@openrig/cli 0.5.16 → 0.5.17

package/node_modules/@openrig/daemon/dist/domain/bundle-archive.js

@@ -1,156 +0,0 @@
-/**
- * TRUST MODEL: Bundle integrity verifies self-consistency, not authenticity.
- * The sibling .sha256 detects corruption during transfer. Content hashes
- * detect tampering of individual files within the archive. Neither mechanism
- * authenticates the bundle author — an attacker who can rewrite the full
- * bundle + digest can bypass verification. Users must trust the source they
- * obtained the bundle from (same model as unsigned npm packages/Docker images).
- * Cryptographic signing (Ed25519) is a future enhancement.
- */
-import { createHash } from "node:crypto";
-import fs from "node:fs";
-import nodePath from "node:path";
-import * as tar from "tar";
-import { verifyIntegrity } from "./bundle-integrity.js";
-// TODO: AS-T12 — migrate to pod-aware bundle types
-import { parseLegacyBundleManifest as parseBundleManifest, normalizeLegacyBundleManifest as normalizeBundleManifest } from "./bundle-types.js";
-/**
- * Pack a staging directory into a .rigbundle archive (deterministic tar.gz).
- * Writes sibling .sha256 digest file.
- * @returns SHA-256 hex digest of the archive
- */
-export async function pack(stagingDir, outputPath) {
-    if (!outputPath.endsWith(".rigbundle")) {
-        throw new Error("Output path must end with .rigbundle");
-    }
-    // Collect all files in deterministic order (alphabetical)
-    const allFiles = walkFilesSync(stagingDir).sort();
-    // Pack with deterministic settings
-    await tar.create({
-        gzip: { level: 9 },
-        file: outputPath,
-        cwd: stagingDir,
-        portable: true, // Normalizes uid/gid/mode
-        mtime: new Date("2026-01-01T00:00:00Z"), // Fixed mtime for determinism
-    }, allFiles);
-    // Compute archive digest
-    const archiveHash = hashFile(outputPath);
-    fs.writeFileSync(`${outputPath}.sha256`, archiveHash, "utf-8");
-    return archiveHash;
-}
-/**
- * Unpack a .rigbundle archive to a directory.
- * Requires sibling .sha256 digest file. Verifies archive integrity before extraction.
- * Rejects symlinks, hardlinks, path traversal, and absolute paths.
- * Runs content integrity verification after extraction.
- */
-export async function unpack(archivePath, outputDir) {
-    // Step 1: Verify archive-level digest
-    const digestResult = verifyArchiveDigest(archivePath);
-    if (!digestResult.valid) {
-        throw new Error(`Archive integrity check failed: expected ${digestResult.expected}, got ${digestResult.actual}`);
-    }
-    // Step 2: Pre-scan archive for unsafe entries BEFORE extraction
-    const unsafeEntries = [];
-    await tar.list({
-        file: archivePath,
-        onReadEntry: (entry) => {
-            const entryPath = entry.path;
-            const entryType = entry.type;
-            if (entryType === "SymbolicLink" || entryType === "Link") {
-                unsafeEntries.push(`${entryType}: ${entryPath}`);
-            }
-            if (entryPath.startsWith("/")) {
-                unsafeEntries.push(`absolute path: ${entryPath}`);
-            }
-            const segments = entryPath.split("/");
-            if (segments.some((s) => s === "..")) {
-                unsafeEntries.push(`path traversal: ${entryPath}`);
-            }
-        },
-    });
-    if (unsafeEntries.length > 0) {
-        throw new Error(`Unsafe archive entries rejected: ${unsafeEntries.join("; ")}`);
-    }
-    // Step 3: Extract (safe — pre-scanned)
-    fs.mkdirSync(outputDir, { recursive: true });
-    await tar.extract({ file: archivePath, cwd: outputDir });
-    // Step 3: Verify content integrity
-    const manifestPath = nodePath.join(outputDir, "bundle.yaml");
-    if (!fs.existsSync(manifestPath)) {
-        throw new Error("Extracted archive missing bundle.yaml");
-    }
-    const rawYaml = fs.readFileSync(manifestPath, "utf-8");
-    const raw = parseBundleManifest(rawYaml);
-    // Schema-version-aware integrity extraction
-    const schemaVersion = raw["schema_version"];
-    let integrity;
-    if (schemaVersion === 2) {
-        // Pod-aware bundle: integrity is optional in manifest
-        if (raw["integrity"] && typeof raw["integrity"] === "object") {
-            const integ = raw["integrity"];
-            integrity = { algorithm: integ["algorithm"], files: integ["files"] ?? {} };
-        }
-    }
-    else {
-        // Legacy bundle: parse as v1
-        const manifest = normalizeBundleManifest(raw);
-        integrity = manifest.integrity;
-    }
-    if (!integrity) {
-        throw new Error("Bundle manifest missing integrity section — cannot verify content");
-    }
-    {
-        const fsOps = {
-            readFile: (p) => fs.readFileSync(p, "utf-8"),
-            readFileBuffer: (p) => fs.readFileSync(p),
-            writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"),
-            exists: (p) => fs.existsSync(p),
-            walkFiles: (dir) => walkFilesSync(dir),
-        };
-        // verifyIntegrity only reads manifest.integrity — safe to cast
-        const result = verifyIntegrity(outputDir, { integrity }, fsOps);
-        if (!result.passed) {
-            const details = [
-                ...result.mismatches.map((f) => `tampered: ${f}`),
-                ...result.missing.map((f) => `missing: ${f}`),
-                ...result.extra.map((f) => `extra: ${f}`),
-                ...result.errors,
-            ];
-            throw new Error(`Content integrity verification failed: ${details.join("; ")}`);
-        }
-    }
-}
-/**
- * Verify the archive-level SHA-256 digest.
- * Requires sibling .sha256 file.
- */
-export function verifyArchiveDigest(archivePath) {
-    const digestPath = `${archivePath}.sha256`;
-    if (!fs.existsSync(digestPath)) {
-        throw new Error(`Archive digest file required but missing: ${digestPath}`);
-    }
-    const expected = fs.readFileSync(digestPath, "utf-8").trim();
-    const actual = hashFile(archivePath);
-    return { valid: expected === actual, expected, actual };
-}
-function hashFile(filePath) {
-    const content = fs.readFileSync(filePath);
-    return createHash("sha256").update(content).digest("hex");
-}
-function walkFilesSync(dir) {
-    const results = [];
-    function walk(d, prefix) {
-        for (const entry of fs.readdirSync(d, { withFileTypes: true })) {
-            if (entry.isDirectory()) {
-                walk(nodePath.join(d, entry.name), prefix ? `${prefix}/${entry.name}` : entry.name);
-            }
-            else {
-                results.push(prefix ? `${prefix}/${entry.name}` : entry.name);
-            }
-        }
-    }
-    walk(dir, "");
-    return results;
-}
-//# sourceMappingURL=bundle-archive.js.map

