@pipobscure/bundle 0.0.1

package/dist/files.js

@@ -0,0 +1,118 @@
+import * as FS from 'node:fs';
+import * as PATH from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * Every file under `dir`, as `/`-separated paths relative to it, sorted.
+ *
+ * A nested `node_modules` is skipped by default: its contents belong to the
+ * packages inside it, which `dependencyFiles` reaches through the dependency
+ * graph instead — so a hoisted tree and a nested one produce the same set.
+ */
+export function walk(dir, { exclude = ['node_modules'] } = {}, prefix = '') {
+    const out = [];
+    for (const entry of FS.readdirSync(dir, { withFileTypes: true })) {
+        if (exclude.includes(entry.name))
+            continue;
+        const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory())
+            out.push(...walk(PATH.join(dir, entry.name), { exclude }, relative));
+        else if (entry.isFile())
+            out.push(relative);
+    }
+    return out.sort();
+}
+/**
+ * Every file of `names` and of everything they depend on, as paths relative to
+ * `base`, sorted. Packages are located the way node locates them, so the answer
+ * describes the tree that is actually installed rather than what a lock file
+ * says should be.
+ *
+ * A dependency that is not installed under `base` — missing, or hoisted above
+ * it, where no member path can name it — is an error rather than a silent
+ * omission, because a bundle whose closure is incomplete is a bundle that
+ * fails at runtime on a machine other than the one that built it. Only an
+ * optional dependency may be absent.
+ */
+export function dependencyFiles(names, base) {
+    const root = PATH.resolve(base);
+    const files = [];
+    const seen = new Set();
+    // Each dependency is looked up from the package that depends on it, not from
+    // the root: a tree can hold several versions of one package, and which one
+    // a `require` gets depends on where it is asked from.
+    const queue = names.map((name) => ({ name, from: root, optional: false }));
+    while (queue.length) {
+        const { name, from, optional } = queue.shift();
+        const dir = locate(name, from, root);
+        if (!dir) {
+            if (optional)
+                continue; // optional, and not installed
+            throw new Error(`'${name}', needed by ${PATH.relative(root, from) || 'the root'}, is not installed ` +
+                `under ${root} — a bundle without it fails wherever the code that needs it runs`);
+        }
+        if (seen.has(dir))
+            continue;
+        seen.add(dir);
+        const relative = PATH.relative(root, dir);
+        for (const file of walk(dir))
+            files.push(posix(relative, file));
+        const manifest = JSON.parse(FS.readFileSync(PATH.join(dir, 'package.json'), 'utf-8'));
+        const optionals = manifest.optionalDependencies ?? {};
+        for (const dep of Object.keys(manifest.dependencies ?? {})) {
+            queue.push({ name: dep, from: dir, optional: dep in optionals });
+        }
+        for (const dep of Object.keys(optionals))
+            queue.push({ name: dep, from: dir, optional: true });
+    }
+    return files.sort();
+}
+// Where `name` is installed as seen from `from`: the nearest `node_modules/name`
+// on the way up, the search node's resolver makes. It looks for the directory
+// rather than resolving `name/package.json`, because a package whose `exports`
+// does not list its manifest would refuse that — and be mistaken for missing.
+// The search stops at `root`: a package above it cannot become a member of an
+// archive rooted there, so finding one is the same as not finding one.
+function locate(name, from, root) {
+    for (let dir = from;; dir = PATH.dirname(dir)) {
+        if (PATH.basename(dir) !== 'node_modules') {
+            const candidate = PATH.join(dir, 'node_modules', name);
+            if (FS.existsSync(PATH.join(candidate, 'package.json')))
+                return candidate;
+        }
+        if (dir === root || PATH.dirname(dir) === dir)
+            return null;
+    }
+}
+/** The three sources above, combined and de-duplicated. */
+export function moduleFiles({ base, files = [], dirs = [], dependencies = [], filter }) {
+    const all = [
+        ...files,
+        ...dirs.flatMap((dir) => walk(PATH.join(base, dir)).map((name) => posix(dir, name))),
+        ...dependencyFiles(dependencies, base),
+    ];
+    const kept = filter ? all.filter(filter) : all;
+    return [...new Set(kept)].sort();
+}
+/**
+ * The shell launcher this package ships: the prefix that turns an archive into
+ * a file you can run by name. `bundle sign --launcher` uses it, so nobody has
+ * to know it lives inside `node_modules`.
