@rehearsal-labs/retest 0.2.0 → 0.3.0

package/dist/cli/install/supervisor-locate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-locate.d.ts","sourceRoot":"","sources":["../../../src/cli/install/supervisor-locate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAa5D,6EAA6E;AAC7E,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AAEhF,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,gBAAgB,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC3C,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAGD,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,EAAE,MAAwC,CAAA;AAE/E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,EAAE,MAAM,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAIzG;AAED,gIAAgI;AAChI,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAQtM;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,GAAG,iBAAiB,CAsB9E"}

package/dist/cli/install/supervisor-locate.js

@@ -0,0 +1,113 @@
+import { createHash } from 'node:crypto';
+import { closeSync, fstatSync, lstatSync, openSync, readSync } from 'node:fs';
+import { win32 } from 'node:path';
+import { errorMessage } from "../../protocol/failures.js";
+import { parse, s } from "../../protocol/schema.js";
+import { isMissingFile } from "../../shared/error-code.js";
+import { maximumSupervisorBinaryBytes, maximumSupervisorSourceBytes, supervisorExecutable, supervisorSourceDigest, supervisorTarget, supervisorVersion } from "./supervisor-pins.js";
+const recordSchema = s.object({ schemaVersion: s.literal(1), version: s.string(), sourceDigest: s.string(), target: s.enum(['x86_64-pc-windows-msvc']), rustcVersion: s.string(), binarySha256: s.string(), notices: s.array(s.object({ path: s.string(), sha256: s.string() })), installedAt: s.string(), installedBy: s.string() });
+/** The command a person runs to install the supervisor. */
+export const supervisorInstallCommand = 'npx retest install supervisor';
+/**
+ * The cache folder one supervisor build is installed in: `%LOCALAPPDATA%\retest\supervisor\…`, beside the browsers in
+ * the root `cacheFolders` gives on Windows, the one platform it is built for. LOCALAPPDATA is read in any case, as
+ * Windows reads it.
+ *
+ * @example supervisorFolder(process.env, 'x86_64-pc-windows-msvc') // 'C:\\Users\\ada\\AppData\\Local\\retest\\supervisor\\supervisor-0.1.0-x86_64-pc-windows-msvc'
+ */
+export function supervisorFolder(env, target) {
+    const local = env['LOCALAPPDATA'] ?? Object.entries(env).find(([name]) => name.toUpperCase() === 'LOCALAPPDATA')?.[1];
+    if (local === undefined || !win32.isAbsolute(local))
+        return undefined;
+    return win32.join(local, 'retest', 'supervisor', `supervisor-${supervisorVersion}-${target}`);
+}
+/** A `build.json` read as this version's record, or why it is not one; its notices and toolchain are the install's to check. */
+export function readSupervisorRecord(path, text, target) {
+    let parsed;
+    try {
+        parsed = parse(recordSchema, JSON.parse(text));
+    }
+    catch {
+        return { ok: false, problem: `${path} is not JSON.` };
+    }
+    if (!parsed.ok)
+        return { ok: false, problem: `${path} is not a valid supervisor build record.` };
+    const record = parsed.value;
+    if (record.version !== supervisorVersion || record.target !== target || record.sourceDigest !== supervisorSourceDigest)
+        return { ok: false, problem: `${path} names another supervisor version, source or target.` };
+    if (!/^[a-f0-9]{64}$/.test(record.binarySha256) || !Number.isFinite(Date.parse(record.installedAt)) || record.installedBy === '')
+        return { ok: false, problem: `${path} has an invalid checksum or installer identity.` };
+    return { ok: true, record };
+}
+/**
+ * The supervisor the runner runs, found as it starts its first process on Windows: the executable