package/node_modules/@openrig/daemon/dist/domain/bundle-archive.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bundle-archive.js","sourceRoot":"","sources":["../../src/domain/bundle-archive.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAuB,MAAM,uBAAuB,CAAC;AAC7E,mDAAmD;AACnD,OAAO,EAAE,yBAAyB,IAAI,mBAAmB,EAAE,6BAA6B,IAAI,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE/I;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,UAAkB,EAAE,UAAkB;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAElD,mCAAmC;IACnC,MAAM,GAAG,CAAC,MAAM,CACd;QACE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QAClB,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,IAAI,EAAE,0BAA0B;QAC1C,KAAK,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,8BAA8B;KACxE,EACD,QAAQ,CACT,CAAC;IAEF,yBAAyB;IACzB,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,EAAE,CAAC,aAAa,CAAC,GAAG,UAAU,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAE/D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,SAAiB;IACjE,sCAAsC;IACtC,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,CAAC,QAAQ,SAAS,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,gEAAgE;IAChE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,GAAG,CAAC,IAAI,CAAC;QACb,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YACrB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;YAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;YAC7B,IAAI,SAAS,KAAK,cAAc,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzD,aAAa,CAAC,IAAI,CAAC,GAAG,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,aAAa,CAAC,IAAI,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,uCAAuC;IACvC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAEzD,mCAAmC;IACnC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAA4B,CAAC;IAEpE,4CAA4C;IAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAW,CAAC;IACtD,IAAI,SAA2E,CAAC;IAEhF,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,sDAAsD;QACtD,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAA4B,CAAC;YAC1D,SAAS,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAW,EAAE,KAAK,EAAG,KAAK,CAAC,OAAO,CAA4B,IAAI,EAAE,EAAE,CAAC;QACnH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC9C,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,CAAC;QACC,MAAM,KAAK,GAAmB;YAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;YAC5C,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;YACpD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/B,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;SACvC,CAAC;QAEF,+DAA+D;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,EAAE,SAAS,EAAsD,EAAE,KAAK,CAAC,CAAC;QACpH,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG;gBACd,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjD,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,GAAG,MAAM,CAAC,MAAM;aACjB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,UAAU,GAAG,GAAG,WAAW,SAAS,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAErC,OAAO,EAAE,KAAK,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,SAAS,IAAI,CAAC,CAAS,EAAE,MAAc;QACrC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACd,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/bundle-assembler.d.ts

