@openmixer/plugin-qualify 0.16.1 → 0.17.0

package/dist/records-package.js

@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Pau Aliagas <linuxnow@gmail.com>
+/**
+ * `plugin-qualify-records-package`: the Debian package of a device's qualification records, so other devices of the
+ * machine class install them as the distributed layer instead of measuring the same plugin set again.
+ *
+ * In: a qualification directory as plugin-qualify-sync leaves it. Out: `omx-qualification-<class>-<set>_<version>_all.deb`
+ * installing every record and the probe output it judged under `/usr/share/omx/qualification/<class>/<set>/`, beside
+ * the set's `provenance.json`. A record goes in only with its probe output, byte for byte the copy the record names;
+ * an unmeasured record never applies and stays out. The archive is written here, `ar` and two `tar.xz` members, so a
+ * machine without dpkg builds it too; the tar members are GNU tar's, owned by root, in name order, at one time.
+ */
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { closeSync, copyFileSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { DISTRIBUTED_DIR_SYSTEM, DISTRIBUTED_LAYER_SINCE, DISTRIBUTED_PROVENANCE_FILE, DISTRIBUTED_PROVENANCE_SCHEMA } from "./distributed-records.js";
+import { sha256Hex } from "./probe-output.js";
+import { QUALIFICATION_RECORD_SCHEMA } from "./qualification-record.js";
+export const RECORDS_PACKAGE_MAINTAINER = "Pau Aliagas <linuxnow@gmail.com>";
+/** A word a Debian package name can hold: lowercase letters, digits, `+`, `-` and `.`, a letter or digit first. */
+const DEB_WORD = /^[a-z0-9][a-z0-9+.-]*$/;
+/** dpkg counts Installed-Size in kibibytes. */
+const KIB = 2 ** 10;
+const DEB_VERSION = /^[0-9][A-Za-z0-9.+~]*$/;
+export function recordsPackageHelp() {
+    return [
+        "plugin-qualify-records-package: the Debian package of a device's qualification records, for the distributed layer",
+        "",
+        "  plugin-qualify-records-package <qualification dir> --host-class <class> --set <set> --provenance <json> [options]",
+        "",
+        "  --host-class <class>     the machine class the records were measured on (rpi5): the directory they install in",
+        "  --set <set>              the plugin set they cover (zynthian-vangelis)",
+        "  --provenance <json>      a JSON file, or the JSON itself: the image, the package versions, the source revisions",
+        "  --version <version>      the package's version (default: today, 2026.10.29)",
+        "  --out <dir>              where the .deb is written (default: .)",
+        "  --maintainer <who>       the package's Maintainer field",
+        "  --help                   this text",
+        "",
+        `the package installs ${DISTRIBUTED_DIR_SYSTEM}/<class>/<set>/ and depends on plugin-qualify (>= ${DISTRIBUTED_LAYER_SINCE})`,
+        "exit 0 the package was written, 2 it could not be",
+        "",
+    ].join("\n");
+}
+export function parseRecordsPackageArgs(argv) {
+    const values = new Map();
+    const positional = [];
+    const valued = new Set(["--host-class", "--set", "--provenance", "--version", "--out", "--maintainer"]);
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "--help")
+            return { ok: true, help: true };
+        if (valued.has(a)) {
+            const v = argv[++i];
+            if (v === undefined)
+                return { ok: false, error: `${a} needs a value` };
+            values.set(a, v);
+        }
+        else if (a.startsWith("--"))
+            return { ok: false, error: `unknown argument ${a}` };
+        else
+            positional.push(a);
+    }
+    if (positional.length !== 1)
+        return { ok: false, error: "name one qualification directory" };
+    for (const flag of ["--host-class", "--set", "--provenance"])
+        if (!values.has(flag))
+            return { ok: false, error: `${flag} is needed` };
+    const hostClass = values.get("--host-class");
+    const set = values.get("--set");
+    for (const [what, v] of [["--host-class", hostClass], ["--set", set]]) {
+        if (!DEB_WORD.test(v))
+            return { ok: false, error: `${what} ${v}: a package name holds lowercase letters, digits, + - and . only` };
+    }
+    const version = values.get("--version");
+    if (version !== undefined && !DEB_VERSION.test(version))
