@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/release/vendored-framework.js

@@ -0,0 +1,98 @@
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+import { promisify } from 'node:util';
+import { directoryOf, readWorkspace } from '../services/bundle-builder.js';
+import { normalizePackedWorkspace } from './portable-archive.js';
+import { inspectFrameworkArchive, verifiedFramework } from './registry-framework.js';
+import { checkoutFrameworkSource, defaultFrameworkSource } from './framework-source.js';
+import { parseFrameworkSource } from '../shared/framework-source.js';
+const exec = promisify(execFile);
+const SHA = /^[0-9a-f]{40}$/;
+const ARCHIVE_LIMIT = 64 * 1024 * 1024;
+export function requireFrameworkCommit(value) {
+    if (!value || !SHA.test(value))
+        throw Error('Vendored framework archives require --omni-commit with the full upstream Git commit to reproduce');
+    return value;
+}
+function git(directory, args, signal) {
+    return exec('git', ['--no-replace-objects', '--literal-pathspecs', ...args], { cwd: directory, signal });
+}
+/** Check the Git blob, not a mutable file beside the worktree or metadata supplied by a consumer. */
+export async function verifyCommittedArchive(projectDir, projectCommit, pkg, signal) {
+    const { stdout } = await git(projectDir, ['ls-tree', '-z', projectCommit, '--', pkg.file], signal);
+    const entry = /^(100644|100755) blob ([0-9a-f]{40,64})\t([^\0]+)\0$/.exec(stdout);
+    if (!entry || entry[3] !== pkg.file)
+        throw Error('Framework archive is not a committed regular file: ' + pkg.file);
+    const object = entry[2];
+    const size = Number((await git(projectDir, ['cat-file', '-s', object], signal)).stdout.trim());
+    if (!Number.isSafeInteger(size) || size <= 0 || size > ARCHIVE_LIMIT)
+        throw Error('Invalid framework archive size: ' + pkg.file);
+    const blob = await exec('git', ['--no-replace-objects', 'cat-file', 'blob', object], { cwd: projectDir, encoding: 'buffer', maxBuffer: ARCHIVE_LIMIT, signal });
+    if ('sha512-' + createHash('sha512').update(blob.stdout).digest('base64') !== pkg.integrity)
+        throw Error('Committed framework archive differs from its lockfile SHA-512: ' + pkg.file);
+    return blob.stdout;
+}
+export async function vendoredFrameworkSource(packages, options) {
+    if (options.frameworkSource !== undefined)
+        return parseFrameworkSource(options.frameworkSource);
+    const core = packages.find(pkg => pkg.name === '@omnitron-dev/omnitron');
+    if (!core)
+        throw Error('The lockfile lacks a verifiable Omnitron archive');
+    const bytes = await verifyCommittedArchive(options.projectDir, options.projectCommit, core, options.signal);
+    const metadata = await inspectFrameworkArchive(core, Readable.from(bytes), options.signal, requireFrameworkCommit(options.frameworkCommit));
+    return defaultFrameworkSource(metadata.repository);
+}
+/** Rebuild before the application install or any of its gates can execute. */
+export async function reproduceVendoredFramework(packages, options) {
+    const { projectDir, projectCommit, scratch, run, signal } = options;
+    const commit = requireFrameworkCommit(options.frameworkCommit);
+    for (const pkg of packages)
+        await verifyCommittedArchive(projectDir, projectCommit, pkg, signal);
+    const source = path.join(scratch, 'upstream');
+    await fs.mkdir(scratch, { recursive: true });
+    const env = { ...options.env, GIT_NO_REPLACE_OBJECTS: '1', GIT_TERMINAL_PROMPT: '0', TZ: 'UTC', CI: '1', TURBO_TELEMETRY_DISABLED: '1' };
+    delete env['TURBO_TOKEN'];
+    delete env['TURBO_TEAM'];
+    const identity = await checkoutFrameworkSource(source, { source: options.frameworkSource, commit, sourceBase: options.sourceBase,
+        env, run, ...(signal && { signal }) });
+    const epoch = (await git(source, ['show', '-s', '--format=%ct', 'HEAD'], signal)).stdout.trim();
+    const buildEnv = { ...env, SOURCE_DATE_EPOCH: epoch, TURBO_FORCE: 'true', TURBO_CONCURRENCY: '3' };
+    await run('pnpm', ['install', '--frozen-lockfile'], source, buildEnv);
+    // The selected source owns its complete build contract, including auxiliary
+    // declaration passes. Reimplementing only its Turbo "build" task changes SDK bytes.
+    await run('pnpm', ['run', 'build'], source, buildEnv);
+    return verifyReproducedFramework(packages, source, identity, scratch, run, buildEnv, signal);
+}
+/** Only the byte-identical result of packing a clean build is used to verify installed and staged files. */
+async function verifyReproducedFramework(packages, source, identity, scratch, run, env, signal) {
+    const commit = identity.commit;
+    const workspace = readWorkspace(source);
+    const verified = new Map();
+    const { stdout } = await git(source, ['show', '-s', '--format=%H %T', 'HEAD'], signal);
+    const [head, tree] = stdout.trim().split(' ');
+    if (head !== commit || !tree || !SHA.test(tree))
+        throw Error('The rebuilt framework checkout differs from the requested commit');
+    const archive = path.join(scratch, 'workspace.tgz');
+    for (const pkg of packages) {
+        const manifest = workspace.get(pkg.name);
+        if (!manifest || manifest.version !== pkg.version)
+            throw Error('No matching workspace package at the framework commit: ' + pkg.name);
+        await run('pnpm', ['pack', '--out', archive], directoryOf(manifest), env);
+        await normalizePackedWorkspace(archive);
+        try {
+            verified.set(pkg.name, await inspectFrameworkArchive(pkg, createReadStream(archive), signal, commit));
+        }
+        finally {
+            await fs.rm(archive, { force: true });
+        }
+    }
+    if ((await git(source, ['rev-parse', 'HEAD'], signal)).stdout.trim() !== commit ||
+        (await git(source, ['status', '--porcelain'], signal)).stdout.trim())
+        throw Error('The framework checkout changed during the build or pack');
+    return verifiedFramework({ ...identity, reproduced: { tree, packages } }, verified);
+}
+//# sourceMappingURL=vendored-framework.js.map

