@opengeni/artifact-tool 0.2.2

package/dist/chunk-U5G2BKM2.js

@@ -0,0 +1,613 @@
+import {
+  doctorVerifiedArtifactRuntime,
+  loadVerifiedArtifactKernelRuntime,
+  probeVerifiedArtifactSkillFacade,
+  resolveCurrentArtifactRuntimeTarget,
+  runArtifactRuntimeCli
+} from "./chunk-ZCJYRJGB.js";
+import {
+  ARTIFACT_RUNTIME_ENVIRONMENT,
+  ARTIFACT_RUNTIME_TARGETS,
+  ArtifactRuntimeError,
+  artifactRuntimeTarget,
+  loadArtifactKernelRuntime,
+  validateArtifactKernelPackageManifest
+} from "./chunk-N2IHNWBS.js";
+
+// src/runtime-development.ts
+import { createHash } from "crypto";
+import { open, realpath, stat } from "fs/promises";
+import { isAbsolute, relative, resolve } from "path";
+import { pathToFileURL } from "url";
+
+// src/runtime-receipt.ts
+var NATIVE_ASSET = "opengeni_artifact_kernel.node";
+var WASM_RUNTIME_FILES = [
+  "artifact_kernel.js",
+  "artifact_kernel_bg.wasm",
+  "artifact_kernel_document.js",
+  "artifact_kernel_document_bg.wasm",
+  "artifact_kernel_presentation.js",
+  "artifact_kernel_presentation_bg.wasm",
+  "artifact_kernel_spreadsheet.js",
+  "artifact_kernel_spreadsheet_bg.wasm"
+];
+var MAX_CAPABILITIES_BYTES = 1024 * 1024;
+function validateArtifactKernelBuildReceipt(value, expectedTarget) {
+  const record = exactRecord(
+    value,
+    [
+      "schemaVersion",
+      "producer",
+      "target",
+      "kind",
+      "buildIdentity",
+      "capabilities",
+      "runtimeFiles"
+    ],
+    "target build receipt"
+  );
+  if (record.schemaVersion !== 1 || record.producer !== "opengeni-artifact-kernel-smoke-v1") {
+    invalid("target build receipt schema/producer is invalid");
+  }
+  if (typeof record.target !== "string" || !ARTIFACT_RUNTIME_TARGETS.includes(record.target)) {
+    invalid("target build receipt target is invalid");
+  }
+  const descriptor = artifactRuntimeTarget(record.target);
+  if (expectedTarget !== void 0 && descriptor.target !== expectedTarget) {
+    invalid(`target build receipt ${descriptor.target} does not match ${expectedTarget}`);
+  }
+  if (record.kind !== descriptor.kind) invalid("target build receipt kind is invalid");
+  if (typeof record.buildIdentity !== "string" || record.buildIdentity.length === 0 || record.buildIdentity.length > 512) {
+    invalid("target build receipt identity is invalid");
+  }
+  const capabilities = fileProof(record.capabilities, "target build capabilities", false);
+  if (capabilities.bytes > MAX_CAPABILITIES_BYTES) {
+    invalid("target build capabilities exceed their maximum size");
+  }
+  if (!Array.isArray(record.runtimeFiles) || record.runtimeFiles.length === 0 || record.runtimeFiles.length > 8) {
+    invalid("target build receipt runtimeFiles is invalid");
+  }
+  const runtimeFiles = record.runtimeFiles.map(
+    (entry, index) => fileProof(entry, `target build runtime file ${index}`, true)
+  );
+  if (!runtimeFiles.every((entry, index) => index === 0 || runtimeFiles[index - 1].path < entry.path)) {
+    invalid("target build receipt runtimeFiles must be strictly sorted");
+  }
+  const expectedPaths = descriptor.kind === "native" ? [NATIVE_ASSET] : WASM_RUNTIME_FILES;
+  if (JSON.stringify(runtimeFiles.map(({ path }) => path)) !== JSON.stringify(expectedPaths)) {
+    invalid("target build receipt runtimeFiles do not match the target package");
+  }
+  return {
+    schemaVersion: 1,
+    producer: "opengeni-artifact-kernel-smoke-v1",
+    target: descriptor.target,
+    kind: descriptor.kind,
+    buildIdentity: record.buildIdentity,
+    capabilities: { bytes: capabilities.bytes, sha256: capabilities.sha256 },
+    runtimeFiles
+  };
+}
+function canonicalArtifactKernelBuildReceiptBytes(value) {
+  const receipt = validateArtifactKernelBuildReceipt(value);
+  return new TextEncoder().encode(`${JSON.stringify(receipt, null, 2)}
+`);
+}
+function fileProof(value, name, includePath) {
+  const record = exactRecord(
+    value,
+    includePath ? ["path", "bytes", "sha256"] : ["bytes", "sha256"],
+    name
+  );
