@openrig/cli 0.0.1 → 0.1.0

package/daemon/dist/domain/bootstrap-repository.js

@@ -0,0 +1,78 @@
+import { ulid } from "ulid";
+export class BootstrapRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    createRun(sourceKind, sourceRef) {
+        const id = ulid();
+        this.db.prepare("INSERT INTO bootstrap_runs (id, source_kind, source_ref) VALUES (?, ?, ?)").run(id, sourceKind, sourceRef);
+        return this.getRun(id);
+    }
+    getRun(id) {
+        const row = this.db.prepare("SELECT * FROM bootstrap_runs WHERE id = ?")
+            .get(id);
+        return row ? this.rowToRun(row) : null;
+    }
+    listRuns() {
+        const rows = this.db.prepare("SELECT * FROM bootstrap_runs ORDER BY created_at DESC")
+            .all();
+        return rows.map((r) => this.rowToRun(r));
+    }
+    updateRunStatus(id, status, opts) {
+        if (opts?.rigId) {
+            this.db.prepare("UPDATE bootstrap_runs SET status = ?, rig_id = ?, applied_at = ? WHERE id = ?")
+                .run(status, opts.rigId, opts.appliedAt ?? new Date().toISOString(), id);
+        }
+        else if (status === "completed" || status === "failed" || status === "partial") {
+            this.db.prepare("UPDATE bootstrap_runs SET status = ?, applied_at = ? WHERE id = ?")
+                .run(status, opts?.appliedAt ?? new Date().toISOString(), id);
+        }
+        else {
+            this.db.prepare("UPDATE bootstrap_runs SET status = ? WHERE id = ?")
+                .run(status, id);
+        }
+    }
+    journalAction(bootstrapId, seq, actionKind, subjectType, subjectName, status, opts) {
+        const id = ulid();
+        this.db.prepare(`INSERT INTO bootstrap_actions (id, bootstrap_id, seq, action_kind, subject_type, subject_name, provider, command_preview, status, detail_json)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, bootstrapId, seq, actionKind, subjectType, subjectName, opts?.provider ?? null, opts?.commandPreview ?? null, status, opts?.detailJson ?? null);
+        return this.getAction(id);
+    }
+    getRunActions(bootstrapId) {
+        const rows = this.db.prepare("SELECT * FROM bootstrap_actions WHERE bootstrap_id = ? ORDER BY seq ASC").all(bootstrapId);
+        return rows.map((r) => this.rowToAction(r));
+    }
+    getAction(id) {
+        const row = this.db.prepare("SELECT * FROM bootstrap_actions WHERE id = ?")
+            .get(id);
+        return row ? this.rowToAction(row) : null;
+    }
+    rowToRun(row) {
+        return {
+            id: row.id,
+            sourceKind: row.source_kind,
+            sourceRef: row.source_ref,
+            status: row.status,
+            rigId: row.rig_id,
+            createdAt: row.created_at,
+            appliedAt: row.applied_at,
+        };
+    }
+    rowToAction(row) {
+        return {
+            id: row.id,
+            bootstrapId: row.bootstrap_id,
+            seq: row.seq,
+            actionKind: row.action_kind,
+            subjectType: row.subject_type,
+            subjectName: row.subject_name,
+            provider: row.provider,
+            commandPreview: row.command_preview,
+            status: row.status,
+            detailJson: row.detail_json,
+            createdAt: row.created_at,
+        };
+    }
+}
+//# sourceMappingURL=bootstrap-repository.js.map