@@ -1,51 +0,0 @@
-import { type LegacyBundleManifest as BundleManifest, type BundleProvenance, type BundleCompatibility } from "./bundle-types.js";
-export interface AssemblerFsOps {
-    readFile: (path: string) => string;
-    exists: (path: string) => boolean;
-    mkdirp: (path: string) => void;
-    writeFile: (path: string, content: string) => void;
-    copyDir: (src: string, dest: string) => void;
-}
-export interface PackageInput {
-    name: string;
-    version: string;
-    sourcePath: string;
-    originalSource: string;
-    manifestHash: string;
-}
-export interface AssembleOptions {
-    specPath: string;
-    packages: PackageInput[];
-    outputDir: string;
-    bundleName: string;
-    bundleVersion: string;
-    /**
-     * Optional Item-1 provenance input. Caller fills the fields it knows
-     * (sourceHost, authorSession, daemonVersion, cliVersion, sourceRigId,
-     * sourceRigName, notes). The assembler mirrors root createdAt into
-     * provenance.createdAt unless caller pre-set it (caller value wins
-     * for test determinism). Missing block = no provenance recorded
-     * (backward compat).
-     */
-    provenance?: BundleProvenance;
-    /**
-     * Optional Item-2 compatibility input. Caller declares minimum
-     * daemon + CLI versions and optional schema_version reaffirmation.
-     * Missing block = no compatibility recorded (backward compat); the
-     * install-time version check at /api/bundles/install (Checkpoint 3.3)
-     * is a no-op for bundles without compatibility.
-     */
-    compatibility?: BundleCompatibility;
-}
-/**
- * Assembles a bundle staging directory with canonical layout.
- * Generates bundle.yaml without integrity (P7-T02 adds that).
- */
-export declare class LegacyBundleAssembler {
-    private fs;
-    constructor(deps: {
-        fsOps: AssemblerFsOps;
-    });
-    assemble(opts: AssembleOptions): BundleManifest;
-}
-//# sourceMappingURL=bundle-assembler.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/bundle-assembler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bundle-assembler.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-assembler.ts"],"names":[],"mappings":"AAIA,OAAO,EAA4D,KAAK,oBAAoB,IAAI,cAAc,EAAE,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE3L,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;;GAGG;AAEH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,EAAE,CAAiB;gBAEf,IAAI,EAAE;QAAE,KAAK,EAAE,cAAc,CAAA;KAAE;IAI3C,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc;CA2FhD"}

