@openrig/cli 0.5.0 → 0.5.1

package/node_modules/@openrig/daemon/dist/domain/bundle-archive.js

@@ -0,0 +1,156 @@
+/**
+ * TRUST MODEL: Bundle integrity verifies self-consistency, not authenticity.
+ * The sibling .sha256 detects corruption during transfer. Content hashes
+ * detect tampering of individual files within the archive. Neither mechanism
+ * authenticates the bundle author — an attacker who can rewrite the full
+ * bundle + digest can bypass verification. Users must trust the source they
+ * obtained the bundle from (same model as unsigned npm packages/Docker images).
+ * Cryptographic signing (Ed25519) is a future enhancement.
+ */
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import nodePath from "node:path";
+import * as tar from "tar";
+import { verifyIntegrity } from "./bundle-integrity.js";
+// TODO: AS-T12 — migrate to pod-aware bundle types
+import { parseLegacyBundleManifest as parseBundleManifest, normalizeLegacyBundleManifest as normalizeBundleManifest } from "./bundle-types.js";
+/**
+ * Pack a staging directory into a .rigbundle archive (deterministic tar.gz).
+ * Writes sibling .sha256 digest file.
+ * @returns SHA-256 hex digest of the archive
+ */
+export async function pack(stagingDir, outputPath) {
+    if (!outputPath.endsWith(".rigbundle")) {
+        throw new Error("Output path must end with .rigbundle");
+    }
+    // Collect all files in deterministic order (alphabetical)
+    const allFiles = walkFilesSync(stagingDir).sort();
+    // Pack with deterministic settings
+    await tar.create({
+        gzip: { level: 9 },
+        file: outputPath,
+        cwd: stagingDir,
+        portable: true, // Normalizes uid/gid/mode
+        mtime: new Date("2026-01-01T00:00:00Z"), // Fixed mtime for determinism
+    }, allFiles);
+    // Compute archive digest
+    const archiveHash = hashFile(outputPath);
+    fs.writeFileSync(`${outputPath}.sha256`, archiveHash, "utf-8");
+    return archiveHash;
+}
+/**
+ * Unpack a .rigbundle archive to a directory.
+ * Requires sibling .sha256 digest file. Verifies archive integrity before extraction.
+ * Rejects symlinks, hardlinks, path traversal, and absolute paths.
+ * Runs content integrity verification after extraction.
+ */
+export async function unpack(archivePath, outputDir) {
+    // Step 1: Verify archive-level digest
+    const digestResult = verifyArchiveDigest(archivePath);
+    if (!digestResult.valid) {
+        throw new Error(`Archive integrity check failed: expected ${digestResult.expected}, got ${digestResult.actual}`);
+    }
+    // Step 2: Pre-scan archive for unsafe entries BEFORE extraction
+    const unsafeEntries = [];
+    await tar.list({
+        file: archivePath,
+        onReadEntry: (entry) => {
+            const entryPath = entry.path;
+            const entryType = entry.type;
+            if (entryType === "SymbolicLink" || entryType === "Link") {
+                unsafeEntries.push(`${entryType}: ${entryPath}`);
+            }
+            if (entryPath.startsWith("/")) {
+                unsafeEntries.push(`absolute path: ${entryPath}`);
+            }
+            const segments = entryPath.split("/");
+            if (segments.some((s) => s === "..")) {
+                unsafeEntries.push(`path traversal: ${entryPath}`);
+            }
+        },
+    });
+    if (unsafeEntries.length > 0) {
+        throw new Error(`Unsafe archive entries rejected: ${unsafeEntries.join("; ")}`);
+    }
+    // Step 3: Extract (safe — pre-scanned)
+    fs.mkdirSync(outputDir, { recursive: true });
+    await tar.extract({ file: archivePath, cwd: outputDir });
+    // Step 3: Verify content integrity
+    const manifestPath = nodePath.join(outputDir, "bundle.yaml");
+    if (!fs.existsSync(manifestPath)) {
+        throw new Error("Extracted archive missing bundle.yaml");
+    }
+    const rawYaml = fs.readFileSync(manifestPath, "utf-8");
+    const raw = parseBundleManifest(rawYaml);
+    // Schema-version-aware integrity extraction
+    const schemaVersion = raw["schema_version"];
+    let integrity;
+    if (schemaVersion === 2) {
+        // Pod-aware bundle: integrity is optional in manifest
+        if (raw["integrity"] && typeof raw["integrity"] === "object") {
+            const integ = raw["integrity"];
+            integrity = { algorithm: integ["algorithm"], files: integ["files"] ?? {} };
