@push.rocks/smartdb 5.0.5 → 5.2.0

package/scripts/release-artifacts.ts

@@ -0,0 +1,626 @@
+import * as childProcess from 'node:child_process';
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+type TReleaseArtifactMode = 'check' | 'build';
+
+interface IReleaseArtifactEnvironment {
+  macosSsh: string;
+  macosTempRoot: string;
+}
+
+const provenanceSuffix = '.tsrust-build.json';
+const defaultCommandTimeoutMs = 60 * 60 * 1000;
+const capabilityCommandTimeoutMs = 5 * 60 * 1000;
+const forceKillDelayMs = 10 * 1000;
+const maximumCapturedOutputBytes = 16 * 1024 * 1024;
+const sshConnectionArgs = [
+  '-o',
+  'ServerAliveInterval=15',
+  '-o',
+  'ServerAliveCountMax=2',
+];
+
+type TForwardedSignal = 'SIGINT' | 'SIGTERM' | 'SIGHUP';
+
+const shellQuote = (valueArg: string): string => `'${valueArg.replace(/'/g, `'"'"'`)}'`;
+
+const executeCommand = (
+  commandArg: string,
+  argsArg: string[],
+  optionsArg: {
+    cwd?: string;
+    capture?: boolean;
+    timeoutMs?: number;
+    heartbeatStdin?: boolean;
+  } = {},
+): Promise<string> =>
+  new Promise((resolveArg, rejectArg) => {
+    const capture = optionsArg.capture === true;
+    const child = childProcess.spawn(commandArg, argsArg, {
+      cwd: optionsArg.cwd || process.cwd(),
+      env: process.env,
+      stdio: capture
+        ? ['ignore', 'pipe', 'pipe']
+        : optionsArg.heartbeatStdin
+          ? ['pipe', 'inherit', 'inherit']
+          : 'inherit',
+      detached: true,
+    });
+    let stdout = '';
+    let stderr = '';
+    let capturedOutputBytes = 0;
+    let timedOut = false;
+    let outputLimitExceeded = false;
+    let forwardedSignal: TForwardedSignal | undefined;
+    let forwardedSignalCount = 0;
+    let settled = false;
+    let forceKillTimer: NodeJS.Timeout | undefined;
+    let heartbeatTimer: NodeJS.Timeout | undefined;
+
+    const killProcessGroup = (signalArg: NodeJS.Signals): void => {
+      if (!child.pid) return;
+      try {
+        process.kill(-child.pid, signalArg);
+      } catch {
+        try {
+          child.kill(signalArg);
+        } catch {
+          // The process may already have exited.
+        }
+      }
+    };
+
+    const terminateProcessGroup = (signalArg: NodeJS.Signals): void => {
+      killProcessGroup(signalArg);
+      if (!forceKillTimer) {
+        forceKillTimer = setTimeout(
+          () => killProcessGroup('SIGKILL'),
+          forceKillDelayMs,
+        );
+      }
+    };
+
+    const processGroupExists = (): boolean => {
+      if (!child.pid) return false;
+      try {
+        process.kill(-child.pid, 0);
+        return true;
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ESRCH') return false;
+        throw error;
+      }
+    };
+
+    const waitForProcessGroupExit = async (timeoutMsArg: number): Promise<boolean> => {
+      const deadline = Date.now() + timeoutMsArg;
+      while (processGroupExists() && Date.now() < deadline) {
+        await new Promise((resolveArg) => setTimeout(resolveArg, 100));
+      }
+      return !processGroupExists();
+    };
+
+    const ensureProcessGroupStopped = async (): Promise<void> => {
+      if (!processGroupExists()) return;
+      terminateProcessGroup('SIGTERM');
+      if (!(await waitForProcessGroupExit(forceKillDelayMs + 1000))) {
+        killProcessGroup('SIGKILL');
+        if (!(await waitForProcessGroupExit(2000))) {
+          throw new Error(`${commandArg} left a live descendant process group`);
+        }
+      }
+    };
+
+    const signalHandlers = new Map<TForwardedSignal, () => void>();
+    for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP'] as TForwardedSignal[]) {
+      const handler = (): void => {
+        forwardedSignal = signal;
+        forwardedSignalCount += 1;
+        if (forwardedSignalCount === 1) terminateProcessGroup(signal);
+        else killProcessGroup('SIGKILL');
+      };
+      signalHandlers.set(signal, handler);
+      process.on(signal, handler);
+    }
+
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      terminateProcessGroup('SIGTERM');
+    }, optionsArg.timeoutMs || defaultCommandTimeoutMs);
+
+    if (optionsArg.heartbeatStdin) {
+      child.stdin?.on('error', () => {
+        // Process close handles a lost stdin channel.