+        return { ok: false, error: `--version ${version} is not a Debian version` };
+    return {
+        ok: true,
+        args: {
+            stateDir: positional[0],
+            hostClass,
+            set,
+            provenance: values.get("--provenance"),
+            ...(version === undefined ? {} : { version }),
+            out: values.get("--out") ?? ".",
+            maintainer: values.get("--maintainer") ?? RECORDS_PACKAGE_MAINTAINER,
+        },
+    };
+}
+/** The package of a class and a set. */
+export const recordsPackageName = (hostClass, set) => `omx-qualification-${hostClass}-${set}`;
+/** Today as a package version, `2026.10.29`, and as a date, `2026-10-29`, in local time. */
+export function today(now = new Date()) {
+    const p = (n) => String(n).padStart(2, "0");
+    const [y, m, d] = [String(now.getFullYear()), p(now.getMonth() + 1), p(now.getDate())];
+    return { version: `${y}.${m}.${d}`, date: `${y}-${m}-${d}` };
+}
+/** The files of a qualification directory that go in the package: each record with its probe output, and what stays out, by name and why. */
+export function collectRecords(stateDir) {
+    const names = readdirSync(stateDir).sort();
+    const records = [];
+    const files = [];
+    const left = [];
+    for (const name of names) {
+        if (name.endsWith(".unmeasured.json")) {
+            left.push({ name, why: "unmeasured, never applies" });
+            continue;
+        }
+        if (!name.endsWith(".qualification.json"))
+            continue;
+        let record;
+        try {
+            record = JSON.parse(readFileSync(join(stateDir, name), "utf8"));
+        }
+        catch {
+            left.push({ name, why: "does not read" });
+            continue;
+        }
+        if (record.schema !== QUALIFICATION_RECORD_SCHEMA || typeof record.probe?.file !== "string" || record.probe.file.includes("/")) {
+            left.push({ name, why: `not a ${QUALIFICATION_RECORD_SCHEMA} naming its probe output` });
+            continue;
+        }
+        let probe;
+        try {
+            probe = readFileSync(join(stateDir, record.probe.file));
+        }
+        catch {
+            left.push({ name, why: `its probe output ${record.probe.file} is not there` });
+            continue;
+        }
+        if (sha256Hex(probe) !== record.probe.sha256) {
+            left.push({ name, why: `its probe output ${record.probe.file} is not the copy it names` });
+            continue;
+        }
+        records.push(name);
+        files.push(name, record.probe.file);
+    }
+    return { records, files: [...new Set(files)].sort(), left };
+}
+/** The provenance argument read: a file's JSON, or the JSON itself. */
+function readProvenanceArg(arg) {
+    const text = arg.trimStart().startsWith("{") ? arg : readFileSync(arg, "utf8");
+    const v = JSON.parse(text);
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        throw new Error("--provenance is not a JSON object");
+    return v;
+}
+// --- the archive ------------------------------------------------------------------------------------------------------
+/** One `ar` member header: name, time, owner, group, mode, size, as dpkg reads them. */
+function arHeader(name, size, mtime) {
+    const field = (v, n) => v.padEnd(n, " ").slice(0, n);
+    return Buffer.from(`${field(name, 16)}${field(String(mtime), 12)}${field("0", 6)}${field("0", 6)}${field("100644", 8)}${field(String(size), 10)}\`\n`, "latin1");
+}
+function writeAr(path, members, mtime) {
+    const fd = openSync(path, "w", 0o644);
+    try {
+        writeSync(fd, Buffer.from("!<arch>\n"));
+        for (const m of members) {
+            writeSync(fd, arHeader(m.name, m.bytes.length, mtime));
+            writeSync(fd, m.bytes);
+            if (m.bytes.length % 2 === 1)
+                writeSync(fd, Buffer.from("\n"));
+        }
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** A tree as a `tar.xz`, every entry `./`-rooted, owned by root, in name order, at `mtime`. */
+function tarXz(tree, out, mtime) {
+    const r = spawnSync("tar", ["--create", "--xz", "--format=gnu", "--owner=0", "--group=0", "--numeric-owner", "--sort=name", `--mtime=@${String(mtime)}`, "--mode=u=rwX,go=rX", "-f", out, "-C", tree, "."], { encoding: "utf8", env: { ...process.env, XZ_OPT: "-6" } });
+    if (r.status !== 0)
+        throw new Error(`tar: ${r.error?.message ?? r.stderr.trim()}`);
