default.json';
+/** Read only regular, uniquely named declaration inputs from the very bytes whose digest
+ * was admitted. Application JavaScript is never imported and the rest of the config stays private. */
+export async function readArchiveInfrastructure(release, app) {
+    const file = release.files.find((candidate) => candidate.app === app);
+    if (!file || !/^[a-f0-9]{64}$/.test(file.sha256))
+        throw Error('Missing verified release archive for ' + app);
+    const expected = path.join(await fs.realpath(release.root), 'artifacts', app + '-' + file.version + '.tar.gz');
+    if ((await fs.realpath(file.path)) !== expected)
+        throw Error('Infrastructure archive leaves its admitted release');
+    const handle = await fs.open(file.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size !== file.bytes)
+            throw Error('Infrastructure archive size changed for ' + app);
+        const chunks = [];
+        const seen = new Set();
+        let invalid = false;
+        const parser = list({
+            strict: true,
+            onReadEntry(entry) {
+                const raw = entry.path.replace(/^\.\//, '').replace(/\/$/, '');
+                const normalized = path.posix.normalize(raw).normalize('NFC').toLowerCase();
+                if (normalized !== canonical && normalized !== 'config')
+                    return;
+                const directory = normalized === 'config';
+                if (normalized !== raw ||
+                    seen.has(normalized) ||
+                    entry.type !== (directory ? 'Directory' : 'File') ||
+                    entry.size > 1_048_576 ||
+                    entry.size < 0) {
+                    invalid = true;
+                    return;
+                }
+                seen.add(normalized);
+                if (!directory)
+                    entry.on('data', (part) => chunks.push(part));
+            },
+        });
+        const finished = once(parser, 'end');
+        const input = handle.createReadStream({ autoClose: false });
+        const hash = createHash('sha256');
+        try {
+            input.on('data', (part) => hash.update(part));
+            input.on('error', (error) => parser.abort(error));
+            input.pipe(parser);
+            await finished;
+        }
+        finally {
+            input.destroy();
+        }
+        if (hash.digest('hex') !== file.sha256)
+            throw Error('Infrastructure archive changed for ' + app);
+        if (invalid)
+            throw Error('Package ' + app + ' must supply config/default.json as a unique physical file of at most 1 MiB');
+        if (!seen.has(canonical))
+            return { configPath: canonical };
+        const declaration = parseDeclaredConfig(Buffer.concat(chunks).toString('utf8'), canonical);
+        if (declaration.malformed)
+            throw Error('Malformed archived ' + canonical + ' for ' + app);
+        return { configPath: canonical, ...(declaration.omnitron && { omnitron: declaration.omnitron }) };
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=infrastructure.js.map

package/dist/release/infrastructure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infrastructure.js","sourceRoot":"","sources":["../../src/release/infrastructure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAuB,MAAM,+BAA+B,CAAC;AAGzF,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAExC;sGACsG;AACtG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAsB,EAAE,GAAW;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,KAAK,CAAC,uCAAuC,GAAG,GAAG,CAAC,CAAC;IAC7G,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC/G,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ;QAAE,MAAM,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1G,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK;YAAE,MAAM,KAAK,CAAC,0CAA0C,GAAG,GAAG,CAAC,CAAC;QAC9G,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC;YAClB,MAAM,EAAE,IAAI;YACZ,WAAW,CAAC,KAAK;gBACf,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC5E,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,QAAQ;oBAAE,OAAO;gBAChE,MAAM,SAAS,GAAG,UAAU,KAAK,QAAQ,CAAC;gBAC1C,IACE,UAAU,KAAK,GAAG;oBAClB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;oBACpB,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;oBACjD,KAAK,CAAC,IAAI,GAAG,SAAS;oBACtB,KAAK,CAAC,IAAI,GAAG,CAAC,EACd,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACrB,IAAI,CAAC,SAAS;oBAAE,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,CAAC;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnB,MAAM,QAAQ,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,qCAAqC,GAAG,GAAG,CAAC,CAAC;QACjG,IAAI,OAAO;YAAE,MAAM,KAAK,CAAC,UAAU,GAAG,GAAG,GAAG,6EAA6E,CAAC,CAAC;QAC3H,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAC3D,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3F,IAAI,WAAW,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC,qBAAqB,GAAG,SAAS,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC;QAC1F,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/release/installed-artifacts.d.ts