package/node_modules/@openrig/daemon/dist/domain/bundle-assembler.js

@@ -1,96 +0,0 @@
-import nodePath from "node:path";
-import { LegacyRigSpecCodec as RigSpecCodec } from "./rigspec-codec.js"; // TODO: AS-T08b — migrate to pod-aware RigSpec
-import { LegacyRigSpecSchema as RigSpecSchema } from "./rigspec-schema.js"; // TODO: AS-T08b — migrate to pod-aware RigSpec
-// TODO: AS-T12 — migrate to pod-aware bundle types
-import { serializeLegacyBundleManifest as serializeBundleManifest } from "./bundle-types.js";
-/**
- * Assembles a bundle staging directory with canonical layout.
- * Generates bundle.yaml without integrity (P7-T02 adds that).
- */
-// TODO: AS-T12 — migrate to pod-aware bundle assembler
-export class LegacyBundleAssembler {
-    fs;
-    constructor(deps) {
-        this.fs = deps.fsOps;
-    }
-    assemble(opts) {
-        // Validate rig spec exists
-        if (!this.fs.exists(opts.specPath)) {
-            throw new Error(`Rig spec not found: ${opts.specPath}`);
-        }
-        // Validate rig spec content
-        const specYaml = this.fs.readFile(opts.specPath);
-        const raw = RigSpecCodec.parse(specYaml);
-        const validation = RigSpecSchema.validate(raw);
-        if (!validation.valid) {
-            throw new Error(`Invalid rig spec: ${validation.errors.join("; ")}`);
-        }
-        // Deduplicate packages by name + manifestHash, preserving all original sources
-        const seen = new Map();
-        const dedupedPackages = [];
-        for (const pkg of opts.packages) {
-            const existing = seen.get(pkg.name);
-            if (existing) {
-                if (existing.pkg.manifestHash !== pkg.manifestHash) {
-                    throw new Error(`Duplicate package name '${pkg.name}' with different content (hash mismatch)`);
-                }
-                // Same name + same hash -> collect source for provenance
-                if (!existing.sources.includes(pkg.originalSource)) {
-                    existing.sources.push(pkg.originalSource);
-                }
-                continue;
-            }
-            const entry = { pkg, sources: [pkg.originalSource] };
-            seen.set(pkg.name, entry);
-            dedupedPackages.push(entry);
-        }
-        // Validate all package source paths exist
-        for (const { pkg } of dedupedPackages) {
-            if (!this.fs.exists(pkg.sourcePath)) {
-                throw new Error(`Package directory not found: ${pkg.sourcePath} (${pkg.name})`);
-            }
-        }
-        // Create staging directory
-        this.fs.mkdirp(opts.outputDir);
-        // Copy rig spec
-        this.fs.writeFile(nodePath.join(opts.outputDir, "rig.yaml"), specYaml);
-        // Vendor packages
-        const packageEntries = [];
-        for (const { pkg, sources } of dedupedPackages) {
-            const destPath = `packages/${pkg.name}`;
-            const destFull = nodePath.join(opts.outputDir, destPath);
-            this.fs.mkdirp(nodePath.dirname(destFull));
-            this.fs.copyDir(pkg.sourcePath, destFull);
-            packageEntries.push({
-                name: pkg.name,
-                version: pkg.version,
-                path: destPath,
-                originalSource: sources[0],
-                ...(sources.length > 1 ? { originalSources: sources } : {}),
-            });
-        }
-        // Generate manifest (no integrity — P7-T02 adds it)
-        const createdAt = new Date().toISOString();
-        const manifest = {
-            schemaVersion: 1,
-            name: opts.bundleName,
-            version: opts.bundleVersion,
-            createdAt,
-            rigSpec: "rig.yaml",
-            packages: packageEntries,
-        };
-        if (opts.provenance) {
-            manifest.provenance = {
-                ...opts.provenance,
-                createdAt: opts.provenance.createdAt ?? createdAt,
-            };
-        }
-        if (opts.compatibility) {
-            manifest.compatibility = { ...opts.compatibility };
-        }
-        // Write bundle.yaml
-        this.fs.writeFile(nodePath.join(opts.outputDir, "bundle.yaml"), serializeBundleManifest(manifest));
-        return manifest;
-    }
-}
-//# sourceMappingURL=bundle-assembler.js.map