+}
+/** The package of `args`, written into `args.out`. Throws, naming why, when it cannot be built. */
+export function buildRecordsPackage(args, now = new Date()) {
+    const name = recordsPackageName(args.hostClass, args.set);
+    const day = today(now);
+    const version = args.version ?? day.version;
+    statSync(args.stateDir);
+    const { records, files, left } = collectRecords(args.stateDir);
+    if (records.length === 0)
+        throw new Error(`${args.stateDir} holds no record that can go in the package`);
+    const provenance = {
+        ...readProvenanceArg(args.provenance),
+        schema: DISTRIBUTED_PROVENANCE_SCHEMA,
+        set: args.set,
+        hostClass: args.hostClass,
+        package: { name, version },
+        date: day.date,
+    };
+    const work = mkdtempSync(join(tmpdir(), "records-package-"));
+    try {
+        const data = join(work, "data");
+        const rel = join("usr", "share", "omx", "qualification", args.hostClass, args.set);
+        const dir = join(data, rel);
+        mkdirSync(dir, { recursive: true });
+        for (const f of files)
+            copyFileSync(join(args.stateDir, f), join(dir, f));
+        writeFileSync(join(dir, DISTRIBUTED_PROVENANCE_FILE), `${JSON.stringify(provenance, null, 2)}\n`);
+        const installed = [...files, DISTRIBUTED_PROVENANCE_FILE].sort();
+        let kib = 0;
+        const sums = [];
+        for (const f of installed) {
+            const bytes = readFileSync(join(dir, f));
+            kib += Math.ceil(bytes.length / KIB);
+            sums.push(`${createHash("md5").update(bytes).digest("hex")}  ${join(rel, f)}`);
+        }
+        const control = join(work, "control");
+        mkdirSync(control);
+        writeFileSync(join(control, "control"), [
+            `Package: ${name}`,
+            `Version: ${version}`,
+            "Architecture: all",
+            `Maintainer: ${args.maintainer}`,
+            `Installed-Size: ${String(kib)}`,
+            `Depends: plugin-qualify (>= ${DISTRIBUTED_LAYER_SINCE}~)`,
+            "Section: sound",
+            "Priority: optional",
+            "Multi-Arch: foreign",
+            `Description: qualification records of the ${args.set} plugin set for ${args.hostClass}`,
+            ` The plugin-qualify records of the ${args.set} plugin set, measured on a`,
+            ` ${args.hostClass} device. plugin-qualify-sync takes a plugin from them instead of`,
+            " measuring it, and only when every file of the installed plugin hashes as the",
+            " measured one did; any other plugin is measured on the device as before.",
+            "",
+        ].join("\n"));
+        writeFileSync(join(control, "md5sums"), `${sums.join("\n")}\n`);
+        const mtime = Math.floor(now.getTime() / 1000);
+        tarXz(control, join(work, "control.tar.xz"), mtime);
+        tarXz(data, join(work, "data.tar.xz"), mtime);
+        mkdirSync(args.out, { recursive: true });
+        const path = join(args.out, `${name}_${version}_all.deb`);
+        writeAr(path, [
+            { name: "debian-binary", bytes: Buffer.from("2.0\n") },
+            { name: "control.tar.xz", bytes: readFileSync(join(work, "control.tar.xz")) },
+            { name: "data.tar.xz", bytes: readFileSync(join(work, "data.tar.xz")) },
+        ], mtime);
+        return { path, name, version, records: records.length, files: installed.length, left };
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+/** A `.deb` read with nothing but `ar`'s layout and tar: its members, its control fields, its files; unpacked into `into` when given. */
+export function readDeb(path, into) {
+    const bytes = readFileSync(path);
+    if (bytes.subarray(0, 8).toString("latin1") !== "!<arch>\n")
+        throw new Error(`${path}: not an ar archive`);
+    const members = new Map();
+    for (let at = 8; at < bytes.length;) {
+        const head = bytes.subarray(at, at + 60).toString("latin1");
+        const name = head.slice(0, 16).trim().replace(/\/$/, "");
+        const size = Number(head.slice(48, 58).trim());
+        members.set(name, bytes.subarray(at + 60, at + 60 + size));
+        at += 60 + size + (size % 2);
+    }
+    const work = mkdtempSync(join(tmpdir(), "read-deb-"));
+    try {
+        const list = (member, extract) => {
+            const file = join(work, member);