@@ -0,0 +1,12 @@
+import type { OrchestratorControl } from '../orchestrator/execution-contract.js';
+import type { InstalledArtifactObservation } from '../shared/dto/installed-release.js';
+/** Legacy deployment layout locates files only; archive bytes, never this path, identify their release. */
+export declare function installedRoot(name: string, entry: {
+    cwd?: string | undefined;
+    bootstrap?: string | undefined;
+    script?: string | undefined;
+    releaseRoot?: string | undefined;
+}): string;
+/** Names must be exact inventory keys; neither paths nor baselines are accepted from the caller. */
+export declare function inspectInstalledArtifacts(orchestrator: OrchestratorControl, names: string[]): Promise<InstalledArtifactObservation[]>;
+//# sourceMappingURL=installed-artifacts.d.ts.map

package/dist/release/installed-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-artifacts.d.ts","sourceRoot":"","sources":["../../src/release/installed-artifacts.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAsFvF,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,MAAM,CAYtL;AAED,oGAAoG;AACpG,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,4BAA4B,EAAE,CAAC,CA+D3I"}

package/dist/release/installed-artifacts.js

@@ -0,0 +1,199 @@
+import { constants } from 'node:fs';
+import { open, opendir, realpath } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+const MAX_FILE_BYTES = 512 * 1024 * 1024;
+const MAX_ENTRY_BYTES = 16 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 2 * 1024 * 1024 * 1024;
+const MAX_DURATION_MS = 45_000;
+const active = new WeakSet();
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+const stamp = (stat) => `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;
+async function file(filename, maximum, read) {
+    const handle = await open(filename, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const before = await handle.stat();
+        if (!before.isFile() || before.size > maximum)
+            throw new Error('File is not regular or exceeds the inspection size limit');
+        const result = await read(handle);
+        if (stamp(before) !== stamp(await handle.stat()))
+            throw new Error('File changed during inspection');
+        return result;
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+}
+async function hash(handle, signal) {
+    const digest = createHash('sha256');
+    const { size } = await handle.stat();
+    if (size > 0)
+        for await (const chunk of handle.createReadStream({ start: 0, end: size - 1, autoClose: false, signal }))
+            digest.update(chunk);
+    return digest.digest('hex');
+}
+/** Uses the same platform tar as deployment; no shell, extraction or executable archive content. */
+async function tar(handle, args, maximum, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const child = spawn('tar', args, { stdio: ['pipe', 'pipe', 'pipe'], signal, timeout: 10_000, killSignal: 'SIGKILL' });
+        const input = handle.createReadStream({ start: 0, end: MAX_FILE_BYTES - 1, autoClose: false, signal });
+        const chunks = [];
+        let bytes = 0;
+        let failure;
+        const fail = (error) => { failure ??= error; child.kill('SIGKILL'); input.destroy(); };
+        child.stdout.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > maximum)
+                fail(new Error('Archive output exceeds the inspection limit'));
+            else
+                chunks.push(chunk);
+        });
+        // Archive names and local paths must not leak through tar diagnostics to viewers.
+        child.stderr.resume();
+        child.stdin.on('error', () => undefined);
+        input.on('error', fail);
+        child.on('error', error => { failure ??= error; });
+        child.on('close', code => {
+            if (!input.readableEnded)
+                input.destroy();
+            if (failure || code !== 0)
+                reject(failure ?? new Error('Archive member could not be read'));
+            else
+                resolve(Buffer.concat(chunks));
+        });
+        input.pipe(child.stdin);
+    });
+}
+async function archiveEntry(handle, relative, signal) {
+    const names = (await tar(handle, ['-tzf', '-'], 2 * 1024 * 1024, signal)).toString('utf8').split('\n');
+    const matches = names.filter(name => name.replace(/^\.\//, '') === relative);
+    if (matches.length !== 1)
+        return null; // Missing and duplicate members are not evidence.
+    const bytes = await tar(handle, ['-xzOf', '-', '--', matches[0]], MAX_ENTRY_BYTES, signal);
+    return bytes.length ? sha(bytes) : null;
+}
+async function frameworkCommit(root) {
+    try {
+        const entry = createRequire(path.join(root, 'package.json')).resolve('@omnitron-dev/omnitron');
+        let directory = path.dirname(await realpath(entry));
+        for (let depth = 0; depth < 8; depth++, directory = path.dirname(directory)) {
+            const manifest = await file(path.join(directory, 'package.json'), 64 * 1024, h => h.readFile('utf8')).catch(() => null);
+            if (!manifest || JSON.parse(manifest).name !== '@omnitron-dev/omnitron')
+                continue;
+            const build = JSON.parse(await file(path.join(directory, 'dist', 'BUILD.json'), 64 * 1024, h => h.readFile('utf8')));
+            return typeof build.commit === 'string' && /^[a-f0-9]{7,40}$/.test(build.commit) && build.dirty === false ? build.commit : null;
+        }
+    }
+    catch { /* An absent/unreadable stamp is unknown, never this backend's own build. */ }
+    return null;
+}
+function identity(orchestrator, name) {
+    const handle = orchestrator.getHandle(name);
+    if (!handle || handle.name !== name)
+        return null;
+    const entry = handle.entry;
+    return { pid: handle.pid ?? null, startedAt: handle.startedAt, cwd: entry.cwd, bootstrap: entry.bootstrap, script: entry.script, releaseRoot: entry.releaseRoot };
+}
+/** Legacy deployment layout locates files only; archive bytes, never this path, identify their release. */