+ */
+export function launcherPath() {
+    return PATH.join(packageRoot(), 'shell-base');
+}
+/** This package's own root — the directory its `package.json` sits in. */
+export function packageRoot() {
+    return PATH.resolve(PATH.dirname(fileURLToPath(import.meta.url)), '..');
+}
+/**
+ * The directory this package's runnable modules are in: `dist` once compiled,
+ * `src` when the source is being run directly under node's type stripping.
+ */
+export function moduleDir() {
+    return PATH.basename(PATH.dirname(fileURLToPath(import.meta.url)));
+}
+function posix(dir, name) {
+    return `${dir.split(PATH.sep).join('/')}/${name}`;
+}
+//# sourceMappingURL=files.js.map

package/dist/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../src/files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuBzC;;;;;;GAMG;AACH,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,EAAE,OAAO,GAAG,CAAC,cAAc,CAAC,EAAE,GAAgB,EAAE,EAAE,MAAM,GAAG,EAAE;IAC3F,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACjE,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;aACzF,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,KAAe,EAAE,IAAY;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,6EAA6E;IAC7E,2EAA2E;IAC3E,sDAAsD;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAE3E,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,IAAI,QAAQ;gBAAE,SAAS,CAAC,8BAA8B;YACtD,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,gBAAgB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,qBAAqB;gBAChG,SAAS,IAAI,mEAAmE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAGnF,CAAC;QACF,MAAM,SAAS,GAAG,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,iFAAiF;AACjF,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,SAAS,MAAM,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IACpD,KAAK,IAAI,GAAG,GAAG,IAAI,GAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC9E,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;AACL,CAAC;AAeD,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,YAAY,GAAG,EAAE,EAAE,MAAM,EAAsB;IACtG,MAAM,GAAG,GAAG;QACR,GAAG,KAAK;QACR,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACpF,GAAG,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC;KACzC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;AAClD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW;IACvB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS;IACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,KAAK,CAAC,GAAW,EAAE,IAAY;IACpC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { createBundle, signBundle, verifyBundle, verifyBundleSync, inspectBundle, runBundle, fileSigner, mountArgv, registerPath, type BuildResult, type CreateOptions, type SignOptions, type VerifyBundleOptions, type RunOptions, type RunResult, type Inspection, } from './api.ts';
+export { bundle, rebundle, createArchive, keySigner, members, fromDirectory, fromArchive, type Member, type Signer, type Signature, type EmitResult, type BundleOptions, type RebundleOptions, } from './archive.ts';
+export { AUTHORITY, buildManifest, parseManifest, parseSignature, formatSignature, signatureOf, verify, verifySync, STATES, type ArchiveSource, type ManifestFields, type SignatureMarker, type VerificationResult, type VerificationState, type VerifyOptions, } from './manifest.ts';
+export { walk, moduleFiles, dependencyFiles, launcherPath, packageRoot, moduleDir, type WalkOptions, type ModuleFilesOptions, } from './files.ts';
+export { prepare as prepareAudit, check as checkAudit, approve as approveAudit, verdictPath, type Verdict, type Finding, type AuditOptions, type Preparation, } from './audit.ts';
+export { skills, skill, install as installSkill, DEFAULT_SKILLS_DIR, type SkillInfo, type InstallResult, } from './skill.ts';
+export { main as cli, USAGE, type Console as CliConsole } from './cli.ts';
+export * as sigstore from './sigstore.ts';
+export * as oidc from './oidc.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACH,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,UAAU,GAClB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACH,MAAM,EACN,QAAQ,EACR,aAAa,EACb,SAAS,EACT,OAAO,EACP,aAAa,EACb,WAAW,EACX,KAAK,MAAM,EACX,KAAK,MAAM,EACX,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,eAAe,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACH,SAAS,EACT,aAAa,EACb,aAAa,EACb,cAAc,EACd,eAAe,EACf,WAAW,EACX,MAAM,EACN,UAAU,EACV,MAAM,EACN,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACH,IAAI,EACJ,WAAW,EACX,eAAe,EACf,YAAY,EACZ,WAAW,EACX,SAAS,EACT,KAAK,WAAW,EAChB,KAAK,kBAAkB,GAC1B,MAAM,YAAY,CAAC;AAIpB,OAAO,EACH,OAAO,IAAI,YAAY,EACvB,KAAK,IAAI,UAAU,EACnB,OAAO,IAAI,YAAY,EACvB,WAAW,EACX,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,WAAW,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACH,MAAM,EACN,KAAK,EACL,OAAO,IAAI,YAAY,EACvB,kBAAkB,EAClB,KAAK,SAAS,EACd,KAAK,aAAa,GACrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,IAAI,IAAI,GAAG,EAAE,KAAK,EAAE,KAAK,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AAK1E,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,35 @@
+// The package root: everything needed to build, sign, verify and run an archive
+// from code, and nothing that needs a flag to import.