+  const bytes = record.bytes;
+  const digest2 = record.sha256;
+  if (!Number.isSafeInteger(bytes) || bytes <= 0) invalid(`${name} bytes is invalid`);
+  if (typeof digest2 !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(digest2)) {
+    invalid(`${name} digest is invalid`);
+  }
+  if (!includePath) return { bytes, sha256: digest2 };
+  const path = record.path;
+  if (typeof path !== "string" || path.length === 0 || path.includes("/") || path.includes("\\") || path === "." || path === "..") {
+    invalid(`${name} path is invalid`);
+  }
+  return { path, bytes, sha256: digest2 };
+}
+function exactRecord(value, keys, name) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    invalid(`${name} is invalid`);
+  }
+  const record = value;
+  if (JSON.stringify(Object.keys(record).sort()) !== JSON.stringify([...keys].sort())) {
+    invalid(`${name} has unexpected fields`);
+  }
+  return record;
+}
+function invalid(message) {
+  throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_MANIFEST_INVALID", message);
+}
+
+// src/runtime-development.ts
+var DEVELOPMENT_ARTIFACT_RUNTIME_ENVIRONMENT = {
+  manifest: "OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST"
+};
+var MAX_MANIFEST_BYTES = 256 * 1024;
+var MAX_IDENTITY_BYTES = 64 * 1024;
+var MAX_RECEIPT_BYTES = 256 * 1024;
+var MAX_JAVASCRIPT_BYTES = 32 * 1024 * 1024;
+var MAX_KERNEL_ASSET_BYTES = 512 * 1024 * 1024;
+var MAX_MATERIALIZER_EXECUTABLE_BYTES = 512 * 1024 * 1024;
+function isArtifactRuntimeConfigured(environment = process.env) {
+  return [
+    ARTIFACT_RUNTIME_ENVIRONMENT.manifest,
+    ARTIFACT_RUNTIME_ENVIRONMENT.toolEntrypoint,
+    DEVELOPMENT_ARTIFACT_RUNTIME_ENVIRONMENT.manifest
+  ].some((name) => typeof environment[name] === "string");
+}
+function validateDevelopmentArtifactRuntimeManifest(value, expectedTarget) {
+  const record = exactRecord2(
+    value,
+    [
+      "schemaVersion",
+      "mode",
+      "target",
+      "sourceFingerprint",
+      "artifactTool",
+      "artifactToolIdentity",
+      "receipt",
+      "skillFacadeEntrypoint",
+      "materializerExecutable",
+      "kernelPackageRoot",
+      "kernel"
+    ],
+    "development runtime manifest"
+  );
+  if (record.schemaVersion !== 1 || record.mode !== "development-current-host") {
+    invalid2("development runtime schema/mode is invalid");
+  }
+  if (record.target === "wasm-web") invalid2("development server runtime must be native");
+  const kernel = validateArtifactKernelPackageManifest(record.kernel);
+  if (kernel.kind !== "native" || kernel.target !== record.target) {
+    invalid2("development runtime target differs from its native kernel");
+  }
+  if (expectedTarget && kernel.target !== expectedTarget) {
+    invalid2(`development runtime target ${kernel.target} does not match ${expectedTarget}`);
+  }
+  const artifactTool = exactRecord2(
+    record.artifactTool,
+    ["packageName", "packageVersion"],
+    "development artifact-tool identity"
+  );
+  if (artifactTool.packageName !== "@opengeni/artifact-tool" || artifactTool.packageVersion !== kernel.artifactToolVersion) {
+    invalid2("development artifact-tool identity differs from its kernel");
+  }
+  return Object.freeze({
+    schemaVersion: 1,
+    mode: "development-current-host",
+    target: kernel.target,
+    sourceFingerprint: digest(record.sourceFingerprint, "development source fingerprint"),
+    artifactTool: Object.freeze({
+      packageName: "@opengeni/artifact-tool",
+      packageVersion: kernel.artifactToolVersion
+    }),
+    artifactToolIdentity: fileDescriptor(
+      record.artifactToolIdentity,
+      "development artifact-tool identity file"
+    ),
+    receipt: fileDescriptor(record.receipt, "development build receipt"),
+    skillFacadeEntrypoint: fileDescriptor(record.skillFacadeEntrypoint, "development skill facade"),
+    materializerExecutable: fileDescriptor(
+      record.materializerExecutable,
+      "development materializer executable"
+    ),