+export function installedRoot(name, entry) {
+    if (entry.releaseRoot && path.isAbsolute(entry.releaseRoot))
+        return entry.releaseRoot;
+    const bootstrap = entry.bootstrap ?? entry.script;
+    if (!bootstrap)
+        throw new Error('Owner did not report an entry point');
+    const [project, , app, extra] = name.split('/');
+    if (project && app && !extra && path.isAbsolute(bootstrap) && path.basename(bootstrap) === 'bootstrap.js' && path.basename(path.dirname(bootstrap)) === 'dist') {
+        const root = path.dirname(path.dirname(bootstrap));
+        const expectedParent = path.join('/opt/omnitron/artifacts', project, app);
+        if (path.dirname(root) === expectedParent && /^[a-zA-Z0-9._-]+$/.test(path.basename(root)))
+            return root;
+    }
+    if (!entry.cwd)
+        throw new Error('Owner did not report an installation root');
+    return entry.cwd;
+}
+/** Names must be exact inventory keys; neither paths nor baselines are accepted from the caller. */
+export async function inspectInstalledArtifacts(orchestrator, names) {
+    if (!Array.isArray(names) || names.length < 1 || names.length > 32 || names.some(name => typeof name !== 'string' || name.length > 256))
+        throw new Error('Provide 1–32 canonical application names');
+    if (active.has(orchestrator))
+        throw new Error('An installed-file inspection is already running on this node');
+    active.add(orchestrator);
+    const signal = AbortSignal.timeout(MAX_DURATION_MS);
+    const results = [];
+    let bytesRead = 0;
+    try {
+        await orchestrator.refreshObservation?.();
+        for (const name of new Set(names)) {
+            const before = identity(orchestrator, name);
+            const observation = { app: name, pid: before?.pid ?? null, startedAt: before?.startedAt ?? null,
+                observedAt: new Date().toISOString(), state: 'unavailable', entrySha256: null, frameworkCommit: null, archives: [], reasons: [] };
+            results.push(observation);
+            try {
+                signal.throwIfAborted();
+                if (!before)
+                    throw new Error('Canonical application is absent from the owner inventory');
+                if (!(before.bootstrap ?? before.script))
+                    throw new Error('Owner did not report an entry point');
+                const root = await realpath(installedRoot(name, before));
+                const entry = path.resolve(before.cwd ?? root, before.bootstrap ?? before.script);
+                const relative = path.relative(root, entry);
+                if (!relative || relative.startsWith('..') || path.isAbsolute(relative))
+                    throw new Error('Entry point is outside its installation root');
+                // Reject escaping intermediate symlinks as well as symlink entry files.
+                if (await realpath(path.dirname(entry)) !== path.dirname(entry))
+                    throw new Error('Entry point traverses a symbolic link');
+                observation.entrySha256 = await file(entry, MAX_ENTRY_BYTES, h => hash(h, signal));
+                observation.frameworkCommit = await frameworkCommit(root);
+                const archives = [];
+                let entries = 0;
+                for await (const item of await opendir(root)) {
+                    if (++entries > 4096)
+                        throw new Error('Installation directory exceeds the inspection entry limit');
+                    if (item.isFile() && item.name.endsWith('.tar.gz'))
+                        archives.push(item.name);
+                    if (archives.length > 8)
+                        throw new Error('Installation directory exceeds the archive inspection limit');
+                }
+                for (const archive of archives.sort()) {
+                    signal.throwIfAborted();
+                    await file(path.join(root, archive), MAX_FILE_BYTES, async (handle) => {
+                        const { size } = await handle.stat();
+                        bytesRead += size;
+                        if (bytesRead > MAX_TOTAL_BYTES)
+                            throw new Error('Node inspection exceeds the archive byte budget');
+                        const sha256 = await hash(handle, signal);
+                        const entrySha256 = await archiveEntry(handle, relative.split(path.sep).join('/'), signal);
+                        observation.archives.push({ sha256, bytes: size, entrySha256 });
+                    });
+                }
+                observation.state = 'observed';
+                if (!archives.length)
+                    observation.reasons.push('No retained release archive exists in the installation directory');
+                if (!observation.frameworkCommit)
+                    observation.reasons.push('Installed framework has no clean, readable build stamp');
+            }
+            catch (error) {
+                // Filesystem errors include paths. Return a controlled category, never config/env/path values.
+                const message = error instanceof Error ? error.message : '';
+                observation.reasons.push(/^(Canonical|Owner|Entry point|Installation directory|Node inspection|File |Archive |The operation was aborted)/.test(message) ? message : 'Installed files could not be read within the inspection limits');
+                observation.archives = [];
+            }
+            await orchestrator.refreshObservation?.();
+            if (JSON.stringify(before) !== JSON.stringify(identity(orchestrator, name))) {
+                observation.state = 'changed-during-inspection';
+                observation.archives = [];
+                observation.entrySha256 = null;
+                observation.reasons.push('Owner PID, start time or entry changed during inspection; repeat the inspection');
+            }
+        }
+        return results;
+    }
+    finally {
+        active.delete(orchestrator);
+    }
+}
+//# sourceMappingURL=installed-artifacts.js.map