+//
+// The two VFS providers are deliberately *not* re-exported here. Importing
+// either needs `node:vfs`, which only exists under `--experimental-vfs`, and
+// creating or verifying an archive does not — so a plain `import
+// '@pipobscure/bundle'` must not drag that requirement in. They have their own
+// entry points:
+//
+//   @pipobscure/bundle/provider   the verifying provider, and register()
+//   @pipobscure/bundle/register   a preload that registers it and nothing else
+//   @pipobscure/bundle/recorder   the recording provider, and register()
+//   @pipobscure/bundle/record     a preload that registers it and nothing else
+// The high-level drive: create, sign, verify, inspect, run.
+export { createBundle, signBundle, verifyBundle, verifyBundleSync, inspectBundle, runBundle, fileSigner, mountArgv, registerPath, } from './api.js';
+// The archive layer, for callers assembling members themselves.
+export { bundle, rebundle, createArchive, keySigner, members, fromDirectory, fromArchive, } from './archive.js';
+// The format layer: the manifest, the signature marker, and verification.
+export { AUTHORITY, buildManifest, parseManifest, parseSignature, formatSignature, signatureOf, verify, verifySync, STATES, } from './manifest.js';
+// Working out what belongs in an archive, for what observing a run cannot see.
+export { walk, moduleFiles, dependencyFiles, launcherPath, packageRoot, moduleDir, } from './files.js';
+// The audit gate — step 3 of building a bundle, and the thing that makes it a
+// step rather than a suggestion.
+export { prepare as prepareAudit, check as checkAudit, approve as approveAudit, verdictPath, } from './audit.js';
+// Installing the auditing skill into a project.
+export { skills, skill, install as installSkill, DEFAULT_SKILLS_DIR, } from './skill.js';
+// The CLI, as a function — so a host can offer the same commands without
+// spawning anything.
+export { main as cli, USAGE } from './cli.js';
+// Signing through sigstore, and the OIDC flows that identity comes from. Both
+// are namespaced: they are a signer implementation and its plumbing, not part
+// of the archive format, and naming them that way keeps that visible.