+      });
+      const sendHeartbeat = (): void => {
+        if (!child.stdin?.destroyed) child.stdin?.write('heartbeat\n');
+      };
+      sendHeartbeat();
+      heartbeatTimer = setInterval(sendHeartbeat, 1000);
+    }
+
+    const cleanup = (): void => {
+      clearTimeout(timeout);
+      if (forceKillTimer) clearTimeout(forceKillTimer);
+      if (heartbeatTimer) clearInterval(heartbeatTimer);
+      child.stdin?.end();
+      for (const [signal, handler] of signalHandlers) {
+        process.off(signal, handler);
+      }
+    };
+
+    const captureChunk = (targetArg: 'stdout' | 'stderr', chunkArg: Buffer): void => {
+      capturedOutputBytes += chunkArg.length;
+      if (capturedOutputBytes > maximumCapturedOutputBytes) {
+        outputLimitExceeded = true;
+        terminateProcessGroup('SIGTERM');
+        return;
+      }
+      if (targetArg === 'stdout') stdout += chunkArg.toString('utf8');
+      else stderr += chunkArg.toString('utf8');
+    };
+    child.stdout?.on('data', (chunkArg: Buffer) => captureChunk('stdout', chunkArg));
+    child.stderr?.on('data', (chunkArg: Buffer) => captureChunk('stderr', chunkArg));
+
+    child.once('error', (errorArg) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      rejectArg(errorArg);
+    });
+    child.once('close', (codeArg, signalArg) => {
+      if (settled) return;
+      settled = true;
+      void (async () => {
+        try {
+          await ensureProcessGroupStopped();
+          cleanup();
+          if (codeArg !== 0 && capture) {
+            if (stdout) process.stdout.write(stdout);
+            if (stderr) process.stderr.write(stderr);
+          }
+          if (timedOut) {
+            rejectArg(new Error(`${commandArg} exceeded its command timeout`));
+          } else if (outputLimitExceeded) {
+            rejectArg(new Error(`${commandArg} exceeded the captured output limit`));
+          } else if (forwardedSignal) {
+            rejectArg(new Error(`${commandArg} was interrupted by ${forwardedSignal}`));
+          } else if (codeArg !== 0) {
+            rejectArg(
+              new Error(
+                `${commandArg} exited with ${signalArg ? `signal ${signalArg}` : `status ${codeArg}`}`,
+              ),
+            );
+          } else {
+            resolveArg(stdout.trim());
+          }
+        } catch (error) {
+          cleanup();
+          rejectArg(error);
+        }
+      })();
+    });
+  });
+
+const runCommand = async (
+  commandArg: string,
+  argsArg: string[],
+  cwdArg: string = process.cwd(),
+  timeoutMsArg: number = defaultCommandTimeoutMs,
+  heartbeatStdinArg: boolean = false,
+): Promise<void> => {
+  await executeCommand(commandArg, argsArg, {
+    cwd: cwdArg,
+    timeoutMs: timeoutMsArg,
+    heartbeatStdin: heartbeatStdinArg,
+  });
+};
+
+const captureCommand = async (
+  commandArg: string,
+  argsArg: string[],
+  cwdArg: string = process.cwd(),
+): Promise<string> => {
+  return executeCommand(commandArg, argsArg, {
+    cwd: cwdArg,
+    capture: true,
+    timeoutMs: capabilityCommandTimeoutMs,
+  });
+};
+
+const loadEnvironment = (): IReleaseArtifactEnvironment => {
+  const macosSsh = process.env.SMARTDB_RELEASE_MACOS_SSH?.trim() || '';