package/daemon/dist/domain/bootstrap-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-repository.js","sourceRoot":"","sources":["../../src/domain/bootstrap-repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA2B5B,MAAM,OAAO,mBAAmB;IACrB,EAAE,CAAoB;IAE/B,YAAY,EAAqB;QAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,SAAS,CAAC,UAAkB,EAAE,SAAiB;QAC7C,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,2EAA2E,CAC5E,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC;aACrE,GAAG,CAAC,EAAE,CAAgC,CAAC;QAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC;aAClF,GAAG,EAAuB,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,eAAe,CAAC,EAAU,EAAE,MAAuB,EAAE,IAA6C;QAChG,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,+EAA+E,CAAC;iBAC7F,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;aAAM,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjF,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC;iBACjF,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC;iBACjE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,aAAa,CACX,WAAmB,EACnB,GAAW,EACX,UAAsB,EACtB,WAA0B,EAC1B,WAA0B,EAC1B,MAAoB,EACpB,IAA0E;QAE1E,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,CAAC,OAAO,CACb;6CACuC,CACxC,CAAC,GAAG,CACH,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAChC,WAAW,EAAE,WAAW,EACxB,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,IAAI,EAAE,cAAc,IAAI,IAAI,EACpD,MAAM,EAAE,IAAI,EAAE,UAAU,IAAI,IAAI,CACjC,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAE,CAAC;IAC7B,CAAC;IAED,aAAa,CAAC,WAAmB;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,yEAAyE,CAC1E,CAAC,GAAG,CAAC,WAAW,CAAyB,CAAC;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAEO,SAAS,CAAC,EAAU;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;aACxE,GAAG,CAAC,EAAE,CAAmC,CAAC;QAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAEO,QAAQ,CAAC,GAAoB;QACnC,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,MAAM,EAAE,GAAG,CAAC,MAAyB;YACrC,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,GAAuB;QACzC,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,UAAU,EAAE,GAAG,CAAC,WAAyB;YACzC,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,cAAc,EAAE,GAAG,CAAC,eAAe;YACnC,MAAM,EAAE,GAAG,CAAC,MAAsB;YAClC,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC;CACF"}

package/daemon/dist/domain/bootstrap-types.d.ts

@@ -0,0 +1,43 @@
+/** Bootstrap run status lifecycle */
+export type BootstrapStatus = "planned" | "running" | "completed" | "failed" | "partial";
+/** Bootstrap action kinds */
+export type ActionKind = "runtime_check" | "requirement_check" | "external_install" | "package_install" | "rig_import" | "launch";
+/** Bootstrap action status lifecycle */
+export type ActionStatus = "planned" | "approved" | "skipped" | "running" | "completed" | "failed";
+/** Runtime verification status */
+export type RuntimeStatus = "verified" | "not_found" | "degraded" | "error";
+/** A bootstrap run — one execution of `rig bootstrap <spec>` */
+export interface BootstrapRun {
+    id: string;
+    sourceKind: string;
+    sourceRef: string;
+    status: BootstrapStatus;
+    rigId: string | null;
+    createdAt: string;
+    appliedAt: string | null;
+}
+/** A single action within a bootstrap run */
+export interface BootstrapAction {
+    id: string;
+    bootstrapId: string;
+    seq: number;
+    actionKind: ActionKind;
+    subjectType: string | null;
+    subjectName: string | null;
+    provider: string | null;
+    commandPreview: string | null;
+    status: ActionStatus;
+    detailJson: string | null;
+    createdAt: string;
+}
+/** A runtime verification record */
+export interface RuntimeVerification {
+    id: string;
+    runtime: string;
+    version: string | null;
+    capabilitiesJson: string | null;
+    verifiedAt: string;
+    status: RuntimeStatus;
+    error: string | null;
+}
+//# sourceMappingURL=bootstrap-types.d.ts.map

package/daemon/dist/domain/bootstrap-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-types.d.ts","sourceRoot":"","sources":["../../src/domain/bootstrap-types.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzF,6BAA6B;AAC7B,MAAM,MAAM,UAAU,GAClB,eAAe,GACf,mBAAmB,GACnB,kBAAkB,GAClB,iBAAiB,GACjB,YAAY,GACZ,QAAQ,CAAC;AAEb,wCAAwC;AACxC,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEnG,kCAAkC;AAClC,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,OAAO,CAAC;AAE5E,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oCAAoC;AACpC,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB"}

package/daemon/dist/domain/bootstrap-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bootstrap-types.js.map

package/daemon/dist/domain/bootstrap-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-types.js","sourceRoot":"","sources":["../../src/domain/bootstrap-types.ts"],"names":[],"mappings":""}

