@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/release/installed-artifacts.js

@@ -0,0 +1,199 @@
+import { constants } from 'node:fs';
+import { open, opendir, realpath } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+const MAX_FILE_BYTES = 512 * 1024 * 1024;
+const MAX_ENTRY_BYTES = 16 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 2 * 1024 * 1024 * 1024;
+const MAX_DURATION_MS = 45_000;
+const active = new WeakSet();
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+const stamp = (stat) => `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;
+async function file(filename, maximum, read) {
+    const handle = await open(filename, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const before = await handle.stat();
+        if (!before.isFile() || before.size > maximum)
+            throw new Error('File is not regular or exceeds the inspection size limit');
+        const result = await read(handle);
+        if (stamp(before) !== stamp(await handle.stat()))
+            throw new Error('File changed during inspection');
+        return result;
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+}
+async function hash(handle, signal) {
+    const digest = createHash('sha256');
+    const { size } = await handle.stat();
+    if (size > 0)
+        for await (const chunk of handle.createReadStream({ start: 0, end: size - 1, autoClose: false, signal }))
+            digest.update(chunk);
+    return digest.digest('hex');
+}
+/** Uses the same platform tar as deployment; no shell, extraction or executable archive content. */
+async function tar(handle, args, maximum, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const child = spawn('tar', args, { stdio: ['pipe', 'pipe', 'pipe'], signal, timeout: 10_000, killSignal: 'SIGKILL' });
+        const input = handle.createReadStream({ start: 0, end: MAX_FILE_BYTES - 1, autoClose: false, signal });
+        const chunks = [];
+        let bytes = 0;
+        let failure;
+        const fail = (error) => { failure ??= error; child.kill('SIGKILL'); input.destroy(); };
+        child.stdout.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > maximum)
+                fail(new Error('Archive output exceeds the inspection limit'));
+            else
+                chunks.push(chunk);
+        });
+        // Archive names and local paths must not leak through tar diagnostics to viewers.
+        child.stderr.resume();
+        child.stdin.on('error', () => undefined);
+        input.on('error', fail);
+        child.on('error', error => { failure ??= error; });
+        child.on('close', code => {
+            if (!input.readableEnded)
+                input.destroy();
+            if (failure || code !== 0)
+                reject(failure ?? new Error('Archive member could not be read'));
+            else
+                resolve(Buffer.concat(chunks));
+        });
+        input.pipe(child.stdin);
+    });
+}
+async function archiveEntry(handle, relative, signal) {
+    const names = (await tar(handle, ['-tzf', '-'], 2 * 1024 * 1024, signal)).toString('utf8').split('\n');
+    const matches = names.filter(name => name.replace(/^\.\//, '') === relative);
+    if (matches.length !== 1)
+        return null; // Missing and duplicate members are not evidence.
+    const bytes = await tar(handle, ['-xzOf', '-', '--', matches[0]], MAX_ENTRY_BYTES, signal);
+    return bytes.length ? sha(bytes) : null;
+}
+async function frameworkCommit(root) {
+    try {
+        const entry = createRequire(path.join(root, 'package.json')).resolve('@omnitron-dev/omnitron');
+        let directory = path.dirname(await realpath(entry));
+        for (let depth = 0; depth < 8; depth++, directory = path.dirname(directory)) {
+            const manifest = await file(path.join(directory, 'package.json'), 64 * 1024, h => h.readFile('utf8')).catch(() => null);
+            if (!manifest || JSON.parse(manifest).name !== '@omnitron-dev/omnitron')
+                continue;
+            const build = JSON.parse(await file(path.join(directory, 'dist', 'BUILD.json'), 64 * 1024, h => h.readFile('utf8')));
+            return typeof build.commit === 'string' && /^[a-f0-9]{7,40}$/.test(build.commit) && build.dirty === false ? build.commit : null;
+        }
+    }
+    catch { /* An absent/unreadable stamp is unknown, never this backend's own build. */ }
+    return null;
+}
+function identity(orchestrator, name) {
+    const handle = orchestrator.getHandle(name);
+    if (!handle || handle.name !== name)
+        return null;
+    const entry = handle.entry;
+    return { pid: handle.pid ?? null, startedAt: handle.startedAt, cwd: entry.cwd, bootstrap: entry.bootstrap, script: entry.script, releaseRoot: entry.releaseRoot };
+}
+/** Legacy deployment layout locates files only; archive bytes, never this path, identify their release. */
+export function installedRoot(name, entry) {
+    if (entry.releaseRoot && path.isAbsolute(entry.releaseRoot))
+        return entry.releaseRoot;
+    const bootstrap = entry.bootstrap ?? entry.script;
+    if (!bootstrap)
+        throw new Error('Owner did not report an entry point');
+    const [project, , app, extra] = name.split('/');
+    if (project && app && !extra && path.isAbsolute(bootstrap) && path.basename(bootstrap) === 'bootstrap.js' && path.basename(path.dirname(bootstrap)) === 'dist') {
+        const root = path.dirname(path.dirname(bootstrap));
