@publish.os/nextjs 0.0.1-alpha.8 → 0.0.1-alpha.90

package/dist/chunk-7OGTPSKI.js

@@ -0,0 +1,156 @@
+import {
+  isSameOrDescendant
+} from "./chunk-YLTOLYWM.js";
+
+// src/lib/compiler/source/diagnostics/errors/publish-os-source-error.ts
+var ERROR_CODES = {
+  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+  CONFIG_INVALID_JSON: "CONFIG_INVALID_JSON",
+  CONFIG_SCHEMA_INVALID: "CONFIG_SCHEMA_INVALID",
+  CONFIG_MOUNT_NOT_FOUND: "CONFIG_MOUNT_NOT_FOUND",
+  CONFIG_MOUNT_INVALID_JSON: "CONFIG_MOUNT_INVALID_JSON",
+  CONFIG_MOUNT_INVALID_SCHEMA: "CONFIG_MOUNT_INVALID_SCHEMA",
+  CONFIG_MOUNT_NOT_FILE: "CONFIG_MOUNT_NOT_FILE",
+  CONFIG_MOUNT_PATH_INVALID: "CONFIG_MOUNT_PATH_INVALID",
+  CONFIG_GROUP_INVALID_SCHEMA: "CONFIG_GROUP_INVALID_SCHEMA",
+  CONFIG_GROUP_INVALID_MOUNT: "CONFIG_GROUP_INVALID_MOUNT",
+  CONFIG_PATH_EMPTY: "CONFIG_PATH_EMPTY",
+  CONFIG_PATH_ABSOLUTE: "CONFIG_PATH_ABSOLUTE",
+  CONFIG_PATH_PROTOCOL: "CONFIG_PATH_PROTOCOL",
+  CONFIG_PATH_OUT_OF_SCOPE: "CONFIG_PATH_OUT_OF_SCOPE",
+  CONFIG_FILE_INVALID_PATH: "CONFIG_FILE_INVALID_PATH",
+  CONFIG_FILE_MISSING: "CONFIG_FILE_MISSING",
+  CONFIG_FILE_NOT_REGULAR: "CONFIG_FILE_NOT_REGULAR",
+  CONFIG_CONTENT_PATH_INVALID: "CONFIG_CONTENT_PATH_INVALID",
+  CONFIG_CONTENT_MISSING: "CONFIG_CONTENT_MISSING",
+  CONFIG_CONTENT_NOT_DIRECTORY: "CONFIG_CONTENT_NOT_DIRECTORY",
+  CONTENT_FRONTMATTER_INVALID_JSON: "CONTENT_FRONTMATTER_INVALID_JSON",
+  CONTENT_FRONTMATTER_REQUIRED: "CONTENT_FRONTMATTER_REQUIRED",
+  CONTENT_FRONTMATTER_ID_INVALID: "CONTENT_FRONTMATTER_ID_INVALID",
+  CONTENT_FILE_PARSE_FAILED: "CONTENT_FILE_PARSE_FAILED",
+  CONTENT_DUPLICATE_ID: "CONTENT_DUPLICATE_ID",
+  CONTENT_DUPLICATE_ROUTE: "CONTENT_DUPLICATE_ROUTE",
+  CONTENT_SLUG_INVALID: "CONTENT_SLUG_INVALID",
+  CONTENT_TREE_MISMATCH: "CONTENT_TREE_MISMATCH",
+  CONTENT_MANIFEST_GENERATION_FAILED: "CONTENT_MANIFEST_GENERATION_FAILED"
+}, AppError = class extends Error {
+  code;
+  details;
+  constructor({ code, message, details }) {
+    super(message), this.name = "AppError", this.code = code, this.details = details;
+  }
+};
+
+// src/lib/compiler/source/assert-publish-os-source-boundary.ts
+import { lstat, readdir, realpath } from "fs/promises";
+import { basename, dirname, join, relative, resolve, sep } from "path";
+function displayPath(root, path) {
+  return relative(root, path).split(sep).join("/") || ".";
+}
+function sourceBoundaryError(options) {
+  return new AppError({
+    code: options.code,
+    message: options.message,
+    details: { file: displayPath(options.root, options.path) }
+  });
+}
+async function assertEntry(options) {
+  let entry = await lstat(options.path);
+  if (entry.isSymbolicLink())
+    throw sourceBoundaryError({
+      code: "FRAMEWORK_SOURCE_SYMLINK",
+      message: "Symbolic links are not allowed inside publish.os.",
+      path: options.path,
+      root: options.root
+    });
+  if (!entry.isDirectory() && !entry.isFile())
+    throw sourceBoundaryError({
+      code: "FRAMEWORK_SOURCE_ENTRY_NOT_REGULAR",
+      message: "publish.os may only contain directories and regular files.",
+      path: options.path,
+      root: options.root
+    });
+  let realEntry = await realpath(options.path);
+  if (!isSameOrDescendant(options.realRoot, realEntry))
+    throw sourceBoundaryError({