package/daemon/dist/domain/bundle-archive.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Pack a staging directory into a .rigbundle archive (deterministic tar.gz).
+ * Writes sibling .sha256 digest file.
+ * @returns SHA-256 hex digest of the archive
+ */
+export declare function pack(stagingDir: string, outputPath: string): Promise<string>;
+/**
+ * Unpack a .rigbundle archive to a directory.
+ * Requires sibling .sha256 digest file. Verifies archive integrity before extraction.
+ * Rejects symlinks, hardlinks, path traversal, and absolute paths.
+ * Runs content integrity verification after extraction.
+ */
+export declare function unpack(archivePath: string, outputDir: string): Promise<void>;
+/**
+ * Verify the archive-level SHA-256 digest.
+ * Requires sibling .sha256 file.
+ */
+export declare function verifyArchiveDigest(archivePath: string): {
+    valid: boolean;
+    expected: string;
+    actual: string;
+};
+//# sourceMappingURL=bundle-archive.d.ts.map

package/daemon/dist/domain/bundle-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-archive.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-archive.ts"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlF;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFlF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAU7G"}

package/daemon/dist/domain/bundle-archive.js

@@ -0,0 +1,156 @@
+/**
+ * TRUST MODEL: Bundle integrity verifies self-consistency, not authenticity.
+ * The sibling .sha256 detects corruption during transfer. Content hashes
+ * detect tampering of individual files within the archive. Neither mechanism
+ * authenticates the bundle author — an attacker who can rewrite the full
+ * bundle + digest can bypass verification. Users must trust the source they
+ * obtained the bundle from (same model as unsigned npm packages/Docker images).
+ * Cryptographic signing (Ed25519) is a future enhancement.
+ */
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import nodePath from "node:path";
+import * as tar from "tar";
+import { verifyIntegrity } from "./bundle-integrity.js";
+// TODO: AS-T12 — migrate to pod-aware bundle types
+import { parseLegacyBundleManifest as parseBundleManifest, normalizeLegacyBundleManifest as normalizeBundleManifest } from "./bundle-types.js";
+/**
+ * Pack a staging directory into a .rigbundle archive (deterministic tar.gz).
+ * Writes sibling .sha256 digest file.
+ * @returns SHA-256 hex digest of the archive
+ */
+export async function pack(stagingDir, outputPath) {
+    if (!outputPath.endsWith(".rigbundle")) {
+        throw new Error("Output path must end with .rigbundle");
+    }
+    // Collect all files in deterministic order (alphabetical)
+    const allFiles = walkFilesSync(stagingDir).sort();
+    // Pack with deterministic settings
+    await tar.create({
+        gzip: { level: 9 },
+        file: outputPath,
+        cwd: stagingDir,
+        portable: true, // Normalizes uid/gid/mode
+        mtime: new Date("2026-01-01T00:00:00Z"), // Fixed mtime for determinism
+    }, allFiles);
+    // Compute archive digest
+    const archiveHash = hashFile(outputPath);
+    fs.writeFileSync(`${outputPath}.sha256`, archiveHash, "utf-8");
+    return archiveHash;
+}
+/**
+ * Unpack a .rigbundle archive to a directory.
+ * Requires sibling .sha256 digest file. Verifies archive integrity before extraction.
+ * Rejects symlinks, hardlinks, path traversal, and absolute paths.
+ * Runs content integrity verification after extraction.
+ */
+export async function unpack(archivePath, outputDir) {
+    // Step 1: Verify archive-level digest
+    const digestResult = verifyArchiveDigest(archivePath);
+    if (!digestResult.valid) {
+        throw new Error(`Archive integrity check failed: expected ${digestResult.expected}, got ${digestResult.actual}`);
+    }
+    // Step 2: Pre-scan archive for unsafe entries BEFORE extraction
+    const unsafeEntries = [];
+    await tar.list({
+        file: archivePath,
+        onReadEntry: (entry) => {
