@omnitron-dev/omnitron 0.3.1 → 0.3.3

package/dist/release/installed-origin.d.ts

@@ -0,0 +1,42 @@
+import { type TargetRuntime } from './target-runtime.js';
+export interface ReleaseArtifactOrigin {
+    releaseId: string;
+    manifestSha256: string;
+    artifactSha256: string;
+    artifactBytes: number;
+    app: string;
+    frameworkCommit: string;
+    runtimeOrigin?: InstalledRuntimeOrigin;
+}
+export interface InstalledRuntimeOrigin {
+    projectCommit: string;
+    producerApp: string;
+    consumer: {
+        releaseId: string;
+        manifestSha256: string;
+        app: string;
+    };
+    entry: {
+        relativeFile: string;
+        mode: 'bootstrap' | 'script';
+    };
+}
+export interface InstalledReleaseReceipt {
+    version: 1 | 2;
+    nodeOptions?: string;
+    target?: TargetRuntime;
+    ownerPackage?: string;
+    origin: ReleaseArtifactOrigin;
+    root: string;
+    treeSha256: string;
+    installedFrameworkCommit: string;
+    frameworkContentUnchanged: boolean;
+    artifactPayloadUnchanged: boolean;
+}
+export declare function validRuntimeOrigin(value: unknown): value is InstalledRuntimeOrigin;
+export declare function validOrigin(value: unknown): value is ReleaseArtifactOrigin;
+/** The same private receipt boundary is used by owners and executing applications. */
+export declare function readInstalledReleaseReceipt(root: string): Promise<InstalledReleaseReceipt>;
+/** Publish complete JSON atomically; readers never observe an empty/partial receipt. */
+export declare function writeInstalledReleaseReceipt(root: string, receipt: InstalledReleaseReceipt): Promise<void>;
+//# sourceMappingURL=installed-origin.d.ts.map

package/dist/release/installed-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-origin.d.ts","sourceRoot":"","sources":["../../src/release/installed-origin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAA;KAAE,CAAC;CAC/D;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB,EAAE,MAAM,CAAC;IACjC,yBAAyB,EAAE,OAAO,CAAC;IACnC,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAQD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CA0BlF;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAa1E;AAED,sFAAsF;AACtF,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA+DhG;AAED,wFAAwF;AACxF,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhH"}