package/dist/release/vendored-framework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendored-framework.js","sourceRoot":"","sources":["../../src/release/vendored-framework.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAsB,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAwB,MAAM,+BAA+B,CAAC;AAG3F,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAC7B,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,kGAAkG,CAAC,CAAC;IAChJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,GAAG,CAAC,SAAiB,EAAE,IAAc,EAAE,MAAoB;IAClE,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAkB,EAAE,aAAqB,EAAE,GAAoB,EAAE,MAAoB;IAChI,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,sDAAsD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,aAAa;QAAE,MAAM,KAAK,CAAC,kCAAkC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAChK,IAAI,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,SAAS;QACzF,MAAM,KAAK,CAAC,iEAAiE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAoC,EAAE,OAEnF;IACC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,oBAAoB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5I,OAAO,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAcD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,QAAoC,EAAE,OAAqB;IAC1G,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACpE,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,MAAM,sBAAsB,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAAC;IAC5J,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9H,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChG,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;IACnG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtE,4EAA4E;IAC5E,oFAAoF;IACpF,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC/F,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,yBAAyB,CAAC,QAAoC,EAAE,MAAc,EAAE,QAAuB,EAAE,OAAe,EAAE,GAAkB,EAAE,GAAsB,EAAE,MAAoB;IACvM,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+D,CAAC;IACxF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACvF,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACjI,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,yDAAyD,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACrI,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxG,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QAC3E,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACtE,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACzE,OAAO,iBAAiB,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;AACtF,CAAC"}

package/dist/release/workspace-source.d.ts

@@ -0,0 +1,3 @@
+/** The registration selects a config; its nearest committed pnpm lock selects the build workspace. */
+export declare function releaseWorkspaceDirectory(repository: string, commit: string, configuration: string): Promise<string>;
+//# sourceMappingURL=workspace-source.d.ts.map

package/dist/release/workspace-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-source.d.ts","sourceRoot":"","sources":["../../src/release/workspace-source.ts"],"names":[],"mappings":"AAMA,sGAAsG;AACtG,wBAAsB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB1H"}

