@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/release/framework-source.js

@@ -0,0 +1,54 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { frameworkRepositoryMetadata, parseFrameworkSource } from '../shared/framework-source.js';
+import { networkRepository, sourceRefContains } from './source.js';
+import { sourcePublication } from './source.js';
+/** Read only committed project metadata, supplied by the build's exact Git snapshot. */
+export function projectFrameworkSource(manifest, override) {
+    if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest))
+        throw Error('Committed package.json must be an object');
+    const project = manifest;
+    if (project.omnitron !== undefined && (!project.omnitron || typeof project.omnitron !== 'object' || Array.isArray(project.omnitron)))
+        throw Error('Committed package.json omnitron configuration must be an object');
+    const selected = override === undefined ? project.omnitron?.framework : override;
+    return selected === undefined ? undefined : parseFrameworkSource(selected);
+}
+/** A legacy package may omit repository metadata. The packager's own declared
+ * package metadata is the compatibility default, not a provider encoded in code. */
+export function defaultFrameworkSource(repository) {
+    const declared = frameworkRepositoryMetadata(repository);
+    if (declared)
+        return parseFrameworkSource({ repository: declared });
+    const own = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+    const fallback = frameworkRepositoryMetadata(own.repository);
+    if (!fallback)
+        throw Error('Configure omnitron.framework.repository; the framework package has no repository metadata');
+    return parseFrameworkSource({ repository: fallback });
+}
+/** Preserve recorded identity while resolving local inputs against the selected project. */
+export function frameworkRepositoryLocation(repository, projectDirectory) {
+    if (networkRepository(repository) || repository.startsWith('file://'))
+        return repository.replace(/^git\+(?=(?:https?|ssh):\/\/)/, '');
+    return repository.startsWith('~/') ? path.join(os.homedir(), repository.slice(2)) : path.resolve(projectDirectory, repository);
+}
+export async function requireFrameworkRef(checkout, source, commit, location, signal) {
+    if (source.ref && await sourceRefContains(checkout, location, commit, source.ref, signal) !== true)
+        throw Error('The selected framework ref does not prove the requested commit; verify source access and the exact ref');
+}
+/** One source-selection path for linked SDKs, archive reproduction and an explicit
+ * registry ref constraint. The clone is visible in the build's normal progress/logs. */
+export async function checkoutFrameworkSource(destination, options) {
+    const { commit, sourceBase, signal, run } = options;
+    const source = parseFrameworkSource(options.source);
+    const location = frameworkRepositoryLocation(source.repository, sourceBase);
+    const env = { ...options.env, GIT_NO_REPLACE_OBJECTS: '1', GIT_TERMINAL_PROMPT: '0' };
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    signal?.throwIfAborted();
+    await run('git', ['clone', '--no-checkout', '--', location, destination], path.dirname(destination), env);
+    await run('git', ['checkout', '--detach', commit], destination, env);
+    await requireFrameworkRef(destination, source, commit, location, signal);
+    return { repo: source.repository, commit, ...(source.ref && { ref: source.ref }),
+        onRemote: await sourcePublication(destination, location, commit, { ...(source.ref && { ref: source.ref }), ...(signal && { signal }) }) };
+}
+//# sourceMappingURL=framework-source.js.map

package/dist/release/framework-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-source.js","sourceRoot":"","sources":["../../src/release/framework-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAwB,MAAM,+BAA+B,CAAC;AACxH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKhD,wFAAwF;AACxF,MAAM,UAAU,sBAAsB,CAAC,QAAiB,EAAE,QAAkB;IAC1E,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAClI,MAAM,OAAO,GAAG,QAAkD,CAAC;IACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClI,MAAM,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjF,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,UAAoB;IACzD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,QAAQ;QAAE,OAAO,oBAAoB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAA6B,CAAC;IAC5H,MAAM,QAAQ,GAAG,2BAA2B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,2FAA2F,CAAC,CAAC;IACxH,OAAO,oBAAoB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,UAAkB,EAAE,gBAAwB;IACtF,IAAI,iBAAiB,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;IACtI,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,MAAuB,EAAE,MAAc,EACjG,QAAgB,EAAE,MAAoB;IACtC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI;QAChG,MAAM,KAAK,CAAC,wGAAwG,CAAC,CAAC;AAC1H,CAAC;AAED;wFACwF;AACxF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,WAAmB,EAAE,OAGlE;IACC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;IACtF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1G,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAC9E,QAAQ,EAAE,MAAM,iBAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9I,CAAC"}