+            writeFileSync(file, members.get(member) ?? Buffer.alloc(0));
+            const r = spawnSync("tar", ["-tvJf", file], { encoding: "utf8", maxBuffer: 256 << 20 });
+            if (r.status !== 0)
+                throw new Error(`${member}: ${r.stderr.trim()}`);
+            if (extract !== undefined) {
+                mkdirSync(extract, { recursive: true });
+                const x = spawnSync("tar", ["-xJf", file, "-C", extract], { encoding: "utf8" });
+                if (x.status !== 0)
+                    throw new Error(`${member}: ${x.stderr.trim()}`);
+            }
+            return r.stdout
+                .split("\n")
+                .filter((l) => l.startsWith("-"))
+                .map((l) => l.slice(l.indexOf("./")))
+                .sort();
+        };
+        const controlDir = join(work, "control");
+        const controlFiles = list("control.tar.xz", controlDir);
+        const control = {};
+        for (const line of readFileSync(join(controlDir, "control"), "utf8").split("\n")) {
+            const m = /^([A-Za-z-]+): (.*)$/.exec(line);
+            if (m !== null)
+                control[m[1]] = m[2];
+        }
+        return {
+            members: [...members.keys()],
+            debianBinary: (members.get("debian-binary") ?? Buffer.alloc(0)).toString("latin1"),
+            control,
+            controlFiles,
+            files: list("data.tar.xz", into),
+        };
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=records-package.js.map

package/dist/records-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records-package.js","sourceRoot":"","sources":["../src/records-package.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,sDAAsD;AACtD;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC3J,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,6BAA6B,EAA8B,MAAM,0BAA0B,CAAC;AACnL,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAaxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,kCAAkC,CAAC;AAE7E,mHAAmH;AACnH,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAC1C,+CAA+C;AAC/C,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,mHAAmH;QACnH,EAAE;QACF,qHAAqH;QACrH,EAAE;QACF,iHAAiH;QACjH,0EAA0E;QAC1E,mHAAmH;QACnH,+EAA+E;QAC/E,mEAAmE;QACnE,2DAA2D;QAC3D,sCAAsC;QACtC,EAAE;QACF,wBAAwB,sBAAsB,qDAAqD,uBAAuB,GAAG;QAC7H,mDAAmD;QACnD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAuB;IAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IACxG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC;;YAC/E,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IAC7F,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC;IACtI,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAU,EAAE,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,CAAC,kEAAkE,EAAE,CAAC;IACrI,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,OAAO,0BAA0B,EAAE,CAAC;IACrI,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE;YACJ,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAE;YACxB,SAAS;YACT,GAAG;YACH,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAE;YACvC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG;YAC/B,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B;SACrE;KACF,CAAC;AACJ,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAE,GAAW,EAAU,EAAE,CAAC,qBAAqB,SAAS,IAAI,GAAG,EAAE,CAAC;AAEtH,4FAA4F;AAC5F,MAAM,UAAU,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;IACpC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,6IAA6I;AAC7I,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAoC,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,SAAS;QACpD,IAAI,MAA0E,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,2BAA2B,IAAI,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/H,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,2BAA2B,0BAA0B,EAAE,CAAC,CAAC;YACzF,SAAS;QACX,CAAC;QACD,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,MAAM,CAAC,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;YAC/E,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,MAAM,CAAC,KAAK,CAAC,IAAI,2BAA2B,EAAE,CAAC,CAAC;YAC3F,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,uEAAuE;AACvE,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClH,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,yHAAyH;AAEzH,wFAAwF;AACxF,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,KAAa;IACzD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACnK,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,OAAmD,EAAE,KAAa;IAC/F,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACvD,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACvB,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,KAAK,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa;IACrD,MAAM,CAAC,GAAG,SAAS,CACjB,KAAK,EACL,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAC/K,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAC5D,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AAYD,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,IAAwB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC5E,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,6CAA6C,CAAC,CAAC;IACzG,MAAM,UAAU,GAA0B;QACxC,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;QACrC,MAAM,EAAE,6BAA6B;QACrC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC;IACF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAClG,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,EAAE,2BAA2B,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACzC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnB,aAAa,CACX,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EACxB;YACE,YAAY,IAAI,EAAE;YAClB,YAAY,OAAO,EAAE;YACrB,mBAAmB;YACnB,eAAe,IAAI,CAAC,UAAU,EAAE;YAChC,mBAAmB,MAAM,CAAC,GAAG,CAAC,EAAE;YAChC,+BAA+B,uBAAuB,IAAI;YAC1D,gBAAgB;YAChB,oBAAoB;YACpB,qBAAqB;YACrB,6CAA6C,IAAI,CAAC,GAAG,mBAAmB,IAAI,CAAC,SAAS,EAAE;YACxF,sCAAsC,IAAI,CAAC,GAAG,4BAA4B;YAC1E,IAAI,IAAI,CAAC,SAAS,kEAAkE;YACpF,+EAA+E;YAC/E,0EAA0E;YAC1E,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAC/C,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9C,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,OAAO,UAAU,CAAC,CAAC;QAC1D,OAAO,CACL,IAAI,EACJ;YACE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YACtD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE;YAC7E,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE;SACxE,EACD,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACzF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAcD,yIAAyI;AACzI,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAa;IACjD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,GAAI,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAC3D,EAAE,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,OAAgB,EAAY,EAAE;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAChC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACrE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAChF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,CAAC,CAAC,MAAM;iBACZ,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;iBACpC,IAAI,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACzC,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAClF,OAAO;YACP,YAAY;YACZ,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC;SACjC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openmixer/plugin-qualify",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "description": "Qualify audio plugins for real-time hosting: scan, offline latency and cost measurement, and a fail-closed rating.",
   "type": "module",
   "license": "GPL-3.0-or-later",
@@ -18,7 +18,8 @@
   },
   "bin": {
     "plugin-qualify": "./bin/plugin-qualify.mjs",
-    "plugin-qualify-sync": "./bin/plugin-qualify-sync.mjs"
+    "plugin-qualify-sync": "./bin/plugin-qualify-sync.mjs",
+    "plugin-qualify-records-package": "./bin/plugin-qualify-records-package.mjs"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/src/distributed-records.ts

@@ -0,0 +1,251 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Pau Aliagas <linuxnow@gmail.com>
+/**
+ * The distributed layer: qualification records another device of the same machine class wrote for a plugin set,
+ * installed read-only under `<dir>/<host class>/<set>/` beside the set's `provenance.json`. plugin-qualify-sync reads
+ * it before measuring a plugin, and takes a plugin from it instead of measuring it only when every file the record
+ * names hashes, here, as it did where it was measured. The name of a plugin finds its record and never decides
+ * anything: a record is never trusted by name alone.
+ *
+ * What applies is copied into the device's own `qualification_dir`, the record with the set's provenance added and
+ * its probe output byte for byte, and the plugin's pin is the one that probe output holds. From then on the sync
+ * treats the plugin as one it measured.