+export * as sigstore from './sigstore.js';
+export * as oidc from './oidc.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,sDAAsD;AACtD,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,iEAAiE;AACjE,+EAA+E;AAC/E,gBAAgB;AAChB,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,yEAAyE;AACzE,+EAA+E;AAE/E,4DAA4D;AAC5D,OAAO,EACH,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,GAQf,MAAM,UAAU,CAAC;AAElB,gEAAgE;AAChE,OAAO,EACH,MAAM,EACN,QAAQ,EACR,aAAa,EACb,SAAS,EACT,OAAO,EACP,aAAa,EACb,WAAW,GAOd,MAAM,cAAc,CAAC;AAEtB,0EAA0E;AAC1E,OAAO,EACH,SAAS,EACT,aAAa,EACb,aAAa,EACb,cAAc,EACd,eAAe,EACf,WAAW,EACX,MAAM,EACN,UAAU,EACV,MAAM,GAOT,MAAM,eAAe,CAAC;AAEvB,+EAA+E;AAC/E,OAAO,EACH,IAAI,EACJ,WAAW,EACX,eAAe,EACf,YAAY,EACZ,WAAW,EACX,SAAS,GAGZ,MAAM,YAAY,CAAC;AAEpB,8EAA8E;AAC9E,iCAAiC;AACjC,OAAO,EACH,OAAO,IAAI,YAAY,EACvB,KAAK,IAAI,UAAU,EACnB,OAAO,IAAI,YAAY,EACvB,WAAW,GAKd,MAAM,YAAY,CAAC;AAEpB,gDAAgD;AAChD,OAAO,EACH,MAAM,EACN,KAAK,EACL,OAAO,IAAI,YAAY,EACvB,kBAAkB,GAGrB,MAAM,YAAY,CAAC;AAEpB,yEAAyE;AACzE,qBAAqB;AACrB,OAAO,EAAE,IAAI,IAAI,GAAG,EAAE,KAAK,EAA8B,MAAM,UAAU,CAAC;AAE1E,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;AACtE,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC"}

package/dist/launch.d.ts

@@ -0,0 +1,97 @@
+import * as VFS from 'node:vfs';
+import { type VerificationResult } from './manifest.ts';
+/** What a caller can decide about a container before it is allowed to run. */
+export interface LaunchOptions {
+    /** Extra trusted roots, as PEM text or paths to PEM files. */
+    roots?: string[] | undefined;
+    /** Require this sigstore signing identity. */
+    identity?: string | undefined;
+    /** Require this sigstore OIDC issuer. */
+    issuer?: string | undefined;
+    /** Path to the sigstore trust root to check against. */
+    trustedRoot?: string | undefined;
+    /**
+     * Run a container whose signature is good but whose chain is not anchored
+     * in the trust store (default: false).
+     */
+    allowUntrusted?: boolean | undefined;
+    /**
+     * Recompute every member digest at mount rather than on first read
+     * (default: false — reads check them anyway, and this is startup latency).
+     */
+    deep?: boolean | undefined;
+    /** Entry point inside the archive, overriding its package.json `main`. */
+    entry?: string | undefined;
+    /**
+     * What to do when the container does not verify. The default prints the
+     * reason and exits 1; nothing from the archive has run at that point.
+     */
+    onRefuse?: ((reason: string) => void) | undefined;
+}
+/** Where a mounted container ended up, and what it is. */
+export interface Mounted {
+    /** The generated mount point the archive is visible at. */
+    root: string;
+    /** The mount, so a caller can unmount it. */
+    vfs: VFS.VirtualFileSystem;
+    /** The resolved entry point, as an absolute path under `root`. */
+    entry: string;
+}
+/**
+ * Verify `container` and mount it. Returns where it landed; nothing has been
+ * executed out of it yet.
+ */
+export declare function mount(container: string, options?: LaunchOptions): Mounted;
+/**
+ * Run what is at a mount's entry point. A CommonJS entry is `require()`d and an
+ * ES module is `import()`ed, chosen the way node itself chooses — the archive's
+ * `package.json` `type` and the entry's own extension.
+ */
+export declare function start({ root, entry }: Mounted): Promise<void>;
+/** Verify a container, mount it, and run the application inside. */
+export declare function run(container: string, options?: LaunchOptions): Promise<void>;
+/**
+ * Verify the running executable and run the archive appended to it — the
+ * self-validating shape, where the signature covers the runtime, the verifier
+ * and the application as one file.
+ */
+export declare function runSelf(options?: LaunchOptions): Promise<void>;
+/** Verify a container without mounting or running it. */
+export declare function verify(container: string, options?: LaunchOptions): VerificationResult;
+/**
+ * What, if anything, is appended to a container.
+ *
+ * This is how one binary can be both shapes: an executable with a signed
+ * archive behind it runs *that*, and the same executable with nothing appended
+ * takes an archive from its command line instead. The discriminator is the
+ * signature marker rather than the presence of a ZIP, because a SEA carries an
+ * archive of its own inside its blob — one that is not at the tail, and never
+ * carries a marker.
+ */
+export declare function appended(container: string): 'signed' | 'unsigned' | 'none';
+/**
+ * The command line of a verifying node.