+        const expectedParent = path.join('/opt/omnitron/artifacts', project, app);
+        if (path.dirname(root) === expectedParent && /^[a-zA-Z0-9._-]+$/.test(path.basename(root)))
+            return root;
+    }
+    if (!entry.cwd)
+        throw new Error('Owner did not report an installation root');
+    return entry.cwd;
+}
+/** Names must be exact inventory keys; neither paths nor baselines are accepted from the caller. */
+export async function inspectInstalledArtifacts(orchestrator, names) {
+    if (!Array.isArray(names) || names.length < 1 || names.length > 32 || names.some(name => typeof name !== 'string' || name.length > 256))
+        throw new Error('Provide 1–32 canonical application names');
+    if (active.has(orchestrator))
+        throw new Error('An installed-file inspection is already running on this node');
+    active.add(orchestrator);
+    const signal = AbortSignal.timeout(MAX_DURATION_MS);
+    const results = [];
+    let bytesRead = 0;
+    try {
+        await orchestrator.refreshObservation?.();
+        for (const name of new Set(names)) {
+            const before = identity(orchestrator, name);
+            const observation = { app: name, pid: before?.pid ?? null, startedAt: before?.startedAt ?? null,
+                observedAt: new Date().toISOString(), state: 'unavailable', entrySha256: null, frameworkCommit: null, archives: [], reasons: [] };
+            results.push(observation);
+            try {
+                signal.throwIfAborted();
+                if (!before)
+                    throw new Error('Canonical application is absent from the owner inventory');
+                if (!(before.bootstrap ?? before.script))
+                    throw new Error('Owner did not report an entry point');
+                const root = await realpath(installedRoot(name, before));
+                const entry = path.resolve(before.cwd ?? root, before.bootstrap ?? before.script);
+                const relative = path.relative(root, entry);
+                if (!relative || relative.startsWith('..') || path.isAbsolute(relative))
+                    throw new Error('Entry point is outside its installation root');
+                // Reject escaping intermediate symlinks as well as symlink entry files.
+                if (await realpath(path.dirname(entry)) !== path.dirname(entry))
+                    throw new Error('Entry point traverses a symbolic link');
+                observation.entrySha256 = await file(entry, MAX_ENTRY_BYTES, h => hash(h, signal));
+                observation.frameworkCommit = await frameworkCommit(root);
+                const archives = [];
+                let entries = 0;
+                for await (const item of await opendir(root)) {
+                    if (++entries > 4096)
+                        throw new Error('Installation directory exceeds the inspection entry limit');
+                    if (item.isFile() && item.name.endsWith('.tar.gz'))
+                        archives.push(item.name);
+                    if (archives.length > 8)
+                        throw new Error('Installation directory exceeds the archive inspection limit');
+                }
+                for (const archive of archives.sort()) {
+                    signal.throwIfAborted();
+                    await file(path.join(root, archive), MAX_FILE_BYTES, async (handle) => {
+                        const { size } = await handle.stat();
+                        bytesRead += size;
+                        if (bytesRead > MAX_TOTAL_BYTES)
+                            throw new Error('Node inspection exceeds the archive byte budget');
+                        const sha256 = await hash(handle, signal);
+                        const entrySha256 = await archiveEntry(handle, relative.split(path.sep).join('/'), signal);
+                        observation.archives.push({ sha256, bytes: size, entrySha256 });
+                    });
+                }
+                observation.state = 'observed';
+                if (!archives.length)
+                    observation.reasons.push('No retained release archive exists in the installation directory');
+                if (!observation.frameworkCommit)
+                    observation.reasons.push('Installed framework has no clean, readable build stamp');
+            }
+            catch (error) {
+                // Filesystem errors include paths. Return a controlled category, never config/env/path values.
+                const message = error instanceof Error ? error.message : '';
+                observation.reasons.push(/^(Canonical|Owner|Entry point|Installation directory|Node inspection|File |Archive |The operation was aborted)/.test(message) ? message : 'Installed files could not be read within the inspection limits');
+                observation.archives = [];
+            }
+            await orchestrator.refreshObservation?.();
+            if (JSON.stringify(before) !== JSON.stringify(identity(orchestrator, name))) {
+                observation.state = 'changed-during-inspection';
+                observation.archives = [];
+                observation.entrySha256 = null;
+                observation.reasons.push('Owner PID, start time or entry changed during inspection; repeat the inspection');
+            }
+        }
+        return results;
+    }
+    finally {
+        active.delete(orchestrator);
+    }
+}
+//# sourceMappingURL=installed-artifacts.js.map