+ * RETEST_SUPERVISOR_BINARY names, as a developer build is given, or the installed one, read back against its record and
+ * its checksum. It reads synchronously, since it runs once, right before a launch that cannot start without it. Throws a
+ * sentence that says how to install it.
+ *
+ * @example const program = locateSupervisor(process.env) // { command: '…\\retest-supervisor.exe', args: [], environment: { SystemRoot: 'C:\\Windows' } }
+ */
+export function locateSupervisor(env) {
+    const environment = { SystemRoot: env['SystemRoot'] ?? env['SYSTEMROOT'] ?? 'C:\\Windows' };
+    const explicit = env['RETEST_SUPERVISOR_BINARY'];
+    if (explicit !== undefined && explicit !== '') {
+        if (!win32.isAbsolute(explicit))
+            throw new Error(`RETEST_SUPERVISOR_BINARY is ${explicit}, which is not an absolute path.`);
+        if (lstatSync(explicit, { throwIfNoEntry: false })?.isFile() !== true)
+            throw new Error(`RETEST_SUPERVISOR_BINARY names ${explicit}, which is not a file.`);
+        return { command: explicit, args: [], environment };
+    }
+    const target = supervisorTarget();
+    if (target === undefined)
+        throw new Error(`retest-supervisor is for Windows x64, and this machine is ${process.platform} ${process.arch}.`);
+    const folder = supervisorFolder(env, target);
+    if (folder === undefined)
+        throw new Error(`LOCALAPPDATA names no folder, so Retest cannot find retest-supervisor. ${missingSentence}`);
+    const executable = win32.join(folder, supervisorExecutable);
+    const recordPath = win32.join(folder, 'build.json');
+    const recordText = readBounded(recordPath, maximumSupervisorSourceBytes);
+    if (recordText === undefined)
+        throw new Error(missingSentence);
+    const checked = readSupervisorRecord(recordPath, recordText.toString('utf8'), target);
+    if (!checked.ok)
+        throw new Error(`${checked.problem} Remove ${folder}, then run ${supervisorInstallCommand}.`);
+    const binary = readBounded(executable, maximumSupervisorBinaryBytes);
+    if (binary === undefined)
+        throw new Error(`${executable} is missing. Remove ${folder}, then run ${supervisorInstallCommand}.`);
+    if (createHash('sha256').update(binary).digest('hex') !== checked.record.binarySha256)
+        throw new Error(`${executable} does not match its record. Remove ${folder}, then run ${supervisorInstallCommand}.`);
+    return { command: executable, args: [], environment };
+}
+const missingSentence = `Retest needs retest-supervisor on Windows to end everything it starts. Run ${supervisorInstallCommand}.`;
+// A regular file's bytes, read through one descriptor, or undefined when nothing is there; a file past the bound, or one
+// that is not a regular file, is refused by name.
+function readBounded(path, maximumBytes) {
+    let descriptor;
+    try {
+        descriptor = openSync(path, 'r');
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return undefined;
+        throw new Error(`${path} cannot be read: ${errorMessage(error)}`);
+    }
+    try {
+        const stats = fstatSync(descriptor);
+        if (!stats.isFile() || stats.size > maximumBytes)
+            throw new Error(`${path} is not a regular file of at most ${maximumBytes} bytes.`);
+        const bytes = Buffer.alloc(stats.size);
+        let filled = 0;
+        while (filled < bytes.length) {
+            const read = readSync(descriptor, bytes, filled, bytes.length - filled, filled);
+            if (read === 0)
+                break;
+            filled += read;
+        }
+        if (filled !== stats.size)
+            throw new Error(`${path} changed size while it was read.`);
+        return bytes;
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}