package/dist/release/workspace-source.js

@@ -0,0 +1,33 @@
+import { execFile } from 'node:child_process';
+import path from 'node:path';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+/** The registration selects a config; its nearest committed pnpm lock selects the build workspace. */
+export async function releaseWorkspaceDirectory(repository, commit, configuration) {
+    if (!/^[a-f0-9]{40}$/.test(commit) || (configuration && (configuration.includes('\\') ||
+        configuration.split('/').some(s => !s || s === '.' || s === '..'))))
+        throw Error('Invalid release source location');
+    const candidates = [];
+    for (let dir = configuration;; dir = path.posix.dirname(dir) === '.' ? '' : path.posix.dirname(dir)) {
+        candidates.push(path.posix.join(dir, 'pnpm-lock.yaml'));
+        if (!dir)
+            break;
+    }
+    const { stdout } = await exec('git', ['--literal-pathspecs', 'ls-tree', '-z', '--full-tree', commit, '--', ...candidates], { cwd: repository });
+    const blobs = stdout.split('\0').filter(Boolean).map(line => {
+        const tab = line.indexOf('\t');
+        return [line.slice(tab + 1), line.slice(0, tab)];
+    });
+    const files = new Map(blobs);
+    for (const file of candidates) {
+        const object = files.get(file);
+        if (object === undefined)
+            continue;
+        if (!/^100(?:644|755) blob [a-f0-9]{40}$/.test(object))
+            throw Error('Release lock must be a regular committed file: ' + file);
+        const dir = path.posix.dirname(file);
+        return dir === '.' ? '' : dir;
+    }
+    throw Error('No committed pnpm-lock.yaml for configuration ' + (configuration || '.') + ' at ' + commit);
+}
+//# sourceMappingURL=workspace-source.js.map

package/dist/release/workspace-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-source.js","sourceRoot":"","sources":["../../src/release/workspace-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,MAAc,EAAE,aAAqB;IACvG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnF,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtH,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,KAAK,IAAI,GAAG,GAAG,aAAa,GAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,MAAM;IAClB,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAChJ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAU,CAAC;IAC5F,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,iDAAiD,GAAG,IAAI,CAAC,CAAC;QAC9H,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAChC,CAAC;IACD,MAAM,KAAK,CAAC,gDAAgD,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;AAC3G,CAAC"}

package/dist/runtime/context.d.ts

@@ -0,0 +1,29 @@
+import { type Token } from '@omnitron-dev/titan/nexus';
+import { type ArtifactIdentity } from './identity.js';
+export type InstalledRuntimeContext = Readonly<{
+    state: 'verified';
+    basis: 'verified-installed-runtime';
+    producer: ArtifactIdentity;
+    consumer: Readonly<{
+        releaseId: string;
+        manifestSha256: string;
+        app: string;
+    }>;
+    entry: Readonly<{
+        relativeFile: string;
+        mode: 'bootstrap' | 'script';
+    }>;
+    payloadSha256: string;
+    executableSha256: string;
+    observedAt: string;
+    ownerAttestation: null;
+}> | Readonly<{
+    state: 'unavailable';
+    reason: string;
+}>;
+export declare const RUNTIME_CONTEXT: Token<InstalledRuntimeContext>;
+/** Startup evidence for this physical compiled entry, not owner or continuous-memory attestation. */
+export declare function verifyInstalledRuntime(entry: URL): Promise<InstalledRuntimeContext>;
+/** A bootstrap child may load only compiled code from the same checked closure. */
+export declare function assertInstalledRuntimeModule(context: InstalledRuntimeContext, entry: URL, module: URL): Promise<void>;
+//# sourceMappingURL=context.d.ts.map

package/dist/runtime/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/runtime/context.ts"],"names":[],"mappings":"AAGA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAKpE,OAAO,EAAE,KAAK,gBAAgB,EAAyD,MAAM,eAAe,CAAC;AAE7G,MAAM,MAAM,uBAAuB,GAC/B,QAAQ,CAAC;IACP,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,4BAA4B,CAAC;IACpC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,EAAE,QAAQ,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAA;KAAE,CAAC,CAAC;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,IAAI,CAAC;CACxB,CAAC,GACF,QAAQ,CAAC;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACvD,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,uBAAuB,CACO,CAAC;AAEnE,qGAAqG;AACrG,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAkFzF;AAED,mFAAmF;AACnF,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,GAAG,GACV,OAAO,CAAC,IAAI,CAAC,CAsBf"}