package/dist/release/installed-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-artifacts.js","sourceRoot":"","sources":["../../src/release/installed-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AACrC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,MAAM,KAAK,GAAG,CAAC,IAA6C,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;AAExI,KAAK,UAAU,IAAI,CAAI,QAAgB,EAAE,OAAe,EAAE,IAAwC;IAChG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACtG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC3H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAkB,EAAE,MAAmB;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,IAAI,GAAG,CAAC;QAAE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7I,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,GAAG,CAAC,MAAkB,EAAE,IAAc,EAAE,OAAe,EAAE,MAAmB;IACzF,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACtH,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACvG,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAA0B,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,KAAY,EAAE,EAAE,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9F,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,OAAO;gBAAE,IAAI,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;;gBAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,kFAAkF;QAClF,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACvB,IAAI,CAAC,KAAK,CAAC,aAAa;gBAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,OAAO,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;;gBACvF,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAkB,EAAE,QAAgB,EAAE,MAAmB;IACnF,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvG,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,kDAAkD;IACzF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC/F,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACxH,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,wBAAwB;gBAAE,SAAS;YAClF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAA0C,CAAC;YAC9J,OAAO,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAClI,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,4EAA4E,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,YAAiC,EAAE,IAAY;IAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;AACpK,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAkI;IAC5K,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC,WAAW,CAAC;IACtF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;IAClD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvE,MAAM,CAAC,OAAO,EAAE,AAAD,EAAG,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/J,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1E,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,cAAc,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1G,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,YAAiC,EAAE,KAAe;IAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrM,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9G,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAiC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;gBAC3H,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACpI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;gBACzF,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBACjG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAO,CAAC,CAAC;gBACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC5C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBACzI,wEAAwE;gBACxE,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC1H,WAAW,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBACnF,WAAW,CAAC,eAAe,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;gBAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,IAAI,EAAE,OAAO,GAAG,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;oBACnG,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC7E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;gBAC1G,CAAC;gBACD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;oBACtC,MAAM,CAAC,cAAc,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;wBAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBACrC,SAAS,IAAI,IAAI,CAAC;wBAClB,IAAI,SAAS,GAAG,eAAe;4BAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;wBACpG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;wBAC1C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;wBAC3F,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;oBAClE,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,WAAW,CAAC,KAAK,GAAG,UAAU,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM;oBAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;gBACnH,IAAI,CAAC,WAAW,CAAC,eAAe;oBAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YACvH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,+FAA+F;gBAC/F,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,gHAAgH,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC;gBACtO,WAAW,CAAC,QAAQ,GAAG,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,YAAY,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC5E,WAAW,CAAC,KAAK,GAAG,2BAA2B,CAAC;gBAChD,WAAW,CAAC,QAAQ,GAAG,EAAE,CAAC;gBAC1B,WAAW,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC/B,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAAC,CAAC;AAC5C,CAAC"}

package/dist/release/installed-graph.d.ts

@@ -0,0 +1,28 @@
+interface PackageInfo {
+    name: string;
+    version: string;
+    files?: string[];
+    dependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    peerDependenciesMeta?: Record<string, {
+        optional?: boolean;
+    }>;
+    publishConfig?: Record<string, unknown>;
+}
+export interface InstalledPackage {
+    root: string;
+    metadata: PackageInfo;
+    dependencies: Map<string, number>;
+}
+/** Resolve the installed *production* graph. Real paths distinguish different peer
+ * bindings of the same version; discovery order is stable and cycles are finite. */
+export declare function installedGraph(source: string, overlays?: ReadonlyMap<string, string>, allowedRoots?: readonly string[]): Promise<InstalledPackage[]>;
+/** Copy only published files for workspaces. Registry packages and previously
+ * verified sealed packages are already packed. Never follow a link outside a package. */
+export declare function materializeGraph(packages: readonly InstalledPackage[], destinations: readonly string[], options?: {
+    verifiedPackages?: ReadonlySet<string>;
+    application?: boolean;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=installed-graph.d.ts.map