package/dist/cli/install/supervisor-pins.d.ts

@@ -0,0 +1,21 @@
+export declare const supervisorVersion: string;
+export declare const minimumSupervisorRust: string;
+/** Fixed limits for the built binary and each shipped source or notice file. */
+export declare const maximumSupervisorBinaryBytes: number;
+export declare const maximumSupervisorSourceBytes: number;
+export declare const supervisorSourceDigest: string;
+export declare const supervisorSourceFiles: readonly {
+    readonly path: string;
+    readonly sha256: string;
+}[];
+/** The one target the supervisor is for: Windows on x64. Windows on Arm comes in a later version. */
+export type SupervisorTarget = 'x86_64-pc-windows-msvc';
+/**
+ * The supervisor's build target on this machine, or undefined where Retest needs no supervisor or has none yet.
+ *
+ * @example supervisorTarget('win32', 'x64') // 'x86_64-pc-windows-msvc'
+ */
+export declare function supervisorTarget(platform?: NodeJS.Platform, arch?: string): SupervisorTarget | undefined;
+/** The executable `cargo build` writes and the install keeps. */
+export declare const supervisorExecutable: string;
+//# sourceMappingURL=supervisor-pins.d.ts.map

package/dist/cli/install/supervisor-pins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-pins.d.ts","sourceRoot":"","sources":["../../../src/cli/install/supervisor-pins.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,iBAAiB,EAAE,MAAgB,CAAA;AAChD,eAAO,MAAM,qBAAqB,EAAE,MAAiB,CAAA;AACrD,gFAAgF;AAChF,eAAO,MAAM,4BAA4B,EAAE,MAAyB,CAAA;AACpE,eAAO,MAAM,4BAA4B,EAAE,MAAoB,CAAA;AAC/D,eAAO,MAAM,sBAAsB,EAAE,MAA2E,CAAA;AAChH,eAAO,MAAM,qBAAqB,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAU9F,CAAA;AAED,qGAAqG;AACrG,MAAM,MAAM,gBAAgB,GAAG,wBAAwB,CAAA;AAEvD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAAE,IAAI,GAAE,MAAqB,GAAG,gBAAgB,GAAG,SAAS,CAExI;AAED,iEAAiE;AACjE,eAAO,MAAM,oBAAoB,EAAE,MAAgC,CAAA"}

package/dist/cli/install/supervisor-pins.js

@@ -0,0 +1,28 @@
+// Pinned source files and notices of retest-supervisor. Regenerate together after a reviewed crate or lock change.
+export const supervisorVersion = '0.1.0';
+export const minimumSupervisorRust = '1.88.0';
+/** Fixed limits for the built binary and each shipped source or notice file. */
+export const maximumSupervisorBinaryBytes = 16 * 1024 * 1024;
+export const maximumSupervisorSourceBytes = 1024 * 1024;
+export const supervisorSourceDigest = '7790e5960f4247f8370a6b361d7f183b2b153f938c3a3fc091e723edd7f4e8a8';
+export const supervisorSourceFiles = [
+    { path: 'supervisor/Cargo.toml', sha256: '8b21a215325f93ae556e4119cbf5e1161592bd9798aedb64e892b21b730fbf85' },
+    { path: 'supervisor/Cargo.lock', sha256: '5b18a75f3d341cc37c4c0178195ab3b29888e46b205e4e7ae59cadc041b403c9' },
+    { path: 'supervisor/build.rs', sha256: 'a1a635b6ace744ef9f0cadf8540f01daeefa0783d9789da0de0266ff3206cc82' },
+    { path: 'supervisor/src/command.rs', sha256: 'f395868828e1d3dcf39e6deb1165af62150add2df90059753aa22f781bc89299' },
+    { path: 'supervisor/src/jobs.rs', sha256: '2b78eea05a8037b2442290215c7ad12634f8ccd962f491dfdb0f1f5f9bb0d579' },
+    { path: 'supervisor/src/main.rs', sha256: '7a4ac8c30bd4401bb2e3cbc4d6621ea15444f5ddf2820388b7d5faffe8bf7e83' },
+    { path: 'supervisor/src/reply.rs', sha256: '97cca24d9a3a3d0403f37697b39aa6e134860aebb1a3345f0dfc19d07b95d3bd' },
+    { path: 'supervisor/NOTICES', sha256: 'b78dcadcbc81915a91a475ff1a6603b1b5261bb23d83e0fd36919bf782af8a1d' },
+    { path: 'LICENSE', sha256: 'cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30' },
+];
+/**
+ * The supervisor's build target on this machine, or undefined where Retest needs no supervisor or has none yet.
+ *
+ * @example supervisorTarget('win32', 'x64') // 'x86_64-pc-windows-msvc'
+ */
+export function supervisorTarget(platform = process.platform, arch = process.arch) {
+    return platform === 'win32' && arch === 'x64' ? 'x86_64-pc-windows-msvc' : undefined;
+}
+/** The executable `cargo build` writes and the install keeps. */
+export const supervisorExecutable = 'retest-supervisor.exe';

package/dist/cli/install/supervisor-record.d.ts

@@ -0,0 +1,31 @@
+import type { FileIdentity, FileReadControl } from '../../shared/regular-file.ts';
+import type { SupervisorEnvironment, SupervisorRecord } from './supervisor-locate.ts';
+import type { SupervisorTarget } from './supervisor-pins.ts';
+export type { SupervisorEnvironment, SupervisorRecord } from './supervisor-locate.ts';
+export { locateSupervisor, supervisorFolder, supervisorInstallCommand } from './supervisor-locate.ts';
+export type SupervisorInspection = {
+    readonly engine: 'supervisor';
+    readonly version: string;
+    readonly target: SupervisorTarget;
+    readonly state: 'missing' | 'installed' | 'damaged';
+    readonly folder: string;
+    readonly executablePath: string;
+    readonly problems: readonly string[];
+    readonly record?: SupervisorRecord;
+    readonly executableIdentity?: FileIdentity;
+};
+export declare function supervisorPackageRoot(): string;
+export declare function supervisorLockPath(folder: string): string;
+/** The notices an installed supervisor carries beside it, under the names it keeps them by. */
+export declare function supervisorNoticePins(): {
+    path: string;
+    sha256: string;
+}[];
+/** Hashes the pinned allowlist only. A changed, absent or non-regular source is refused before cargo runs. */
+export declare function checkSupervisorSource(root: string, options?: FileReadControl): Promise<string | undefined>;
+/** Reads an installed supervisor back: its record, its binary and notices against the record, and nothing else beside them. */
+export declare function inspectSupervisor(env: SupervisorEnvironment, options?: FileReadControl & {
+    readonly target?: SupervisorTarget;
+    readonly verify?: boolean;
+}): Promise<SupervisorInspection | undefined>;
+//# sourceMappingURL=supervisor-record.d.ts.map