+  const macosTempRoot = (process.env.SMARTDB_RELEASE_MACOS_TEMP_ROOT?.trim() || '').replace(
+    /\/+$/,
+    '',
+  );
+
+  if (!/^[A-Za-z0-9._-]+@[A-Za-z0-9.-]+$/.test(macosSsh)) {
+    throw new Error(
+      'SMARTDB_RELEASE_MACOS_SSH must use the user@host form without SSH options',
+    );
+  }
+  if (
+    !/^\/[A-Za-z0-9._/-]+$/.test(macosTempRoot) ||
+    path.posix.normalize(macosTempRoot) !== macosTempRoot ||
+    macosTempRoot.split('/').filter(Boolean).length < 2
+  ) {
+    throw new Error(
+      'SMARTDB_RELEASE_MACOS_TEMP_ROOT must be a non-root absolute path without spaces',
+    );
+  }
+  return { macosSsh, macosTempRoot };
+};
+
+const runRemoteLoginScript = async (
+  environmentArg: IReleaseArtifactEnvironment,
+  scriptArg: string,
+  timeoutMsArg: number = defaultCommandTimeoutMs,
+): Promise<void> => {
+  const ownedRemoteScript = [
+    'set -u',
+    'exec 3<&0',
+    'child_pid=',
+    'watchdog_pid=',
+    'kill_tree() {',
+    '  local parent_pid children child_pid_to_kill',
+    '  parent_pid="$1"',
+    '  kill -STOP "$parent_pid" 2>/dev/null || return 0',
+    '  children="$(/usr/bin/pgrep -P "$parent_pid" 2>/dev/null || true)"',
+    '  for child_pid_to_kill in $children; do kill_tree "$child_pid_to_kill"; done',
+    '  kill -KILL "$parent_pid" 2>/dev/null || true',
+    '}',
+    'terminate_owned() { test -z "$child_pid" || kill_tree "$child_pid"; test -z "$watchdog_pid" || kill -KILL "$watchdog_pid" 2>/dev/null || true; }',
+    'watch_channel() { while IFS= read -r -t 45 ignored_line; do :; done; test -z "$child_pid" || kill_tree "$child_pid"; }',
+    'trap terminate_owned EXIT HUP INT TERM',
+    `/bin/zsh -lc ${shellQuote(scriptArg)} </dev/null &`,
+    'child_pid=$!',
+    'watch_channel <&3 &',
+    'watchdog_pid=$!',
+    'wait "$child_pid"',
+    'exit_status=$?',
+    'child_pid=',
+    'kill -KILL "$watchdog_pid" 2>/dev/null || true',
+    'wait "$watchdog_pid" 2>/dev/null || true',
+    'watchdog_pid=',
+    'exec 3<&-',
+    'trap - EXIT HUP INT TERM',
+    'exit "$exit_status"',
+  ].join('\n');
+  await runCommand(
+    'ssh',
+    [
+      ...sshConnectionArgs,
+      environmentArg.macosSsh,
+      `zsh -lic ${shellQuote(`/bin/sh -c ${shellQuote(ownedRemoteScript)}`)}`,
+    ],
+    process.cwd(),
+    timeoutMsArg,
+    true,
+  );
+};
+
+const checkBuilders = async (
+  environmentArg: IReleaseArtifactEnvironment,
+): Promise<void> => {
+  if (process.platform !== 'linux' || process.arch !== 'x64') {
+    throw new Error('SmartDB release artifact assembly requires a Linux amd64 coordinator');
+  }
+
+  await runCommand('git', ['--version'], process.cwd(), capabilityCommandTimeoutMs);
+  await runCommand('pnpm', ['--version'], process.cwd(), capabilityCommandTimeoutMs);
+  await captureCommand('/bin/sh', ['-c', 'command -v scp >/dev/null']);
+  const linuxProbeParent = path.join(process.cwd(), '.nogit', 'smartdb-release-probe');
+  fs.mkdirSync(linuxProbeParent, { recursive: true, mode: 0o700 });
+  const linuxProbeDirectory = fs.mkdtempSync(path.join(linuxProbeParent, 'arm64-'));
+  try {
+    const sourcePath = path.join(linuxProbeDirectory, 'probe.c');
+    const binaryPath = path.join(linuxProbeDirectory, 'probe');