package/dist/release/frozen-installation.d.ts

@@ -0,0 +1,23 @@
+import { type TargetRuntime } from './target-runtime.js';
+import { type ReleaseArtifactOrigin } from './installed-origin.js';
+import type { ReleaseLaunch } from './manifest.js';
+/** Validate manifest data before any destination is created or archive is transferred. */
+export declare function assertFrozenLaunch(launch: ReleaseLaunch | undefined, origin?: ReleaseArtifactOrigin): asserts launch is ReleaseLaunch;
+export declare function frozenMember(root: string, relative: string): Promise<string>;
+/** A fresh directory, no special files, hardlinks, path aliases or writes through a symlink. */
+export declare function extractFrozenArchive(archive: string, directory: string): Promise<void>;
+export declare function assertFrozenDirectory(dir: string): Promise<void>;
+/** The packed application owns every dependency and its bootstrap adapter. The
+ * execution owner supplies the exact Node image, lifecycle and authorization. */
+export declare function verifyFrozenApplication(root: string, launch: ReleaseLaunch, runtime: TargetRuntime, nodeOptions: string): Promise<string>;
+/** Immutable payload proof does not require or execute a JavaScript launch entry. */
+export declare function verifyFrozenPayload(root: string, closureSha256: string, runtime: TargetRuntime, nodeOptions?: string): Promise<void>;
+/** A receipt is operational evidence, never a trusted member of a build archive. */
+export declare function assertNoReleaseMetadata(root: string): Promise<void>;
+/** Execute the same archive and closure checks on the receiving host. No package
+ * installation, graph rebinding or application module evaluation is performed. */
+export declare function installFrozenApplicationCommand(directory: string, archiveName: string, launch: ReleaseLaunch, origin: ReleaseArtifactOrigin, owner: {
+    root: string;
+    executable: string;
+}, nodeOptions: string, controlPackage: string): string;
+//# sourceMappingURL=frozen-installation.d.ts.map

package/dist/release/frozen-installation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frozen-installation.d.ts","sourceRoot":"","sources":["../../src/release/frozen-installation.ts"],"names":[],"mappings":"AAYA,OAAO,EAA0D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjH,OAAO,EAA6C,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnD,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAKrI;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKlF;AAED,gGAAgG;AAChG,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B5F;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,iBAItD;AAGD;iFACiF;AACjF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU/I;AAED,qFAAqF;AACrF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB1I;AAED,oFAAoF;AACpF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzE;AAED;kFACkF;AAClF,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAC3G,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAkCjI"}