package/dist/release/installed-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-artifacts.js","sourceRoot":"","sources":["../../src/release/installed-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AACrC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,MAAM,KAAK,GAAG,CAAC,IAA6C,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;AAExI,KAAK,UAAU,IAAI,CAAI,QAAgB,EAAE,OAAe,EAAE,IAAwC;IAChG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACtG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC3H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAkB,EAAE,MAAmB;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,IAAI,GAAG,CAAC;QAAE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7I,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,GAAG,CAAC,MAAkB,EAAE,IAAc,EAAE,OAAe,EAAE,MAAmB;IACzF,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACtH,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACvG,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAA0B,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,KAAY,EAAE,EAAE,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9F,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,OAAO;gBAAE,IAAI,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;;gBAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,kFAAkF;QAClF,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACvB,IAAI,CAAC,KAAK,CAAC,aAAa;gBAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,OAAO,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;;gBACvF,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAkB,EAAE,QAAgB,EAAE,MAAmB;IACnF,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvG,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,kDAAkD;IACzF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC/F,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACxH,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,wBAAwB;gBAAE,SAAS;YAClF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAA0C,CAAC;YAC9J,OAAO,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAClI,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,4EAA4E,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,YAAiC,EAAE,IAAY;IAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;AACpK,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAkI;IAC5K,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC,WAAW,CAAC;IACtF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;IAClD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvE,MAAM,CAAC,OAAO,EAAE,AAAD,EAAG,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/J,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1E,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,cAAc,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1G,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,YAAiC,EAAE,KAAe;IAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrM,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9G,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAiC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;gBAC3H,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACpI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;gBACzF,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBACjG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAO,CAAC,CAAC;gBACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC5C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBACzI,wEAAwE;gBACxE,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC1H,WAAW,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBACnF,WAAW,CAAC,eAAe,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;gBAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,IAAI,EAAE,OAAO,GAAG,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;oBACnG,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC7E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;gBAC1G,CAAC;gBACD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;oBACtC,MAAM,CAAC,cAAc,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;wBAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBACrC,SAAS,IAAI,IAAI,CAAC;wBAClB,IAAI,SAAS,GAAG,eAAe;4BAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;wBACpG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;wBAC1C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;wBAC3F,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;oBAClE,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,WAAW,CAAC,KAAK,GAAG,UAAU,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM;oBAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;gBACnH,IAAI,CAAC,WAAW,CAAC,eAAe;oBAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YACvH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,+FAA+F;gBAC/F,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,gHAAgH,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC;gBACtO,WAAW,CAAC,QAAQ,GAAG,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,YAAY,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC5E,WAAW,CAAC,KAAK,GAAG,2BAA2B,CAAC;gBAChD,WAAW,CAAC,QAAQ,GAAG,EAAE,CAAC;gBAC1B,WAAW,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC/B,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAAC,CAAC;AAC5C,CAAC"}