+    kernelPackageRoot: safeRelativePath(record.kernelPackageRoot, "development kernel root"),
+    kernel
+  });
+}
+function canonicalDevelopmentArtifactRuntimeManifestBytes(value) {
+  const manifest = validateDevelopmentArtifactRuntimeManifest(value);
+  return new TextEncoder().encode(`${JSON.stringify(manifest, null, 2)}
+`);
+}
+function canonicalDevelopmentArtifactToolIdentityBytes(artifactTool) {
+  if (artifactTool.packageName !== "@opengeni/artifact-tool" || !stableVersion(artifactTool.packageVersion)) {
+    invalid2("development artifact-tool identity is invalid");
+  }
+  return new TextEncoder().encode(`${JSON.stringify(artifactTool, null, 2)}
+`);
+}
+async function locateVerifiedDevelopmentArtifactRuntime(options = {}) {
+  const environment = options.environment ?? process.env;
+  assertDevelopmentEnvironment(environment);
+  const expectedTarget = options.expectedTarget ?? currentNativeTarget();
+  const manifestInput = requiredPath(
+    environment,
+    DEVELOPMENT_ARTIFACT_RUNTIME_ENVIRONMENT.manifest
+  );
+  const facadeInput = requiredPath(environment, ARTIFACT_RUNTIME_ENVIRONMENT.toolEntrypoint);
+  const manifestPath = await canonicalFile(manifestInput, "development runtime manifest");
+  const manifestBytes = await readBoundedFile(
+    manifestPath,
+    MAX_MANIFEST_BYTES,
+    "development runtime manifest"
+  );
+  const manifest = validateDevelopmentArtifactRuntimeManifest(
+    parseJson(manifestBytes, "development runtime manifest"),
+    expectedTarget
+  );
+  if (!sameBytes(manifestBytes, canonicalDevelopmentArtifactRuntimeManifestBytes(manifest))) {
+    integrity("Development runtime manifest is not canonical");
+  }
+  const root = await realpath(resolve(manifestPath, ".."));
+  const identityPath = await confinedFile(
+    root,
+    manifest.artifactToolIdentity.path,
+    "artifact-tool identity"
+  );
+  const receiptPath = await confinedFile(root, manifest.receipt.path, "kernel build receipt");
+  const skillFacadeEntrypoint = await confinedFile(
+    root,
+    manifest.skillFacadeEntrypoint.path,
+    "development skill facade"
+  );
+  const materializerExecutable = await confinedFile(
+    root,
+    manifest.materializerExecutable.path,
+    "development materializer executable"
+  );
+  const configuredFacade = await canonicalFile(facadeInput, "configured development skill facade");
+  if (configuredFacade !== skillFacadeEntrypoint) {
+    integrity(
+      `${ARTIFACT_RUNTIME_ENVIRONMENT.toolEntrypoint} differs from the development manifest`
+    );
+  }
+  const kernelRoot = await confinedDirectory(
+    root,
+    manifest.kernelPackageRoot,
+    "kernel package root"
+  );
+  const kernelEntrypoint = await confinedFile(
+    kernelRoot,
+    manifest.kernel.entrypoint.path,
+    "kernel entrypoint"
+  );
+  const kernelAsset = await confinedFile(kernelRoot, manifest.kernel.asset.path, "kernel asset");
+  const kernelSupportFiles = await Promise.all(
+    manifest.kernel.supportFiles.map(
+      (file, index) => confinedFile(kernelRoot, file.path, `kernel support file ${index}`)
+    )
+  );
+  const identityBytes = await readAndVerify(
+    identityPath,
+    manifest.artifactToolIdentity,
+    MAX_IDENTITY_BYTES,
+    "artifact-tool identity"
+  );
+  if (!sameBytes(identityBytes, canonicalDevelopmentArtifactToolIdentityBytes(manifest.artifactTool))) {
+    integrity("Development artifact-tool identity bytes differ from the manifest");
+  }
+  const receiptBytes = await readAndVerify(
+    receiptPath,
+    manifest.receipt,
+    MAX_RECEIPT_BYTES,
+    "kernel build receipt"
+  );
+  const receipt = validateArtifactKernelBuildReceipt(
+    parseJson(receiptBytes, "kernel build receipt"),
+    manifest.target
+  );
+  if (!sameBytes(receiptBytes, canonicalArtifactKernelBuildReceiptBytes(receipt))) {
+    integrity("Development kernel receipt is not canonical");
+  }
+  assertReceiptMatchesKernel(receipt, manifest.kernel);
+  await verifyFile(
+    skillFacadeEntrypoint,
+    manifest.skillFacadeEntrypoint,