+      code: "FRAMEWORK_SOURCE_PATH_ESCAPE",
+      message: "A publish.os entry resolves outside the source directory.",
+      path: options.path,
+      root: options.root
+    });
+  if (entry.isDirectory()) {
+    if (basename(options.path) === "publish.os") {
+      options.nestedSources.push(displayPath(options.root, options.path));
+      return;
+    }
+    for (let child of await readdir(options.path))
+      await assertEntry({
+        nestedSources: options.nestedSources,
+        path: resolve(options.path, child),
+        root: options.root,
+        realRoot: options.realRoot
+      });
+  }
+}
+async function assertPublishOsSourceBoundary(publishOsDir, sourceIdentity) {
+  let root = resolve(publishOsDir), authoredRoot = resolve(sourceIdentity?.sourceRoot ?? root);
+  if (basename(authoredRoot) !== "publish.os")
+    throw sourceBoundaryError({
+      code: "SOURCE_ROOT_NAME_INVALID",
+      message: "The authored source folder must be named publish.os.",
+      path: root,
+      root
+    });
+  for (let ancestor = authoredRoot; ; ancestor = dirname(ancestor)) {
+    if (await lstat(join(ancestor, ".git")).then(() => !0).catch((error) => {
+      if (error.code === "ENOENT" || error.code === "ENOTDIR") return !1;
+      throw error;
+    })) {
+      if (ancestor !== authoredRoot) break;
+      throw sourceBoundaryError({
+        code: "SOURCE_ROOT_IS_REPOSITORY",
+        message: "The repository root cannot be an authored source root.",
+        path: root,
+        root
+      });
+    }
+    if (ancestor !== authoredRoot && basename(ancestor) === "publish.os")
+      throw sourceBoundaryError({
+        code: "SOURCE_ROOT_NESTED",
+        message: "Select the outer publish.os source instead of a nested source.",
+        path: root,
+        root
+      });
+    if (dirname(ancestor) === ancestor) break;
+  }
+  let rootEntry = await lstat(root);
+  if (rootEntry.isSymbolicLink())
+    throw sourceBoundaryError({
+      code: "FRAMEWORK_SOURCE_SYMLINK",
+      message: "The publish.os source directory must not be a symbolic link.",
+      path: root,
+      root
+    });
+  if (!rootEntry.isDirectory())
+    throw sourceBoundaryError({
+      code: "FRAMEWORK_SOURCE_ROOT_NOT_DIRECTORY",
+      message: "The publish.os source path must be a directory.",
+      path: root,
+      root
+    });
+  let realRoot = await realpath(root), nestedSources = [];
+  for (let child of await readdir(root))
+    child === ".publish.os" || child === "tsconfig.json" || await assertEntry({
+      nestedSources,
+      path: resolve(root, child),
+      root,
+      realRoot
+    });
+  return { nestedSources: nestedSources.sort() };
+}
+
+export {
+  ERROR_CODES,
+  AppError,
+  assertPublishOsSourceBoundary
+};

package/dist/chunk-AI2UULNX.js

@@ -0,0 +1,9 @@
+// src/lib/compiler/source/config/runtime-package.ts
+var exactRuntimePackage = /^@publish\.os\/nextjs@((?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)$/u;
+function runtimePackageVersion(value) {
+  return typeof value == "string" ? exactRuntimePackage.exec(value)?.[1] : void 0;
+}
+
+export {
+  runtimePackageVersion
+};

package/dist/chunk-B2V22WRT.js

@@ -0,0 +1,297 @@
+import {
+  acquireOperationLock,
+  assertGeneratedOutput,
+  assertLocalDirectory,
+  assertOperationOutput,
+  ensureOutputOwnership,