package/dist/release/frozen-installation.js

@@ -0,0 +1,159 @@
+import { constants } from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { extract, list } from 'tar';
+import { applicationBootstrapRuntime } from '../orchestrator/application-runtime.js';
+import { resolveApplicationBootstrapRuntime } from '../orchestrator/application-runtime-resolution.js';
+import { shellEscape } from '../shared/shell-escape.js';
+import { loadRuntimeExtractor } from './runtime-extractor.js';
+import { CLOSURE_FILE } from './application-closure.js';
+import { RELEASE_RECEIPT, releaseTreeDigest } from './runtime-provenance.js';
+import { assertReleaseTarget, targetRuntime, releaseNodeOptions } from './target-runtime.js';
+import { writeInstalledReleaseReceipt, validOrigin } from './installed-origin.js';
+const digest = (s) => /^[a-f0-9]{64}$/.test(s);
+const componentPath = (s) => s.length <= 4096 && !s.includes('\\') && !s.includes(':') &&
+    !s.includes('\0') && s.split('/').every(part => part && part !== '.' && part !== '..');
+const inside = (root, name) => name.startsWith(root + path.sep);
+/** Validate manifest data before any destination is created or archive is transferred. */
+export function assertFrozenLaunch(launch, origin) {
+    if (!launch || !['bootstrap', 'script'].includes(launch.mode) || typeof launch.file !== 'string' ||
+        !componentPath(launch.file) || !/\.[cm]?js$/.test(launch.file) || !digest(launch.closureSha256) ||
+        (origin && (!origin.runtimeOrigin || origin.runtimeOrigin.entry.mode !== launch.mode || origin.runtimeOrigin.entry.relativeFile !== launch.file)))
+        throw Error('Checked release lacks a valid admitted compiled launch; rebuild it before deployment');
+}
+export async function frozenMember(root, relative) {
+    if (!componentPath(relative) || !/\.[cm]?js$/.test(relative))
+        throw Error('Expected a package-relative compiled JavaScript entry: ' + relative);
+    const file = path.join(root, relative);
+    if (file !== await fs.realpath(file) || !(await fs.lstat(file)).isFile())
+        throw Error('Release entry must be a physical file: ' + relative);
+    return file;
+}
+/** A fresh directory, no special files, hardlinks, path aliases or writes through a symlink. */
+export async function extractFrozenArchive(archive, directory) {
+    let invalid, bytes = 0;
+    const names = new Map();
+    await list({ file: archive, strict: true, onReadEntry(entry) {
+            if (invalid)
+                return;
+            const name = entry.path.replace(/\/$/, ''), key = name.normalize('NFC').toLowerCase();
+            if (path.resolve(directory, name) === path.resolve(archive) || !componentPath(name) || names.has(key) || [RELEASE_RECEIPT, '.artifact-sha256'].includes(path.posix.basename(key)) ||
+                !['File', 'Directory', 'SymbolicLink'].includes(entry.type) || names.size >= 200_000 ||
+                !Number.isSafeInteger(entry.size) || entry.size < 0 || entry.size > 268_435_456 || (bytes += entry.size) > 2_147_483_648) {
+                invalid = 'Invalid release archive member: ' + name;
+                return;
+            }
+            names.set(key, entry.type);
+            if (entry.type === 'SymbolicLink') {
+                const link = entry.linkpath ?? '', resolved = path.posix.normalize(path.posix.join(path.posix.dirname(name), link));
+                if (!link || /[\\:\0]/.test(link) || path.posix.isAbsolute(link) || resolved === '..' || resolved.startsWith('../'))
+                    invalid = 'Release archive link leaves its root: ' + name;
+            }
+        } });
+    if (invalid)
+        throw Error(invalid);
+    // Entries may occur in any order. A link to an in-tree directory is fine, writing through that link is not.
+    for (const name of names.keys()) {
+        for (let p = path.posix.dirname(name); p !== '.'; p = path.posix.dirname(p)) {
+            if (names.get(p) !== 'Directory')
+                throw Error('Invalid release archive parent: ' + p);
+        }
+    }
+    await extract({ file: archive, cwd: directory, strict: true, preserveOwner: false, noChmod: false });
+}
+export async function assertFrozenDirectory(dir) {
+    const s = await fs.lstat(dir);
+    if (!s.isDirectory() || await fs.realpath(dir) !== dir || (s.mode & 0o077) || (process.getuid && s.uid !== process.getuid()))
+        throw Error('Frozen installation requires a private physical directory: ' + dir);
+}
+/** The packed application owns every dependency and its bootstrap adapter. The
+ * execution owner supplies the exact Node image, lifecycle and authorization. */
+export async function verifyFrozenApplication(root, launch, runtime, nodeOptions) {
+    assertFrozenLaunch(launch);
+    await verifyFrozenPayload(root, launch.closureSha256, runtime, nodeOptions);
+    const file = await frozenMember(root, launch.file);
+    if (launch.mode === 'bootstrap') {
+        const adapter = await fs.realpath(createRequire(file).resolve('@omnitron-dev/omnitron'));
+        if (!inside(root, adapter) || !inside(root, await fs.realpath(await applicationBootstrapRuntime(file, adapter))))
+            throw Error('Frozen release must supply its own aligned Omnitron adapter');
+    }
+    return file;
+}
+/** Immutable payload proof does not require or execute a JavaScript launch entry. */
+export async function verifyFrozenPayload(root, closureSha256, runtime, nodeOptions) {