+ */
+import { readFileSync, readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+import { clapPinUri, pinVerdictOf, type PinEntry } from "./pins-file.js";
+import { integrityOfProbeOutput } from "./probe-judge.js";
+import { readProbeOutput, sha256Hex } from "./probe-output.js";
+import { QUALIFICATION_RECORD_SCHEMA, type QualificationRecord, type RecordVerdict } from "./qualification-record.js";
+import type { FileDigest, SyncItem, SyncOutcome, SyncPlugin } from "./qualify-sync.js";
+import type { SuitabilityRating } from "./rating.js";
+import { writeFileWhole } from "./whole-file.js";
+
+/** Where a system's packages install the distributed records. */
+export const DISTRIBUTED_DIR_SYSTEM = "/usr/share/omx/qualification";
+
+/** The file of a set that says where its records come from. */
+export const DISTRIBUTED_PROVENANCE_FILE = "provenance.json";
+export const DISTRIBUTED_PROVENANCE_SCHEMA = "plugin-qualify.distributed-provenance/1";
+
+/** The first plugin-qualify that reads the layer: what a package of records depends on. */
+export const DISTRIBUTED_LAYER_SINCE = "0.17.0";
+
+/** Where the records of a set come from. The keys below are always there; the rest is what the builder was given. */
+export interface DistributedProvenance {
+  readonly schema: typeof DISTRIBUTED_PROVENANCE_SCHEMA;
+  readonly set: string;
+  readonly hostClass: string;
+  /** The package that installed the set. */
+  readonly package: { readonly name: string; readonly version: string };
+  /** The day the package was built (YYYY-MM-DD). */
+  readonly date: string;
+  readonly [key: string]: unknown;
+}
+
+/** The device tree's model file, where a board names itself. */
+export const BOARD_MODEL_FILE = "/proc/device-tree/model";
+
+/** The board's own model, or `undefined` on a machine without a device tree. */
+export function readBoardModel(): string | undefined {
+  try {
+    return readFileSync(BOARD_MODEL_FILE, "utf8");
+  } catch {
+    return undefined;
+  }
+}
+
+/** The host class of a board the layer knows by its device-tree model: `rpi5` for a Raspberry Pi 5 or its compute module. */
+export function hostClassOfBoard(model: string | undefined): string | undefined {
+  if (model === undefined) return undefined;
+  const m = /^Raspberry Pi (?:Compute Module )?(\d)(?:\s|$)/.exec(model.replace(/\0/g, "").trim());
+  return m === null ? undefined : `rpi${m[1]!}`;
+}
+
+/** One distributed record, read: where it is, what it says, and the set it came with. */
+export interface DistributedRecord {
+  readonly path: string;
+  readonly record: QualificationRecord;
+  readonly set: string;
+  readonly provenance: DistributedProvenance;
+}
+
+/** The layer as one run reads it: the records of the host class, by what finds them. */
+export interface DistributedLayer {
+  /** By the `.clap` path the record measured, made absolute. */
+  readonly clap: ReadonlyMap<string, readonly DistributedRecord[]>;
+  /** By the LV2 plugin's uri. */
+  readonly lv2: ReadonlyMap<string, readonly DistributedRecord[]>;
+  readonly sets: readonly string[];
+  readonly records: number;
+}
+
+export const EMPTY_LAYER: DistributedLayer = { clap: new Map(), lv2: new Map(), sets: [], records: 0 };
+
+const RECORD_SUFFIX = ".qualification.json";
+
+const names = (dir: string): string[] => {
+  try {
+    return readdirSync(dir).sort();
+  } catch {
+    return [];
+  }
+};
+
+/**
+ * The records of one host class under each directory, in the order given. A set without a provenance that reads, or
+ * whose provenance names another set or class, is not read; a record that does not read as a record of this schema is
+ * named and left out.