+  localOperationName,
+  markOperationOutput
+} from "./chunk-GGKFQ3MA.js";
+import {
+  assertPublishOsSourceBoundary
+} from "./chunk-7OGTPSKI.js";
+import {
+  isExcludedSourcePath
+} from "./chunk-YLTOLYWM.js";
+import {
+  AppError
+} from "./chunk-WDY4IK6Z.js";
+
+// src/lib/compiler/lifecycle/local-operation.ts
+import { mkdir as mkdir2, mkdtemp, realpath as realpath2, rename, rm } from "fs/promises";
+import { isAbsolute as isAbsolute2, join as join2, resolve as resolve2 } from "path";
+
+// src/lib/compiler/lifecycle/capture-local-source.ts
+import { createHash } from "crypto";
+import { constants } from "fs";
+import {
+  lstat,
+  mkdir,
+  open,
+  readdir,
+  readFile,
+  realpath,
+  writeFile
+} from "fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "path";
+function isInside({ root, path }) {
+  let value = relative(root, path);
+  return value !== "" && value !== ".." && !value.startsWith(`..${sep}`) && !isAbsolute(value);
+}
+async function captureLocalSource({
+  sourceRoot,
+  captureDir,
+  signal
+}) {
+  signal?.throwIfAborted(), await assertPublishOsSourceBoundary(sourceRoot), signal?.throwIfAborted();
+  let root = await realpath(sourceRoot), destination = resolve(captureDir), outputRoot = join(root, ".publish.os");
+  if (!isInside({ root: outputRoot, path: destination }) || await realpath(dirname(destination)) !== dirname(destination))
+    throw new AppError({
+      code: "FRAMEWORK_CAPTURE_OUTPUT_INVALID",
+      message: "Source capture requires an owned path inside source output."
+    });
+  await mkdir(destination).catch((error) => {
+    if (error.code !== "EEXIST") throw error;
+  });
+  let destinationEntry = await lstat(destination);
+  if (!destinationEntry.isDirectory() || destinationEntry.isSymbolicLink() || await realpath(destination) !== destination || (await readdir(destination)).length > 0)
+    throw new AppError({
+      code: "FRAMEWORK_CAPTURE_OUTPUT_INVALID",
+      message: "Source capture requires an empty owned directory."
+    });
+  let capturedFiles = [], copyDirectory = async (relativeDirectory) => {
+    signal?.throwIfAborted();
+    let directory = join(root, relativeDirectory);
+    for (let name of (await readdir(directory)).sort()) {
+      signal?.throwIfAborted();
+      let path = relativeDirectory ? `${relativeDirectory}/${name}` : name;
+      if (isExcludedSourcePath(path) || relativeDirectory === "" && name.startsWith(".env"))
+        continue;
+      let sourcePath = join(root, path), outputPath = join(destination, path), entry = await lstat(sourcePath);
+      if (entry.isSymbolicLink())
+        throw new AppError({
+          code: "FRAMEWORK_SOURCE_SYMLINK",
+          message: "Symbolic links are not allowed inside publish.os."
+        });
+      if (!isInside({ root, path: await realpath(sourcePath) }))
+        throw new AppError({
+          code: "FRAMEWORK_SOURCE_PATH_ESCAPE",
+          message: "A source entry resolves outside the selected source."
+        });
+      if (entry.isDirectory()) {
+        await mkdir(outputPath), await copyDirectory(path);
+        continue;
+      }
+      if (!entry.isFile())
+        throw new AppError({
+          code: "FRAMEWORK_SOURCE_ENTRY_NOT_REGULAR",
+          message: "Source capture accepts only directories and regular files."