+            const entryPath = entry.path;
+            const entryType = entry.type;
+            if (entryType === "SymbolicLink" || entryType === "Link") {
+                unsafeEntries.push(`${entryType}: ${entryPath}`);
+            }
+            if (entryPath.startsWith("/")) {
+                unsafeEntries.push(`absolute path: ${entryPath}`);
+            }
+            const segments = entryPath.split("/");
+            if (segments.some((s) => s === "..")) {
+                unsafeEntries.push(`path traversal: ${entryPath}`);
+            }
+        },
+    });
+    if (unsafeEntries.length > 0) {
+        throw new Error(`Unsafe archive entries rejected: ${unsafeEntries.join("; ")}`);
+    }
+    // Step 3: Extract (safe — pre-scanned)
+    fs.mkdirSync(outputDir, { recursive: true });
+    await tar.extract({ file: archivePath, cwd: outputDir });
+    // Step 3: Verify content integrity
+    const manifestPath = nodePath.join(outputDir, "bundle.yaml");
+    if (!fs.existsSync(manifestPath)) {
+        throw new Error("Extracted archive missing bundle.yaml");
+    }
+    const rawYaml = fs.readFileSync(manifestPath, "utf-8");
+    const raw = parseBundleManifest(rawYaml);
+    // Schema-version-aware integrity extraction
+    const schemaVersion = raw["schema_version"];
+    let integrity;
+    if (schemaVersion === 2) {
+        // Pod-aware bundle: integrity is optional in manifest
+        if (raw["integrity"] && typeof raw["integrity"] === "object") {
+            const integ = raw["integrity"];
+            integrity = { algorithm: integ["algorithm"], files: integ["files"] ?? {} };
+        }
+    }
+    else {
+        // Legacy bundle: parse as v1
+        const manifest = normalizeBundleManifest(raw);
+        integrity = manifest.integrity;
+    }
+    if (!integrity) {
+        throw new Error("Bundle manifest missing integrity section — cannot verify content");
+    }
+    {
+        const fsOps = {
+            readFile: (p) => fs.readFileSync(p, "utf-8"),
+            readFileBuffer: (p) => fs.readFileSync(p),
+            writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"),
+            exists: (p) => fs.existsSync(p),
+            walkFiles: (dir) => walkFilesSync(dir),
+        };
+        // verifyIntegrity only reads manifest.integrity — safe to cast
+        const result = verifyIntegrity(outputDir, { integrity }, fsOps);
+        if (!result.passed) {
+            const details = [
+                ...result.mismatches.map((f) => `tampered: ${f}`),
+                ...result.missing.map((f) => `missing: ${f}`),
+                ...result.extra.map((f) => `extra: ${f}`),
+                ...result.errors,
+            ];
+            throw new Error(`Content integrity verification failed: ${details.join("; ")}`);
+        }
+    }
+}
+/**
+ * Verify the archive-level SHA-256 digest.
+ * Requires sibling .sha256 file.
+ */
+export function verifyArchiveDigest(archivePath) {
+    const digestPath = `${archivePath}.sha256`;
+    if (!fs.existsSync(digestPath)) {
+        throw new Error(`Archive digest file required but missing: ${digestPath}`);
+    }
+    const expected = fs.readFileSync(digestPath, "utf-8").trim();
+    const actual = hashFile(archivePath);
+    return { valid: expected === actual, expected, actual };
+}
+function hashFile(filePath) {
+    const content = fs.readFileSync(filePath);
+    return createHash("sha256").update(content).digest("hex");
+}
+function walkFilesSync(dir) {
+    const results = [];
+    function walk(d, prefix) {
+        for (const entry of fs.readdirSync(d, { withFileTypes: true })) {
+            if (entry.isDirectory()) {
+                walk(nodePath.join(d, entry.name), prefix ? `${prefix}/${entry.name}` : entry.name);
+            }
+            else {
+                results.push(prefix ? `${prefix}/${entry.name}` : entry.name);
+            }
+        }
+    }
+    walk(dir, "");
+    return results;
+}
+//# sourceMappingURL=bundle-archive.js.map