+        }
+    }
+    else {
+        // Legacy bundle: parse as v1
+        const manifest = normalizeBundleManifest(raw);
+        integrity = manifest.integrity;
+    }
+    if (!integrity) {
+        throw new Error("Bundle manifest missing integrity section — cannot verify content");
+    }
+    {
+        const fsOps = {
+            readFile: (p) => fs.readFileSync(p, "utf-8"),
+            readFileBuffer: (p) => fs.readFileSync(p),
+            writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"),
+            exists: (p) => fs.existsSync(p),
+            walkFiles: (dir) => walkFilesSync(dir),
+        };
+        // verifyIntegrity only reads manifest.integrity — safe to cast
+        const result = verifyIntegrity(outputDir, { integrity }, fsOps);
+        if (!result.passed) {
+            const details = [
+                ...result.mismatches.map((f) => `tampered: ${f}`),
+                ...result.missing.map((f) => `missing: ${f}`),
+                ...result.extra.map((f) => `extra: ${f}`),
+                ...result.errors,
+            ];
+            throw new Error(`Content integrity verification failed: ${details.join("; ")}`);
+        }
+    }
+}
+/**
+ * Verify the archive-level SHA-256 digest.
+ * Requires sibling .sha256 file.
+ */
+export function verifyArchiveDigest(archivePath) {
+    const digestPath = `${archivePath}.sha256`;
+    if (!fs.existsSync(digestPath)) {
+        throw new Error(`Archive digest file required but missing: ${digestPath}`);
+    }
+    const expected = fs.readFileSync(digestPath, "utf-8").trim();
+    const actual = hashFile(archivePath);
+    return { valid: expected === actual, expected, actual };
+}
+function hashFile(filePath) {
+    const content = fs.readFileSync(filePath);
+    return createHash("sha256").update(content).digest("hex");
+}
+function walkFilesSync(dir) {
+    const results = [];
+    function walk(d, prefix) {
+        for (const entry of fs.readdirSync(d, { withFileTypes: true })) {
+            if (entry.isDirectory()) {
+                walk(nodePath.join(d, entry.name), prefix ? `${prefix}/${entry.name}` : entry.name);
+            }
+            else {
+                results.push(prefix ? `${prefix}/${entry.name}` : entry.name);
+            }
+        }
+    }
+    walk(dir, "");
+    return results;
+}
+//# sourceMappingURL=bundle-archive.js.map

package/node_modules/@openrig/daemon/dist/domain/bundle-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-archive.js","sourceRoot":"","sources":["../../src/domain/bundle-archive.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAuB,MAAM,uBAAuB,CAAC;AAC7E,mDAAmD;AACnD,OAAO,EAAE,yBAAyB,IAAI,mBAAmB,EAAE,6BAA6B,IAAI,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE/I;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,UAAkB,EAAE,UAAkB;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAElD,mCAAmC;IACnC,MAAM,GAAG,CAAC,MAAM,CACd;QACE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QAClB,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,IAAI,EAAE,0BAA0B;QAC1C,KAAK,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,8BAA8B;KACxE,EACD,QAAQ,CACT,CAAC;IAEF,yBAAyB;IACzB,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,EAAE,CAAC,aAAa,CAAC,GAAG,UAAU,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAE/D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,SAAiB;IACjE,sCAAsC;IACtC,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,CAAC,QAAQ,SAAS,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,gEAAgE;IAChE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,GAAG,CAAC,IAAI,CAAC;QACb,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YACrB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;YAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;YAC7B,IAAI,SAAS,KAAK,cAAc,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzD,aAAa,CAAC,IAAI,CAAC,GAAG,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,aAAa,CAAC,IAAI,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,uCAAuC;IACvC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAEzD,mCAAmC;IACnC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAA4B,CAAC;IAEpE,4CAA4C;IAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAW,CAAC;IACtD,IAAI,SAA2E,CAAC;IAEhF,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,sDAAsD;QACtD,