package/dist/release/installed-graph.d.ts

@@ -0,0 +1,28 @@
+interface PackageInfo {
+    name: string;
+    version: string;
+    files?: string[];
+    dependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    peerDependenciesMeta?: Record<string, {
+        optional?: boolean;
+    }>;
+    publishConfig?: Record<string, unknown>;
+}
+export interface InstalledPackage {
+    root: string;
+    metadata: PackageInfo;
+    dependencies: Map<string, number>;
+}
+/** Resolve the installed *production* graph. Real paths distinguish different peer
+ * bindings of the same version; discovery order is stable and cycles are finite. */
+export declare function installedGraph(source: string, overlays?: ReadonlyMap<string, string>, allowedRoots?: readonly string[]): Promise<InstalledPackage[]>;
+/** Copy only published files for workspaces. Registry packages and previously
+ * verified sealed packages are already packed. Never follow a link outside a package. */
+export declare function materializeGraph(packages: readonly InstalledPackage[], destinations: readonly string[], options?: {
+    verifiedPackages?: ReadonlySet<string>;
+    application?: boolean;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=installed-graph.d.ts.map

package/dist/release/installed-graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-graph.d.ts","sourceRoot":"","sources":["../../src/release/installed-graph.ts"],"names":[],"mappings":"AAKA,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AACD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAUD;oFACoF;AACpF,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,EAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA8BrK;AAKD;yFACyF;AACzF,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EACtE,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,IAAI,CAAC,CA6Df"}