+    if (!digest(closureSha256))
+        throw Error('Frozen payload requires a recorded closure digest');
+    await assertFrozenDirectory(root);
+    const handle = await fs.open(path.join(root, CLOSURE_FILE), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    let raw;
+    try {
+        const s = await handle.stat();
+        if (!s.isFile() || s.size > 2_000_000)
+            throw Error('Invalid frozen closure record');
+        raw = await handle.readFile();
+    }
+    finally {
+        await handle.close();
+    }
+    if (createHash('sha256').update(raw).digest('hex') !== closureSha256)
+        throw Error('Frozen closure differs from the admitted manifest');
+    const c = JSON.parse(raw.toString('utf8'));
+    if (c.protocol !== 1 || !digest(c.payloadSha256) || typeof c.nodeOptions !== 'string' ||
+        releaseNodeOptions(c.nodeOptions) !== c.nodeOptions || (nodeOptions !== undefined && c.nodeOptions !== nodeOptions))
+        throw Error('Frozen release closure, execution target or Node options differ from the build');
+    assertReleaseTarget(c.runtime, runtime);
+    if (await releaseTreeDigest(root, true, false, [CLOSURE_FILE]) !== c.payloadSha256)
+        throw Error('Frozen release files differ from the admitted payload');
+}
+/** A receipt is operational evidence, never a trusted member of a build archive. */
+export async function assertNoReleaseMetadata(root) {
+    for (const name of [RELEASE_RECEIPT, '.artifact-sha256']) {
+        const stat = await fs.lstat(path.join(root, name)).catch((error) => {
+            if (error.code !== 'ENOENT')
+                throw error;
+            return null;
+        });
+        if (stat)
+            throw Error('Unexpected operational metadata in frozen release: ' + name);
+    }
+}
+/** Execute the same archive and closure checks on the receiving host. No package
+ * installation, graph rebinding or application module evaluation is performed. */
+export function installFrozenApplicationCommand(directory, archiveName, launch, origin, owner, nodeOptions, controlPackage) {
+    if (!validOrigin(origin) || ![directory, owner.root, owner.executable, controlPackage].every(p => path.isAbsolute(p)) ||
+        !/^[a-zA-Z0-9._+-]+\.tar\.gz$/.test(archiveName) || archiveName.includes('..'))
+        throw Error('Verified frozen installation requires an admitted origin and physical execution owner');
+    assertFrozenLaunch(launch, origin);
+    releaseNodeOptions(nodeOptions);
+    const source = `import fsSync,{constants,createReadStream} from 'node:fs';import fs from 'node:fs/promises';
+import path from 'node:path';import {createHash} from 'node:crypto';import {createRequire} from 'node:module';
+const {list,extract}=await (${loadRuntimeExtractor.toString()})(${JSON.stringify(controlPackage)});
+const CLOSURE_FILE=${JSON.stringify(CLOSURE_FILE)},RELEASE_RECEIPT=${JSON.stringify(RELEASE_RECEIPT)};
+const digest=${digest.toString()},componentPath=${componentPath.toString()},inside=${inside.toString()};
+const assertFrozenLaunch=${assertFrozenLaunch.toString()};
+const assertFrozenDirectory=${assertFrozenDirectory.toString()},frozenMember=${frozenMember.toString()};
+const extractFrozenArchive=${extractFrozenArchive.toString()},releaseTreeDigest=${releaseTreeDigest.toString()};
+const applicationBootstrapRuntime=((fs)=>(${resolveApplicationBootstrapRuntime.toString()}))(fsSync);
+const releaseNodeOptions=${releaseNodeOptions.toString()},verifyFrozenPayload=${verifyFrozenPayload.toString()};
+const targetRuntime=${targetRuntime.toString()},assertReleaseTarget=${assertReleaseTarget.toString()},verifyFrozenApplication=${verifyFrozenApplication.toString()};
+const assertNoReleaseMetadata=${assertNoReleaseMetadata.toString()},writeInstalledReleaseReceipt=${writeInstalledReleaseReceipt.toString()};
+const root=${JSON.stringify(directory)},archive=path.join(root,${JSON.stringify(archiveName)}),origin=${JSON.stringify(origin)};
+await assertFrozenDirectory(root);await assertNoReleaseMetadata(root);
+const before=await fs.lstat(archive,{bigint:true});
+if(!before.isFile()||before.size!==BigInt(origin.artifactBytes))throw Error('Delivered frozen archive size or type differs');
+const hash=createHash('sha256');for await(const bytes of createReadStream(archive))hash.update(bytes);
+if(hash.digest('hex')!==origin.artifactSha256)throw Error('Delivered frozen archive digest differs');
+await extractFrozenArchive(archive,root);
+const after=await fs.lstat(archive,{bigint:true});
+if(before.ino!==after.ino||before.dev!==after.dev||before.ctimeNs!==after.ctimeNs)throw Error('Delivered archive changed while extracting');
+await fs.unlink(archive);await assertNoReleaseMetadata(root);
+const target=await targetRuntime();await verifyFrozenApplication(root,${JSON.stringify(launch)},target,${JSON.stringify(nodeOptions)});
+await writeInstalledReleaseReceipt(root,{version:2,root,origin,ownerPackage:await fs.realpath(${JSON.stringify(owner.root)}),target,
+nodeOptions:${JSON.stringify(nodeOptions)},treeSha256:await releaseTreeDigest(root),installedFrameworkCommit:origin.frameworkCommit,
+frameworkContentUnchanged:true,artifactPayloadUnchanged:true});
+console.log(JSON.stringify(${JSON.stringify(nodeOptions)}));`;
+    return `env -u NODE_OPTIONS -u NODE_PATH ${shellEscape(owner.executable)} --input-type=module -e ${shellEscape(source)}`;
+}
+//# sourceMappingURL=frozen-installation.js.map