package/dist/release/installed-graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-graph.d.ts","sourceRoot":"","sources":["../../src/release/installed-graph.ts"],"names":[],"mappings":"AAKA,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AACD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAUD;oFACoF;AACpF,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,EAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA8BrK;AAKD;yFACyF;AACzF,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EACtE,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,IAAI,CAAC,CA6Df"}

package/dist/release/installed-graph.js

@@ -0,0 +1,138 @@
+import fs from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { resolveInstalledDependency } from './package-resolution.js';
+import path from 'node:path';
+const validName = (name) => /^(?:@[\w.-]+\/)?[\w.-]+$/.test(name) &&
+    name.split('/').every(part => part !== '.' && part !== '..' && !part.startsWith('.'));
+const readManifest = async (root) => {
+    const meta = JSON.parse(await fs.readFile(path.join(root, 'package.json'), 'utf8'));
+    if (!meta || !validName(meta.name) || typeof meta.version !== 'string' || !meta.version)
+        throw Error('Invalid installed package at ' + root);
+    return meta;
+};
+/** Resolve the installed *production* graph. Real paths distinguish different peer
+ * bindings of the same version; discovery order is stable and cycles are finite. */
+export async function installedGraph(source, overlays = new Map(), allowedRoots) {
+    const packages = [], known = new Map();
+    async function visit(directory) {
+        let root = await fs.realpath(directory);
+        if (allowedRoots && !allowedRoots.some(parent => root === parent || root.startsWith(parent + path.sep)))
+            throw Error('Installed dependency escapes the frozen checkouts: ' + root);
+        let id = known.get(root);
+        if (id !== undefined)
+            return id;
+        let metadata = await readManifest(root);
+        const overlay = overlays.get(metadata.name);
+        if (overlay && root !== overlay) {
+            const replacement = await readManifest(overlay);
+            if (replacement.name !== metadata.name || replacement.version !== metadata.version)
+                throw Error('Overlay changes installed package identity: ' + metadata.name);
+            root = overlay;
+            metadata = replacement;
+            id = known.get(root);
+            if (id !== undefined)
+                return id;
+        }
+        if (packages.length >= 4096)
+            throw Error('Installed graph exceeds 4096 packages');
+        id = packages.length;
+        known.set(root, id);
+        const item = { root, metadata, dependencies: new Map() };
+        packages.push(item);
+        const names = Object.keys({ ...metadata.dependencies, ...metadata.optionalDependencies, ...metadata.peerDependencies }).sort();
+        for (const name of names) {
+            const target = await resolveInstalledDependency(root, name);
+            if (target)
+                item.dependencies.set(name, await visit(target));
+            else if (!Object.hasOwn(metadata.optionalDependencies ?? {}, name) && !metadata.peerDependenciesMeta?.[name]?.optional)
+                throw Error('Missing installed dependency: ' + metadata.name + ' → ' + name);
+        }
+        return id;
+    }
+    await visit(source);
+    return packages;
+}
+const excluded = new Set(['node_modules', '.git', '.npmrc', '.DS_Store', '.codex', '.agents', '.turbo', '.cache', 'coverage']);
+const reserved = new Set(['.omnitron-closure.json', '.omnitron-release.json', '.artifact-sha256']);
+/** Copy only published files for workspaces. Registry packages and previously
+ * verified sealed packages are already packed. Never follow a link outside a package. */
+export async function materializeGraph(packages, destinations, options = {}) {
+    if (destinations.length !== packages.length || new Set(destinations).size !== packages.length)
+        throw Error('Invalid package destinations');
+    for (const [id, item] of packages.entries()) {
+        const target = destinations[id];
+        await fs.mkdir(target, { recursive: true, mode: 0o755 });
+        const registry = item.root.split(path.sep).includes('node_modules') || options.verifiedPackages?.has(item.root);
+        // Select a publication surface even for a private workspace without a files list.
+        const files = !registry ? new Set(['package.json', 'LICENSE', 'README.md', ...(item.metadata.files ??
+                ['dist', 'config']), ...(id === 0 && options.application ? ['dist', 'config'] : [])]) : null;
+        const copy = async (name) => {
+            if (name !== '.' && (path.isAbsolute(name) || name.split(/[\\/]/).some(p => !p || p === '.' || p === '..') || /[*?{}!]/.test(name)))
+                throw Error('Unsupported publication path in ' + item.metadata.name + ': ' + name + '; use an unpacked publication surface');
+            const from = path.resolve(item.root, name), to = path.resolve(target, name);
+            try {
+                await fs.lstat(from);
+            }
+            catch (e) {
+                if (e.code === 'ENOENT')
+                    return;
+                throw e;
+            }
+            // Check intermediate components of a declared path too.
+            const real = await fs.realpath(from);
+            if (real !== item.root && !real.startsWith(item.root + path.sep))
+                throw Error('Publication path escapes package ' + item.metadata.name);
+            await fs.cp(from, to, { recursive: true, mode: constants.COPYFILE_FICLONE, verbatimSymlinks: true, filter: async (file) => {
+                    const base = path.basename(file);
+                    if (file !== item.root && (excluded.has(base) || base === '.env' || base.startsWith('.env.')))
+                        return false;
+                    if (reserved.has(base))
+                        throw Error('Reserved release metadata in package ' + item.metadata.name);
+                    const stat = await fs.lstat(file);
+                    if (stat.isSymbolicLink()) {
+                        const link = await fs.readlink(file), resolved = await fs.realpath(file);
+                        if (path.isAbsolute(link) || !resolved.startsWith(item.root + path.sep))
+                            throw Error('Non-portable symbolic link in package ' + item.metadata.name);
+                    }
+                    else if (!stat.isFile() && !stat.isDirectory())
+                        throw Error('Unsupported file in package ' + item.metadata.name);
+                    return true;
+                } });
+        };
+        for (const name of files ?? ['.'])
+            await copy(name);
+        if (!registry) {
+            // Equivalent to publish-time entry points. Keep the install's runtime metadata;
+            // private manifest ranges never trigger a package manager on the target.
+            const manifest = { ...item.metadata };
+            for (const name of ['main', 'module', 'exports', 'types', 'bin', 'imports'])
+                if (item.metadata.publishConfig?.[name] !== undefined)
+                    Object.assign(manifest, { [name]: item.metadata.publishConfig[name] });
+            // Dev-only metadata can include absolute developer links and does not belong in an artifact.
+            for (const key of ['devDependencies', 'publishConfig', 'overrides', 'pnpm', 'packageManager'])
+                Reflect.deleteProperty(manifest, key);
+            for (const key of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
+                const deps = manifest[key];
+                if (!deps)
+                    continue;
+                manifest[key] = Object.fromEntries(Object.entries(deps).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([name, version]) => {
+                    const child = item.dependencies.get(name);
+                    if (/^(?:workspace:|link:|file:|\/)/.test(version)) {
+                        if (child === undefined)
+                            throw Error('Cannot publish an unbound local dependency: ' + name);
+                        return [name, packages[child].metadata.version];
+                    }
+                    return [name, version];
+                }));
+            }
+            await fs.writeFile(path.join(target, 'package.json'), JSON.stringify(manifest, null, 2) + '\n');
+        }
+    }
+    for (const [id, item] of packages.entries())
+        for (const [name, child] of item.dependencies) {
+            const link = path.join(destinations[id], 'node_modules', name);
+            await fs.mkdir(path.dirname(link), { recursive: true });
+            await fs.symlink(path.relative(path.dirname(link), destinations[child]), link, 'dir');
+        }
+}
+//# sourceMappingURL=installed-graph.js.map