package/dist/runtime/context.js

@@ -0,0 +1,111 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createToken } from '@omnitron-dev/titan/nexus';
+import { readInstalledReleaseReceipt, validRuntimeOrigin } from '../release/installed-origin.js';
+import { releaseTreeDigest } from '../release/runtime-provenance.js';
+import { releaseNodeOptions, targetRuntime } from '../release/target-runtime.js';
+import { parseArtifactIdentity, RuntimeOriginVerificationError } from './identity.js';
+export const RUNTIME_CONTEXT = createToken('omnitron.runtime-context');
+/** Startup evidence for this physical compiled entry, not owner or continuous-memory attestation. */
+export async function verifyInstalledRuntime(entry) {
+    try {
+        if (!(entry instanceof URL) || entry.protocol !== 'file:' || entry.search || entry.hash)
+            throw Error('Expected the actual compiled entry file URL');
+        const file = fileURLToPath(entry);
+        let root, directory = path.dirname(file);
+        for (;;) {
+            const exists = await fs.lstat(path.join(directory, '.omnitron-release.json')).then(() => true, (e) => {
+                if (e.code === 'ENOENT')
+                    return false;
+                throw e;
+            });
+            if (exists) {
+                if (root)
+                    throw Error('Ambiguous nested installed-origin receipts');
+                root = directory;
+            }
+            const parent = path.dirname(directory);
+            if (parent === directory)
+                break;
+            directory = parent;
+        }
+        if (!root)
+            return Object.freeze({ state: 'unavailable', reason: 'No admitted runtime origin is recorded for this entry' });
+        if (!/\.[cm]?js$/.test(file) || (await fs.realpath(file)) !== file || !(await fs.lstat(file)).isFile())
+            throw Error('Runtime entry must be a physical compiled file');
+        const r = await readInstalledReleaseReceipt(root), origin = r.origin.runtimeOrigin;
+        if (r.artifactPayloadUnchanged !== true ||
+            r.frameworkContentUnchanged !== true ||
+            r.installedFrameworkCommit !== r.origin.frameworkCommit)
+            throw Error('Installed runtime binding changed');
+        if (origin === undefined)
+            return Object.freeze({ state: 'unavailable', reason: 'Legacy installation has no runtime-origin contract' });
+        if (r.version !== 2 || !validRuntimeOrigin(origin))
+            throw Error('Invalid installed runtime-origin contract');
+        if (process.env['NODE_PATH'])
+            throw Error('Runtime extends NODE_PATH');
+        const nodeOptions = releaseNodeOptions(process.env['NODE_OPTIONS']);
+        // No inherited loader/preload can be represented by a permitted resource setting.
+        if (process.execArgv.some((arg) => arg !== nodeOptions || !/^--max-old-space-size=[1-9][0-9]{0,6}$/.test(arg)))
+            throw Error('Runtime command-line options are outside the verified installation');
+        if (path.join(root, origin.entry.relativeFile) !== file)
+            throw Error('Runtime entry differs from the admitted compiled entry');
+        if (r.nodeOptions !== nodeOptions ||
+            r.artifactPayloadUnchanged !== true ||
+            r.frameworkContentUnchanged !== true ||
+            r.installedFrameworkCommit !== r.origin.frameworkCommit)
+            throw Error('Installed runtime binding changed');
+        const target = await targetRuntime();
+        if (!r.target || Object.entries(target).some(([k, v]) => r.target[k] !== v))
+            throw Error('Runtime executable differs from the admitted target');
+        if ((await releaseTreeDigest(root)) !== r.treeSha256)
+            throw Error('Installed runtime payload changed');
+        return Object.freeze({
+            state: 'verified',
+            basis: 'verified-installed-runtime',
+            producer: parseArtifactIdentity({
+                releaseId: r.origin.releaseId,
+                manifestSha256: r.origin.manifestSha256,
+                artifactSha256: r.origin.artifactSha256,
+                producerApp: origin.producerApp,
+                projectCommit: origin.projectCommit,
+                frameworkCommit: r.origin.frameworkCommit,
+            }),
+            consumer: Object.freeze({ ...origin.consumer }),
+            entry: Object.freeze({ ...origin.entry }),
+            payloadSha256: r.treeSha256,
+            executableSha256: target.executableSha256,
+            observedAt: new Date().toISOString(),
+            ownerAttestation: null,
+        });
+    }
+    catch (error) {
+        if (error instanceof RuntimeOriginVerificationError)
+            throw error;
+        throw new RuntimeOriginVerificationError(error instanceof Error ? error.message : 'Runtime origin verification failed', { cause: error });
+    }
+}
+/** A bootstrap child may load only compiled code from the same checked closure. */
+export async function assertInstalledRuntimeModule(context, entry, module) {
+    if (context.state !== 'verified')
+        return;
+    try {
+        const entryPath = fileURLToPath(entry);
+        let root = entryPath;
+        for (const _ of context.entry.relativeFile.split('/'))
+            root = path.dirname(root);
+        if (path.join(root, context.entry.relativeFile) !== entryPath ||
+            module.protocol !== 'file:' ||
+            module.search ||
+            module.hash)
+            throw Error('Runtime module does not belong to the admitted entry');
+        const file = await fs.realpath(fileURLToPath(module));
+        if (!file.startsWith(root + path.sep) || !/\.[cm]?js$/.test(file) || !(await fs.lstat(file)).isFile())
+            throw Error('Runtime module is outside the installed compiled closure');
+    }
+    catch (error) {
+        throw new RuntimeOriginVerificationError(error instanceof Error ? error.message : 'Runtime module verification failed', { cause: error });
+    }
+}
+//# sourceMappingURL=context.js.map