package/daemon/dist/domain/bundle-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-archive.js","sourceRoot":"","sources":["../../src/domain/bundle-archive.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAuB,MAAM,uBAAuB,CAAC;AAC7E,mDAAmD;AACnD,OAAO,EAAE,yBAAyB,IAAI,mBAAmB,EAAE,6BAA6B,IAAI,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE/I;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,UAAkB,EAAE,UAAkB;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAElD,mCAAmC;IACnC,MAAM,GAAG,CAAC,MAAM,CACd;QACE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QAClB,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,IAAI,EAAE,0BAA0B;QAC1C,KAAK,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,8BAA8B;KACxE,EACD,QAAQ,CACT,CAAC;IAEF,yBAAyB;IACzB,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,EAAE,CAAC,aAAa,CAAC,GAAG,UAAU,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAE/D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,SAAiB;IACjE,sCAAsC;IACtC,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,CAAC,QAAQ,SAAS,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,gEAAgE;IAChE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,GAAG,CAAC,IAAI,CAAC;QACb,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YACrB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;YAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;YAC7B,IAAI,SAAS,KAAK,cAAc,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzD,aAAa,CAAC,IAAI,CAAC,GAAG,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,aAAa,CAAC,IAAI,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,uCAAuC;IACvC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAEzD,mCAAmC;IACnC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAA4B,CAAC;IAEpE,4CAA4C;IAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAW,CAAC;IACtD,IAAI,SAA2E,CAAC;IAEhF,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,sDAAsD;QACtD,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAA4B,CAAC;YAC1D,SAAS,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAW,EAAE,KAAK,EAAG,KAAK,CAAC,OAAO,CAA4B,IAAI,EAAE,EAAE,CAAC;QACnH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC9C,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,CAAC;QACC,MAAM,KAAK,GAAmB;YAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;YAC5C,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;YACpD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/B,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;SACvC,CAAC;QAEF,+DAA+D;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,EAAE,SAAS,EAAsD,EAAE,KAAK,CAAC,CAAC;QACpH,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG;gBACd,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjD,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,GAAG,MAAM,CAAC,MAAM;aACjB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,UAAU,GAAG,GAAG,WAAW,SAAS,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAErC,OAAO,EAAE,KAAK,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,SAAS,IAAI,CAAC,CAAS,EAAE,MAAc;QACrC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACd,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/daemon/dist/domain/bundle-assembler.d.ts

@@ -0,0 +1,34 @@
+import { type LegacyBundleManifest as BundleManifest } from "./bundle-types.js";
+export interface AssemblerFsOps {
+    readFile: (path: string) => string;
+    exists: (path: string) => boolean;
+    mkdirp: (path: string) => void;
+    writeFile: (path: string, content: string) => void;
+    copyDir: (src: string, dest: string) => void;
+}
+export interface PackageInput {
+    name: string;
+    version: string;
+    sourcePath: string;
+    originalSource: string;
+    manifestHash: string;
+}
+export interface AssembleOptions {
+    specPath: string;
+    packages: PackageInput[];
+    outputDir: string;
+    bundleName: string;
+    bundleVersion: string;
+}
+/**
+ * Assembles a bundle staging directory with canonical layout.
+ * Generates bundle.yaml without integrity (P7-T02 adds that).
+ */
+export declare class LegacyBundleAssembler {
+    private fs;
+    constructor(deps: {
+        fsOps: AssemblerFsOps;
+    });
+    assemble(opts: AssembleOptions): BundleManifest;
+}
+//# sourceMappingURL=bundle-assembler.d.ts.map

package/daemon/dist/domain/bundle-assembler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-assembler.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-assembler.ts"],"names":[],"mappings":"AAIA,OAAO,EAA4D,KAAK,oBAAoB,IAAI,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE1I,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AAEH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,EAAE,CAAiB;gBAEf,IAAI,EAAE;QAAE,KAAK,EAAE,cAAc,CAAA;KAAE;IAI3C,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc;CAiFhD"}