package/dist/release/installed-origin.js

@@ -0,0 +1,130 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { releaseNodeOptions } from './target-runtime.js';
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const hash = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const commit = (v) => typeof v === 'string' && /^[a-f0-9]{40}$/.test(v);
+const identifier = (v) => typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/.test(v) && !v.includes('..');
+export function validRuntimeOrigin(value) {
+    if (!record(value) || Object.keys(value).sort().join(',') !== 'consumer,entry,producerApp,projectCommit')
+        return false;
+    const consumer = value['consumer'], entry = value['entry'];
+    if (!record(consumer) ||
+        !record(entry) ||
+        Object.keys(consumer).sort().join(',') !== 'app,manifestSha256,releaseId' ||
+        Object.keys(entry).sort().join(',') !== 'mode,relativeFile')
+        return false;
+    const file = entry['relativeFile'];
+    return (commit(value['projectCommit']) &&
+        identifier(value['producerApp']) &&
+        identifier(consumer['releaseId']) &&
+        hash(consumer['manifestSha256']) &&
+        identifier(consumer['app']) &&
+        (entry['mode'] === 'bootstrap' || entry['mode'] === 'script') &&
+        typeof file === 'string' &&
+        file.length <= 4096 &&
+        !/[\\:\0]/.test(file) &&
+        file.split('/').every((p) => p && p !== '.' && p !== '..') &&
+        /\.[cm]?js$/.test(file));
+}
+export function validOrigin(value) {
+    return (record(value) &&
+        identifier(value['releaseId']) &&
+        hash(value['manifestSha256']) &&
+        hash(value['artifactSha256']) &&
+        commit(value['frameworkCommit']) &&
+        identifier(value['app']) &&
+        Number.isSafeInteger(value['artifactBytes']) &&
+        value['artifactBytes'] > 0 &&
+        (value['runtimeOrigin'] === undefined || (validRuntimeOrigin(value['runtimeOrigin']) &&
+            value['runtimeOrigin'].consumer.app === value['app'])));
+}
+/** The same private receipt boundary is used by owners and executing applications. */
+export async function readInstalledReleaseReceipt(root) {
+    const file = path.join(root, '.omnitron-release.json');
+    if ((await fs.realpath(root)) !== root)
+        throw Error('Installed release root is not physical');
+    const { constants } = await import('node:fs');
+    const fd = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    let raw;
+    try {
+        const stat = await fd.stat();
+        if (!stat.isFile() ||
+            stat.size > 16384 ||
+            (stat.mode & 0o077) !== 0 ||
+            (process.getuid && stat.uid !== process.getuid()))
+            throw Error('The installed release receipt is not a private regular file');
+        raw = await fd.readFile('utf8');
+        const after = await fd.stat();
+        if (stat.size !== after.size || stat.mtimeMs !== after.mtimeMs || stat.ctimeMs !== after.ctimeMs)
+            throw Error('Installed release receipt changed during verification');
+    }
+    finally {
+        await fd.close();
+    }
+    let r;
+    try {
+        r = JSON.parse(raw);
+    }
+    catch {
+        throw Error('The installed release receipt is not valid JSON');
+    }
+    if (!record(r) ||
+        (r.version !== 1 && r.version !== 2) ||
+        r.root !== root ||
+        !validOrigin(r.origin) ||
+        !hash(r.treeSha256) ||
+        !commit(r.installedFrameworkCommit) ||
+        typeof r.frameworkContentUnchanged !== 'boolean' ||
+        typeof r.artifactPayloadUnchanged !== 'boolean')
+        throw Error('The installed release receipt is invalid');
+    if (r.version === 2) {
+        const t = r.target;
+        if (!t ||
+            !record(t) ||
+            typeof t.platform !== 'string' ||
+            !/^[a-z0-9_-]{1,32}$/.test(t.platform) ||
+            typeof t.arch !== 'string' ||
+            !/^[a-z0-9_-]{1,32}$/.test(t.arch) ||
+            typeof t.node !== 'string' ||
+            !/^v[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.-]+)?$/.test(t.node) ||
+            typeof t.abi !== 'string' ||
+            !/^[0-9]{1,8}$/.test(t.abi) ||
+            !hash(t.executableSha256) ||
+            (t.libc !== null && (typeof t.libc !== 'string' || t.libc.length > 128)) ||
+            typeof r.ownerPackage !== 'string' ||
+            !path.isAbsolute(r.ownerPackage) ||
+            r.ownerPackage.length > 4096 ||
+            typeof r.nodeOptions !== 'string' ||
+            releaseNodeOptions(r.nodeOptions) !== r.nodeOptions)
+            throw Error('The installed runtime target is invalid');
+    }
+    return r;
+}
+/** Publish complete JSON atomically; readers never observe an empty/partial receipt. */
+export async function writeInstalledReleaseReceipt(root, receipt) {
+    const io = await import('node:fs/promises'), paths = await import('node:path');
+    const { randomUUID } = await import('node:crypto');
+    const bytes = JSON.stringify(receipt);
+    if (Buffer.byteLength(bytes) > 16384)
+        throw Error('Installed release receipt exceeds its size limit');
+    const temp = paths.join(paths.dirname(root), '.origin-' + randomUUID());
+    try {
+        const fd = await io.open(temp, 'wx', 0o600);
+        try {
+            await fd.writeFile(bytes);
+            await fd.sync();
+        }
+        finally {
+            await fd.close();
+        }
+        await io.link(temp, paths.join(root, '.omnitron-release.json'));
+    }
+    finally {
+        await io.unlink(temp).catch((error) => {
+            if (error.code !== 'ENOENT')
+                throw error;
+        });
+    }
+}
+//# sourceMappingURL=installed-origin.js.map