+        });
+      let file = await open(
+        sourcePath,
+        constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0)
+      );
+      try {
+        let opened = await file.stat();
+        if (!opened.isFile() || opened.dev !== entry.dev || opened.ino !== entry.ino)
+          throw new AppError({
+            code: "FRAMEWORK_CAPTURE_SOURCE_CHANGED",
+            message: "A source entry changed before capture could read it."
+          });
+        signal?.throwIfAborted();
+        let contents = await file.readFile({ signal });
+        signal?.throwIfAborted(), await writeFile(outputPath, contents, { flag: "wx", signal }), capturedFiles.push(path);
+      } finally {
+        await file.close();
+      }
+    }
+  };
+  await copyDirectory("");
+  let hash = createHash("sha256");
+  for (let path of capturedFiles.sort()) {
+    signal?.throwIfAborted();
+    let contents = await readFile(join(destination, path), { signal });
+    hash.update(JSON.stringify([path, contents.byteLength])), hash.update("\0"), hash.update(contents);
+  }
+  return signal?.throwIfAborted(), {
+    sourceDir: captureDir,
+    sourceRevision: `sha256:${hash.digest("hex")}`
+  };
+}
+
+// src/lib/compiler/lifecycle/local-operation.ts
+async function withLocalOperation(options) {
+  let operation = await openLocalOperation(options);
+  try {
+    operation.context.signal.throwIfAborted();
+    let result = await options.run(operation.context);
+    return options.signal?.throwIfAborted(), result;
+  } finally {
+    await operation.close();
+  }
+}
+async function openLocalOperation(options) {
+  if (options.signal?.throwIfAborted(), options.operation !== "build" && options.operation !== "dev")
+    throw new AppError({
+      code: "FRAMEWORK_LOCAL_OPERATION_INVALID",
+      message: "Select a build or development operation."
+    });
+  if (!isAbsolute2(options.sourceRoot))
+    throw new AppError({
+      code: "FRAMEWORK_LOCAL_SOURCE_INVALID",
+      message: "Supply an absolute publish.os source path."
+    });
+  await assertPublishOsSourceBoundary(options.sourceRoot);
+  let operationName = localOperationName(options), sourceRoot = await realpath2(options.sourceRoot), outputRoot = join2(sourceRoot, ".publish.os"), outputDir = join2(outputRoot, operationName);
+  if (options.outputDir && resolve2(options.outputDir) !== outputDir)
+    throw new AppError({
+      code: "FRAMEWORK_LOCAL_OUTPUT_INVALID",
+      message: "Local output must use the selected source and operation directory."
+    });
+  let ownership = await ensureOutputOwnership({ sourceRoot }), output = {
+    sourceRoot,
+    outputDir,
+    operation: options.operation,
+    scope: options.scope
+  };
+  await assertOperationOutput(output), await assertGeneratedOutput(output);
+  let releaseLock = await acquireOperationLock({
+    sourceRoot,
+    outputRoot,
+    operation: options.operation,
+    scope: options.scope,
+    signal: options.signal
+  }), stagingRoot;
+  try {
+    await mkdir2(join2(outputRoot, ".stages"), { recursive: !0 }), stagingRoot = await mkdtemp(
+      join2(outputRoot, ".stages", `${operationName}-`)
+    );
+  } catch (error) {
+    throw await releaseLock(), error;
+  }
+  let stagingIdentity = await assertLocalDirectory(stagingRoot), retainStaging = !1, assertStaging = async () => {
+    try {
+      await ownership.assertCurrent(), await assertLocalDirectory(stagingRoot, stagingIdentity);
+    } catch (error) {
+      throw retainStaging = !0, error;
+    }
+  }, controller = new AbortController(), signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal, sourceDir = sourceRoot, sourceRevision;
+  try {
+    if (options.operation === "build") {
+      let capture = await captureLocalSource({