+ *
+ * Options are read up to the first non-option argument, which is the archive;
+ * everything after it belongs to the application, untouched. That is the shape
+ * of every command that wraps another one — `env`, `nice`, `time` — and it is
+ * what lets an application have flags of its own that collide with these.
+ */
+export declare const USAGE = "usage: <runtime> [options] <archive> [args...]\n\nVerifies an archive and runs the application inside it. Nothing from the archive\nruns until its signature, its certificate chain and its member digests check out,\nand every member is re-hashed as it is read for the life of the process.\n\noptions:\n  -r, --root <file>     extra trusted root certificate (PEM); repeatable\n      --identity <san>  require this sigstore signing identity\n      --issuer <url>    require this sigstore OIDC issuer\n      --untrusted       run an archive whose signature is good but unanchored\n      --deep            check every member digest at mount, not on first read\n      --entry <path>    entry point inside the archive, overriding its main\n      --verify          report the archive's trust state and stop\n  -h, --help            this\n      --version         the verifier's version, and the runtime's\n\nThe same policy can come from the environment \u2014 BUNDLE_ROOTS, BUNDLE_IDENTITY,\nBUNDLE_ISSUER, BUNDLE_SIGSTORE_ROOT, BUNDLE_ALLOW_UNTRUSTED \u2014 which is what a\ncontainer built with no policy of its own falls back to.\n";
+/** Options baked into a runtime at build time, and whether they are the last word. */
+export interface Baked extends LaunchOptions {
+    /**
+     * A runtime built with a policy of its own accepts no policy from its
+     * command line: a binary that demands a signing identity is not one whose
+     * user can ask it to stop. Adding a root, requiring a different identity
+     * and `--untrusted` are all refused. What remains — `--entry`, `--verify`,
+     * `--help` — cannot loosen anything.
+     */
+    sealed?: boolean | undefined;
+}
+/**
+ * Run a verifying node's command line. Returns the exit code; the application's
+ * own exit code is its business, set the ordinary way from inside it.
+ */
+export declare function main(argv: string[], baked?: Baked): Promise<number>;
+//# sourceMappingURL=launch.d.ts.map

package/dist/launch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../src/launch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAOhC,OAAO,EAAoC,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAuB1F,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC1B,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACrD;AAED,0DAA0D;AAC1D,MAAM,WAAW,OAAO;IACpB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,GAAG,EAAE,GAAG,CAAC,iBAAiB,CAAC;IAC3B,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAqB7E;AAED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnE;AAED,oEAAoE;AACpE,wBAAsB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvF;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAExE;AAED,yDAAyD;AACzD,wBAAgB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,kBAAkB,CAMzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAU1E;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,2mCAoBjB,CAAC;AAEF,sFAAsF;AACtF,MAAM,WAAW,KAAM,SAAQ,aAAa;IACxC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA2F7E"}

package/dist/launch.js

@@ -0,0 +1,267 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import * as VFS from 'node:vfs';
+import * as FS from 'node:fs';
+import * as PATH from 'node:path';
+import * as ZLIB from 'node:zlib';
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { open as openBundle } from './provider.js';
+import { message, signatureOf, verifySync } from './manifest.js';
+/**
+ * Verify `container` and mount it. Returns where it landed; nothing has been
+ * executed out of it yet.
+ */
+export function mount(container, options = {}) {
+    const settings = {
+        roots: options.roots,
+        identity: options.identity,
+        issuer: options.issuer,
+        trustedRoot: options.trustedRoot,
+        allowUntrusted: options.allowUntrusted,
+        deep: options.deep,
+        name: 'bundle-launch',
+    };
+    let provider;
+    try {
+        provider = openBundle(container, settings);
+    }
+    catch (err) {
+        refuse(options, message(err));
+    }
+    const vfs = VFS.create(provider, { emitExperimentalWarning: false });
+    const root = vfs.mount();
+    return { root, vfs, entry: entryPoint(root, options.entry) };
+}
+/**
+ * Run what is at a mount's entry point. A CommonJS entry is `require()`d and an
+ * ES module is `import()`ed, chosen the way node itself chooses — the archive's
+ * `package.json` `type` and the entry's own extension.