package/dist/release/frozen-installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frozen-installation.js","sourceRoot":"","sources":["../../src/release/frozen-installation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAAsB,MAAM,qBAAqB,CAAC;AACjH,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAA8B,MAAM,uBAAuB,CAAC;AAG9G,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvD,MAAM,aAAa,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC5F,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AACzF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhF,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,MAAiC,EAAE,MAA8B;IAClG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC5F,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/F,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;QACnJ,MAAM,KAAK,CAAC,sFAAsF,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IAC/D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,KAAK,CAAC,yDAAyD,GAAG,QAAQ,CAAC,CAAC;IAChJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;QAAE,MAAM,KAAK,CAAC,yCAAyC,GAAG,QAAQ,CAAC,CAAC;IAC5I,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,SAAiB;IAC3E,IAAI,OAA2B,EAAE,KAAK,GAAG,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK;YACzD,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACtF,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC/K,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO;gBACpF,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,WAAW,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,EAAE,CAAC;gBAC3H,OAAO,GAAG,kCAAkC,GAAG,IAAI,CAAC;gBAAC,OAAO;YAC9D,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpH,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;oBACjH,OAAO,GAAG,wCAAwC,GAAG,IAAI,CAAC;YAC9D,CAAC;QACH,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,OAAO;QAAE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,4GAA4G;IAC5G,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,WAAW;gBAAE,MAAM,KAAK,CAAC,kCAAkC,GAAG,CAAC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1H,MAAM,KAAK,CAAC,6DAA6D,GAAG,GAAG,CAAC,CAAC;AACrF,CAAC;AAGD;iFACiF;AACjF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,MAAqB,EAAE,OAAsB,EAAE,WAAmB;IAC5H,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9G,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,aAAqB,EAAE,OAAsB,EAAE,WAAoB;IACzH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC7F,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9H,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACpF,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACnC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,aAAa;QAAE,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvI,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACnF,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC;QACnH,MAAM,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAChG,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa;QAAE,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3J,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;YACxF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,IAAI;YAAE,MAAM,KAAK,CAAC,qDAAqD,GAAG,IAAI,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,+BAA+B,CAAC,SAAiB,EAAE,WAAmB,EAAE,MAAqB,EAC3G,MAA6B,EAAE,KAA2C,EAAE,WAAmB,EAAE,cAAsB;IACvH,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjH,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChF,MAAM,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACvG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG;;8BAEa,oBAAoB,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;qBAC3E,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;eACrF,MAAM,CAAC,QAAQ,EAAE,kBAAkB,aAAa,CAAC,QAAQ,EAAE,WAAW,MAAM,CAAC,QAAQ,EAAE;2BAC3E,kBAAkB,CAAC,QAAQ,EAAE;8BAC1B,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,YAAY,CAAC,QAAQ,EAAE;6BACzE,oBAAoB,CAAC,QAAQ,EAAE,sBAAsB,iBAAiB,CAAC,QAAQ,EAAE;4CAClE,kCAAkC,CAAC,QAAQ,EAAE;2BAC9D,kBAAkB,CAAC,QAAQ,EAAE,wBAAwB,mBAAmB,CAAC,QAAQ,EAAE;sBACxF,aAAa,CAAC,QAAQ,EAAE,wBAAwB,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,uBAAuB,CAAC,QAAQ,EAAE;gCAClI,uBAAuB,CAAC,QAAQ,EAAE,iCAAiC,4BAA4B,CAAC,QAAQ,EAAE;aAC7H,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;;;;;;;;;;wEAUtD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;gGACpC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;cAC5G,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;6BAEZ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC;IAC5D,OAAO,oCAAoC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,2BAA2B,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3H,CAAC"}