+    fs.writeFileSync(sourcePath, 'int main(void) { return 0; }\n');
+    await runCommand(
+      'aarch64-linux-gnu-gcc',
+      ['-static', '-O2', sourcePath, '-o', binaryPath],
+      process.cwd(),
+      capabilityCommandTimeoutMs,
+    );
+    await runCommand(binaryPath, [], process.cwd(), capabilityCommandTimeoutMs);
+  } finally {
+    fs.rmSync(linuxProbeDirectory, { recursive: true, force: true });
+  }
+
+  const probeToken = crypto.randomUUID();
+  const probePath = `${environmentArg.macosTempRoot}/smartdb-release-check.${probeToken}`;
+  const remoteCheckScript = [
+    'set -eu',
+    'test "$(uname -s)" = "Darwin"',
+    'test "$(uname -m)" = "arm64"',
+    'command -v git >/dev/null',
+    'command -v pnpm >/dev/null',
+    'command -v codesign >/dev/null',
+    'command -v cmp >/dev/null',
+    `root=${shellQuote(environmentArg.macosTempRoot)}`,
+    `probe=${shellQuote(probePath)}`,
+    `test "$probe" = "$root/smartdb-release-check.${probeToken}"`,
+    'mkdir -p "$root"',
+    'test "$(cd "$root" && pwd -P)" = "$root"',
+    'created=0',
+    `cleanup_probe() { if [ "$created" = 1 ]; then test ! -f "$probe/.smartdb-release-owner" || test "$(cat "$probe/.smartdb-release-owner")" = ${shellQuote(probeToken)} || return; rm -f "$probe/.smartdb-release-owner"; rmdir "$probe" 2>/dev/null || true; fi; }`,
+    'trap cleanup_probe EXIT HUP INT TERM',
+    'mkdir -m 700 "$probe"',
+    'created=1',
+    `printf '%s\\n' ${shellQuote(probeToken)} > "$probe/.smartdb-release-owner"`,
+    'rm -f "$probe/.smartdb-release-owner"',
+    'rmdir "$probe"',
+    'trap - EXIT HUP INT TERM',
+    '/usr/bin/arch -x86_64 /usr/bin/true',
+  ].join('\n');
+  await runRemoteLoginScript(
+    environmentArg,
+    remoteCheckScript,
+    capabilityCommandTimeoutMs,
+  );
+  console.log('All SmartDB release builders can execute their assigned architectures.');
+};
+
+const assertArtifactSet = (directoryArg: string, targetsArg: string[]): void => {
+  const expectedNames = targetsArg.flatMap((targetArg) => [
+    `rustdb_${targetArg}`,
+    `rustdb_${targetArg}${provenanceSuffix}`,
+  ]);
+  const actualNames = fs.readdirSync(directoryArg).sort();
+  if (JSON.stringify(actualNames) !== JSON.stringify(expectedNames.sort())) {
+    throw new Error(
+      `Unexpected release artifact set in ${directoryArg}: ${actualNames.join(', ')}`,
+    );
+  }
+  for (const target of targetsArg) {
+    const binaryPath = path.join(directoryArg, `rustdb_${target}`);
+    const stat = fs.lstatSync(binaryPath);
+    if (!stat.isFile() || (stat.mode & 0o111) === 0) {
+      throw new Error(`Release artifact is not an executable regular file: ${binaryPath}`);
+    }
+  }
+};
+
+const remoteWorkspacePath = (
+  environmentArg: IReleaseArtifactEnvironment,
+  gitCommitArg: string,
+  ownerTokenArg: string,
+): string =>
+  `${environmentArg.macosTempRoot}/smartdb-release.${gitCommitArg}.${ownerTokenArg}`;
+
+const assertOwnedRemoteWorkspacePath = (
+  environmentArg: IReleaseArtifactEnvironment,
+  remoteDirectoryArg: string,
+  gitCommitArg: string,
+  ownerTokenArg: string,
+): void => {
+  const expectedDirectory = remoteWorkspacePath(
+    environmentArg,