package/daemon/dist/domain/bundle-assembler.js

@@ -0,0 +1,86 @@
+import nodePath from "node:path";
+import { LegacyRigSpecCodec as RigSpecCodec } from "./rigspec-codec.js"; // TODO: AS-T08b — migrate to pod-aware RigSpec
+import { LegacyRigSpecSchema as RigSpecSchema } from "./rigspec-schema.js"; // TODO: AS-T08b — migrate to pod-aware RigSpec
+// TODO: AS-T12 — migrate to pod-aware bundle types
+import { serializeLegacyBundleManifest as serializeBundleManifest } from "./bundle-types.js";
+/**
+ * Assembles a bundle staging directory with canonical layout.
+ * Generates bundle.yaml without integrity (P7-T02 adds that).
+ */
+// TODO: AS-T12 — migrate to pod-aware bundle assembler
+export class LegacyBundleAssembler {
+    fs;
+    constructor(deps) {
+        this.fs = deps.fsOps;
+    }
+    assemble(opts) {
+        // Validate rig spec exists
+        if (!this.fs.exists(opts.specPath)) {
+            throw new Error(`Rig spec not found: ${opts.specPath}`);
+        }
+        // Validate rig spec content
+        const specYaml = this.fs.readFile(opts.specPath);
+        const raw = RigSpecCodec.parse(specYaml);
+        const validation = RigSpecSchema.validate(raw);
+        if (!validation.valid) {
+            throw new Error(`Invalid rig spec: ${validation.errors.join("; ")}`);
+        }
+        // Deduplicate packages by name + manifestHash, preserving all original sources
+        const seen = new Map();
+        const dedupedPackages = [];
+        for (const pkg of opts.packages) {
+            const existing = seen.get(pkg.name);
+            if (existing) {
+                if (existing.pkg.manifestHash !== pkg.manifestHash) {
+                    throw new Error(`Duplicate package name '${pkg.name}' with different content (hash mismatch)`);
+                }
+                // Same name + same hash -> collect source for provenance
+                if (!existing.sources.includes(pkg.originalSource)) {
+                    existing.sources.push(pkg.originalSource);
+                }
+                continue;
+            }
+            const entry = { pkg, sources: [pkg.originalSource] };
+            seen.set(pkg.name, entry);
+            dedupedPackages.push(entry);
+        }
+        // Validate all package source paths exist
+        for (const { pkg } of dedupedPackages) {
+            if (!this.fs.exists(pkg.sourcePath)) {
+                throw new Error(`Package directory not found: ${pkg.sourcePath} (${pkg.name})`);
+            }
+        }
+        // Create staging directory
+        this.fs.mkdirp(opts.outputDir);
+        // Copy rig spec
+        this.fs.writeFile(nodePath.join(opts.outputDir, "rig.yaml"), specYaml);
+        // Vendor packages
+        const packageEntries = [];
+        for (const { pkg, sources } of dedupedPackages) {
+            const destPath = `packages/${pkg.name}`;
+            const destFull = nodePath.join(opts.outputDir, destPath);
+            this.fs.mkdirp(nodePath.dirname(destFull));
+            this.fs.copyDir(pkg.sourcePath, destFull);
+            packageEntries.push({
+                name: pkg.name,
+                version: pkg.version,
+                path: destPath,
+                originalSource: sources[0],
+                ...(sources.length > 1 ? { originalSources: sources } : {}),
+            });
+        }
+        // Generate manifest (no integrity — P7-T02 adds it)
+        const manifest = {
+            schemaVersion: 1,
+            name: opts.bundleName,
+            version: opts.bundleVersion,
+            createdAt: new Date().toISOString(),
+            rigSpec: "rig.yaml",
+            packages: packageEntries,
+        };
+        // Write bundle.yaml
+        this.fs.writeFile(nodePath.join(opts.outputDir, "bundle.yaml"), serializeBundleManifest(manifest));
+        return manifest;
+    }
+}
+//# sourceMappingURL=bundle-assembler.js.map

package/daemon/dist/domain/bundle-assembler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-assembler.js","sourceRoot":"","sources":["../../src/domain/bundle-assembler.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC,CAAC,+CAA+C;AACxH,OAAO,EAAE,mBAAmB,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC,CAAC,+CAA+C;AAC3H,mDAAmD;AACnD,OAAO,EAAE,6BAA6B,IAAI,uBAAuB,EAA+C,MAAM,mBAAmB,CAAC;AA0B1I;;;GAGG;AACH,uDAAuD;AACvD,MAAM,OAAO,qBAAqB;IACxB,EAAE,CAAiB;IAE3B,YAAY,IAA+B;QACzC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,IAAqB;QAC5B,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoD,CAAC;QACzE,MAAM,eAAe,GAAoD,EAAE,CAAC;QAC5E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,IAAI,0CAA0C,CAAC,CAAC;gBACjG,CAAC;gBACD,yDAAyD;gBACzD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;oBACnD,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC5C,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,0CAA0C;QAC1C,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE/B,gBAAgB;QAChB,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEvE,kBAAkB;QAClB,MAAM,cAAc,GAA+B,EAAE,CAAC;QACtD,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,eAAe,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,YAAY,GAAG,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC1C,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,QAAQ;gBACd,cAAc,EAAE,OAAO,CAAC,CAAC,CAAE;gBAC3B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,oDAAoD;QACpD,MAAM,QAAQ,GAAmB;YAC/B,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,OAAO,EAAE,IAAI,CAAC,aAAa;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,cAAc;SACzB,CAAC;QAEF,oBAAoB;QACpB,IAAI,CAAC,EAAE,CAAC,SAAS,CACf,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC5C,uBAAuB,CAAC,QAAQ,CAAC,CAClC,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/daemon/dist/domain/bundle-integrity.d.ts