+ */
+export function readDistributedLayer(dirs: readonly string[], hostClass: string, log: (line: string) => void = () => {}): DistributedLayer {
+  const clap = new Map<string, DistributedRecord[]>();
+  const lv2 = new Map<string, DistributedRecord[]>();
+  const sets: string[] = [];
+  let records = 0;
+  const add = (map: Map<string, DistributedRecord[]>, key: string, r: DistributedRecord): void => {
+    map.set(key, [...(map.get(key) ?? []), r]);
+  };
+  for (const base of dirs) {
+    const classDir = join(base, hostClass);
+    for (const set of names(classDir)) {
+      const dir = join(classDir, set);
+      let provenance: DistributedProvenance;
+      try {
+        provenance = JSON.parse(readFileSync(join(dir, DISTRIBUTED_PROVENANCE_FILE), "utf8")) as DistributedProvenance;
+      } catch (e) {
+        if ((e as NodeJS.ErrnoException).code === "ENOTDIR") continue;
+        log(`distributed: ${dir}: ${(e as NodeJS.ErrnoException).code === "ENOENT" ? `no ${DISTRIBUTED_PROVENANCE_FILE}` : `${DISTRIBUTED_PROVENANCE_FILE} does not read`}, not read`);
+        continue;
+      }
+      if (provenance.schema !== DISTRIBUTED_PROVENANCE_SCHEMA || provenance.set !== set || provenance.hostClass !== hostClass) {
+        log(`distributed: ${dir}: its ${DISTRIBUTED_PROVENANCE_FILE} is not of set ${set} and host class ${hostClass} (${DISTRIBUTED_PROVENANCE_SCHEMA}), not read`);
+        continue;
+      }
+      sets.push(set);
+      for (const name of names(dir)) {
+        if (!name.endsWith(RECORD_SUFFIX)) continue;
+        const path = join(dir, name);
+        let record: QualificationRecord;
+        try {
+          record = JSON.parse(readFileSync(path, "utf8")) as QualificationRecord;
+        } catch {
+          log(`distributed: ${path}: does not read, left out`);
+          continue;
+        }
+        if (record.schema !== QUALIFICATION_RECORD_SCHEMA || typeof record.binary?.path !== "string" || !Array.isArray(record.binary.files) || record.binary.files.length === 0) {
+          log(`distributed: ${path}: not a ${QUALIFICATION_RECORD_SCHEMA} with its binary's files, left out`);
+          continue;
+        }
+        const r: DistributedRecord = { path, record, set, provenance };
+        records++;
+        if (record.plugin.format === "clap") add(clap, resolve(record.binary.path), r);
+        else if (record.plugin.format === "lv2") add(lv2, record.plugin.id, r);
+      }
+    }
+  }
+  return { clap, lv2, sets, records };
+}
+
+/** The uri a record's plugin has on this machine: the installed `.clap`'s path and the id, or the LV2 uri. */
+export function distributedUri(item: SyncItem, r: DistributedRecord): string {
+  return item.format === "clap" ? clapPinUri(join(item.root, item.files[0]!), `urn:clap:${r.record.plugin.id}`) : r.record.plugin.id;
+}
+
+/** What the sync's own judgment would make of the record's verdict for the host, as `outcomeOf` reads a run. */
+function outcomeOfVerdict(v: RecordVerdict): SyncOutcome {
+  if (!v.measured) return v.deciding === "probe.crashed" ? "crashed" : v.deciding === "probe.timeout" ? "hung" : "unmeasured";
+  if (v.rating === "suitable" || v.rating === "conditional") return "qualified";
+  return v.rating === "unsuitable" ? "refused" : "unmeasured";
+}
+
+/** What the layer makes of one item. */
+export type DistributedMatch =
+  /** No distributed record names the plugin: it is measured, and nothing is said. */
+  | { readonly status: "none" }
+  /** Every reason a record found was not taken, one line each; the plugin is measured. */
+  | { readonly status: "ignored"; readonly lines: readonly string[] }
+  | { readonly status: "applies"; readonly set: string; readonly records: readonly DistributedRecord[]; readonly files: readonly string[] };
+
+/**
+ * Whether the item is taken from the layer. The records that find it are tried one set at a time, in the order the
+ * layer read them. Of a set, only the records whose every file is installed with the SHA-256 it recorded (computed
+ * here by `digest`) count: a record of other bytes is another build of the plugin and is passed over. The set applies
+ * when at least one record of these bytes holds a verdict for `host`, and none of those verdicts is one the source
+ * could not measure; a set with no record of these bytes is a binary that differs.