package/dist/cli/install/supervisor-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-record.d.ts","sourceRoot":"","sources":["../../../src/cli/install/supervisor-record.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAa5D,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAErG,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IAC1F,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IAC5E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,YAAY,CAAA;CAC3C,CAAA;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAAwE;AAEvH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAA+E;AAEzI,+FAA+F;AAC/F,wBAAgB,oBAAoB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,CAEzE;AAED,8GAA8G;AAC9G,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAWpH;AAED,+HAA+H;AAC/H,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,qBAAqB,EAAE,OAAO,GAAE,eAAe,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAwChN"}

package/dist/cli/install/supervisor-record.js

@@ -0,0 +1,104 @@
+import { createHash } from 'node:crypto';
+import { lstat, readdir } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Deadline } from "../../protocol/deadline.js";
+import { errorMessage } from "../../protocol/failures.js";
+import { isMissingFile } from "../../shared/error-code.js";
+import { checkFileIdentity, readFileSha256, readRecordText } from "../../shared/regular-file.js";
+import { rustAtLeast } from "./media-tools.js";
+import { readSupervisorRecord, supervisorFolder } from "./supervisor-locate.js";
+import { maximumSupervisorBinaryBytes, maximumSupervisorSourceBytes, minimumSupervisorRust, supervisorExecutable, supervisorSourceDigest, supervisorSourceFiles, supervisorTarget, supervisorVersion } from "./supervisor-pins.js";
+export { locateSupervisor, supervisorFolder, supervisorInstallCommand } from "./supervisor-locate.js";
+export function supervisorPackageRoot() { return resolve(dirname(fileURLToPath(import.meta.url)), '../../..'); }
+export function supervisorLockPath(folder) { return join(dirname(dirname(folder)), 'locks', `${basename(folder)}.lock`); }
+/** The notices an installed supervisor carries beside it, under the names it keeps them by. */
+export function supervisorNoticePins() {
+    return supervisorSourceFiles.filter((file) => file.path === 'LICENSE' || file.path === 'supervisor/NOTICES').map((file) => ({ path: file.path === 'LICENSE' ? 'LICENSE' : 'THIRD-PARTY-NOTICES.txt', sha256: file.sha256 }));
+}
+/** Hashes the pinned allowlist only. A changed, absent or non-regular source is refused before cargo runs. */
+export async function checkSupervisorSource(root, options = {}) {
+    const deadline = options.deadline ?? new Deadline(15_000, { signal: options.signal });
+    const hash = createHash('sha256');
+    for (const file of supervisorSourceFiles) {
+        const path = join(root, ...file.path.split('/'));
+        const reading = await readFileSha256(path, { maximumBytes: maximumSupervisorSourceBytes, deadline, ...(options.signal === undefined ? {} : { signal: options.signal }) });
+        if (reading.kind !== 'file')
+            return reading.kind === 'other' ? reading.problem : `${path} is missing. Reinstall the Retest package with its supervisor source and notices.`;
+        if (reading.sha256 !== file.sha256)
+            return `${path} has SHA-256 ${reading.sha256}, not the pinned ${file.sha256}. Reinstall the Retest package; cargo was not run.`;
+        hash.update(`${file.path}\0${reading.sha256}\n`);
+    }
+    return hash.digest('hex') === supervisorSourceDigest ? undefined : 'The supervisor source manifest does not match its pinned digest. Reinstall Retest.';
+}
+/** Reads an installed supervisor back: its record, its binary and notices against the record, and nothing else beside them. */
+export async function inspectSupervisor(env, options = {}) {
+    const deadline = options.deadline ?? new Deadline(15_000, { signal: options.signal });
+    const target = options.target ?? supervisorTarget();
+    if (target === undefined)
+        return undefined;
+    const folder = supervisorFolder(env, target);
+    if (folder === undefined)
+        return undefined;
+    const base = { engine: 'supervisor', version: supervisorVersion, target, folder, executablePath: join(folder, supervisorExecutable) };
+    const bad = (problem) => ({ ...base, state: 'damaged', problems: [problem] });
+    try {
+        const stats = await lstat(folder);
+        if (!stats.isDirectory())