+ */
+export async function start({ root, entry }) {
+    if (isModule(root, entry))
+        await import(__rewriteRelativeImportExtension(pathToFileURL(entry).href));
+    else
+        createRequire(PATH.join(root, 'package.json'))(entry);
+}
+/** Verify a container, mount it, and run the application inside. */
+export async function run(container, options = {}) {
+    await start(mount(container, options));
+}
+/**
+ * Verify the running executable and run the archive appended to it — the
+ * self-validating shape, where the signature covers the runtime, the verifier
+ * and the application as one file.
+ */
+export async function runSelf(options = {}) {
+    await run(process.execPath, options);
+}
+/** Verify a container without mounting or running it. */
+export function verify(container, options = {}) {
+    const roots = (options.roots ?? []).map((root) => (root.includes('-----BEGIN') ? root : FS.readFileSync(root, 'utf-8')));
+    return verifySync(container, {
+        extraRoots: roots, deep: options.deep ?? false,
+        identity: options.identity, issuer: options.issuer, trustedRoot: options.trustedRoot,
+    });
+}
+/**
+ * What, if anything, is appended to a container.
+ *
+ * This is how one binary can be both shapes: an executable with a signed
+ * archive behind it runs *that*, and the same executable with nothing appended
+ * takes an archive from its command line instead. The discriminator is the
+ * signature marker rather than the presence of a ZIP, because a SEA carries an
+ * archive of its own inside its blob — one that is not at the tail, and never
+ * carries a marker.
+ */
+export function appended(container) {
+    if (signatureOf(container) !== null)
+        return 'signed';
+    try {
+        // An archive at the tail with no marker is the one case worth naming:
+        // somebody appended an application and never signed it.
+        ZLIB.ZipFile.openSync(container).closeSync();
+        return 'unsigned';
+    }
+    catch {
+        return 'none';
+    }
+}
+// --------------------------------------------------------- the command line ---
+/**
+ * The command line of a verifying node.
+ *
+ * Options are read up to the first non-option argument, which is the archive;
+ * everything after it belongs to the application, untouched. That is the shape
+ * of every command that wraps another one — `env`, `nice`, `time` — and it is
+ * what lets an application have flags of its own that collide with these.
+ */
+export const USAGE = `usage: <runtime> [options] <archive> [args...]
+
+Verifies an archive and runs the application inside it. Nothing from the archive
+runs until its signature, its certificate chain and its member digests check out,
+and every member is re-hashed as it is read for the life of the process.
+
+options:
+  -r, --root <file>     extra trusted root certificate (PEM); repeatable
+      --identity <san>  require this sigstore signing identity
+      --issuer <url>    require this sigstore OIDC issuer
+      --untrusted       run an archive whose signature is good but unanchored
+      --deep            check every member digest at mount, not on first read
+      --entry <path>    entry point inside the archive, overriding its main
+      --verify          report the archive's trust state and stop
+  -h, --help            this
+      --version         the verifier's version, and the runtime's
+
+The same policy can come from the environment — BUNDLE_ROOTS, BUNDLE_IDENTITY,
+BUNDLE_ISSUER, BUNDLE_SIGSTORE_ROOT, BUNDLE_ALLOW_UNTRUSTED — which is what a
+container built with no policy of its own falls back to.
+`;
+/**
+ * Run a verifying node's command line. Returns the exit code; the application's
+ * own exit code is its business, set the ordinary way from inside it.
+ */
+export async function main(argv, baked = {}) {
+    const flags = { roots: [...(baked.roots ?? [])] };
+    let verifyOnly = false;
+    let i = 0;
+    const sealedRefusal = (flag) => {
+        process.stderr.write(`${flag} is not accepted: this runtime was built with a policy of its own\n`);
+        return 64;
+    };
+    for (; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--') {
+            i++;
+            break;
+        }
+        if (!arg.startsWith('-') || arg === '-')
+            break;
+        // `--flag=value` and `--flag value` both, because both are written.