package/dist/release/installed-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-origin.js","sourceRoot":"","sources":["../../src/release/installed-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAsB,MAAM,qBAAqB,CAAC;AAgC7E,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/G,MAAM,IAAI,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5F,MAAM,MAAM,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAM,UAAU,GAAG,CAAC,CAAU,EAAe,EAAE,CAC7C,OAAO,CAAC,KAAK,QAAQ,IAAI,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAE7F,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,0CAA0C;QACtG,OAAO,KAAK,CAAC;IACf,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,EAChC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACzB,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjB,CAAC,MAAM,CAAC,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,8BAA8B;QACzE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mBAAmB;QAE3D,OAAO,KAAK,CAAC;IACf,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IACnC,OAAO,CACL,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC9B,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAChC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;QAC7D,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,CAAC,MAAM,IAAI,IAAI;QACnB,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAC1D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,CACL,MAAM,CAAC,KAAK,CAAC;QACb,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC3C,KAAK,CAAC,eAAe,CAAY,GAAG,CAAC;QACtC,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9F,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjG,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC7B,IACE,CAAC,IAAI,CAAC,MAAM,EAAE;YACd,IAAI,CAAC,IAAI,GAAG,KAAK;YACjB,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YACzB,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAEjD,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7E,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAC9F,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACzE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,CAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IACD,IACE,CAAC,MAAM,CAAC,CAAC,CAAC;QACV,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QACtB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;QACnB,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC;QACnC,OAAO,CAAC,CAAC,yBAAyB,KAAK,SAAS;QAChD,OAAO,CAAC,CAAC,wBAAwB,KAAK,SAAS;QAE/C,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnB,IACE,CAAC,CAAC;YACF,CAAC,MAAM,CAAC,CAAC,CAAC;YACV,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,+CAA+C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YACzB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3B,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACzB,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAClC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;YAChC,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,IAAI;YAC5B,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;YACjC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW;YAEnD,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,IAAY,EAAE,OAAgC;IAC/F,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,EACzC,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK;QAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACpC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/release/installed-release.d.ts

@@ -0,0 +1,23 @@
+import type { ReleaseManifest } from './manifest.js';
+import type { InstalledArtifactObservation, InstalledReleaseCandidate, InstalledReleaseInspection } from '../shared/dto/installed-release.js';
+export interface InstalledReleaseCatalog {
+    complete: boolean;
+    reasons: string[];
+    releases: Array<{
+        manifest: ReleaseManifest;
+        sha256: string;
+    }>;
+}
+export declare function installedReadDeadline<T>(read: () => Promise<T>, timeout?: number): Promise<T>;
+export declare function boundedInstalledNodeRead(read: () => Promise<unknown>): Promise<InstalledArtifactObservation[]>;
+export declare function installedNodeFailure(error: unknown): string;
+/** Only bounded manifest reads; neither audit rows nor directory names establish an installed release. */
+export declare function installedReleaseCatalog(root: string, project: string): Promise<InstalledReleaseCatalog>;
+/** Every hash-and-byte match is reported; a reused artifact cannot silently choose a release. */
+export declare function installedReleaseCandidates(observation: InstalledArtifactObservation, catalog: InstalledReleaseCatalog): InstalledReleaseCandidate[];
+export declare function installedReleaseReport(project: string, stack: string, catalog: InstalledReleaseCatalog, nodes: Array<{
+    node: string;
+    observations?: InstalledArtifactObservation[];
+    error?: string;
+}>): InstalledReleaseInspection;
+//# sourceMappingURL=installed-release.d.ts.map

package/dist/release/installed-release.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-release.d.ts","sourceRoot":"","sources":["../../src/release/installed-release.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,OAAO,KAAK,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAE9I,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,eAAe,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAKnG;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,4BAA4B,EAAE,CAAC,CASpH;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAK3D;AAED,0GAA0G;AAC1G,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwC7G;AAED,iGAAiG;AACjG,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,4BAA4B,EAAE,OAAO,EAAE,uBAAuB,GAAG,yBAAyB,EAAE,CAiCnJ;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EACrG,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,0BAA0B,CAO3H"}