+    gitCommitArg,
+    ownerTokenArg,
+  );
+  if (
+    remoteDirectoryArg !== expectedDirectory ||
+    path.posix.dirname(remoteDirectoryArg) !== environmentArg.macosTempRoot ||
+    path.posix.normalize(remoteDirectoryArg) !== remoteDirectoryArg
+  ) {
+    throw new Error(`Refusing unsafe macOS release workspace path: ${remoteDirectoryArg}`);
+  }
+};
+
+const createRemoteWorkspace = async (
+  environmentArg: IReleaseArtifactEnvironment,
+  remoteDirectoryArg: string,
+  gitCommitArg: string,
+  ownerTokenArg: string,
+): Promise<void> => {
+  assertOwnedRemoteWorkspacePath(
+    environmentArg,
+    remoteDirectoryArg,
+    gitCommitArg,
+    ownerTokenArg,
+  );
+  const createScript = [
+    'set -eu',
+    `root=${shellQuote(environmentArg.macosTempRoot)}`,
+    `directory=${shellQuote(remoteDirectoryArg)}`,
+    `test "$directory" = "$root/smartdb-release.${gitCommitArg}.${ownerTokenArg}"`,
+    'mkdir -p "$root"',
+    'test "$(cd "$root" && pwd -P)" = "$root"',
+    'created=0',
+    `cleanup_unowned() { if [ "$created" = 1 ]; then test ! -f "$directory/.smartdb-release-owner" || test "$(cat "$directory/.smartdb-release-owner")" = ${shellQuote(ownerTokenArg)} || return; rm -f "$directory/.smartdb-release-owner"; rmdir "$directory" 2>/dev/null || true; fi; }`,
+    'trap cleanup_unowned EXIT HUP INT TERM',
+    'mkdir -m 700 "$directory"',
+    'created=1',
+    `printf '%s\\n' ${shellQuote(ownerTokenArg)} > "$directory/.smartdb-release-owner"`,
+    'trap - EXIT HUP INT TERM',
+  ].join('\n');
+  await runCommand(
+    'ssh',
+    [...sshConnectionArgs, environmentArg.macosSsh, createScript],
+    process.cwd(),
+    capabilityCommandTimeoutMs,
+  );
+};
+
+const cleanupRemoteWorkspace = async (
+  environmentArg: IReleaseArtifactEnvironment,
+  remoteDirectoryArg: string,
+  gitCommitArg: string,
+  ownerTokenArg: string,
+): Promise<void> => {
+  assertOwnedRemoteWorkspacePath(
+    environmentArg,
+    remoteDirectoryArg,
+    gitCommitArg,
+    ownerTokenArg,
+  );
+  const cleanupScript = [
+    'set -eu',
+    `root=${shellQuote(environmentArg.macosTempRoot)}`,
+    `directory=${shellQuote(remoteDirectoryArg)}`,
+    `test "$directory" = "$root/smartdb-release.${gitCommitArg}.${ownerTokenArg}"`,
+    'test "$(cd "$root" && pwd -P)" = "$root"',
+    'test -f "$directory/.smartdb-release-owner"',
+    `test "$(cat "$directory/.smartdb-release-owner")" = ${shellQuote(ownerTokenArg)}`,
+    'rm -rf "$directory"',
+  ].join('\n');
+  await runCommand('ssh', [...sshConnectionArgs, environmentArg.macosSsh, cleanupScript]);
+};
+
+const buildArtifacts = async (
+  environmentArg: IReleaseArtifactEnvironment,
+): Promise<void> => {
+  await checkBuilders(environmentArg);
+
+  const workspace = process.cwd();
+  const branch = await captureCommand('git', ['branch', '--show-current'], workspace);
+  const gitCommit = await captureCommand('git', ['rev-parse', 'HEAD'], workspace);
+  const gitStatus = await captureCommand(
+    'git',
+    ['status', '--porcelain=v1', '--untracked-files=all'],
+    workspace,
+  );
+  const packageJson = JSON.parse(
+    fs.readFileSync(path.join(workspace, 'package.json'), 'utf8'),
+  ) as { version?: string };