+        const eq = arg.indexOf('=');
+        const name = eq === -1 ? arg : arg.slice(0, eq);
+        const inline = eq === -1 ? undefined : arg.slice(eq + 1);
+        const value = () => {
+            const next = inline ?? argv[++i];
+            if (next === undefined)
+                throw new Error(`${name} needs a value`);
+            return next;
+        };
+        switch (name) {
+            case '-h':
+            case '--help':
+                process.stdout.write(USAGE);
+                return 0;
+            case '--version':
+                process.stdout.write(`${version()} (node ${process.versions.node})\n`);
+                return 0;
+            case '--verify':
+                verifyOnly = true;
+                break;
+            case '--deep':
+                flags.deep = true;
+                break;
+            case '--entry':
+                flags.entry = value();
+                break;
+            case '-r':
+            case '--root':
+                if (baked.sealed)
+                    return sealedRefusal(name);
+                flags.roots.push(value());
+                break;
+            case '--identity':
+                if (baked.sealed)
+                    return sealedRefusal(name);
+                flags.identity = value();
+                break;
+            case '--issuer':
+                if (baked.sealed)
+                    return sealedRefusal(name);
+                flags.issuer = value();
+                break;
+            case '--untrusted':
+                if (baked.sealed)
+                    return sealedRefusal(name);
+                flags.allowUntrusted = true;
+                break;
+            default:
+                process.stderr.write(`unknown option ${name}\n\n${USAGE}`);
+                return 64;
+        }
+    }
+    const archive = argv[i];
+    if (archive === undefined) {
+        process.stderr.write(`no archive to run\n\n${USAGE}`);
+        return 64;
+    }
+    const options = {
+        ...baked,
+        ...flags,
+        roots: flags.roots.length > 0 ? flags.roots : undefined,
+    };
+    const container = PATH.resolve(archive);
+    if (verifyOnly) {
+        const result = verify(container, options);
+        process.stdout.write(`${result.state.toUpperCase()} — ${result.reason}\n`);
+        if (result.identity)
+            process.stdout.write(`  identity: ${result.identity}\n`);
+        return result.state === 'valid' ? 0 : 1;
+    }
+    // The application sees the argv it would have had from `--vfs-load`: the
+    // archive's own path where a script path goes, and its arguments from
+    // index 2 on. The runtime's own options are gone by then — they were the
+    // runtime's, not the program's.
+    process.argv = [process.argv[0], container, ...argv.slice(i + 1)];
+    await run(container, options);
+    return 0;
+}
+/** This package's version, read out of the mount the verifier is running from. */
+function version() {
+    try {
+        const manifest = JSON.parse(FS.readFileSync(PATH.join(import.meta.dirname, '..', 'package.json'), 'utf-8'));
+        return `${manifest.name ?? 'bundle'} ${manifest.version ?? '0.0.0'}`;
+    }
+    catch {
+        return 'bundle';
+    }
+}
+// ------------------------------------------------------------------ details ---
+// The archive's entry point: an explicit override, else its package.json
+// `main`, else `index.js` — node's own order for a directory.
+function entryPoint(root, override) {
+    if (override)
+        return PATH.resolve(root, override);
+    const manifest = readPackage(root);
+    return PATH.resolve(root, typeof manifest['main'] === 'string' ? manifest['main'] : 'index.js');
+}
+function isModule(root, entry) {
+    if (entry.endsWith('.mjs'))
+        return true;
+    if (entry.endsWith('.cjs'))
+        return false;
+    return readPackage(root)['type'] === 'module';
+}
+function readPackage(root) {
+    try {
+        return JSON.parse(FS.readFileSync(PATH.join(root, 'package.json'), 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+function refuse(options, reason) {
+    if (options.onRefuse) {
+        options.onRefuse(reason);
+        throw new Error(reason);
+    }
+    process.stderr.write(`refusing to run: ${reason}\n`);
+    process.exit(1);
+}
+//# sourceMappingURL=launch.js.map