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAA4B,CAAC;YAC1D,SAAS,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAW,EAAE,KAAK,EAAG,KAAK,CAAC,OAAO,CAA4B,IAAI,EAAE,EAAE,CAAC;QACnH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC9C,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,CAAC;QACC,MAAM,KAAK,GAAmB;YAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;YAC5C,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;YACpD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/B,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;SACvC,CAAC;QAEF,+DAA+D;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,EAAE,SAAS,EAAsD,EAAE,KAAK,CAAC,CAAC;QACpH,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG;gBACd,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjD,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,GAAG,MAAM,CAAC,MAAM;aACjB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,UAAU,GAAG,GAAG,WAAW,SAAS,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAErC,OAAO,EAAE,KAAK,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,SAAS,IAAI,CAAC,CAAS,EAAE,MAAc;QACrC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACd,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/bundle-assembler.d.ts

@@ -0,0 +1,51 @@
+import { type LegacyBundleManifest as BundleManifest, type BundleProvenance, type BundleCompatibility } from "./bundle-types.js";
+export interface AssemblerFsOps {
+    readFile: (path: string) => string;
+    exists: (path: string) => boolean;
+    mkdirp: (path: string) => void;
+    writeFile: (path: string, content: string) => void;
+    copyDir: (src: string, dest: string) => void;
+}
+export interface PackageInput {
+    name: string;
+    version: string;
+    sourcePath: string;
+    originalSource: string;
+    manifestHash: string;
+}
+export interface AssembleOptions {
+    specPath: string;
+    packages: PackageInput[];
+    outputDir: string;
+    bundleName: string;
+    bundleVersion: string;
+    /**
+     * Optional Item-1 provenance input. Caller fills the fields it knows
+     * (sourceHost, authorSession, daemonVersion, cliVersion, sourceRigId,
+     * sourceRigName, notes). The assembler mirrors root createdAt into
+     * provenance.createdAt unless caller pre-set it (caller value wins
+     * for test determinism). Missing block = no provenance recorded
+     * (backward compat).
+     */
+    provenance?: BundleProvenance;
+    /**
+     * Optional Item-2 compatibility input. Caller declares minimum
+     * daemon + CLI versions and optional schema_version reaffirmation.
+     * Missing block = no compatibility recorded (backward compat); the
+     * install-time version check at /api/bundles/install (Checkpoint 3.3)
+     * is a no-op for bundles without compatibility.
+     */
+    compatibility?: BundleCompatibility;
+}
+/**
+ * Assembles a bundle staging directory with canonical layout.
+ * Generates bundle.yaml without integrity (P7-T02 adds that).
+ */
+export declare class LegacyBundleAssembler {
+    private fs;
+    constructor(deps: {
+        fsOps: AssemblerFsOps;
+    });
+    assemble(opts: AssembleOptions): BundleManifest;
+}
+//# sourceMappingURL=bundle-assembler.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/bundle-assembler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-assembler.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-assembler.ts"],"names":[],"mappings":"AAIA,OAAO,EAA4D,KAAK,oBAAoB,IAAI,cAAc,EAAE,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE3L,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;;GAGG;AAEH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,EAAE,CAAiB;gBAEf,IAAI,EAAE;QAAE,KAAK,EAAE,cAAc,CAAA;KAAE;IAI3C,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc;CA2FhD"}

package/node_modules/@openrig/daemon/dist/domain/bundle-assembler.js

@@ -0,0 +1,96 @@
+import nodePath from "node:path";
+import { LegacyRigSpecCodec as RigSpecCodec } from "./rigspec-codec.js"; // TODO: AS-T08b — migrate to pod-aware RigSpec
+import { LegacyRigSpecSchema as RigSpecSchema } from "./rigspec-schema.js"; // TODO: AS-T08b — migrate to pod-aware RigSpec
+// TODO: AS-T12 — migrate to pod-aware bundle types
+import { serializeLegacyBundleManifest as serializeBundleManifest } from "./bundle-types.js";
+/**
+ * Assembles a bundle staging directory with canonical layout.