+    MAX_JAVASCRIPT_BYTES,
+    "development skill facade"
+  );
+  await verifyFile(
+    materializerExecutable,
+    manifest.materializerExecutable,
+    MAX_MATERIALIZER_EXECUTABLE_BYTES,
+    "development materializer executable"
+  );
+  await verifyFile(
+    kernelEntrypoint,
+    manifest.kernel.entrypoint,
+    MAX_JAVASCRIPT_BYTES,
+    "kernel entrypoint"
+  );
+  await verifyFile(kernelAsset, manifest.kernel.asset, MAX_KERNEL_ASSET_BYTES, "kernel asset");
+  for (const [index, path] of kernelSupportFiles.entries()) {
+    await verifyFile(
+      path,
+      manifest.kernel.supportFiles[index],
+      MAX_JAVASCRIPT_BYTES,
+      `kernel support file ${index}`
+    );
+  }
+  return Object.freeze({
+    schemaVersion: 1,
+    mode: "development-current-host",
+    target: manifest.target,
+    manifestPath,
+    receiptPath,
+    artifactTool: Object.freeze({ ...manifest.artifactTool }),
+    skillFacadeEntrypoint,
+    materializerExecutable,
+    kernel: Object.freeze({
+      packageName: manifest.kernel.packageName,
+      packageVersion: manifest.kernel.packageVersion,
+      entrypoint: kernelEntrypoint,
+      asset: kernelAsset,
+      supportFiles: Object.freeze(kernelSupportFiles),
+      buildIdentity: manifest.kernel.buildIdentity
+    })
+  });
+}
+async function doctorVerifiedDevelopmentArtifactRuntime(options = {}) {
+  const location = await locateVerifiedDevelopmentArtifactRuntime(options);
+  let imported;
+  try {
+    imported = await (options.importer ?? defaultImporter)(
+      pathToFileURL(location.skillFacadeEntrypoint).href
+    );
+  } catch (cause) {
+    throw new ArtifactRuntimeError(
+      "ARTIFACT_RUNTIME_UNAVAILABLE",
+      "Verified development skill facade could not be evaluated",
+      { cause }
+    );
+  }
+  if (!isRecord(imported)) incompatible("development skill facade returned an invalid module");
+  if (options.probe) await options.probe(imported);
+  else probeVerifiedArtifactSkillFacade(imported, location);
+  return location;
+}
+async function loadVerifiedDevelopmentArtifactKernelRuntime(options = {}) {
+  const environment = options.environment ?? process.env;
+  const expectedTarget = options.expectedTarget ?? currentNativeTarget();
+  const before = await locateVerifiedDevelopmentArtifactRuntime({ environment, expectedTarget });
+  const manifest = validateDevelopmentArtifactRuntimeManifest(
+    parseJson(
+      await readBoundedFile(
+        before.manifestPath,
+        MAX_MANIFEST_BYTES,
+        "development runtime manifest"
+      ),
+      "development runtime manifest"
+    ),
+    expectedTarget
+  );
+  const kernelRoot = pathToFileURL(
+    `${resolve(before.manifestPath, "..", manifest.kernelPackageRoot)}/`
+  );
+  const dependencies = {
+    target: {
+      target: manifest.target,
+      kind: "native",
+      packageName: manifest.kernel.packageName,
+      platform: manifest.target.startsWith("darwin-") ? "darwin" : manifest.target.startsWith("linux-") ? "linux" : "win32",
+      arch: manifest.target.includes("arm64") ? "arm64" : "x64",
+      ...manifest.target.includes("-gnu") ? { libc: "gnu" } : manifest.target.includes("-musl") ? { libc: "musl" } : {}
+    },
+    kernelEntrypoint: new URL(manifest.kernel.entrypoint.path, kernelRoot),
+    manifest: {
+      kernel: manifest.kernel
+    }
+  };
+  const runtime = await loadArtifactKernelRuntime(dependencies);
+  const after = await locateVerifiedDevelopmentArtifactRuntime({ environment, expectedTarget });
+  if (!sameJson(before, after) || runtime.kind !== "native" || runtime.target !== after.target || runtime.buildIdentity !== after.kernel.buildIdentity) {
+    integrity("Loaded development kernel differs from its verified installation");
+  }
+  return Object.freeze({ location: after, runtime });
+}
+async function doctorConfiguredArtifactRuntime(environment = process.env) {
+  return usesDevelopmentRuntime(environment) ? await doctorVerifiedDevelopmentArtifactRuntime({ environment }) : await doctorVerifiedArtifactRuntime({ environment });