package/node_modules/@openrig/daemon/dist/domain/bundle-assembler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bundle-assembler.js","sourceRoot":"","sources":["../../src/domain/bundle-assembler.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC,CAAC,+CAA+C;AACxH,OAAO,EAAE,mBAAmB,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC,CAAC,+CAA+C;AAC3H,mDAAmD;AACnD,OAAO,EAAE,6BAA6B,IAAI,uBAAuB,EAAgG,MAAM,mBAAmB,CAAC;AA2C3L;;;GAGG;AACH,uDAAuD;AACvD,MAAM,OAAO,qBAAqB;IACxB,EAAE,CAAiB;IAE3B,YAAY,IAA+B;QACzC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,IAAqB;QAC5B,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoD,CAAC;QACzE,MAAM,eAAe,GAAoD,EAAE,CAAC;QAC5E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,IAAI,0CAA0C,CAAC,CAAC;gBACjG,CAAC;gBACD,yDAAyD;gBACzD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;oBACnD,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC5C,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,0CAA0C;QAC1C,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE/B,gBAAgB;QAChB,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEvE,kBAAkB;QAClB,MAAM,cAAc,GAA+B,EAAE,CAAC;QACtD,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,eAAe,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,YAAY,GAAG,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC1C,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,QAAQ;gBACd,cAAc,EAAE,OAAO,CAAC,CAAC,CAAE;gBAC3B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,oDAAoD;QACpD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAmB;YAC/B,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,OAAO,EAAE,IAAI,CAAC,aAAa;YAC3B,SAAS;YACT,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,cAAc;SACzB,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,QAAQ,CAAC,UAAU,GAAG;gBACpB,GAAG,IAAI,CAAC,UAAU;gBAClB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,SAAS;aAClD,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,QAAQ,CAAC,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACrD,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,EAAE,CAAC,SAAS,CACf,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC5C,uBAAuB,CAAC,QAAQ,CAAC,CAClC,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/bundle-audit.d.ts

@@ -1,89 +0,0 @@
-/**
- * Bundle install audit trail (Item 4 / slice-05 Checkpoint 5.1).
- *
- * Append-only JSONL log of bundle install events. Matches the JSONL audit-
- * trail convention used by Transcript / Log Cleanup v0 and UI Enhancement
- * Pack v0 — no new SQLite schema or migration.
- *
- * Default location is ~/.openrig/bundle-audit.jsonl. The writer is a pure
- * data sink: callers (the /api/bundles/install route handler) compose the
- * record at the right moment in the install lifecycle and hand it to
- * BundleAuditWriter.append. The reader exposes a small filter API
- * (rig name + since timestamp) for the /api/bundles/history endpoint and
- * the `rig bundle history` CLI subcommand (both land at Checkpoint 5.2).
- *
- * FsOps injection mirrors the codebase pattern for testability: real
- * implementation reads/writes node:fs; tests substitute an in-memory mock.
- */
-/** A single bundle install audit row. */
-export interface BundleAuditRecord {
-    /** ISO timestamp of when the install event was recorded. */
-    installedAt: string;
-    /** Source bundle path the install operated on. */
-    bundlePath: string;
-    /** SHA-256 archive hash (when available from bundle's sibling digest). */
-    archiveHash?: string;
-    /** ULID of the rig the install targeted (when applicable). */
-    targetRigId?: string;
-    /** Name of the rig the install targeted (when applicable). */
-    targetRigName?: string;
-    /** Hostname recorded in the bundle's provenance (Item 1), when present. */
-    sourceHost?: string;
-    /** Daemon version at install time. */
-    daemonVersion?: string;
-    /** CLI version at install time (when CLI sent it; Item 1 + Item 2 path). */
-    cliVersion?: string;
-    /** Install outcome — keep honest (partial = some stages ok, some not). */
-    outcome: "success" | "failed" | "partial";
-}
-/** Filesystem injection point — real impl wraps node:fs. Tests substitute in-memory. */
-export interface BundleAuditFsOps {
-    appendFile: (path: string, content: string) => void;
-    readFile: (path: string) => string;
-    exists: (path: string) => boolean;
-    mkdirp: (path: string) => void;
-}
-/** Configuration for the audit writer + reader. */
-export interface BundleAuditOpts {
-    /** Absolute path to the JSONL file (default location: ~/.openrig/bundle-audit.jsonl). */
-    auditPath: string;
-}
-/** Append-only writer for bundle install audit records. */
-export declare class BundleAuditWriter {
-    private opts;
-    private fs;
-    constructor(deps: {
-        opts: BundleAuditOpts;
-        fsOps: BundleAuditFsOps;
-    });
-    /**
-     * Append one record to the JSONL file. Creates the parent directory if
-     * missing. Each record is one JSON object on its own line (operator can
-     * tail -f for live monitoring). Throws on filesystem errors via fsOps.
-     */
-    append(record: BundleAuditRecord): void;
-}
-/** Filters supported by the audit reader (subset of /api/bundles/history). */
-export interface BundleAuditFilters {
-    /** When set, only return records whose targetRigName equals this value. */
-    rig?: string;
-    /** When set, only return records whose installedAt is >= this ISO timestamp. */
-    since?: string;
-}
-/** Reader for the bundle install audit JSONL file. */
-export declare class BundleAuditReader {
-    private opts;
-    private fs;
-    constructor(deps: {
-        opts: BundleAuditOpts;
-        fsOps: BundleAuditFsOps;
-    });
-    /**
-     * Return all audit records (optionally filtered). Malformed lines are
-     * skipped silently — forward-compat with future record-shape evolutions
-     * that don't parse under the current shape; the readable lines still
-     * surface. Records are returned in append order (oldest first).
-     */
-    list(filters?: BundleAuditFilters): BundleAuditRecord[];
-}
-//# sourceMappingURL=bundle-audit.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/bundle-audit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bundle-audit.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,yCAAyC;AACzC,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC3C;AAED,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,yFAAyF;IACzF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2DAA2D;AAC3D,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,IAAI,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE;IAKpE;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;CAKxC;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sDAAsD;AACtD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,IAAI,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE;IAKpE;;;;;OAKG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,iBAAiB,EAAE;CAiBxD"}