+            return bad(`${folder} is not a regular cache folder. Remove it before installing again.`);
+    }
+    catch (error) {
+        return isMissingFile(error) ? { ...base, state: 'missing', problems: [] } : bad(`${folder} cannot be read: ${errorMessage(error)}`);
+    }
+    const path = join(folder, 'build.json');
+    const read = await readRecordText(path, { deadline, ...(options.signal === undefined ? {} : { signal: options.signal }) });
+    if (read.kind !== 'text')
+        return bad(`${path} cannot be read: ${read.kind === 'missing' ? 'it is missing' : read.problem}.`);
+    const checked = checkRecord(path, read.text, target);
+    if (!checked.ok)
+        return bad(checked.problem);
+    const record = checked.record;
+    const notices = supervisorNoticePins();
+    let executableIdentity;
+    for (const file of [{ path: supervisorExecutable, sha256: record.binarySha256 }, ...notices]) {
+        const filePath = join(folder, file.path);
+        const reading = await readFileSha256(filePath, { maximumBytes: file.path === supervisorExecutable ? maximumSupervisorBinaryBytes : maximumSupervisorSourceBytes, deadline, ...(options.signal === undefined ? {} : { signal: options.signal }) });
+        if (reading.kind !== 'file')
+            return bad(reading.kind === 'missing' ? `${filePath} is missing.` : reading.problem);
+        if (reading.sha256 !== file.sha256)
+            return bad(`${filePath} has SHA-256 ${reading.sha256}, not the recorded ${file.sha256}.`);
+        if (file.path === supervisorExecutable)
+            executableIdentity = reading.identity;
+    }
+    if (options.verify === true) {
+        const allowed = new Set(['build.json', supervisorExecutable, ...notices.map((notice) => notice.path)]);
+        let names;
+        try {
+            names = await readdir(folder);
+        }
+        catch (error) {
+            return bad(`${folder} cannot be checked: ${errorMessage(error)}.`);
+        }
+        const unexpected = names.filter((name) => !allowed.has(name));
+        if (unexpected.length > 0)
+            return bad(`${folder} holds unrecorded entries: ${unexpected.slice(0, 5).join(', ')}.`);
+    }
+    if (executableIdentity === undefined)
+        return bad(`${base.executablePath} has no hashed file identity.`);
+    const changed = await checkFileIdentity(base.executablePath, executableIdentity);
+    if (changed !== undefined)
+        return bad(changed);
+    return { ...base, state: 'installed', problems: [], record, executableIdentity };
+}
+// The record as the locator reads it, and also the toolchain it names and the notices it lists, which an install
+// checks and a launch has no need to.
+function checkRecord(path, text, target) {
+    const read = readSupervisorRecord(path, text, target);
+    if (!read.ok)
+        return read;
+    if (!rustAtLeast(read.record.rustcVersion, minimumSupervisorRust))
+        return { ok: false, problem: `${path} names no supported rustc build version.` };
+    if (JSON.stringify(read.record.notices) !== JSON.stringify(supervisorNoticePins()))
+        return { ok: false, problem: `${path} does not name the pinned licence notices.` };
+    return read;
+}

package/dist/cli/install/supervisor-report.d.ts

@@ -0,0 +1,11 @@
+import type { Marks } from '../../reporters/style.ts';
+import type { SupervisorInspection } from './supervisor-record.ts';
+import type { SupervisorInstallResult } from './supervisor-install.ts';
+/**
+ * Adds the supervisor to the install list, as text or as one more build in the JSON document. Where no supervisor is
+ * needed there is nothing to add, and the list is left exactly as it was.
+ */
+export declare function renderSupervisorListing(listing: string, inspection: SupervisorInspection | undefined, json: boolean): string;
+/** The install's outcome, marked as the console can draw it: a plain Windows console has no check or cross glyph. */
+export declare function renderSupervisorInstall(result: SupervisorInstallResult, marks?: Marks): string;
+//# sourceMappingURL=supervisor-report.d.ts.map

package/dist/cli/install/supervisor-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-report.d.ts","sourceRoot":"","sources":["../../../src/cli/install/supervisor-report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAMtE;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,SAAS,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAgB5H;AAED,qHAAqH;AACrH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,EAAE,KAAK,GAAE,KAAoB,GAAG,MAAM,CAG5G"}