package/dist/release/installed-release.js

@@ -0,0 +1,141 @@
+import { constants } from 'node:fs';
+import { open, opendir } from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { artifactReleaseContext, validateReleaseOrigins, MAX_RELEASE_MANIFEST_BYTES } from './origin.js';
+import { projectOfId } from './store.js';
+export async function installedReadDeadline(read, timeout = 55_000) {
+    let timer;
+    try {
+        return await Promise.race([read(), new Promise((_resolve, reject) => { timer = setTimeout(() => reject(new Error('Installed-file inspection timed out')), timeout); })]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+export async function boundedInstalledNodeRead(read) {
+    const value = await installedReadDeadline(read);
+    const digest = (input) => typeof input === 'string' && /^[a-f0-9]{64}$/.test(input);
+    if (!Array.isArray(value) || value.length > 32 || value.some(item => !item || typeof item.app !== 'string' || item.app.length > 256 ||
+        !['observed', 'unavailable', 'changed-during-inspection'].includes(item.state) || typeof item.observedAt !== 'string' ||
+        !(item.entrySha256 === null || digest(item.entrySha256)) || !(item.frameworkCommit === null || typeof item.frameworkCommit === 'string' && /^[a-f0-9]{7,40}$/.test(item.frameworkCommit)) ||
+        !Array.isArray(item.archives) || item.archives.length > 8 || item.archives.some((archive) => !archive || !digest(archive.sha256) || !Number.isSafeInteger(archive.bytes) || archive.bytes <= 0 || !(archive.entrySha256 === null || digest(archive.entrySha256))) ||
+        !Array.isArray(item.reasons) || item.reasons.length > 32 || item.reasons.some((reason) => typeof reason !== 'string' || reason.length > 1024)))
+        throw new Error('Invalid inspection response');
+    return value;
+}
+export function installedNodeFailure(error) {
+    const value = error;
+    if (value?.code === 'METHOD_NOT_FOUND' || value?.code === 404 || typeof value?.message === 'string' && /not a function|method.*(not found|does not exist|unknown)|unknown.*method/i.test(value.message))
+        return 'Node backend does not support installed-file inspection; update its backend. Applications were not changed';
+    if (typeof value?.message === 'string' && /timed out/i.test(value.message))
+        return 'Node did not finish installed-file inspection within the time limit';
+    return 'Node inspection is unavailable or busy; applications were not changed';
+}
+/** Only bounded manifest reads; neither audit rows nor directory names establish an installed release. */
+export async function installedReleaseCatalog(root, project) {
+    const catalog = { complete: true, reasons: [], releases: [] };
+    try {
+        let scanned = 0;
+        for await (const directory of await opendir(root)) {
+            if (++scanned > 2048)
+                throw new Error('Release catalog exceeds the inspection limit');
+            if (!directory.isDirectory() || projectOfId(directory.name) !== project)
+                continue;
+            const handle = await open(path.join(root, directory.name, 'manifest.json'), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK).catch(error => {
+                if (error.code !== 'ENOENT') {
+                    catalog.complete = false;
+                    catalog.reasons.push(`Release ${directory.name} manifest is unreadable`);
+                }
+                return null;
+            });
+            // Incomplete build directories do not participate in the release catalog.
+            if (!handle)
+                continue;
+            try {
+                const stat = await handle.stat();
+                if (!stat.isFile() || stat.size > MAX_RELEASE_MANIFEST_BYTES)
+                    throw new Error('Invalid release manifest');
+                const bytes = await handle.readFile();
+                const after = await handle.stat();
+                if (stat.size !== after.size || stat.ctimeMs !== after.ctimeMs)
+                    throw new Error('Release manifest changed while being read');
+                const manifest = JSON.parse(bytes.toString('utf8'));
+                if (manifest.id !== directory.name || !Array.isArray(manifest.artifacts) || manifest.artifacts.length > 256 ||
+                    typeof manifest.omni?.commit !== 'string' || !/^[a-f0-9]{7,40}$/.test(manifest.omni.commit) ||
+                    manifest.artifacts.some(a => typeof a.app !== 'string' || !/^[a-f0-9]{64}$/.test(a.sha256) || !Number.isSafeInteger(a.bytes) || a.bytes <= 0))
+                    throw new Error('Invalid release manifest');
+                validateReleaseOrigins(manifest);
+                catalog.releases.push({ manifest, sha256: createHash('sha256').update(bytes).digest('hex') });
+            }
+            catch {
+                catalog.complete = false;
+                catalog.reasons.push(`Release ${directory.name} has an invalid or changing manifest`);
+            }
+            finally {
+                await handle.close();
+            }
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            catalog.complete = false;
+            catalog.reasons.push('Release catalog could not be read completely within its inspection limits');
+        }
+    }
+    return catalog;
+}
+/** Every hash-and-byte match is reported; a reused artifact cannot silently choose a release. */
+export function installedReleaseCandidates(observation, catalog) {
+    if (observation.state !== 'observed')
+        return [];
+    const app = observation.app.split('/').at(-1);
+    return catalog.releases.flatMap(({ manifest, sha256 }) => {
+        const matches = manifest.artifacts.filter(artifact => artifact.app === app).flatMap(artifact => observation.archives.filter(archive => archive.sha256 === artifact.sha256 && archive.bytes === artifact.bytes));
+        if (!matches.length)
+            return [];
+        const reasons = [];
+        let framework;
+        try {
+            framework = artifactReleaseContext(manifest, app).manifest.omni;
+        }
+        catch {
+            return [{ releaseId: manifest.id, manifestSha256: sha256, state: 'incomplete', reasons: ['The artifact producer could not be verified from the retained release manifest'] }];
+        }
+        let modified = false;
+        let incomplete = false;
+        for (const match of matches) {
+            if (!match.entrySha256 || !observation.entrySha256) {
+                incomplete = true;
+                reasons.push('Entry point could not be compared with the retained archive');
+            }
+            else if (match.entrySha256 !== observation.entrySha256) {
+                modified = true;
+                reasons.push('Installed entry point differs from the retained release archive');
+            }
+        }
+        if (!observation.frameworkCommit) {
+            incomplete = true;
+            reasons.push('Installed framework build identity is unavailable');
+        }
+        else if (!framework.commit.startsWith(observation.frameworkCommit) && !observation.frameworkCommit.startsWith(framework.commit)) {
+            modified = true;
+            reasons.push(`Installed framework reports ${observation.frameworkCommit}; artifact producer records ${framework.commit}`);
+        }
+        else if ((framework.registry || framework.reproduced) && (observation.frameworkCommit.length !== 40 || observation.frameworkCommit !== framework.commit)) {
+            incomplete = true;
+            reasons.push('An archive-backed release requires the full framework commit for an exact comparison');
+        }
+        return [{ releaseId: manifest.id, manifestSha256: sha256, state: modified ? 'modified' : incomplete ? 'incomplete' : 'entry-matches', reasons: [...new Set(reasons)] }];
+    });
+}
+export function installedReleaseReport(project, stack, catalog, nodes) {
+    return { project, stack, observedAt: new Date().toISOString(), catalogComplete: catalog.complete, catalogReasons: catalog.reasons,
+        apps: nodes.flatMap(node => (node.observations ?? []).map(observation => ({ ...observation, node: node.node, candidates: installedReleaseCandidates(observation, catalog) }))),
+        nodes: nodes.filter(node => node.error).map(node => ({ node: node.node, error: node.error })),
+        limitations: ['Installed files were inspected now; this does not prove what a running process loaded.',
+            'Archive matches require SHA-256 and byte count. All matching catalog releases are shown; multiple matches are ambiguous.',
+            'Only the entry point and reported framework build are compared. A matching entry is not a full installation integrity check.'] };
+}
+//# sourceMappingURL=installed-release.js.map