package/dist/launch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.js","sourceRoot":"","sources":["../src/launch.ts"],"names":[],"mappings":";;;;;;;;AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,IAAI,UAAU,EAAwB,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAA2B,MAAM,eAAe,CAAC;AA8D1F;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,SAAiB,EAAE,OAAO,GAAkB,EAAE;IAChE,MAAM,QAAQ,GAAoB;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,eAAe;KACxB,CAAC;IAEF,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACD,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAW;IAChD,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,MAAM,MAAM,kCAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAC,CAAC;;QAC9D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,SAAiB,EAAE,OAAO,GAAkB,EAAE;IACpE,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAO,GAAkB,EAAE;IACrD,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,MAAM,CAAC,SAAiB,EAAE,OAAO,GAAkB,EAAE;IACjE,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACzH,OAAO,UAAU,CAAC,SAAS,EAAE;QACzB,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,KAAK;QAC9C,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;KACvF,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAiB;IACtC,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACrD,IAAI,CAAC;QACD,sEAAsE;QACtE,wDAAwD;QACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,UAAU,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,MAAM,CAAC;IAClB,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;CAoBpB,CAAC;AAcF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,KAAK,GAAU,EAAE;IACxD,MAAM,KAAK,GAAwC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IACvF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,qEAAqE,CAAC,CAAC;QACnG,OAAO,EAAE,CAAC;IACd,CAAC,CAAC;IAEF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,MAAM;QAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG;YAAE,MAAM;QAE/C,oEAAoE;QACpE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,GAAW,EAAE;YACvB,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC;QAEF,QAAQ,IAAI,EAAE,CAAC;YACX,KAAK,IAAI,CAAC;YAAC,KAAK,QAAQ;gBACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC5B,OAAO,CAAC,CAAC;YACb,KAAK,WAAW;gBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,EAAE,UAAU,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;gBACvE,OAAO,CAAC,CAAC;YACb,KAAK,UAAU;gBACX,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACV,KAAK,QAAQ;gBACT,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;gBAClB,MAAM;YACV,KAAK,SAAS;gBACV,KAAK,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;gBACtB,MAAM;YACV,KAAK,IAAI,CAAC;YAAC,KAAK,QAAQ;gBACpB,IAAI,KAAK,CAAC,MAAM;oBAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;gBAC7C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1B,MAAM;YACV,KAAK,YAAY;gBACb,IAAI,KAAK,CAAC,MAAM;oBAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;gBAC7C,KAAK,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC;gBACzB,MAAM;YACV,KAAK,UAAU;gBACX,IAAI,KAAK,CAAC,MAAM;oBAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;gBAC7C,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACvB,MAAM;YACV,KAAK,aAAa;gBACd,IAAI,KAAK,CAAC,MAAM;oBAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;gBAC7C,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC5B,MAAM;YACV;gBACI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC;gBAC3D,OAAO,EAAE,CAAC;QAClB,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAkB;QAC3B,GAAG,KAAK;QACR,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC1D,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,UAAU,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC;AACb,CAAC;AAED,kFAAkF;AAClF,SAAS,OAAO;IACZ,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACvB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAC1C,CAAC;QACzC,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,QAAQ,CAAC;IACpB,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF,yEAAyE;AACzE,8DAA8D;AAC9D,SAAS,UAAU,CAAC,IAAY,EAAE,QAA4B;IAC1D,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC7B,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAA4B,CAAC;IAC5G,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,OAAsB,EAAE,MAAc;IAClD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,IAAI,CAAC,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/dist/main.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { main } from './cli.js';
+// The executable entry point, in every launch mode this tool has:
+//
+//   * `bundle …` / `node dist/main.js …` — an ordinary CLI.
+//   * `--vfs-load=<archive>` — node runs the mounted package's
+//     `main`, which is this file, out of the archive.
+//   * the SEA container, whose bootstrap mounts its own tail and then requires
+//     the package inside it, landing here.
+//
+// In all three, `process.argv` is [runtime, entry, ...userArgs], so the user's
+// arguments always start at index 2.
+//
+// Nothing but argv handling lives here. `cli.ts` returns an exit code rather
+// than exiting, so it stays callable in-process — by a test, or by a host that
+// wants the commands without a subprocess — and the one place that turns a code
+// into an exit is this file.
+process.exitCode = await main(process.argv.slice(2));
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,kEAAkE;AAClE,EAAE;AACF,4DAA4D;AAC5D,+DAA+D;AAC/D,sDAAsD;AACtD,+EAA+E;AAC/E,2CAA2C;AAC3C,EAAE;AACF,+EAA+E;AAC/E,qCAAqC;AACrC,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,6BAA6B;AAE7B,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC"}