package/node_modules/@openrig/daemon/dist/domain/bundle-audit.js

@@ -1,87 +0,0 @@
-/**
- * Bundle install audit trail (Item 4 / slice-05 Checkpoint 5.1).
- *
- * Append-only JSONL log of bundle install events. Matches the JSONL audit-
- * trail convention used by Transcript / Log Cleanup v0 and UI Enhancement
- * Pack v0 — no new SQLite schema or migration.
- *
- * Default location is ~/.openrig/bundle-audit.jsonl. The writer is a pure
- * data sink: callers (the /api/bundles/install route handler) compose the
- * record at the right moment in the install lifecycle and hand it to
- * BundleAuditWriter.append. The reader exposes a small filter API
- * (rig name + since timestamp) for the /api/bundles/history endpoint and
- * the `rig bundle history` CLI subcommand (both land at Checkpoint 5.2).
- *
- * FsOps injection mirrors the codebase pattern for testability: real
- * implementation reads/writes node:fs; tests substitute an in-memory mock.
- */
-import nodePath from "node:path";
-/** Append-only writer for bundle install audit records. */
-export class BundleAuditWriter {
-    opts;
-    fs;
-    constructor(deps) {
-        this.opts = deps.opts;
-        this.fs = deps.fsOps;
-    }
-    /**
-     * Append one record to the JSONL file. Creates the parent directory if
-     * missing. Each record is one JSON object on its own line (operator can
-     * tail -f for live monitoring). Throws on filesystem errors via fsOps.
-     */
-    append(record) {
-        this.fs.mkdirp(nodePath.dirname(this.opts.auditPath));
-        const line = `${JSON.stringify(record)}\n`;
-        this.fs.appendFile(this.opts.auditPath, line);
-    }
-}
-/** Reader for the bundle install audit JSONL file. */
-export class BundleAuditReader {
-    opts;
-    fs;
-    constructor(deps) {
-        this.opts = deps.opts;
-        this.fs = deps.fsOps;
-    }
-    /**
-     * Return all audit records (optionally filtered). Malformed lines are
-     * skipped silently — forward-compat with future record-shape evolutions
-     * that don't parse under the current shape; the readable lines still
-     * surface. Records are returned in append order (oldest first).
-     */
-    list(filters) {
-        if (!this.fs.exists(this.opts.auditPath))
-            return [];
-        const content = this.fs.readFile(this.opts.auditPath);
-        const lines = content.split("\n").filter((l) => l.length > 0);
-        const records = [];
-        for (const line of lines) {
-            try {
-                const parsed = JSON.parse(line);
-                if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-                    records.push(parsed);
-                }
-            }
-            catch {
-                // Malformed line — skip silently.
-            }
-        }
-        return applyFilters(records, filters);
-    }
-}
-/** Apply the supported filters to an in-memory record array. */
-function applyFilters(records, filters) {
-    if (!filters)
-        return records;
-    let out = records;
-    if (filters.rig !== undefined && filters.rig.length > 0) {
-        const rigName = filters.rig;
-        out = out.filter((r) => r.targetRigName === rigName);
-    }
-    if (filters.since !== undefined && filters.since.length > 0) {
-        const since = filters.since;
-        out = out.filter((r) => r.installedAt >= since);
-    }
-    return out;
-}
-//# sourceMappingURL=bundle-audit.js.map