package/dist/release/installed-graph.js

@@ -0,0 +1,138 @@
+import fs from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { resolveInstalledDependency } from './package-resolution.js';
+import path from 'node:path';
+const validName = (name) => /^(?:@[\w.-]+\/)?[\w.-]+$/.test(name) &&
+    name.split('/').every(part => part !== '.' && part !== '..' && !part.startsWith('.'));
+const readManifest = async (root) => {
+    const meta = JSON.parse(await fs.readFile(path.join(root, 'package.json'), 'utf8'));
+    if (!meta || !validName(meta.name) || typeof meta.version !== 'string' || !meta.version)
+        throw Error('Invalid installed package at ' + root);
+    return meta;
+};
+/** Resolve the installed *production* graph. Real paths distinguish different peer
+ * bindings of the same version; discovery order is stable and cycles are finite. */
+export async function installedGraph(source, overlays = new Map(), allowedRoots) {
+    const packages = [], known = new Map();
+    async function visit(directory) {
+        let root = await fs.realpath(directory);
+        if (allowedRoots && !allowedRoots.some(parent => root === parent || root.startsWith(parent + path.sep)))
+            throw Error('Installed dependency escapes the frozen checkouts: ' + root);
+        let id = known.get(root);
+        if (id !== undefined)
+            return id;
+        let metadata = await readManifest(root);
+        const overlay = overlays.get(metadata.name);
+        if (overlay && root !== overlay) {
+            const replacement = await readManifest(overlay);
+            if (replacement.name !== metadata.name || replacement.version !== metadata.version)
+                throw Error('Overlay changes installed package identity: ' + metadata.name);
+            root = overlay;
+            metadata = replacement;
+            id = known.get(root);
+            if (id !== undefined)
+                return id;
+        }
+        if (packages.length >= 4096)
+            throw Error('Installed graph exceeds 4096 packages');
+        id = packages.length;
+        known.set(root, id);
+        const item = { root, metadata, dependencies: new Map() };
+        packages.push(item);
+        const names = Object.keys({ ...metadata.dependencies, ...metadata.optionalDependencies, ...metadata.peerDependencies }).sort();
+        for (const name of names) {
+            const target = await resolveInstalledDependency(root, name);
+            if (target)
+                item.dependencies.set(name, await visit(target));
+            else if (!Object.hasOwn(metadata.optionalDependencies ?? {}, name) && !metadata.peerDependenciesMeta?.[name]?.optional)
+                throw Error('Missing installed dependency: ' + metadata.name + ' → ' + name);
+        }
+        return id;
+    }
+    await visit(source);
+    return packages;
+}
+const excluded = new Set(['node_modules', '.git', '.npmrc', '.DS_Store', '.codex', '.agents', '.turbo', '.cache', 'coverage']);
+const reserved = new Set(['.omnitron-closure.json', '.omnitron-release.json', '.artifact-sha256']);
+/** Copy only published files for workspaces. Registry packages and previously
+ * verified sealed packages are already packed. Never follow a link outside a package. */
+export async function materializeGraph(packages, destinations, options = {}) {
+    if (destinations.length !== packages.length || new Set(destinations).size !== packages.length)
+        throw Error('Invalid package destinations');
+    for (const [id, item] of packages.entries()) {
+        const target = destinations[id];
+        await fs.mkdir(target, { recursive: true, mode: 0o755 });
+        const registry = item.root.split(path.sep).includes('node_modules') || options.verifiedPackages?.has(item.root);
+        // Select a publication surface even for a private workspace without a files list.
+        const files = !registry ? new Set(['package.json', 'LICENSE', 'README.md', ...(item.metadata.files ??
+                ['dist', 'config']), ...(id === 0 && options.application ? ['dist', 'config'] : [])]) : null;
+        const copy = async (name) => {
+            if (name !== '.' && (path.isAbsolute(name) || name.split(/[\\/]/).some(p => !p || p === '.' || p === '..') || /[*?{}!]/.test(name)))
+                throw Error('Unsupported publication path in ' + item.metadata.name + ': ' + name + '; use an unpacked publication surface');
+            const from = path.resolve(item.root, name), to = path.resolve(target, name);
+            try {
+                await fs.lstat(from);
+            }
+            catch (e) {
+                if (e.code === 'ENOENT')
+                    return;
+                throw e;
+            }
+            // Check intermediate components of a declared path too.
+            const real = await fs.realpath(from);
+            if (real !== item.root && !real.startsWith(item.root + path.sep))
+                throw Error('Publication path escapes package ' + item.metadata.name);
+            await fs.cp(from, to, { recursive: true, mode: constants.COPYFILE_FICLONE, verbatimSymlinks: true, filter: async (file) => {
+                    const base = path.basename(file);
+                    if (file !== item.root && (excluded.has(base) || base === '.env' || base.startsWith('.env.')))
+                        return false;
+                    if (reserved.has(base))
+                        throw Error('Reserved release metadata in package ' + item.metadata.name);
+                    const stat = await fs.lstat(file);
+                    if (stat.isSymbolicLink()) {
+                        const link = await fs.readlink(file), resolved = await fs.realpath(file);
+                        if (path.isAbsolute(link) || !resolved.startsWith(item.root + path.sep))
+                            throw Error('Non-portable symbolic link in package ' + item.metadata.name);
+                    }
+                    else if (!stat.isFile() && !stat.isDirectory())
+                        throw Error('Unsupported file in package ' + item.metadata.name);
+                    return true;
+                } });
+        };
+        for (const name of files ?? ['.'])
+            await copy(name);
+        if (!registry) {
+            // Equivalent to publish-time entry points. Keep the install's runtime metadata;
+            // private manifest ranges never trigger a package manager on the target.
+            const manifest = { ...item.metadata };
+            for (const name of ['main', 'module', 'exports', 'types', 'bin', 'imports'])
+                if (item.metadata.publishConfig?.[name] !== undefined)
+                    Object.assign(manifest, { [name]: item.metadata.publishConfig[name] });
+            // Dev-only metadata can include absolute developer links and does not belong in an artifact.
+            for (const key of ['devDependencies', 'publishConfig', 'overrides', 'pnpm', 'packageManager'])
+                Reflect.deleteProperty(manifest, key);
+            for (const key of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
+                const deps = manifest[key];
+                if (!deps)
+                    continue;
+                manifest[key] = Object.fromEntries(Object.entries(deps).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([name, version]) => {
+                    const child = item.dependencies.get(name);
+                    if (/^(?:workspace:|link:|file:|\/)/.test(version)) {
+                        if (child === undefined)
+                            throw Error('Cannot publish an unbound local dependency: ' + name);
+                        return [name, packages[child].metadata.version];
+                    }
+                    return [name, version];
+                }));
+            }
+            await fs.writeFile(path.join(target, 'package.json'), JSON.stringify(manifest, null, 2) + '\n');
+        }
+    }
+    for (const [id, item] of packages.entries())
+        for (const [name, child] of item.dependencies) {
+            const link = path.join(destinations[id], 'node_modules', name);
+            await fs.mkdir(path.dirname(link), { recursive: true });
+            await fs.symlink(path.relative(path.dirname(link), destinations[child]), link, 'dir');
+        }
+}
+//# sourceMappingURL=installed-graph.js.map