+ * Generates bundle.yaml without integrity (P7-T02 adds that).
+ */
+// TODO: AS-T12 — migrate to pod-aware bundle assembler
+export class LegacyBundleAssembler {
+    fs;
+    constructor(deps) {
+        this.fs = deps.fsOps;
+    }
+    assemble(opts) {
+        // Validate rig spec exists
+        if (!this.fs.exists(opts.specPath)) {
+            throw new Error(`Rig spec not found: ${opts.specPath}`);
+        }
+        // Validate rig spec content
+        const specYaml = this.fs.readFile(opts.specPath);
+        const raw = RigSpecCodec.parse(specYaml);
+        const validation = RigSpecSchema.validate(raw);
+        if (!validation.valid) {
+            throw new Error(`Invalid rig spec: ${validation.errors.join("; ")}`);
+        }
+        // Deduplicate packages by name + manifestHash, preserving all original sources
+        const seen = new Map();
+        const dedupedPackages = [];
+        for (const pkg of opts.packages) {
+            const existing = seen.get(pkg.name);
+            if (existing) {
+                if (existing.pkg.manifestHash !== pkg.manifestHash) {
+                    throw new Error(`Duplicate package name '${pkg.name}' with different content (hash mismatch)`);
+                }
+                // Same name + same hash -> collect source for provenance
+                if (!existing.sources.includes(pkg.originalSource)) {
+                    existing.sources.push(pkg.originalSource);
+                }
+                continue;
+            }
+            const entry = { pkg, sources: [pkg.originalSource] };
+            seen.set(pkg.name, entry);
+            dedupedPackages.push(entry);
+        }
+        // Validate all package source paths exist
+        for (const { pkg } of dedupedPackages) {
+            if (!this.fs.exists(pkg.sourcePath)) {
+                throw new Error(`Package directory not found: ${pkg.sourcePath} (${pkg.name})`);
+            }
+        }
+        // Create staging directory
+        this.fs.mkdirp(opts.outputDir);
+        // Copy rig spec
+        this.fs.writeFile(nodePath.join(opts.outputDir, "rig.yaml"), specYaml);
+        // Vendor packages
+        const packageEntries = [];
+        for (const { pkg, sources } of dedupedPackages) {
+            const destPath = `packages/${pkg.name}`;
+            const destFull = nodePath.join(opts.outputDir, destPath);
+            this.fs.mkdirp(nodePath.dirname(destFull));
+            this.fs.copyDir(pkg.sourcePath, destFull);
+            packageEntries.push({
+                name: pkg.name,
+                version: pkg.version,
+                path: destPath,
+                originalSource: sources[0],
+                ...(sources.length > 1 ? { originalSources: sources } : {}),
+            });
+        }
+        // Generate manifest (no integrity — P7-T02 adds it)
+        const createdAt = new Date().toISOString();
+        const manifest = {
+            schemaVersion: 1,
+            name: opts.bundleName,
+            version: opts.bundleVersion,
+            createdAt,
+            rigSpec: "rig.yaml",
+            packages: packageEntries,
+        };
+        if (opts.provenance) {
+            manifest.provenance = {
+                ...opts.provenance,
+                createdAt: opts.provenance.createdAt ?? createdAt,
+            };
+        }
+        if (opts.compatibility) {
+            manifest.compatibility = { ...opts.compatibility };
+        }
+        // Write bundle.yaml
+        this.fs.writeFile(nodePath.join(opts.outputDir, "bundle.yaml"), serializeBundleManifest(manifest));
+        return manifest;
+    }
+}
+//# sourceMappingURL=bundle-assembler.js.map

package/node_modules/@openrig/daemon/dist/domain/bundle-assembler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-assembler.js","sourceRoot":"","sources":["../../src/domain/bundle-assembler.