package/node_modules/@openrig/daemon/dist/domain/bundle-audit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bundle-audit.js","sourceRoot":"","sources":["../../src/domain/bundle-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,QAAQ,MAAM,WAAW,CAAC;AAsCjC,2DAA2D;AAC3D,MAAM,OAAO,iBAAiB;IACpB,IAAI,CAAkB;IACtB,EAAE,CAAmB;IAE7B,YAAY,IAAwD;QAClE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAyB;QAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;CACF;AAUD,sDAAsD;AACtD,MAAM,OAAO,iBAAiB;IACpB,IAAI,CAAkB;IACtB,EAAE,CAAmB;IAE7B,YAAY,IAAwD;QAClE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,OAA4B;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnE,OAAO,CAAC,IAAI,CAAC,MAA2B,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;CACF;AAED,gEAAgE;AAChE,SAAS,YAAY,CAAC,OAA4B,EAAE,OAA4B;IAC9E,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/bundle-conflict-detector.d.ts

@@ -1,57 +0,0 @@
-/**
- * Bundle conflict detector (Item 3 / slice-05 Checkpoint 4.1).
- *
- * Pure function. Compares a bundle's declared identifiers against the daemon's
- * current state and returns a structured conflict report. Callers (route
- * handlers in Checkpoint 4.2) provide the daemon state (listRigs() etc.); the
- * detector itself has no daemon dependencies — fully unit-testable.
- *
- * Fails CLOSED: the conflict list is the source of truth. Missing or ambiguous
- * input is treated as no-conflict-detectable, NOT as bypass — Items 4.2+ will
- * surface ambiguity as a conflict where appropriate. This commit ships the
- * rig-name collision check only; agent / port / managed-app / sibling-primitive
- * checks land in Checkpoint 4.3 + 4.4.
- *
- * Extends, does NOT replace, the existing 409 "install already in progress"
- * guard at /api/bundles/install (concurrency lock) per PRD Item 3 §
- * "extends, does NOT replace".
- */
-/** A rig-name collision: bundle declares a rig name that a currently-running rig already uses. */
-export interface RigNameCollision {
-    kind: "rig_name_collision";
-    /** Name declared by the bundle's rig spec. */
-    bundleRigName: string;
-    /** Identity of the running rig that holds the same name. */
-    collisionWith: {
-        rigId: string;
-        rigName: string;
-    };
-    /** Human-readable summary suitable for the 3-part error description line. */
-    description: string;
-    /** Operator-actionable resolutions (3-part error what-to-do line). */
-    resolutions: string[];
-}
-/** Discriminated union over all conflict kinds. Extends in Checkpoint 4.3+. */
-export type BundleConflict = RigNameCollision;
-/** Result of a conflict check. */
-export interface ConflictReport {
-    conflicts: BundleConflict[];
-    hasConflicts: boolean;
-}
-/** Input to detectBundleConflicts. Pure data; no daemon handles. */
-export interface DetectConflictsInput {
-    /** Rig name declared in the bundle's rig spec (rig.yaml `name:` field). */
-    bundleRigName: string;
-    /** Snapshot of currently-running rigs from rigRepo.listRigs(). */
-    runningRigs: Array<{
-        rigId: string;
-        name: string;
-    }>;
-}
-/**
- * Run the conflict checks for an install candidate. Returns the full conflict
- * list (Checkpoint 4.2 returns it via /install --plan; --apply blocks on
- * non-empty unless --force).
- */
-export declare function detectBundleConflicts(input: DetectConflictsInput): ConflictReport;
-//# sourceMappingURL=bundle-conflict-detector.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/bundle-conflict-detector.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bundle-conflict-detector.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-conflict-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE9C,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,oEAAoE;AACpE,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB,GAAG,cAAc,CA0BjF"}