+        sourceRoot,
+        captureDir: join2(stagingRoot, "source"),
+        signal
+      });
+      sourceDir = capture.sourceDir, sourceRevision = capture.sourceRevision;
+    }
+  } catch (error) {
+    throw await assertStaging(), await rm(stagingRoot, { recursive: !0, force: !0 }), await releaseLock(), error;
+  }
+  let shutdown = [], shutdownFailures = [], acceptsShutdownRegistrations = !0, stopping, stopCallbacks = async (callbacks) => {
+    let results = await Promise.allSettled(
+      callbacks.map((callback) => Promise.resolve().then(callback))
+    );
+    shutdownFailures.push(
+      ...results.filter((result) => result.status === "rejected").map((result) => result.reason)
+    );
+  }, stop = async () => {
+    stopping ??= stopCallbacks(shutdown);
+    let active = stopping;
+    for (; await active, active !== stopping; )
+      active = stopping;
+    if (shutdownFailures.length)
+      throw new AppError({
+        code: "FRAMEWORK_PROCESS_SHUTDOWN_FAILED",
+        message: "Owned resources did not stop. Output and locks remain in place. Confirm that all operation processes have stopped before recovery.",
+        details: { failures: shutdownFailures }
+      });
+  }, abort = () => {
+    stop().catch(() => {
+    });
+  };
+  signal.addEventListener("abort", abort, { once: !0 });
+  let replacementWork, replaceOutput = async (run) => {
+    signal.throwIfAborted(), await assertStaging();
+    let replacement = await mkdtemp(join2(stagingRoot, "output-")), replacementIdentity = await assertLocalDirectory(replacement), assertReplacement = async () => {
+      try {
+        await assertStaging(), await assertLocalDirectory(replacement, replacementIdentity);
+      } catch (error) {
+        throw retainStaging = !0, error;
+      }
+    }, incoming = join2(replacement, "app"), previous = join2(replacement, "previous"), movedPrevious = !1, published = !1;
+    try {
+      await mkdir2(incoming), await run(incoming), signal.throwIfAborted(), await assertReplacement(), await assertLocalDirectory(incoming), await assertOperationOutput(output), await assertGeneratedOutput(output), await markOperationOutput({ ...output, outputDir: incoming }), signal.throwIfAborted();
+      try {
+        await rename(outputDir, previous), movedPrevious = !0;
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      try {
+        signal.throwIfAborted(), await rename(incoming, outputDir), published = !0;
+      } catch (error) {
+        if (movedPrevious)
+          try {
+            await assertReplacement(), await rename(previous, outputDir);
+          } catch (rollbackError) {
+            throw retainStaging = !0, new AggregateError(
+              [error, rollbackError],
+              `Output replacement failed. Recover the prior output from ${previous}.`
+            );
+          }
+        throw error;
+      }
+    } finally {
+      published && (await assertReplacement(), await rm(replacement, { recursive: !0, force: !0 }));
+    }
+  };
+  return {
+    context: {
+      sourceRoot,
+      sourceDir,
+      sourceRevision,
+      outputDir,
+      signal,
+      onShutdown: (callback) => acceptsShutdownRegistrations ? stopping ? (stopping = stopping.then(() => stopCallbacks([callback])), () => {
+      }) : (shutdown.push(callback), () => {
+        let index = shutdown.indexOf(callback);
+        index !== -1 && shutdown.splice(index, 1);
+      }) : (signal.throwIfAborted(), () => {
+      }),
+      replaceOutput: (run) => {
+        if (replacementWork)
+          return Promise.reject(
+            new AppError({
+              code: "FRAMEWORK_LOCAL_REPLACEMENT_ACTIVE",
+              message: "Wait for the current output replacement to finish."