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC,CAAC,+CAA+C;AACxH,OAAO,EAAE,mBAAmB,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC,CAAC,+CAA+C;AAC3H,mDAAmD;AACnD,OAAO,EAAE,6BAA6B,IAAI,uBAAuB,EAAgG,MAAM,mBAAmB,CAAC;AA2C3L;;;GAGG;AACH,uDAAuD;AACvD,MAAM,OAAO,qBAAqB;IACxB,EAAE,CAAiB;IAE3B,YAAY,IAA+B;QACzC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,IAAqB;QAC5B,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoD,CAAC;QACzE,MAAM,eAAe,GAAoD,EAAE,CAAC;QAC5E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,IAAI,0CAA0C,CAAC,CAAC;gBACjG,CAAC;gBACD,yDAAyD;gBACzD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;oBACnD,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC5C,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,0CAA0C;QAC1C,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE/B,gBAAgB;QAChB,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEvE,kBAAkB;QAClB,MAAM,cAAc,GAA+B,EAAE,CAAC;QACtD,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,eAAe,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,YAAY,GAAG,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC1C,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,QAAQ;gBACd,cAAc,EAAE,OAAO,CAAC,CAAC,CAAE;gBAC3B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,oDAAoD;QACpD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAmB;YAC/B,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,OAAO,EAAE,IAAI,CAAC,aAAa;YAC3B,SAAS;YACT,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,cAAc;SACzB,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,QAAQ,CAAC,UAAU,GAAG;gBACpB,GAAG,IAAI,CAAC,UAAU;gBAClB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,SAAS;aAClD,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,QAAQ,CAAC,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACrD,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,EAAE,CAAC,SAAS,CACf,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC5C,uBAAuB,CAAC,QAAQ,CAAC,CAClC,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/bundle-audit.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Bundle install audit trail (Item 4 / slice-05 Checkpoint 5.1).
+ *
+ * Append-only JSONL log of bundle install events. Matches the JSONL audit-
+ * trail convention used by Transcript / Log Cleanup v0 and UI Enhancement
+ * Pack v0 — no new SQLite schema or migration.
+ *
+ * Default location is ~/.openrig/bundle-audit.jsonl. The writer is a pure
+ * data sink: callers (the /api/bundles/install route handler) compose the
+ * record at the right moment in the install lifecycle and hand it to
+ * BundleAuditWriter.append. The reader exposes a small filter API
+ * (rig name + since timestamp) for the /api/bundles/history endpoint and
+ * the `rig bundle history` CLI subcommand (both land at Checkpoint 5.2).
+ *
+ * FsOps injection mirrors the codebase pattern for testability: real
+ * implementation reads/writes node:fs; tests substitute an in-memory mock.
+ */
+/** A single bundle install audit row. */
+export interface BundleAuditRecord {
+    /** ISO timestamp of when the install event was recorded. */
+    installedAt: string;
+    /** Source bundle path the install operated on. */
+    bundlePath: string;
+    /** SHA-256 archive hash (when available from bundle's sibling digest). */
+    archiveHash?: string;
+    /** ULID of the rig the install targeted (when applicable). */
+    targetRigId?: string;
+    /** Name of the rig the install targeted (when applicable). */
+    targetRigName?: string;
+    /** Hostname recorded in the bundle's provenance (Item 1), when present. */
+    sourceHost?: string;
+    /** Daemon version at install time. */
+    daemonVersion?: string;
+    /** CLI version at install time (when CLI sent it; Item 1 + Item 2 path). */
+    cliVersion?: string;
+    /** Install outcome — keep honest (partial = some stages ok, some not). */
+    outcome: "success" | "failed" | "partial";
+}
+/** Filesystem injection point — real impl wraps node:fs. Tests substitute in-memory. */
+export interface BundleAuditFsOps {
+    appendFile: (path: string, content: string) => void;
+    readFile: (path: string) => string;
+    exists: (path: string) => boolean;
+    mkdirp: (path: string) => void;
+}
+/** Configuration for the audit writer + reader. */
+export interface BundleAuditOpts {
+    /** Absolute path to the JSONL file (default location: ~/.openrig/bundle-audit.jsonl). */
+    auditPath: string;
+}
+/** Append-only writer for bundle install audit records. */
+export declare class BundleAuditWriter {
+    private opts;
+    private fs;
+    constructor(deps: {
+        opts: BundleAuditOpts;
+        fsOps: BundleAuditFsOps;
+    });
+    /**
+     * Append one record to the JSONL file. Creates the parent directory if
+     * missing. Each record is one JSON object on its own line (operator can
+     * tail -f for live monitoring). Throws on filesystem errors via fsOps.