+  const expectedTag = `v${packageJson.version || ''}`;
+  const tagsAtHead = (
+    await captureCommand('git', ['tag', '--points-at', 'HEAD'], workspace)
+  ).split(/\r?\n/);
+  if (branch !== 'main') throw new Error('SmartDB releases must be built from main');
+  if (gitStatus) throw new Error('SmartDB release artifact build requires a clean worktree');
+  if (!packageJson.version || !tagsAtHead.includes(expectedTag)) {
+    throw new Error(`SmartDB release artifact build requires ${expectedTag} at HEAD`);
+  }
+
+  const releaseParent = path.join(workspace, '.nogit', 'smartdb-release');
+  fs.mkdirSync(releaseParent, { recursive: true, mode: 0o700 });
+  const localDirectory = fs.mkdtempSync(
+    path.join(releaseParent, `${gitCommit.slice(0, 12)}-`),
+  );
+  const linuxDirectory = path.join(localDirectory, 'linux');
+  const macosDirectory = path.join(localDirectory, 'macos');
+  const bundlePath = path.join(localDirectory, 'source.bundle');
+  const ownerToken = crypto.randomUUID();
+  let remoteDirectory: string | undefined;
+  let completed = false;
+
+  try {
+    await runCommand('pnpm', ['exec', 'tsbundle'], workspace);
+    await runCommand('pnpm', ['exec', 'tsbuild', 'tsfolders'], workspace);
+    await runCommand('pnpm', ['exec', 'tsrust'], workspace);
+
+    fs.cpSync(path.join(workspace, 'dist_rust'), linuxDirectory, {
+      recursive: true,
+      preserveTimestamps: true,
+    });
+    assertArtifactSet(linuxDirectory, ['linux_amd64', 'linux_arm64']);
+    await runCommand(path.join(linuxDirectory, 'rustdb_linux_amd64'), ['--version'], workspace);
+    await runCommand(
+      path.join(linuxDirectory, 'rustdb_linux_arm64'),
+      ['--version'],
+      workspace,
+    );
+
+    await runCommand('git', ['bundle', 'create', bundlePath, 'HEAD'], workspace);
+    remoteDirectory = remoteWorkspacePath(environmentArg, gitCommit, ownerToken);
+    await createRemoteWorkspace(
+      environmentArg,
+      remoteDirectory,
+      gitCommit,
+      ownerToken,
+    );
+    await runCommand('scp', [
+      '-p',
+      ...sshConnectionArgs,
+      bundlePath,
+      `${environmentArg.macosSsh}:${remoteDirectory}/source.bundle`,
+    ]);
+
+    const remoteWorkspace = `${remoteDirectory}/workspace`;
+    const remoteBuildScript = [
+      'set -eu',
+      `bundle=${shellQuote(`${remoteDirectory}/source.bundle`)}`,
+      `workspace=${shellQuote(remoteWorkspace)}`,
+      `expected_commit=${shellQuote(gitCommit)}`,
+      'git clone --quiet "$bundle" "$workspace"',
+      'cd "$workspace"',
+      'test "$(git rev-parse HEAD)" = "$expected_commit"',
+      'test -z "$(git status --porcelain=v1 --untracked-files=all)"',
+      'pnpm install --frozen-lockfile',
+      'pnpm exec tsrust',
+      'cmp .nogit/tsrust-target/aarch64-apple-darwin/release/rustdb dist_rust/rustdb_macos_arm64',
+      'cmp .nogit/tsrust-target/x86_64-apple-darwin/release/rustdb dist_rust/rustdb_macos_amd64',
+      'codesign --verify --deep --strict dist_rust/rustdb_macos_arm64',
+      'codesign --verify --deep --strict dist_rust/rustdb_macos_amd64',
+      '/usr/bin/arch -arm64 dist_rust/rustdb_macos_arm64 --version',
+      '/usr/bin/arch -x86_64 dist_rust/rustdb_macos_amd64 --version',