@@ -0,0 +1,30 @@
+import type { LegacyBundleManifest as BundleManifest, BundleIntegrity } from "./bundle-types.js";
+export interface IntegrityFsOps {
+    readFile: (path: string) => string;
+    readFileBuffer: (path: string) => Buffer;
+    writeFile: (path: string, content: string) => void;
+    exists: (path: string) => boolean;
+    walkFiles: (dir: string) => string[];
+}
+/**
+ * Compute integrity hashes for all content files in a bundle directory.
+ * Throws on sensitive paths. Excludes control files and OS junk.
+ */
+export declare function computeIntegrity(dir: string, fsOps: IntegrityFsOps): BundleIntegrity;
+/**
+ * Write integrity section into bundle.yaml, then write bundle.yaml.sha256 digest.
+ */
+export declare function writeIntegrity(dir: string, integrity: BundleIntegrity, fsOps: IntegrityFsOps): void;
+/** Verification result */
+export interface VerifyResult {
+    passed: boolean;
+    mismatches: string[];
+    missing: string[];
+    extra: string[];
+    errors: string[];
+}
+/**
+ * Verify bundle integrity. Checks manifest digest first, then per-file hashes.
+ */
+export declare function verifyIntegrity(dir: string, manifest: BundleManifest, fsOps: IntegrityFsOps): VerifyResult;
+//# sourceMappingURL=bundle-integrity.d.ts.map

package/daemon/dist/domain/bundle-integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-integrity.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-integrity.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,IAAI,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGjG,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;CACtC;AA+BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,eAAe,CAyBpF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAQnG;AAED,0BAA0B;AAC1B,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,YAAY,CAoD1G"}