+}
+async function loadConfiguredArtifactKernelRuntime(environment = process.env) {
+  return usesDevelopmentRuntime(environment) ? await loadVerifiedDevelopmentArtifactKernelRuntime({ environment }) : await loadVerifiedArtifactKernelRuntime({ environment });
+}
+async function runConfiguredArtifactRuntimeCli(args, environment = process.env) {
+  if (!usesDevelopmentRuntime(environment)) return await runArtifactRuntimeCli(args, environment);
+  const [command, format, ...rest] = args;
+  if (command !== "locate" && command !== "doctor" || format !== "--json" || rest.length > 0) {
+    invalid2("Usage: opengeni-artifact-runtime <locate|doctor> --json");
+  }
+  const location = command === "doctor" ? await doctorVerifiedDevelopmentArtifactRuntime({ environment }) : await locateVerifiedDevelopmentArtifactRuntime({ environment });
+  return `${JSON.stringify(location)}
+`;
+}
+function usesDevelopmentRuntime(environment) {
+  return Boolean(environment[DEVELOPMENT_ARTIFACT_RUNTIME_ENVIRONMENT.manifest]);
+}
+function assertDevelopmentEnvironment(environment) {
+  if (environment.NODE_ENV === "production") {
+    throw new ArtifactRuntimeError(
+      "ARTIFACT_RUNTIME_UNAVAILABLE",
+      "Development artifact runtime is forbidden when NODE_ENV=production"
+    );
+  }
+  if (environment[ARTIFACT_RUNTIME_ENVIRONMENT.manifest]) {
+    invalid2("Production and development artifact runtime manifests cannot both be configured");
+  }
+}
+function currentNativeTarget() {
+  const target = resolveCurrentArtifactRuntimeTarget();
+  if (target === "wasm-web") {
+    throw new ArtifactRuntimeError(
+      "ARTIFACT_RUNTIME_UNSUPPORTED_TARGET",
+      "Development server runtime requires a native host"
+    );
+  }
+  return target;
+}
+function assertReceiptMatchesKernel(receipt, kernel) {
+  const runtimeFiles = [kernel.asset, ...kernel.supportFiles].sort(
+    (left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0
+  );
+  if (receipt.buildIdentity !== kernel.buildIdentity || !sameJson(receipt.runtimeFiles, runtimeFiles)) {
+    integrity("Development build receipt differs from its kernel manifest");
+  }
+}
+async function confinedFile(root, path, name) {
+  return await confined(root, path, name, "file");
+}
+async function confinedDirectory(root, path, name) {
+  return await confined(root, path, name, "directory");
+}
+async function confined(root, path, name, kind) {
+  const candidate = await realpath(resolve(root, path)).catch((cause) => {
+    throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_UNAVAILABLE", `${name} is unavailable`, {
+      cause
+    });
+  });
+  const fromRoot = relative(root, candidate);
+  if (fromRoot === ".." || fromRoot.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(fromRoot)) {
+    invalid2(`${name} resolves outside the development installation`);
+  }
+  const metadata = await stat(candidate);
+  if (kind === "file" && !metadata.isFile() || kind === "directory" && !metadata.isDirectory()) {
+    throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_UNAVAILABLE", `${name} is not a ${kind}`);
+  }
+  return candidate;
+}
+async function canonicalFile(input, name) {
+  if (!isAbsolute(input)) invalid2(`${name} path must be absolute`);
+  try {
+    const path = await realpath(input);
+    if (!(await stat(path)).isFile()) throw new Error("not a file");
+    return path;
+  } catch (cause) {
+    throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_UNAVAILABLE", `${name} is unavailable`, {
+      cause
+    });
+  }
+}
+async function readAndVerify(path, expected, maximumBytes, name) {
+  const bytes = await readBoundedFile(path, maximumBytes, name);
+  if (bytes.byteLength !== expected.bytes || sha256(bytes) !== expected.sha256) {
+    integrity(`${name} differs from the development manifest`);
+  }
+  return bytes;
+}
+async function verifyFile(path, expected, maximumBytes, name) {
+  await readAndVerify(path, expected, maximumBytes, name);