+      'test "$(git rev-parse HEAD)" = "$expected_commit"',
+      'test -z "$(git status --porcelain=v1 --untracked-files=all)"',
+    ].join('\n');
+    await runRemoteLoginScript(environmentArg, remoteBuildScript);
+    await runCommand('scp', [
+      '-pr',
+      ...sshConnectionArgs,
+      `${environmentArg.macosSsh}:${remoteWorkspace}/dist_rust`,
+      macosDirectory,
+    ]);
+    assertArtifactSet(macosDirectory, ['macos_amd64', 'macos_arm64']);
+
+    await runCommand(
+      'pnpm',
+      ['exec', 'tsrust', 'assemble', linuxDirectory, macosDirectory],
+      workspace,
+    );
+    assertArtifactSet(path.join(workspace, 'dist_rust'), [
+      'linux_amd64',
+      'linux_arm64',
+      'macos_amd64',
+      'macos_arm64',
+    ]);
+    for (const target of ['linux_amd64', 'linux_arm64', 'macos_amd64', 'macos_arm64']) {
+      await runCommand(
+        'pnpm',
+        ['exec', 'tsrust', 'inspect', `dist_rust/rustdb_${target}`],
+        workspace,
+      );
+    }
+
+    await cleanupRemoteWorkspace(
+      environmentArg,
+      remoteDirectory,
+      gitCommit,
+      ownerToken,
+    );
+    remoteDirectory = undefined;
+    fs.rmSync(localDirectory, { recursive: true });
+    completed = true;
+    console.log(`Assembled and qualified SmartDB release artifacts for ${expectedTag}.`);
+  } finally {
+    if (!completed) {
+      console.error(`Retained local release diagnostics at ${localDirectory}`);
+      if (remoteDirectory) {
+        console.error(`Retained macOS release diagnostics at ${remoteDirectory}`);
+      }
+    }
+  }
+};
+
+try {
+  const mode = process.argv.find((argumentArg) =>
+    ['check', 'build'].includes(argumentArg),
+  ) as TReleaseArtifactMode | undefined;
+  if (!mode) throw new Error('Usage: release-artifacts.ts <check|build>');
+  const environment = loadEnvironment();
+  if (mode === 'check') {
+    await checkBuilders(environment);
+  } else {
+    await buildArtifacts(environment);
+  }
+} catch (error) {
+  console.error(error);
+  process.exitCode = 1;
+}

package/third-party-notices.md

@@ -1,6 +1,6 @@
 # Third-Party Notices
 
-The statically linked Rust executables distributed with this package include
+The Rust executables distributed with this package include
 third-party components. This document covers the complete third-party package
 set recorded by `rust/Cargo.lock`, including target-inactive and compile-time
 components. The nine `rustdb*` workspace crates are covered by the package's

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdb',
-  version: '5.0.5',
+  version: '5.2.0',
   description: 'A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.'
 }

package/ts/index.ts

@@ -14,6 +14,13 @@ export type {
   ILocalSmartDbOfflinePhysicalNamespaceInspectionResult,
   ILocalSmartDbOfflineStringValueInspection,
   TLocalSmartDbOfflineStringValueInspectionResult,
+  ILocalSmartDbStoppedStorageRootRelocationInput,
+  ILocalSmartDbStoppedStorageRootRelocationReceipt,
+  TLocalSmartDbStorageRootRelocationErrorCode,
+} from './ts_local/index.js';
+export {
+  LocalSmartDbStorageRootRelocationError,
+  localSmartDbStorageRootRelocationErrorCodes,
 } from './ts_local/index.js';
 
 // Export migration