package/dist/release/installed-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-graph.js","sourceRoot":"","sources":["../../src/release/installed-graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,IAAI,MAAM,WAAW,CAAC;AAiB7B,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxF,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAwB,EAAE;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAgB,CAAC;IACnG,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO;QACrF,MAAM,KAAK,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;oFACoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,QAAQ,GAAgC,IAAI,GAAG,EAAE,EAAE,YAAgC;IACtI,MAAM,QAAQ,GAAuB,EAAE,EAAE,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3E,KAAK,UAAU,KAAK,CAAC,SAAiB;QACpC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACrG,MAAM,KAAK,CAAC,qDAAqD,GAAG,IAAI,CAAC,CAAC;QAC5E,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1D,IAAI,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBAChF,MAAM,KAAK,CAAC,8CAA8C,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9E,IAAI,GAAG,OAAO,CAAC;YAAC,QAAQ,GAAG,WAAW,CAAC;YACvC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI;YAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAClF,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,oBAAoB,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/H,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;iBACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ;gBACpH,MAAM,KAAK,CAAC,gCAAgC,GAAG,QAAQ,CAAC,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAC/H,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,wBAAwB,EAAE,wBAAwB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEnG;yFACyF;AACzF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAqC,EAAE,YAA+B,EACtE,OAAO,GAAsE,EAAE;IAE/E,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAC3F,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,CAAE,CAAC;QACjC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChH,kFAAkF;QAClF,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK;gBAChG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/F,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;YACjD,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjI,MAAM,KAAK,CAAC,kCAAkC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,uCAAuC,CAAC,CAAC;YAC/H,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO;gBAAC,MAAM,CAAC,CAAC;YACtE,CAAC;YACD,wDAAwD;YACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxI,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;oBACtH,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACjC,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;oBAC5G,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,MAAM,KAAK,CAAC,uCAAuC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAClG,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAClC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC1B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBACzE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;4BACrE,MAAM,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC/E,CAAC;yBAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;wBAAE,MAAM,KAAK,CAAC,8BAA8B,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACnH,OAAO,IAAI,CAAC;gBACd,CAAC,EAAE,CAAC,CAAC;QACP,CAAC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,gFAAgF;YAChF,yEAAyE;YACzE,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAU;gBAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,SAAS;oBAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChI,6FAA6F;YAC7F,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAU;gBAAE,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC9I,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,CAAU,EAAE,CAAC;gBACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAChD,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;oBAC7H,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC1C,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBACnD,IAAI,KAAK,KAAK,SAAS;4BAAE,MAAM,KAAK,CAAC,8CAA8C,GAAG,IAAI,CAAC,CAAC;wBAC5F,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACnD,CAAC;oBACD,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACzB,CAAC,CAAC,CAAC,CAAC;YACN,CAAC;YACD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE;QAAE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;YAChE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,KAAK,CAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzF,CAAC;AACH,CAAC"}