package/dist/release/installed-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-graph.js","sourceRoot":"","sources":["../../src/release/installed-graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,IAAI,MAAM,WAAW,CAAC;AAiB7B,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxF,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAwB,EAAE;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAgB,CAAC;IACnG,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO;QACrF,MAAM,KAAK,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;oFACoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,QAAQ,GAAgC,IAAI,GAAG,EAAE,EAAE,YAAgC;IACtI,MAAM,QAAQ,GAAuB,EAAE,EAAE,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3E,KAAK,UAAU,KAAK,CAAC,SAAiB;QACpC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACrG,MAAM,KAAK,CAAC,qDAAqD,GAAG,IAAI,CAAC,CAAC;QAC5E,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1D,IAAI,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBAChF,MAAM,KAAK,CAAC,8CAA8C,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9E,IAAI,GAAG,OAAO,CAAC;YAAC,QAAQ,GAAG,WAAW,CAAC;YACvC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI;YAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAClF,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,oBAAoB,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/H,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;iBACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ;gBACpH,MAAM,KAAK,CAAC,gCAAgC,GAAG,QAAQ,CAAC,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAC/H,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,wBAAwB,EAAE,wBAAwB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEnG;yFACyF;AACzF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAqC,EAAE,YAA+B,EACtE,OAAO,GAAsE,EAAE;IAE/E,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAC3F,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,CAAE,CAAC;QACjC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChH,kFAAkF;QAClF,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK;gBAChG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/F,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;YACjD,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjI,MAAM,KAAK,CAAC,kCAAkC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,uCAAuC,CAAC,CAAC;YAC/H,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO;gBAAC,MAAM,CAAC,CAAC;YACtE,CAAC;YACD,wDAAwD;YACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxI,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;oBACtH,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACjC,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;oBAC5G,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,MAAM,KAAK,CAAC,uCAAuC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAClG,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAClC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC1B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBACzE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;4BACrE,MAAM,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC/E,CAAC;yBAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;wBAAE,MAAM,KAAK,CAAC,8BAA8B,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACnH,OAAO,IAAI,CAAC;gBACd,CAAC,EAAE,CAAC,CAAC;QACP,CAAC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,gFAAgF;YAChF,yEAAyE;YACzE,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAU;gBAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,SAAS;oBAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChI,6FAA6F;YAC7F,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAU;gBAAE,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC9I,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,CAAU,EAAE,CAAC;gBACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAChD,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;oBAC7H,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC1C,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBACnD,IAAI,KAAK,KAAK,SAAS;4BAAE,MAAM,KAAK,CAAC,8CAA8C,GAAG,IAAI,CAAC,CAAC;wBAC5F,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACnD,CAAC;oBACD,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACzB,CAAC,CAAC,CAAC,CAAC;YACN,CAAC;YACD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE;QAAE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;YAChE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,KAAK,CAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzF,CAAC;AACH,CAAC"}