package/dist/release/import-artifacts.d.ts

@@ -0,0 +1,9 @@
+import type { IEcosystemAppEntry } from '../config/types.js';
+import { type ReleaseArtifact, type ReleaseManifestImport } from './manifest.js';
+/** Materialize exact admitted producer archives in the normal release directory.
+ * No extraction, rebuilding, dependency installation or producer application code executes. */
+export declare function importReleaseArtifacts(entries: readonly IEcosystemAppEntry[], destination: string, store?: string): Promise<{
+    artifacts: ReleaseArtifact[];
+    imports: ReleaseManifestImport[];
+}>;
+//# sourceMappingURL=import-artifacts.d.ts.map

package/dist/release/import-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-artifacts.d.ts","sourceRoot":"","sources":["../../src/release/import-artifacts.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,EAAsB,KAAK,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAIrG;+FAC+F;AAC/F,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,SAAiB,GAAG,OAAO,CAAC;IACzI,SAAS,EAAE,eAAe,EAAE,CAAC;IAAC,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAChE,CAAC,CAuCD"}

package/dist/release/import-artifacts.js

@@ -0,0 +1,60 @@
+import { constants } from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { assertReleaseId, loadRelease, releasesRoot } from './load.js';
+import { decideStackRelease } from './manifest.js';
+import { artifactReleaseContext, assertImportableArtifact, assertReleaseArtifactReference } from './origin.js';
+import { sha256File } from './portable-archive.js';
+/** Materialize exact admitted producer archives in the normal release directory.
+ * No extraction, rebuilding, dependency installation or producer application code executes. */
+export async function importReleaseArtifacts(entries, destination, store = releasesRoot()) {
+    const artifacts = [], imports = new Map(), names = new Set();
+    const directory = await fs.realpath(destination);
+    if (directory !== path.resolve(destination) || !(await fs.lstat(directory)).isDirectory())
+        throw Error('Release artifacts need a physical destination');
+    for (const entry of entries) {
+        if (entry.enabled === false)
+            continue;
+        assertReleaseId(entry.name);
+        if (names.has(entry.name))
+            throw Error('Duplicate imported application: ' + entry.name);
+        names.add(entry.name);
+        assertReleaseArtifactReference(entry.releaseFrom);
+        const ref = entry.releaseFrom;
+        if (entry.bootstrap || entry.script || entry.releaseRoot || entry.releaseEntry || (entry.watch !== undefined && entry.watch !== false))
+            throw Error('An imported application cannot override its release entry, boundary or watcher: ' + entry.name);
+        const source = await loadRelease(ref.release, store);
+        if (source.manifestSha256 !== ref.manifestSha256)
+            throw Error('Producer manifest differs from the pinned release: ' + ref.release);
+        const decision = decideStackRelease(source.manifest, undefined, [ref.app]);
+        if (decision.action === 'refuse')
+            throw Error('Cannot import ' + ref.release + '/' + ref.app + ': ' + decision.because);
+        const producer = artifactReleaseContext(source.manifest, ref.app);
+        assertImportableArtifact(producer.manifest, producer.artifact);
+        const artifact = source.manifest.artifacts.find(item => item.app === ref.app);
+        const file = source.files.find(item => item.app === ref.app);
+        // Preserve the producer's bytes exactly; JSON serialization would change its admitted digest.
+        const manifestJson = await fs.readFile(path.join(source.root, 'manifest.json'), 'utf8');
+        if (createHash('sha256').update(manifestJson).digest('hex') !== ref.manifestSha256)
+            throw Error('Producer manifest changed during import: ' + ref.release);
+        if (Buffer.byteLength(manifestJson) > 4_194_304)
+            throw Error('Producer manifest exceeds the import evidence limit');
+        const temporary = await fs.mkdtemp(path.join(directory, '.import-'));
+        try {
+            const staged = path.join(temporary, 'artifact');
+            await fs.copyFile(file.path, staged, constants.COPYFILE_EXCL | constants.COPYFILE_FICLONE);
+            if ((await fs.stat(staged)).size !== artifact.bytes || await sha256File(staged) !== artifact.sha256)
+                throw Error('Producer archive changed during import: ' + ref.app);
+            // link is atomic and refuses an existing destination; rename could overwrite a local artifact.
+            await fs.link(staged, path.join(directory, entry.name + '-' + artifact.version + '.tar.gz'));
+        }
+        finally {
+            await fs.rm(temporary, { recursive: true, force: true });
+        }
+        artifacts.push({ ...artifact, app: entry.name, origin: { ...ref } });
+        imports.set(ref.manifestSha256, { sha256: ref.manifestSha256, manifestJson });
+    }
+    return { artifacts, imports: [...imports.values()] };
+}
+//# sourceMappingURL=import-artifacts.js.map