+     */
+    append(record: BundleAuditRecord): void;
+}
+/** Filters supported by the audit reader (subset of /api/bundles/history). */
+export interface BundleAuditFilters {
+    /** When set, only return records whose targetRigName equals this value. */
+    rig?: string;
+    /** When set, only return records whose installedAt is >= this ISO timestamp. */
+    since?: string;
+}
+/** Reader for the bundle install audit JSONL file. */
+export declare class BundleAuditReader {
+    private opts;
+    private fs;
+    constructor(deps: {
+        opts: BundleAuditOpts;
+        fsOps: BundleAuditFsOps;
+    });
+    /**
+     * Return all audit records (optionally filtered). Malformed lines are
+     * skipped silently — forward-compat with future record-shape evolutions
+     * that don't parse under the current shape; the readable lines still
+     * surface. Records are returned in append order (oldest first).
+     */
+    list(filters?: BundleAuditFilters): BundleAuditRecord[];
+}
+//# sourceMappingURL=bundle-audit.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/bundle-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-audit.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,yCAAyC;AACzC,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC3C;AAED,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,yFAAyF;IACzF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2DAA2D;AAC3D,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,IAAI,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE;IAKpE;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;CAKxC;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sDAAsD;AACtD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,IAAI,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE;IAKpE;;;;;OAKG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,iBAAiB,EAAE;CAiBxD"}

package/node_modules/@openrig/daemon/dist/domain/bundle-audit.js

@@ -0,0 +1,87 @@
+/**
+ * Bundle install audit trail (Item 4 / slice-05 Checkpoint 5.1).
+ *
+ * Append-only JSONL log of bundle install events. Matches the JSONL audit-
+ * trail convention used by Transcript / Log Cleanup v0 and UI Enhancement
+ * Pack v0 — no new SQLite schema or migration.
+ *
+ * Default location is ~/.openrig/bundle-audit.jsonl. The writer is a pure
+ * data sink: callers (the /api/bundles/install route handler) compose the
+ * record at the right moment in the install lifecycle and hand it to
+ * BundleAuditWriter.append. The reader exposes a small filter API
+ * (rig name + since timestamp) for the /api/bundles/history endpoint and
+ * the `rig bundle history` CLI subcommand (both land at Checkpoint 5.2).
+ *
+ * FsOps injection mirrors the codebase pattern for testability: real
+ * implementation reads/writes node:fs; tests substitute an in-memory mock.
+ */
+import nodePath from "node:path";
+/** Append-only writer for bundle install audit records. */
+export class BundleAuditWriter {
+    opts;
+    fs;
+    constructor(deps) {
+        this.opts = deps.opts;
+        this.fs = deps.fsOps;
+    }
+    /**
+     * Append one record to the JSONL file. Creates the parent directory if
+     * missing. Each record is one JSON object on its own line (operator can
+     * tail -f for live monitoring). Throws on filesystem errors via fsOps.
+     */
+    append(record) {
+        this.fs.mkdirp(nodePath.dirname(this.opts.auditPath));
+        const line = `${JSON.stringify(record)}\n`;
+        this.fs.appendFile(this.opts.auditPath, line);
+    }
+}
+/** Reader for the bundle install audit JSONL file. */
+export class BundleAuditReader {
+    opts;
+    fs;
+    constructor(deps) {
+        this.opts = deps.opts;
+        this.fs = deps.fsOps;
+    }
+    /**
+     * Return all audit records (optionally filtered). Malformed lines are
+     * skipped silently — forward-compat with future record-shape evolutions
+     * that don't parse under the current shape; the readable lines still
+     * surface. Records are returned in append order (oldest first).