package/dist/release/installed-origin.d.ts

@@ -0,0 +1,42 @@
+import { type TargetRuntime } from './target-runtime.js';
+export interface ReleaseArtifactOrigin {
+    releaseId: string;
+    manifestSha256: string;
+    artifactSha256: string;
+    artifactBytes: number;
+    app: string;
+    frameworkCommit: string;
+    runtimeOrigin?: InstalledRuntimeOrigin;
+}
+export interface InstalledRuntimeOrigin {
+    projectCommit: string;
+    producerApp: string;
+    consumer: {
+        releaseId: string;
+        manifestSha256: string;
+        app: string;
+    };
+    entry: {
+        relativeFile: string;
+        mode: 'bootstrap' | 'script';
+    };
+}
+export interface InstalledReleaseReceipt {
+    version: 1 | 2;
+    nodeOptions?: string;
+    target?: TargetRuntime;
+    ownerPackage?: string;
+    origin: ReleaseArtifactOrigin;
+    root: string;
+    treeSha256: string;
+    installedFrameworkCommit: string;
+    frameworkContentUnchanged: boolean;
+    artifactPayloadUnchanged: boolean;
+}
+export declare function validRuntimeOrigin(value: unknown): value is InstalledRuntimeOrigin;
+export declare function validOrigin(value: unknown): value is ReleaseArtifactOrigin;
+/** The same private receipt boundary is used by owners and executing applications. */
+export declare function readInstalledReleaseReceipt(root: string): Promise<InstalledReleaseReceipt>;
+/** Publish complete JSON atomically; readers never observe an empty/partial receipt. */
+export declare function writeInstalledReleaseReceipt(root: string, receipt: InstalledReleaseReceipt): Promise<void>;
+//# sourceMappingURL=installed-origin.d.ts.map

package/dist/release/installed-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-origin.d.ts","sourceRoot":"","sources":["../../src/release/installed-origin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAA;KAAE,CAAC;CAC/D;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB,EAAE,MAAM,CAAC;IACjC,yBAAyB,EAAE,OAAO,CAAC;IACnC,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAQD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CA0BlF;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAa1E;AAED,sFAAsF;AACtF,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA+DhG;AAED,wFAAwF;AACxF,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhH"}