package/dist/release/import-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-artifacts.js","sourceRoot":"","sources":["../../src/release/import-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAoD,MAAM,eAAe,CAAC;AACrG,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC/G,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD;+FAC+F;AAC/F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAsC,EAAE,WAAmB,EAAE,KAAK,GAAG,YAAY,EAAE;IAG9H,MAAM,SAAS,GAAsB,EAAE,EAAE,OAAO,GAAG,IAAI,GAAG,EAAiC,EAAE,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IACvH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACxJ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;YAAE,SAAS;QACtC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,kCAAkC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxF,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,8BAA8B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC;QAC9B,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC;YACpI,MAAM,KAAK,CAAC,kFAAkF,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG,CAAC,cAAc;YAAE,MAAM,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACnI,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxH,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAClE,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAE,CAAC;QAC9D,8FAA8F;QAC9F,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;QACxF,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,cAAc;YAChF,MAAM,KAAK,CAAC,2CAA2C,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACpH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAChD,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,aAAa,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAC3F,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM;gBACjG,MAAM,KAAK,CAAC,0CAA0C,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACpE,+FAA+F;YAC/F,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC;QAC/F,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QACvE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/release/infrastructure.d.ts

@@ -0,0 +1,6 @@
+import { type DeclaredConfig } from '../project/declared-config.js';
+import type { LoadedRelease } from './load.js';
+/** Read only regular, uniquely named declaration inputs from the very bytes whose digest
+ * was admitted. Application JavaScript is never imported and the rest of the config stays private. */
+export declare function readArchiveInfrastructure(release: LoadedRelease, app: string): Promise<DeclaredConfig>;
+//# sourceMappingURL=infrastructure.d.ts.map

package/dist/release/infrastructure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infrastructure.d.ts","sourceRoot":"","sources":["../../src/release/infrastructure.ts"],"names":[],"mappings":"AAMA,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAI/C;sGACsG;AACtG,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAqD5G"}