+     */
+    list(filters) {
+        if (!this.fs.exists(this.opts.auditPath))
+            return [];
+        const content = this.fs.readFile(this.opts.auditPath);
+        const lines = content.split("\n").filter((l) => l.length > 0);
+        const records = [];
+        for (const line of lines) {
+            try {
+                const parsed = JSON.parse(line);
+                if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                    records.push(parsed);
+                }
+            }
+            catch {
+                // Malformed line — skip silently.
+            }
+        }
+        return applyFilters(records, filters);
+    }
+}
+/** Apply the supported filters to an in-memory record array. */
+function applyFilters(records, filters) {
+    if (!filters)
+        return records;
+    let out = records;
+    if (filters.rig !== undefined && filters.rig.length > 0) {
+        const rigName = filters.rig;
+        out = out.filter((r) => r.targetRigName === rigName);
+    }
+    if (filters.since !== undefined && filters.since.length > 0) {
+        const since = filters.since;
+        out = out.filter((r) => r.installedAt >= since);
+    }
+    return out;
+}
+//# sourceMappingURL=bundle-audit.js.map

package/node_modules/@openrig/daemon/dist/domain/bundle-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-audit.js","sourceRoot":"","sources":["../../src/domain/bundle-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,QAAQ,MAAM,WAAW,CAAC;AAsCjC,2DAA2D;AAC3D,MAAM,OAAO,iBAAiB;IACpB,IAAI,CAAkB;IACtB,EAAE,CAAmB;IAE7B,YAAY,IAAwD;QAClE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAyB;QAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;CACF;AAUD,sDAAsD;AACtD,MAAM,OAAO,iBAAiB;IACpB,IAAI,CAAkB;IACtB,EAAE,CAAmB;IAE7B,YAAY,IAAwD;QAClE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,OAA4B;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnE,OAAO,CAAC,IAAI,CAAC,MAA2B,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;CACF;AAED,gEAAgE;AAChE,SAAS,YAAY,CAAC,OAA4B,EAAE,OAA4B;IAC9E,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/bundle-conflict-detector.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Bundle conflict detector (Item 3 / slice-05 Checkpoint 4.1).
+ *
+ * Pure function. Compares a bundle's declared identifiers against the daemon's
+ * current state and returns a structured conflict report. Callers (route
+ * handlers in Checkpoint 4.2) provide the daemon state (listRigs() etc.); the
+ * detector itself has no daemon dependencies — fully unit-testable.
+ *
+ * Fails CLOSED: the conflict list is the source of truth. Missing or ambiguous
+ * input is treated as no-conflict-detectable, NOT as bypass — Items 4.2+ will
+ * surface ambiguity as a conflict where appropriate. This commit ships the
+ * rig-name collision check only; agent / port / managed-app / sibling-primitive
+ * checks land in Checkpoint 4.3 + 4.4.
+ *
+ * Extends, does NOT replace, the existing 409 "install already in progress"
+ * guard at /api/bundles/install (concurrency lock) per PRD Item 3 §
+ * "extends, does NOT replace".
+ */
+/** A rig-name collision: bundle declares a rig name that a currently-running rig already uses. */
+export interface RigNameCollision {
+    kind: "rig_name_collision";
+    /** Name declared by the bundle's rig spec. */
+    bundleRigName: string;
+    /** Identity of the running rig that holds the same name. */
+    collisionWith: {
+        rigId: string;
+        rigName: string;
+    };
+    /** Human-readable summary suitable for the 3-part error description line. */
+    description: string;
+    /** Operator-actionable resolutions (3-part error what-to-do line). */
+    resolutions: string[];
+}
+/** Discriminated union over all conflict kinds. Extends in Checkpoint 4.3+. */
+export type BundleConflict = RigNameCollision;
+/** Result of a conflict check. */
+export interface ConflictReport {
+    conflicts: BundleConflict[];
+    hasConflicts: boolean;
+}
+/** Input to detectBundleConflicts. Pure data; no daemon handles. */
+export interface DetectConflictsInput {
+    /** Rig name declared in the bundle's rig spec (rig.yaml `name:` field). */
+    bundleRigName: string;
+    /** Snapshot of currently-running rigs from rigRepo.listRigs(). */
+    runningRigs: Array<{
+        rigId: string;
+        name: string;
+    }>;
+}
+/**
+ * Run the conflict checks for an install candidate. Returns the full conflict
+ * list (Checkpoint 4.2 returns it via /install --plan; --apply blocks on
+ * non-empty unless --force).