package/dist/release/installed-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-release.js","sourceRoot":"","sources":["../../src/release/installed-release.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASzC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAI,IAAsB,EAAE,OAAO,GAAG,MAAM;IACrF,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClL,CAAC;YAAS,CAAC;QAAC,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAA4B;IACzE,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG;QACjI,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,2BAA2B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACrH,CAAC,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzL,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAyD,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACnT,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAe,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1M,OAAO,KAAuC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,KAAK,GAAG,KAAqD,CAAC;IACpE,IAAI,KAAK,EAAE,IAAI,KAAK,kBAAkB,IAAI,KAAK,EAAE,IAAI,KAAK,GAAG,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,4EAA4E,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,4GAA4G,CAAC;IAC7T,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,qEAAqE,CAAC;IACzJ,OAAO,uEAAuE,CAAC;AACjF,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,OAAe;IACzE,MAAM,OAAO,GAA4B,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACvF,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,KAAK,EAAE,MAAM,SAAS,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,IAAI,EAAE,OAAO,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YACtF,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,OAAO;gBAAE,SAAS;YAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBAC1J,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvD,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;oBACzB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,IAAI,yBAAyB,CAAC,CAAC;gBAC3E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,0EAA0E;YAC1E,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,0BAA0B;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC1G,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC7H,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAoB,CAAC;gBACvE,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;oBACzG,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;oBAC3F,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC7L,sBAAsB,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChG,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACzB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,IAAI,sCAAsC,CAAC,CAAC;YACxF,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,0BAA0B,CAAC,WAAyC,EAAE,OAAgC;IACpH,IAAI,WAAW,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAChN,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,SAAkC,CAAC;QACvC,IAAI,CAAC;YAAC,SAAS,GAAG,sBAAsB,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAC,CAAC;QACzE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,YAAqB,EAAE,OAAO,EAAE,CAAC,gFAAgF,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACjM,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBACnD,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC9E,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;gBACzD,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;YACjC,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAClI,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,+BAA+B,WAAW,CAAC,eAAe,+BAA+B,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5H,CAAC;aAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,KAAK,EAAE,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3J,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAqB,CAAC,CAAC,CAAC,eAAwB,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACrM,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAa,EAAE,OAAgC,EACrG,KAA6F;IAC7F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/H,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,0BAA0B,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9K,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAM,EAAE,CAAC,CAAC;QAC9F,WAAW,EAAE,CAAC,wFAAwF;YACpG,0HAA0H;YAC1H,8HAA8H,CAAC,EAAE,CAAC;AACxI,CAAC"}