package/dist/release/installed-origin.js

@@ -0,0 +1,130 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { releaseNodeOptions } from './target-runtime.js';
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const hash = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const commit = (v) => typeof v === 'string' && /^[a-f0-9]{40}$/.test(v);
+const identifier = (v) => typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/.test(v) && !v.includes('..');
+export function validRuntimeOrigin(value) {
+    if (!record(value) || Object.keys(value).sort().join(',') !== 'consumer,entry,producerApp,projectCommit')
+        return false;
+    const consumer = value['consumer'], entry = value['entry'];
+    if (!record(consumer) ||
+        !record(entry) ||
+        Object.keys(consumer).sort().join(',') !== 'app,manifestSha256,releaseId' ||
+        Object.keys(entry).sort().join(',') !== 'mode,relativeFile')
+        return false;
+    const file = entry['relativeFile'];
+    return (commit(value['projectCommit']) &&
+        identifier(value['producerApp']) &&
+        identifier(consumer['releaseId']) &&
+        hash(consumer['manifestSha256']) &&
+        identifier(consumer['app']) &&
+        (entry['mode'] === 'bootstrap' || entry['mode'] === 'script') &&
+        typeof file === 'string' &&
+        file.length <= 4096 &&
+        !/[\\:\0]/.test(file) &&
+        file.split('/').every((p) => p && p !== '.' && p !== '..') &&
+        /\.[cm]?js$/.test(file));
+}
+export function validOrigin(value) {
+    return (record(value) &&
+        identifier(value['releaseId']) &&
+        hash(value['manifestSha256']) &&
+        hash(value['artifactSha256']) &&
+        commit(value['frameworkCommit']) &&
+        identifier(value['app']) &&
+        Number.isSafeInteger(value['artifactBytes']) &&
+        value['artifactBytes'] > 0 &&
+        (value['runtimeOrigin'] === undefined || (validRuntimeOrigin(value['runtimeOrigin']) &&
+            value['runtimeOrigin'].consumer.app === value['app'])));
+}
+/** The same private receipt boundary is used by owners and executing applications. */
+export async function readInstalledReleaseReceipt(root) {
+    const file = path.join(root, '.omnitron-release.json');
+    if ((await fs.realpath(root)) !== root)
+        throw Error('Installed release root is not physical');
+    const { constants } = await import('node:fs');
+    const fd = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    let raw;
+    try {
+        const stat = await fd.stat();
+        if (!stat.isFile() ||
+            stat.size > 16384 ||
+            (stat.mode & 0o077) !== 0 ||
+            (process.getuid && stat.uid !== process.getuid()))
+            throw Error('The installed release receipt is not a private regular file');
+        raw = await fd.readFile('utf8');
+        const after = await fd.stat();
+        if (stat.size !== after.size || stat.mtimeMs !== after.mtimeMs || stat.ctimeMs !== after.ctimeMs)
+            throw Error('Installed release receipt changed during verification');
+    }
+    finally {
+        await fd.close();
+    }
+    let r;
+    try {
+        r = JSON.parse(raw);
+    }
+    catch {
+        throw Error('The installed release receipt is not valid JSON');
+    }
+    if (!record(r) ||
+        (r.version !== 1 && r.version !== 2) ||
+        r.root !== root ||
+        !validOrigin(r.origin) ||
+        !hash(r.treeSha256) ||
+        !commit(r.installedFrameworkCommit) ||
+        typeof r.frameworkContentUnchanged !== 'boolean' ||
+        typeof r.artifactPayloadUnchanged !== 'boolean')
+        throw Error('The installed release receipt is invalid');
+    if (r.version === 2) {
+        const t = r.target;
+        if (!t ||
+            !record(t) ||
+            typeof t.platform !== 'string' ||
+            !/^[a-z0-9_-]{1,32}$/.test(t.platform) ||
+            typeof t.arch !== 'string' ||
+            !/^[a-z0-9_-]{1,32}$/.test(t.arch) ||
+            typeof t.node !== 'string' ||
+            !/^v[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.-]+)?$/.test(t.node) ||
+            typeof t.abi !== 'string' ||
+            !/^[0-9]{1,8}$/.test(t.abi) ||
+            !hash(t.executableSha256) ||
+            (t.libc !== null && (typeof t.libc !== 'string' || t.libc.length > 128)) ||
+            typeof r.ownerPackage !== 'string' ||
+            !path.isAbsolute(r.ownerPackage) ||
+            r.ownerPackage.length > 4096 ||
+            typeof r.nodeOptions !== 'string' ||
+            releaseNodeOptions(r.nodeOptions) !== r.nodeOptions)
+            throw Error('The installed runtime target is invalid');
+    }
+    return r;
+}
+/** Publish complete JSON atomically; readers never observe an empty/partial receipt. */
+export async function writeInstalledReleaseReceipt(root, receipt) {
+    const io = await import('node:fs/promises'), paths = await import('node:path');
+    const { randomUUID } = await import('node:crypto');
+    const bytes = JSON.stringify(receipt);
+    if (Buffer.byteLength(bytes) > 16384)
+        throw Error('Installed release receipt exceeds its size limit');
+    const temp = paths.join(paths.dirname(root), '.origin-' + randomUUID());
+    try {
+        const fd = await io.open(temp, 'wx', 0o600);
+        try {
+            await fd.writeFile(bytes);
+            await fd.sync();
+        }
+        finally {
+            await fd.close();
+        }
+        await io.link(temp, paths.join(root, '.omnitron-release.json'));
+    }
+    finally {
+        await io.unlink(temp).catch((error) => {
+            if (error.code !== 'ENOENT')
+                throw error;
+        });
+    }
+}
+//# sourceMappingURL=installed-origin.js.map