+ */
+export declare function detectBundleConflicts(input: DetectConflictsInput): ConflictReport;
+//# sourceMappingURL=bundle-conflict-detector.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/bundle-conflict-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-conflict-detector.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-conflict-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE9C,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,oEAAoE;AACpE,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB,GAAG,cAAc,CA0BjF"}

package/node_modules/@openrig/daemon/dist/domain/bundle-conflict-detector.js

@@ -0,0 +1,49 @@
+/**
+ * Bundle conflict detector (Item 3 / slice-05 Checkpoint 4.1).
+ *
+ * Pure function. Compares a bundle's declared identifiers against the daemon's
+ * current state and returns a structured conflict report. Callers (route
+ * handlers in Checkpoint 4.2) provide the daemon state (listRigs() etc.); the
+ * detector itself has no daemon dependencies — fully unit-testable.
+ *
+ * Fails CLOSED: the conflict list is the source of truth. Missing or ambiguous
+ * input is treated as no-conflict-detectable, NOT as bypass — Items 4.2+ will
+ * surface ambiguity as a conflict where appropriate. This commit ships the
+ * rig-name collision check only; agent / port / managed-app / sibling-primitive
+ * checks land in Checkpoint 4.3 + 4.4.
+ *
+ * Extends, does NOT replace, the existing 409 "install already in progress"
+ * guard at /api/bundles/install (concurrency lock) per PRD Item 3 §
+ * "extends, does NOT replace".
+ */
+/**
+ * Run the conflict checks for an install candidate. Returns the full conflict
+ * list (Checkpoint 4.2 returns it via /install --plan; --apply blocks on
+ * non-empty unless --force).
+ */
+export function detectBundleConflicts(input) {
+    const conflicts = [];
+    // Rig-name collision: bundle declares a name a running rig already holds.
+    // O(n) scan over runningRigs — acceptable for the seat-scale rig counts the
+    // daemon manages (tens, not thousands).
+    if (input.bundleRigName && input.bundleRigName.length > 0) {
+        for (const rig of input.runningRigs) {
+            if (rig.name === input.bundleRigName) {
+                conflicts.push({
+                    kind: "rig_name_collision",
+                    bundleRigName: input.bundleRigName,
+                    collisionWith: { rigId: rig.rigId, rigName: rig.name },
+                    description: `bundle declares rig name '${input.bundleRigName}' but a running rig with this name already exists (rigId: ${rig.rigId})`,
+                    resolutions: [
+                        "use --target <newname> on install to rename the rig on install (lands at Checkpoint 4.2)",
+                        `stop the running rig first (e.g. rig down ${rig.name}) and re-attempt install`,
+                        "use --force on install for an operator-explicit override (lands at Checkpoint 4.2; NOT recommended for routine use)",
+                    ],
+                });
+                break;
+            }
+        }
+    }
+    return { conflicts, hasConflicts: conflicts.length > 0 };
+}
+//# sourceMappingURL=bundle-conflict-detector.js.map

package/node_modules/@openrig/daemon/dist/domain/bundle-conflict-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-conflict-detector.js","sourceRoot":"","sources":["../../src/domain/bundle-conflict-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgCH;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA2B;IAC/D,MAAM,SAAS,GAAqB,EAAE,CAAC;IAEvC,0EAA0E;IAC1E,4EAA4E;IAC5E,wCAAwC;IACxC,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;gBACrC,SAAS,CAAC,IAAI,CAAC;oBACb,IAAI,EAAE,oBAAoB;oBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,aAAa,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;oBACtD,WAAW,EAAE,6BAA6B,KAAK,CAAC,aAAa,6DAA6D,GAAG,CAAC,KAAK,GAAG;oBACtI,WAAW,EAAE;wBACX,0FAA0F;wBAC1F,6CAA6C,GAAG,CAAC,IAAI,0BAA0B;wBAC/E,qHAAqH;qBACtH;iBACF,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AAC3D,CAAC"}