package/node_modules/@openrig/daemon/dist/domain/bundle-conflict-detector.js

@@ -1,49 +0,0 @@
-/**
- * Bundle conflict detector (Item 3 / slice-05 Checkpoint 4.1).
- *
- * Pure function. Compares a bundle's declared identifiers against the daemon's
- * current state and returns a structured conflict report. Callers (route
- * handlers in Checkpoint 4.2) provide the daemon state (listRigs() etc.); the
- * detector itself has no daemon dependencies — fully unit-testable.
- *
- * Fails CLOSED: the conflict list is the source of truth. Missing or ambiguous
- * input is treated as no-conflict-detectable, NOT as bypass — Items 4.2+ will
- * surface ambiguity as a conflict where appropriate. This commit ships the
- * rig-name collision check only; agent / port / managed-app / sibling-primitive
- * checks land in Checkpoint 4.3 + 4.4.
- *
- * Extends, does NOT replace, the existing 409 "install already in progress"
- * guard at /api/bundles/install (concurrency lock) per PRD Item 3 §
- * "extends, does NOT replace".
- */
-/**
- * Run the conflict checks for an install candidate. Returns the full conflict
- * list (Checkpoint 4.2 returns it via /install --plan; --apply blocks on
- * non-empty unless --force).
- */
-export function detectBundleConflicts(input) {
-    const conflicts = [];
-    // Rig-name collision: bundle declares a name a running rig already holds.
-    // O(n) scan over runningRigs — acceptable for the seat-scale rig counts the
-    // daemon manages (tens, not thousands).
-    if (input.bundleRigName && input.bundleRigName.length > 0) {
-        for (const rig of input.runningRigs) {
-            if (rig.name === input.bundleRigName) {
-                conflicts.push({
-                    kind: "rig_name_collision",
-                    bundleRigName: input.bundleRigName,
-                    collisionWith: { rigId: rig.rigId, rigName: rig.name },
-                    description: `bundle declares rig name '${input.bundleRigName}' but a running rig with this name already exists (rigId: ${rig.rigId})`,
-                    resolutions: [
-                        "use --target <newname> on install to rename the rig on install (lands at Checkpoint 4.2)",
-                        `stop the running rig first (e.g. rig down ${rig.name}) and re-attempt install`,
-                        "use --force on install for an operator-explicit override (lands at Checkpoint 4.2; NOT recommended for routine use)",
-                    ],
-                });
-                break;
-            }
-        }
-    }
-    return { conflicts, hasConflicts: conflicts.length > 0 };
-}
-//# sourceMappingURL=bundle-conflict-detector.js.map

package/node_modules/@openrig/daemon/dist/domain/bundle-conflict-detector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bundle-conflict-detector.js","sourceRoot":"","sources":["../../src/domain/bundle-conflict-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgCH;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA2B;IAC/D,MAAM,SAAS,GAAqB,EAAE,CAAC;IAEvC,0EAA0E;IAC1E,4EAA4E;IAC5E,wCAAwC;IACxC,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;gBACrC,SAAS,CAAC,IAAI,CAAC;oBACb,IAAI,EAAE,oBAAoB;oBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,aAAa,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;oBACtD,WAAW,EAAE,6BAA6B,KAAK,CAAC,aAAa,6DAA6D,GAAG,CAAC,KAAK,GAAG;oBACtI,WAAW,EAAE;wBACX,0FAA0F;wBAC1F,6CAA6C,GAAG,CAAC,IAAI,0BAA0B;wBAC/E,qHAAqH;qBACtH;iBACF,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AAC3D,CAAC"}