package/dist/release/installed-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-origin.js","sourceRoot":"","sources":["../../src/release/installed-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAsB,MAAM,qBAAqB,CAAC;AAgC7E,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/G,MAAM,IAAI,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5F,MAAM,MAAM,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAM,UAAU,GAAG,CAAC,CAAU,EAAe,EAAE,CAC7C,OAAO,CAAC,KAAK,QAAQ,IAAI,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAE7F,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,0CAA0C;QACtG,OAAO,KAAK,CAAC;IACf,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,EAChC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACzB,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjB,CAAC,MAAM,CAAC,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,8BAA8B;QACzE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mBAAmB;QAE3D,OAAO,KAAK,CAAC;IACf,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IACnC,OAAO,CACL,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC9B,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAChC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;QAC7D,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,CAAC,MAAM,IAAI,IAAI;QACnB,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAC1D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,CACL,MAAM,CAAC,KAAK,CAAC;QACb,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC3C,KAAK,CAAC,eAAe,CAAY,GAAG,CAAC;QACtC,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9F,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjG,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC7B,IACE,CAAC,IAAI,CAAC,MAAM,EAAE;YACd,IAAI,CAAC,IAAI,GAAG,KAAK;YACjB,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YACzB,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAEjD,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7E,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAC9F,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACzE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,CAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IACD,IACE,CAAC,MAAM,CAAC,CAAC,CAAC;QACV,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QACtB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;QACnB,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC;QACnC,OAAO,CAAC,CAAC,yBAAyB,KAAK,SAAS;QAChD,OAAO,CAAC,CAAC,wBAAwB,KAAK,SAAS;QAE/C,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnB,IACE,CAAC,CAAC;YACF,CAAC,MAAM,CAAC,CAAC,CAAC;YACV,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,+CAA+C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YACzB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3B,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACzB,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAClC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;YAChC,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,IAAI;YAC5B,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;YACjC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW;YAEnD,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,IAAY,EAAE,OAAgC;IAC/F,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,EACzC,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK;QAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACpC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/release/installed-release.d.ts

@@ -0,0 +1,23 @@
+import type { ReleaseManifest } from './manifest.js';
+import type { InstalledArtifactObservation, InstalledReleaseCandidate, InstalledReleaseInspection } from '../shared/dto/installed-release.js';
+export interface InstalledReleaseCatalog {
+    complete: boolean;
+    reasons: string[];
+    releases: Array<{
+        manifest: ReleaseManifest;
+        sha256: string;
+    }>;
+}
+export declare function installedReadDeadline<T>(read: () => Promise<T>, timeout?: number): Promise<T>;
+export declare function boundedInstalledNodeRead(read: () => Promise<unknown>): Promise<InstalledArtifactObservation[]>;
+export declare function installedNodeFailure(error: unknown): string;
+/** Only bounded manifest reads; neither audit rows nor directory names establish an installed release. */
+export declare function installedReleaseCatalog(root: string, project: string): Promise<InstalledReleaseCatalog>;
+/** Every hash-and-byte match is reported; a reused artifact cannot silently choose a release. */
+export declare function installedReleaseCandidates(observation: InstalledArtifactObservation, catalog: InstalledReleaseCatalog): InstalledReleaseCandidate[];
+export declare function installedReleaseReport(project: string, stack: string, catalog: InstalledReleaseCatalog, nodes: Array<{
+    node: string;
+    observations?: InstalledArtifactObservation[];
+    error?: string;
+}>): InstalledReleaseInspection;
+//# sourceMappingURL=installed-release.d.ts.map

package/dist/release/installed-release.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-release.d.ts","sourceRoot":"","sources":["../../src/release/installed-release.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,OAAO,KAAK,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAE9I,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,eAAe,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAKnG;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,4BAA4B,EAAE,CAAC,CASpH;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAK3D;AAED,0GAA0G;AAC1G,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwC7G;AAED,iGAAiG;AACjG,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,4BAA4B,EAAE,OAAO,EAAE,uBAAuB,GAAG,yBAAyB,EAAE,CAiCnJ;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EACrG,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,0BAA0B,CAO3H"}