+ */
+export function matchDistributed(
+  layer: DistributedLayer,
+  item: SyncItem,
+  host: string,
+  digest: (files: readonly string[]) => readonly FileDigest[] | undefined,
+): DistributedMatch {
+  const found = item.format === "clap" ? layer.clap.get(resolve(join(item.root, item.files[0]!))) : layer.lv2.get(item.uri ?? "");
+  if (found === undefined || found.length === 0) return { status: "none" };
+  const lines: string[] = [];
+  const say = (line: string): void => {
+    if (!lines.includes(line)) lines.push(line);
+  };
+  for (const set of [...new Set(found.map((r) => r.set))]) {
+    // a set may hold records of earlier bytes of the plugin beside the ones of these: only the ones of these bytes count
+    const records = found.filter((r) => {
+      if (r.set !== set || r.record.plugin.format !== item.format) return false;
+      const wanted = r.record.binary.files;
+      const now = digest(wanted.map((f) => f.path));
+      return now !== undefined && wanted.every((f) => now.find((d) => d.path === f.path)?.sha256 === f.sha256);
+    });
+    if (records.length === 0) {
+      say(`distributed: ${distributedUri(item, found.find((r) => r.set === set)!)}: binary differs`);
+      continue;
+    }
+    const judged = records.filter((r) => r.record.verdicts.some((v) => v.host === host));
+    if (judged.length === 0) {
+      say(`distributed: ${distributedUri(item, records[0]!)}: no verdict for ${host} in ${set}`);
+      continue;
+    }
+    const unmeasured = judged.find((r) => outcomeOfVerdict(r.record.verdicts.find((v) => v.host === host)!) === "unmeasured");
+    if (unmeasured !== undefined) {
+      say(`distributed: ${distributedUri(item, unmeasured)}: unmeasured in ${set}, measured here`);
+      continue;
+    }
+    return { status: "applies", set, records, files: [...new Set(records.flatMap((r) => r.record.binary.files.map((f) => f.path)))] };
+  }
+  return { status: "ignored", lines };
+}
+
+/**
+ * The records of a match copied into `qualificationDir` and the plugins they make: the probe output first, byte for
+ * byte and read back through this version's reader, its SHA-256 the one the record names; then the record with the
+ * set's provenance added. A record whose probe output is missing, altered or unreadable throws, naming it, and the
+ * caller measures the plugin instead. Records of the other tier (no verdict for `host`) are copied and make no plugin,
+ * as the sweep writes them.
+ */
+export function applyDistributed(qualificationDir: string, item: SyncItem, match: Extract<DistributedMatch, { status: "applies" }>, host: string): SyncPlugin[] {
+  const copies = match.records.map((r) => {
+    const probeName = r.record.probe.file;
+    const probePath = join(r.path, "..", probeName);
+    let bytes: Buffer;
+    try {
+      bytes = readFileSync(probePath);
+    } catch (e) {
+      throw new Error(`${probeName}: ${(e as NodeJS.ErrnoException).code ?? String(e)}`);
+    }
+    if (sha256Hex(bytes) !== r.record.probe.sha256) throw new Error(`${probeName}: not the probe output the record names (its SHA-256 differs)`);
+    const read = readProbeOutput(bytes.toString("utf8"));
+    if (!read.ok) throw new Error(`${probeName}: ${read.code}: ${read.problem}`);
+    return { r, bytes, output: read.output };
+  });
+  const plugins: SyncPlugin[] = [];
+  for (const { r, bytes, output } of copies) {
+    writeFileWhole(join(qualificationDir, r.record.probe.file), bytes);
+    const recordPath = join(qualificationDir, r.path.slice(r.path.lastIndexOf("/") + 1));
+    writeFileWhole(recordPath, `${JSON.stringify({ ...r.record, provenance: r.provenance }, null, 2)}\n`);
+    const v = r.record.verdicts.find((x) => x.host === host);
+    if (v === undefined) continue;
+    const word = v.measured ? pinVerdictOf(v.rating as SuitabilityRating) : undefined;
+    const pin: PinEntry = { uri: distributedUri(item, r), integrity: integrityOfProbeOutput(output), ...(word === undefined ? {} : { verdict: word }) };
+    const outcome = outcomeOfVerdict(v);
+    plugins.push({ uri: pin.uri, outcome, ...(v.deciding === undefined ? {} : { code: v.deciding }), pin, record: recordPath });
+  }
+  return plugins;
+}

package/src/index.ts

@@ -24,9 +24,14 @@ export * from "./probe-output.js";
 export * from "./probe-judge.js";
 export * from "./qualification-record.js";
 export * from "./probe-runner.js";
+export * from "./measurement-grid.js";
+export * from "./memory-bound.js";
+export * from "./probe-merge.js";
 export * from "./judge-cli.js";
 export * from "./whole-file.js";
 export * from "./qualify-sync.js";
+export * from "./distributed-records.js";
+export * from "./records-package.js";
 export * from "./host-admission.js";
 export * from "./history-file.js";
 export * from "./history-adjust.js";