+            })
+          );
+        let work = replaceOutput(run);
+        return replacementWork = work, work.finally(() => {
+          replacementWork === work && (replacementWork = void 0);
+        }).catch(() => {
+        }), work;
+      }
+    },
+    close: async () => {
+      if (controller.abort(), acceptsShutdownRegistrations = !1, await stop().catch(async (error) => {
+        try {
+          await releaseLock({ shutdownUnverified: !0 });
+        } catch (retentionFailure) {
+          error instanceof AppError && error.details && (error.details.lockRetentionFailure = retentionFailure);
+        }
+        throw error;
+      }), await replacementWork?.catch(() => {
+      }), signal.removeEventListener("abort", abort), await assertStaging(), retainStaging)
+        throw new AppError({
+          code: "FRAMEWORK_LOCAL_OUTPUT_REDIRECTED",
+          message: `Output cleanup stopped to preserve unverified data. Inspect ${stagingRoot} before recovery.`
+        });
+      await rm(stagingRoot, { recursive: !0, force: !0 }), await releaseLock();
+    }
+  };
+}
+
+export {
+  withLocalOperation
+};

package/dist/chunk-DLDFHU7Y.js

@@ -0,0 +1,191 @@
+import {
+  runtimePackageVersion
+} from "./chunk-AI2UULNX.js";
+import {
+  AppError,
+  readInstalledFrameworkLocation
+} from "./chunk-WDY4IK6Z.js";
+
+// src/lib/compiler/release/framework-selection.ts
+import { createHash } from "crypto";
+import { readFile, realpath, stat } from "fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/compiler/release/framework-archive.ts
+import { posix } from "path";
+import { isDeepStrictEqual } from "util";
+import { Parser } from "tar";
+function invalidArchive(message) {
+  return new AppError({ code: "FRAMEWORK_ARCHIVE_INVALID", message });
+}
+async function readArchiveManifest(archive) {
+  return await new Promise((resolve2, reject) => {
+    let manifestFound = !1, manifestSource, parser = new Parser({
+      strict: !0,
+      onReadEntry: (entry) => {
+        if (posix.normalize(entry.path.replaceAll("\\", "/")) !== "package/package.json") {
+          entry.resume();
+          return;
+        }
+        if (manifestFound || entry.path !== "package/package.json" || entry.type !== "File" || entry.size > 1048576) {
+          parser.abort(
+            invalidArchive(
+              "The framework archive must contain one regular package manifest."
+            )
+          ), entry.resume();
+          return;
+        }
+        manifestFound = !0;
+        let chunks = [];
+        entry.on("data", (chunk) => {
+          chunks.push(chunk);
+        }), entry.on("end", () => {
+          manifestSource = Buffer.concat(chunks).toString("utf8");
+        }), entry.resume();
+      }
+    });
+    parser.on("error", (error) => {
+      reject(
+        error instanceof AppError ? error : invalidArchive("The framework archive is malformed.")
+      );
+    }), parser.on("end", () => {
+      try {
+        let manifest = JSON.parse(manifestSource ?? "");
+        if (!manifest || typeof manifest != "object" || Array.isArray(manifest))
+          throw invalidArchive(
+            "The framework archive package manifest is invalid."
+          );
+        resolve2(manifest);
+      } catch {
+        reject(
+          invalidArchive(
+            "The framework archive package manifest is missing or invalid."
+          )
+        );
+      }
+    }), parser.end(archive);
+  });
+}
+async function assertFrameworkArchiveIdentity({
+  archive,
+  framework
+}) {
+  let manifest = await readArchiveManifest(archive);
+  if (manifest.name !== framework.packageName || manifest.version !== framework.version)
+    throw invalidArchive(
+      "The framework archive identity does not match the executing release."
+    );
+  let installed = readInstalledFrameworkLocation();
+  if (installed.packageRoot !== framework.packageRoot || installed.manifest.version !== framework.version)
+    throw invalidArchive(
+      "The executing framework identity changed during archive validation."
+    );
+  for (let field of [
+    "dependencies",
+    "optionalDependencies",
+    "peerDependencies",
+    "peerDependenciesMeta",
+    "engines"
+  ])
+    if (!isDeepStrictEqual(manifest[field] ?? {}, installed.manifest[field] ?? {}))
+      throw invalidArchive(
+        `The framework archive field ${field} does not match the executing release.`
+      );
+}
+
+// src/lib/compiler/release/framework-selection.ts
+async function readCheckoutTypeScriptConfig({
+  packageRoot
+}) {
+  try {
+    let source = await readFile(join(packageRoot, "tsconfig.json")), paths = JSON.parse(source.toString("utf8"))?.compilerOptions?.paths;
+    if (!paths || typeof paths != "object" || Array.isArray(paths) || !Object.values(paths).every(
+      (targets) => Array.isArray(targets) && targets.length > 0 && targets.every(
+        (target) => typeof target == "string" && target.length > 0
+      )
+    ))
+      throw new Error("Invalid checkout paths");
+    let aliases = paths;
+    if (!aliases["@/*"] || aliases["@/*"].some(
+      (target) => resolve(packageRoot, target) !== join(packageRoot, "src/*")
+    ))
+      throw new Error("Missing compiler source alias");
+    return { source, paths: aliases };
+  } catch {
+    throw new AppError({
+      code: "FRAMEWORK_SELECTION_INVALID",
+      message: "The selected checkout TypeScript configuration is missing or invalid.",
+      fix: "Restore the checkout tsconfig.json and its source paths, then repeat the operation. No registry fallback is available."