package/dist/runtime/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/runtime/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAc,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAEjF,OAAO,EAAyB,qBAAqB,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAe7G,MAAM,CAAC,MAAM,eAAe,GAC1B,WAAW,CAA0B,0BAA0B,CAAC,CAAC;AAEnE,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAU;IACrD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI;YACrF,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAwB,EAC1B,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAChF,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,CAAC,EAAE,EAAE;gBACJ,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBACjE,MAAM,CAAC,CAAC;YACV,CAAC,CACF,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,IAAI;oBAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBACpE,IAAI,GAAG,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,IAAI;YACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;YACpG,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,EAC/C,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;QAClC,IACE,CAAC,CAAC,wBAAwB,KAAK,IAAI;YACnC,CAAC,CAAC,yBAAyB,KAAK,IAAI;YACpC,CAAC,CAAC,wBAAwB,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe;YAEvD,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC,CAAC;QAC/G,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACpE,kFAAkF;QAClF,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,WAAW,IAAI,CAAC,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5G,MAAM,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAEpF,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI;YACrD,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,IACE,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,CAAC,CAAC,wBAAwB,KAAK,IAAI;YACnC,CAAC,CAAC,yBAAyB,KAAK,IAAI;YACpC,CAAC,CAAC,wBAAwB,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe;YAEvD,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAO,CAAC,CAAwB,CAAC,KAAK,CAAC,CAAC;YACjG,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU;YAAE,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,4BAA4B;YACnC,QAAQ,EAAE,qBAAqB,CAAC;gBAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;gBAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc;gBACvC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc;gBACvC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,eAAe;aAC1C,CAAC;YACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/C,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YACzC,aAAa,EAAE,CAAC,CAAC,UAAU;YAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,8BAA8B;YAAE,MAAM,KAAK,CAAC;QACjE,MAAM,IAAI,8BAA8B,CACtC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,EAC7E,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgC,EAChC,KAAU,EACV,MAAW;IAEX,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,IAAI,GAAG,SAAS,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjF,IACE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,SAAS;YACzD,MAAM,CAAC,QAAQ,KAAK,OAAO;YAC3B,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,IAAI;YAEX,MAAM,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;YACnG,MAAM,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,8BAA8B,CACtC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,EAC7E,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/runtime/identity.d.ts

@@ -0,0 +1,15 @@
+export type ArtifactIdentity = Readonly<{
+    releaseId: string;
+    manifestSha256: string;
+    artifactSha256: string;
+    producerApp: string;
+    projectCommit: string;
+    frameworkCommit: string;
+}>;
+export declare class RuntimeOriginVerificationError extends Error {
+    readonly code = "RUNTIME_ORIGIN_INVALID";
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare function assertArtifactIdentity(value: unknown): asserts value is ArtifactIdentity;
+export declare function parseArtifactIdentity(value: unknown): ArtifactIdentity;
+//# sourceMappingURL=identity.d.ts.map

package/dist/runtime/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/runtime/identity.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC,CAAC;AACH,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAGlD;CACF;AACD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,gBAAgB,CAexF;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAUtE"}