package/dist/release/installed-origin.d.ts

@@ -0,0 +1,42 @@
+import { type TargetRuntime } from './target-runtime.js';
+export interface ReleaseArtifactOrigin {
+    releaseId: string;
+    manifestSha256: string;
+    artifactSha256: string;
+    artifactBytes: number;
+    app: string;
+    frameworkCommit: string;
+    runtimeOrigin?: InstalledRuntimeOrigin;
+}
+export interface InstalledRuntimeOrigin {
+    projectCommit: string;
+    producerApp: string;
+    consumer: {
+        releaseId: string;
+        manifestSha256: string;
+        app: string;
+    };
+    entry: {
+        relativeFile: string;
+        mode: 'bootstrap' | 'script';
+    };
+}
+export interface InstalledReleaseReceipt {
+    version: 1 | 2;
+    nodeOptions?: string;
+    target?: TargetRuntime;
+    ownerPackage?: string;
+    origin: ReleaseArtifactOrigin;
+    root: string;
+    treeSha256: string;
+    installedFrameworkCommit: string;
+    frameworkContentUnchanged: boolean;
+    artifactPayloadUnchanged: boolean;
+}
+export declare function validRuntimeOrigin(value: unknown): value is InstalledRuntimeOrigin;
+export declare function validOrigin(value: unknown): value is ReleaseArtifactOrigin;
+/** The same private receipt boundary is used by owners and executing applications. */
+export declare function readInstalledReleaseReceipt(root: string): Promise<InstalledReleaseReceipt>;
+/** Publish complete JSON atomically; readers never observe an empty/partial receipt. */
+export declare function writeInstalledReleaseReceipt(root: string, receipt: InstalledReleaseReceipt): Promise<void>;
+//# sourceMappingURL=installed-origin.d.ts.map

package/dist/release/installed-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-origin.d.ts","sourceRoot":"","sources":["../../src/release/installed-origin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAA;KAAE,CAAC;CAC/D;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB,EAAE,MAAM,CAAC;IACjC,yBAAyB,EAAE,OAAO,CAAC;IACnC,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAQD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CA0BlF;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAa1E;AAED,sFAAsF;AACtF,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA+DhG;AAED,wFAAwF;AACxF,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhH"}