+}
+async function readBoundedFile(path, maximumBytes, name) {
+  let handle;
+  try {
+    handle = await open(path, "r");
+    const before = await handle.stat();
+    if (!before.isFile() || before.size <= 0 || before.size > maximumBytes) {
+      integrity(`${name} size is invalid`);
+    }
+    const bytes = new Uint8Array(await handle.readFile());
+    const after = await handle.stat();
+    if (after.size !== before.size || bytes.byteLength !== before.size) {
+      integrity(`${name} changed while reading`);
+    }
+    return bytes;
+  } catch (cause) {
+    if (cause instanceof ArtifactRuntimeError) throw cause;
+    throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_UNAVAILABLE", `Could not read ${name}`, {
+      cause
+    });
+  } finally {
+    await handle?.close();
+  }
+}
+function fileDescriptor(value, name) {
+  const record = exactRecord2(value, ["path", "bytes", "sha256"], name);
+  if (!Number.isSafeInteger(record.bytes) || record.bytes <= 0) {
+    invalid2(`${name} byte size is invalid`);
+  }
+  return Object.freeze({
+    path: safeRelativePath(record.path, `${name} path`),
+    bytes: record.bytes,
+    sha256: digest(record.sha256, `${name} digest`)
+  });
+}
+function safeRelativePath(value, name) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 1024 || value.startsWith("/") || value.startsWith("\\") || value.includes("\\") || value.split("/").some((part) => part === "" || part === "." || part === "..") || /[%?#\0]/u.test(value)) {
+    invalid2(`${name} must be a normalized relative path`);
+  }
+  return value;
+}
+function digest(value, name) {
+  if (typeof value !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(value)) {
+    invalid2(`${name} is invalid`);
+  }
+  return value;
+}
+function stableVersion(value) {
+  return typeof value === "string" && /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u.test(value);
+}
+function requiredPath(environment, name) {
+  const value = environment[name];
+  if (!value) {
+    throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_UNAVAILABLE", `${name} is required`);
+  }
+  return value;
+}
+function parseJson(bytes, name) {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch (cause) {
+    throw new ArtifactRuntimeError(
+      "ARTIFACT_RUNTIME_MANIFEST_INVALID",
+      `${name} is not strict UTF-8 JSON`,
+      { cause }
+    );
+  }
+}
+function exactRecord2(value, keys, name) {
+  if (!isRecord(value)) invalid2(`${name} is invalid`);
+  if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify([...keys].sort())) {
+    invalid2(`${name} has unexpected fields`);
+  }
+  return value;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sha256(value) {
+  return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+function sameJson(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function sameBytes(left, right) {
+  return left.byteLength === right.byteLength && left.every((byte, index) => byte === right[index]);
+}
+function defaultImporter(specifier) {
+  return import(
+    /* @vite-ignore */
+    specifier
+  );
+}
+function invalid2(message) {
+  throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_MANIFEST_INVALID", message);
+}
+function integrity(message) {
+  throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_INTEGRITY", message);
+}
+function incompatible(message) {
+  throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_INCOMPATIBLE", message);
+}
+
+export {
+  DEVELOPMENT_ARTIFACT_RUNTIME_ENVIRONMENT,
+  isArtifactRuntimeConfigured,
+  validateDevelopmentArtifactRuntimeManifest,
+  canonicalDevelopmentArtifactRuntimeManifestBytes,
+  canonicalDevelopmentArtifactToolIdentityBytes,
+  locateVerifiedDevelopmentArtifactRuntime,
+  doctorVerifiedDevelopmentArtifactRuntime,
+  loadVerifiedDevelopmentArtifactKernelRuntime,
+  doctorConfiguredArtifactRuntime,
+  loadConfiguredArtifactKernelRuntime,
+  runConfiguredArtifactRuntimeCli
+};
+//# sourceMappingURL=chunk-U5G2BKM2.js.map