package/dist/runtime/identity.js

@@ -0,0 +1,33 @@
+export class RuntimeOriginVerificationError extends Error {
+    code = 'RUNTIME_ORIGIN_INVALID';
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'RuntimeOriginVerificationError';
+    }
+}
+export function assertArtifactIdentity(value) {
+    const v = value;
+    const id = (s) => typeof s === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/.test(s) && !s.includes('..');
+    if (!v ||
+        typeof v !== 'object' ||
+        Array.isArray(v) ||
+        !id(v.releaseId) ||
+        !id(v.producerApp) ||
+        ![v.manifestSha256, v.artifactSha256].every((s) => typeof s === 'string' && /^[a-f0-9]{64}$/.test(s)) ||
+        ![v.projectCommit, v.frameworkCommit].every((s) => typeof s === 'string' && /^[a-f0-9]{40}$/.test(s)) ||
+        Object.keys(v).sort().join(',') !==
+            'artifactSha256,frameworkCommit,manifestSha256,producerApp,projectCommit,releaseId')
+        throw new RuntimeOriginVerificationError('Invalid immutable artifact identity');
+}
+export function parseArtifactIdentity(value) {
+    assertArtifactIdentity(value);
+    return Object.freeze({
+        releaseId: value.releaseId,
+        manifestSha256: value.manifestSha256,
+        artifactSha256: value.artifactSha256,
+        producerApp: value.producerApp,
+        projectCommit: value.projectCommit,
+        frameworkCommit: value.frameworkCommit,
+    });
+}
+//# sourceMappingURL=identity.js.map

package/dist/runtime/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/runtime/identity.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAC9C,IAAI,GAAG,wBAAwB,CAAC;IACzC,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AACD,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,EAAE,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtH,IACE,CAAC,CAAC;QACF,OAAO,CAAC,KAAK,QAAQ;QACrB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAChB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QAClB,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,mFAAmF;QAErF,MAAM,IAAI,8BAA8B,CAAC,qCAAqC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/index.d.ts

@@ -0,0 +1,3 @@
+export { RUNTIME_CONTEXT, verifyInstalledRuntime, type InstalledRuntimeContext } from './context.js';
+export { RuntimeOriginVerificationError, assertArtifactIdentity, parseArtifactIdentity, type ArtifactIdentity, } from './identity.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACrG,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC"}

package/dist/runtime/index.js

@@ -0,0 +1,3 @@
+export { RUNTIME_CONTEXT, verifyInstalledRuntime } from './context.js';
+export { RuntimeOriginVerificationError, assertArtifactIdentity, parseArtifactIdentity, } from './identity.js';
+//# sourceMappingURL=index.js.map

package/dist/runtime/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAgC,MAAM,cAAc,CAAC;AACrG,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,qBAAqB,GAEtB,MAAM,eAAe,CAAC"}

package/dist/services/access.rpc-service.d.ts

@@ -0,0 +1,41 @@
+import { type Kysely } from 'kysely';
+import type { Netron } from '@omnitron-dev/titan/netron';
+import type { OmnitronDatabase } from '../database/schema.js';
+import type { ConsoleAccess, ConsoleAccount, ConsoleRole, IOmnitronAccessService } from '../shared/dto/access.js';
+import type { AuthService } from './auth.service.js';
+import type { AuditService } from './audit.service.js';
+/** Human control-plane accounts. Application roles and service identities stay separate. */
+export declare class AccessRpcService implements IOmnitronAccessService {
+    private readonly db;
+    private readonly auth;
+    private readonly audit;
+    private readonly netron;
+    constructor(db: Kysely<OmnitronDatabase>, auth: AuthService, audit: AuditService, netron: Netron);
+    describe(): Promise<ConsoleAccess>;
+    listUsers(data?: {
+        after?: string;
+    }): Promise<{
+        users: ConsoleAccount[];
+        next: string | null;
+    }>;
+    /** Serialize role changes and recheck the actor inside the same transaction. */
+    private transaction;
+    createUser(data: {
+        username: string;
+        displayName?: string;
+        password: string;
+        role: ConsoleRole;
+    }): Promise<ConsoleAccount>;
+    setRole(data: {
+        id: string;
+        role: ConsoleRole;
+        previous: string;
+    }): Promise<void>;
+    revokeSessions(data: {
+        id: string;
+    }): Promise<{
+        revoked: number;
+    }>;
+    private invalidateAuthority;
+}
+//# sourceMappingURL=access.rpc-service.d.ts.map

package/dist/services/access.rpc-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/access.rpc-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,KAAK,MAAM,EAAoB,MAAM,QAAQ,CAAC;AAG5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAIzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAClH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAyBvD,4FAA4F;AAC5F,qBACa,gBAAiB,YAAW,sBAAsB;IAE3D,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,YACmB,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC5B,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM,EAC7B;IAGE,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,CAiCvC;IAGK,SAAS,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO;;;OAM5C;IAED,gFAAgF;YAClE,WAAW;IAoBnB,UAAU,CAAC,IAAI,EAAE;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,WAAW,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CA2C1B;IAGK,OAAO,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6CtF;IAGK,cAAc,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAiBvE;IAED,OAAO,CAAC,mBAAmB;CAG5B"}