package/daemon/dist/domain/bundle-integrity.js

@@ -0,0 +1,120 @@
+import { createHash } from "node:crypto";
+import nodePath from "node:path";
+import { parseLegacyBundleManifest as parseBundleManifest, normalizeLegacyBundleManifest as normalizeBundleManifest, serializeLegacyBundleManifest as serializeBundleManifest } from "./bundle-types.js";
+/** Files to ignore during integrity operations */
+const IGNORE_FILES = new Set([".DS_Store", "Thumbs.db", ".gitkeep"]);
+/** Reserved control files — not content, not extras */
+const CONTROL_FILES = new Set(["bundle.yaml"]);
+/** Sensitive path patterns that block bundle creation */
+const SENSITIVE_PATTERNS = [
+    /^\.env$/,
+    /^\.env\..+$/,
+    /\.env$/,
+    /^credentials\./,
+    /^tokens\./,
+    /\.pem$/,
+    /\.key$/,
+    /\.p12$/,
+    /^\.git\//,
+    /^node_modules\//,
+];
+function isSensitivePath(relativePath) {
+    const name = nodePath.basename(relativePath);
+    return SENSITIVE_PATTERNS.some((p) => p.test(name) || p.test(relativePath));
+}
+function hashContent(content) {
+    return createHash("sha256").update(content).digest("hex");
+}
+/**
+ * Compute integrity hashes for all content files in a bundle directory.
+ * Throws on sensitive paths. Excludes control files and OS junk.
+ */
+export function computeIntegrity(dir, fsOps) {
+    const allFiles = fsOps.walkFiles(dir);
+    const files = {};
+    const sensitive = [];
+    for (const relPath of allFiles) {
+        const name = nodePath.basename(relPath);
+        if (IGNORE_FILES.has(name))
+            continue;
+        if (CONTROL_FILES.has(relPath))
+            continue;
+        if (isSensitivePath(relPath)) {
+            sensitive.push(relPath);
+            continue;
+        }
+        const fullPath = nodePath.join(dir, relPath);
+        const content = fsOps.readFileBuffer(fullPath);
+        files[relPath] = hashContent(content);
+    }
+    if (sensitive.length > 0) {
+        throw new Error(`Sensitive paths detected in bundle: ${sensitive.join(", ")}`);
+    }
+    return { algorithm: "sha256", files };
+}
+/**
+ * Write integrity section into bundle.yaml, then write bundle.yaml.sha256 digest.
+ */
+export function writeIntegrity(dir, integrity, fsOps) {
+    const manifestPath = nodePath.join(dir, "bundle.yaml");
+    const yaml = fsOps.readFile(manifestPath);
+    const raw = parseBundleManifest(yaml);
+    const manifest = normalizeBundleManifest(raw);
+    manifest.integrity = integrity;
+    const updatedYaml = serializeBundleManifest(manifest);
+    fsOps.writeFile(manifestPath, updatedYaml);
+}
+/**
+ * Verify bundle integrity. Checks manifest digest first, then per-file hashes.
+ */
+export function verifyIntegrity(dir, manifest, fsOps) {
+    const result = {
+        passed: true,
+        mismatches: [],
+        missing: [],
+        extra: [],
+        errors: [],
+    };
+    // Verify content file integrity (manifest trust is P7-T03's archive-level responsibility)
+    if (!manifest.integrity) {
+        result.passed = false;
+        result.errors.push("manifest has no integrity section");
+        return result;
+    }
+    const expectedFiles = manifest.integrity.files;
+    // Check expected files
+    for (const [relPath, expectedHash] of Object.entries(expectedFiles)) {
+        const fullPath = nodePath.join(dir, relPath);
+        if (!fsOps.exists(fullPath)) {
+            result.missing.push(relPath);
+            result.passed = false;
+            continue;
+        }
+        const actualHash = hashContent(fsOps.readFileBuffer(fullPath));
+        if (actualHash !== expectedHash) {
+            result.mismatches.push(relPath);
+            result.passed = false;
+        }
+    }
+    // Check for extra files + sensitive paths
+    const allFiles = fsOps.walkFiles(dir);
+    const expectedSet = new Set(Object.keys(expectedFiles));
+    for (const relPath of allFiles) {
+        const name = nodePath.basename(relPath);
+        if (IGNORE_FILES.has(name))
+            continue;
+        if (CONTROL_FILES.has(relPath))
+            continue;
+        if (!expectedSet.has(relPath)) {
+            result.extra.push(relPath);
+            result.passed = false;
+        }
+        // Check for sensitive paths on install/verify path (not just create)
+        if (isSensitivePath(relPath)) {
+            result.errors.push(`Sensitive file detected: ${relPath}`);
+            result.passed = false;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=bundle-integrity.js.map

package/daemon/dist/domain/bundle-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-integrity.js","sourceRoot":"","sources":["../../src/domain/bundle-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,QAAQ,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,yBAAyB,IAAI,mBAAmB,EAAE,6BAA6B,IAAI,uBAAuB,EAAE,6BAA6B,IAAI,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAUzM,kDAAkD;AAClD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAErE,uDAAuD;AACvD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAE/C,yDAAyD;AACzD,MAAM,kBAAkB,GAAG;IACzB,SAAS;IACT,aAAa;IACb,QAAQ;IACR,gBAAgB;IAChB,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,iBAAiB;CAClB,CAAC;AAEF,SAAS,eAAe,CAAC,YAAoB;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAqB;IACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAEzC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC/C,KAAK,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAA0B,EAAE,KAAqB;IAC3F,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC9C,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,MAAM,WAAW,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACtD,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAWD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,QAAwB,EAAE,KAAqB;IAC1F,MAAM,MAAM,GAAiB;QAC3B,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,0FAA0F;IAC1F,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;IAE/C,uBAAuB;IACvB,KAAK,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;YACtB,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,qEAAqE;QACrE,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}