package/dist/release/infrastructure.js

@@ -0,0 +1,74 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { once } from 'node:events';
+import { list } from 'tar';
+import { parseDeclaredConfig } from '../project/declared-config.js';
+const canonical = 'config/default.json';
+/** Read only regular, uniquely named declaration inputs from the very bytes whose digest
+ * was admitted. Application JavaScript is never imported and the rest of the config stays private. */
+export async function readArchiveInfrastructure(release, app) {
+    const file = release.files.find((candidate) => candidate.app === app);
+    if (!file || !/^[a-f0-9]{64}$/.test(file.sha256))
+        throw Error('Missing verified release archive for ' + app);
+    const expected = path.join(await fs.realpath(release.root), 'artifacts', app + '-' + file.version + '.tar.gz');
+    if ((await fs.realpath(file.path)) !== expected)
+        throw Error('Infrastructure archive leaves its admitted release');
+    const handle = await fs.open(file.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size !== file.bytes)
+            throw Error('Infrastructure archive size changed for ' + app);
+        const chunks = [];
+        const seen = new Set();
+        let invalid = false;
+        const parser = list({
+            strict: true,
+            onReadEntry(entry) {
+                const raw = entry.path.replace(/^\.\//, '').replace(/\/$/, '');
+                const normalized = path.posix.normalize(raw).normalize('NFC').toLowerCase();
+                if (normalized !== canonical && normalized !== 'config')
+                    return;
+                const directory = normalized === 'config';
+                if (normalized !== raw ||
+                    seen.has(normalized) ||
+                    entry.type !== (directory ? 'Directory' : 'File') ||
+                    entry.size > 1_048_576 ||
+                    entry.size < 0) {
+                    invalid = true;
+                    return;
+                }
+                seen.add(normalized);
+                if (!directory)
+                    entry.on('data', (part) => chunks.push(part));
+            },
+        });
+        const finished = once(parser, 'end');
+        const input = handle.createReadStream({ autoClose: false });
+        const hash = createHash('sha256');
+        try {
+            input.on('data', (part) => hash.update(part));
+            input.on('error', (error) => parser.abort(error));
+            input.pipe(parser);
+            await finished;
+        }
+        finally {
+            input.destroy();
+        }
+        if (hash.digest('hex') !== file.sha256)
+            throw Error('Infrastructure archive changed for ' + app);
+        if (invalid)
+            throw Error('Package ' + app + ' must supply config/default.json as a unique physical file of at most 1 MiB');
+        if (!seen.has(canonical))
+            return { configPath: canonical };
+        const declaration = parseDeclaredConfig(Buffer.concat(chunks).toString('utf8'), canonical);
+        if (declaration.malformed)
+            throw Error('Malformed archived ' + canonical + ' for ' + app);
+        return { configPath: canonical, ...(declaration.omnitron && { omnitron: declaration.omnitron }) };
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=infrastructure.js.map

package/dist/release/infrastructure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infrastructure.js","sourceRoot":"","sources":["../../src/release/infrastructure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAuB,MAAM,+BAA+B,CAAC;AAGzF,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAExC;sGACsG;AACtG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAsB,EAAE,GAAW;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,KAAK,CAAC,uCAAuC,GAAG,GAAG,CAAC,CAAC;IAC7G,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC/G,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ;QAAE,MAAM,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1G,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK;YAAE,MAAM,KAAK,CAAC,0CAA0C,GAAG,GAAG,CAAC,CAAC;QAC9G,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC;YAClB,MAAM,EAAE,IAAI;YACZ,WAAW,CAAC,KAAK;gBACf,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC5E,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,QAAQ;oBAAE,OAAO;gBAChE,MAAM,SAAS,GAAG,UAAU,KAAK,QAAQ,CAAC;gBAC1C,IACE,UAAU,KAAK,GAAG;oBAClB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;oBACpB,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;oBACjD,KAAK,CAAC,IAAI,GAAG,SAAS;oBACtB,KAAK,CAAC,IAAI,GAAG,CAAC,EACd,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACrB,IAAI,CAAC,SAAS;oBAAE,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,CAAC;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnB,MAAM,QAAQ,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,qCAAqC,GAAG,GAAG,CAAC,CAAC;QACjG,IAAI,OAAO;YAAE,MAAM,KAAK,CAAC,UAAU,GAAG,GAAG,GAAG,6EAA6E,CAAC,CAAC;QAC3H,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAC3D,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3F,IAAI,WAAW,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC,qBAAqB,GAAG,SAAS,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC;QAC1F,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/release/installed-artifacts.d.ts

@@ -0,0 +1,12 @@
+import type { OrchestratorControl } from '../orchestrator/execution-contract.js';
+import type { InstalledArtifactObservation } from '../shared/dto/installed-release.js';
+/** Legacy deployment layout locates files only; archive bytes, never this path, identify their release. */
+export declare function installedRoot(name: string, entry: {
+    cwd?: string | undefined;
+    bootstrap?: string | undefined;
+    script?: string | undefined;
+    releaseRoot?: string | undefined;
+}): string;
+/** Names must be exact inventory keys; neither paths nor baselines are accepted from the caller. */
+export declare function inspectInstalledArtifacts(orchestrator: OrchestratorControl, names: string[]): Promise<InstalledArtifactObservation[]>;
+//# sourceMappingURL=installed-artifacts.d.ts.map

package/dist/release/installed-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-artifacts.d.ts","sourceRoot":"","sources":["../../src/release/installed-artifacts.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAsFvF,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,MAAM,CAYtL;AAED,oGAAoG;AACpG,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,4BAA4B,EAAE,CAAC,CA+D3I"}