+    });
+  }
+}
+async function assertFrameworkSelection({
+  context,
+  framework,
+  runtime
+}) {
+  let selected = context?.framework;
+  if (selected !== void 0) {
+    if (!selected || !["checkout", "candidate"].includes(selected.kind) || selected.packageName !== framework.packageName || selected.version !== framework.version)
+      throw new AppError({
+        code: "FRAMEWORK_SELECTION_INVALID",
+        message: "The selected local framework does not match the executing input.",
+        fix: "Select a valid local checkout or package candidate and repeat the operation. No registry fallback is available."
+      });
+    if (selected.kind === "checkout") {
+      let root = typeof selected.packageRoot == "string" && isAbsolute(selected.packageRoot) ? await realpath(selected.packageRoot).catch(() => {
+      }) : void 0;
+      if (!root || !relative(root, fileURLToPath(import.meta.url)).startsWith(
+        `src${sep}`
+      ) || !fileURLToPath(import.meta.url).endsWith(".ts") || root !== await realpath(framework.packageRoot) || !(await stat(join(root, "src/compiler.ts")).catch(() => {
+      }))?.isFile() || context?.archive !== void 0)
+        throw new AppError({
+          code: "FRAMEWORK_SELECTION_INVALID",
+          message: "The selected checkout is missing or does not contain the executing compiler.",
+          fix: "Invoke src/compiler.ts from the selected editable checkout without a package archive. No registry fallback is available."
+        });
+      let config = await readCheckoutTypeScriptConfig({ packageRoot: root }), manifest = await readFile(join(root, "package.json")).catch(() => {
+        throw new AppError({
+          code: "FRAMEWORK_SELECTION_INVALID",
+          message: "The selected checkout package metadata is unreadable.",
+          fix: "Restore the checkout package.json, then repeat the operation. No registry fallback is available."
+        });
+      });
+      return `checkout:${createHash("sha256").update(root).update(manifest).update(config.source).update(JSON.stringify(framework.release)).digest("hex")}`;
+    }
+    if (typeof selected.integrity != "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/u.test(selected.integrity) || selected.integrity !== context?.archive?.integrity)
+      throw new AppError({
+        code: "FRAMEWORK_SELECTION_INVALID",
+        message: "The selected local framework does not match the executing input.",
+        fix: "Select a valid local checkout or package candidate and repeat the operation. No registry fallback is available."
+      });
+    let archive = await readFile(context?.archive?.path ?? "").catch(() => {
+      throw new AppError({
+        code: "FRAMEWORK_SELECTION_INVALID",
+        message: "The selected local framework archive is missing or unreadable.",
+        fix: "Prepare the selected local framework again. No registry fallback is available."
+      });
+    });
+    if (`sha512-${createHash("sha512").update(archive).digest("base64")}` !== selected.integrity)
+      throw new AppError({
+        code: "FRAMEWORK_SELECTION_INVALID",
+        message: "The selected local framework archive does not match its integrity.",
+        fix: "Prepare the selected local framework again. No registry fallback is available."
+      });
+    return await assertFrameworkArchiveIdentity({ archive, framework }), selected.integrity;
+  }
+  if (runtimePackageVersion(runtime) !== framework.version)
+    throw new AppError({
+      code: "FRAMEWORK_SOURCE_PIN_MISMATCH",
+      message: "The source pin does not match the executing framework release.",
+      fix: "Invoke the exact framework version selected in publish.os.config.json."
+    });
+  return context?.archive?.integrity ?? "";
+}
+
+export {
+  assertFrameworkArchiveIdentity,
+  readCheckoutTypeScriptConfig,
+  assertFrameworkSelection
+};