package/dist/release/layout.d.ts

@@ -1,20 +1,3 @@
-/**
- * Where a release is built, so the lockfile's links land on the omni clone.
- *
- * Until the registry migration the project declares every omni package as a
- * `link:` to a checkout on the developer's disk, and the lockfile records it
- * RELATIVE to each importer — `link:../../luxquant/omnitron-dev/omni/apps/omnitron`
- * from the project root. `pnpm install --frozen-lockfile` follows that
- * relative path. So a clean clone of the project placed anywhere else either
- * links nothing (measured 2026-09-22: 97 of 97 links dangling, install exit 0)
- * or, placed at the same depth as the working checkout, links the DEVELOPER'S
- * omni — dirty tree and all — into a build that claims to be a commit.
- *
- * A release is therefore built inside a root that reproduces the relative
- * layout, with a clean clone of omni exactly where the links point. The
- * layout is read from the lockfile rather than written down here, because the
- * lockfile is what pnpm will follow.
- */
 export interface LinkLayout {
     /** omni's checkout relative to the project root, as the lockfile implies it. */
     readonly omniRel: string;
@@ -23,25 +6,37 @@ export interface LinkLayout {
     /** The omni workspace directories the project links, relative to omni's root. */
     readonly linkedDirs: readonly string[];
 }
-/**
- * Read the layout the lockfile implies, or say why there is none.
- *
- * A link that leaves the project root is an omni link; its target minus the
- * trailing `packages/<name>` or `apps/<name>` is omni's root. All of them
- * must agree on that root: links into two outside checkouts cannot be laid
- * out by one clone, and guessing which one is "omni" would build from the
- * wrong one.
- */
+export type RegistryPackage = {
+    name: string;
+    version: string;
+    integrity: string;
+    tarball?: string;
+};
+export type VendoredPackage = RegistryPackage & {
+    file: string;
+};
+/** Compatibility API for projects which explicitly reproduce a linked checkout. */
 export declare function readLinkLayout(lockfile: string): LinkLayout | {
     refusal: string;
 };
-/**
- * The two checkouts inside `srcRoot`: the project where its own last
- * `climbs` path segments put it, and omni where its links then land.
- */
-export declare function planBuildRoot(srcRoot: string, projectPath: string, layout: LinkLayout): {
+export type FrameworkLayout = {
+    kind: 'linked';
+    layout: LinkLayout;
+} | {
+    kind: 'registry';
+    packages: RegistryPackage[];
+    importers: string[];
+} | {
+    kind: 'vendored';
+    packages: VendoredPackage[];
+    importers: string[];
+};
+export declare function readFrameworkLayout(lockfile: string): FrameworkLayout;
+/** Lay out complete checkouts while preserving the registered project's location inside Git. */
+export declare function planBuildRoot(srcRoot: string, projectPath: string, layout: LinkLayout | undefined, repositoryPath?: string): {
+    repositoryDir: string;
     projectDir: string;
-    omniDir: string;
+    omniDir: string | null;
 } | {
     refusal: string;
 };

package/dist/release/layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../src/release/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CA4BjF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,UAAU,GACjB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAY/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAGnH"}
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../src/release/layout.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAUD,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACrG,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAoHjE,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAIjF;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE3E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAiCrE;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,cAAc,SAAc,GAC3B;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CA0B7F;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAGnH"}