package/dist/cli/install/supervisor-report.js

@@ -0,0 +1,33 @@
+import { isArray, isPlainObject } from "../../protocol/schema.js";
+import { unicodeMarks } from "../../reporters/style.js";
+import { supervisorSourceDigest } from "./supervisor-pins.js";
+import { supervisorInstallCommand } from "./supervisor-locate.js";
+/**
+ * Adds the supervisor to the install list, as text or as one more build in the JSON document. Where no supervisor is
+ * needed there is nothing to add, and the list is left exactly as it was.
+ */
+export function renderSupervisorListing(listing, inspection, json) {
+    if (inspection === undefined)
+        return listing;
+    if (!json) {
+        const problems = inspection.problems.map((problem) => `                   ${problem}\n`).join('');
+        const last = inspection.record === undefined ? `Run ${supervisorInstallCommand}.` : `binary SHA-256 ${inspection.record.binarySha256}`;
+        return `${listing}\n  supervisor       retest-supervisor ${inspection.version}, ${inspection.target}\n                   ${inspection.state}\n                   ${inspection.executablePath}\n${problems}                   ${last}\n`;
+    }
+    const document = JSON.parse(listing);
+    if (!isPlainObject(document) || document['schemaVersion'] !== 1 || !isArray(document['builds']))
+        throw new Error('The install list did not match its versioned document.');
+    const supervisor = {
+        engine: 'supervisor', title: 'retest-supervisor', version: inspection.version, target: inspection.target, source: 'shipped crate source', pinnedSha256: null,
+        sourceDigest: supervisorSourceDigest, state: inspection.state, folder: inspection.folder, executablePath: inspection.executablePath,
+        binarySha256: inspection.record?.binarySha256, rustcVersion: inspection.record?.rustcVersion, installedAt: inspection.record?.installedAt,
+        problems: inspection.problems, install: { command: supervisorInstallCommand },
+    };
+    return `${JSON.stringify({ ...document, builds: [...document['builds'], supervisor] }, null, 2)}\n`;
+}
+/** The install's outcome, marked as the console can draw it: a plain Windows console has no check or cross glyph. */
+export function renderSupervisorInstall(result, marks = unicodeMarks) {
+    if (!result.ok)
+        return `  ${marks.failed} supervisor       ${result.message}\n`;
+    return `  ${marks.passed} supervisor       retest-supervisor ${result.inspection.version} ${result.action === 'installed' ? 'installed' : 'was already installed'}\n                     ${result.inspection.executablePath}\n                     binary SHA-256 ${result.inspection.record?.binarySha256 ?? 'unavailable'}\n                     Runs find it in this checked cache.\n`;
+}

package/dist/cli/install/supervisor-tools.d.ts

@@ -0,0 +1,43 @@
+import type { CommandResult } from '../../native/processes.ts';
+import type { SupervisorEnvironment } from './supervisor-locate.ts';
+export type SupervisorToolOptions = {
+    readonly env: SupervisorEnvironment;
+    readonly signal?: AbortSignal | undefined;
+    readonly cwd?: string;
+    readonly timeoutMs?: number;
+    readonly environment?: Readonly<Record<string, string>>;
+};
+export type SupervisorToolRunner = (command: string, args: readonly string[], options: SupervisorToolOptions) => Promise<CommandResult>;
+/**
+ * Runs a build tool with only the variables `toolVariables` names, whatever case the environment spells them in. This
+ * is the one start on Windows no job holds, since the job's supervisor is what it builds: the tool is held by Node's own
+ * handle on it, which ends it at the deadline or the stop and lets no other process stand behind its pid, and the
+ * compilers it starts finish their own work. Nothing a test starts runs this way.
+ */
+export declare const runSupervisorTool: SupervisorToolRunner;
+/**
+ * A tool on PATH, by its own name, or by that name and `.exe` on Windows. A name with a folder in it is taken as given.
+ *
+ * @example await findSupervisorTool('cargo', process.env) // 'C:\\Users\\ada\\.cargo\\bin\\cargo.exe'
+ */
+export declare function findSupervisorTool(name: string, env: SupervisorEnvironment, platform?: NodeJS.Platform): Promise<string | undefined>;
+export type SupervisorRust = {
+    readonly ok: true;
+    readonly cargo: string;
+    readonly rustc: string;
+    readonly rustcVersion: string;
+    readonly target: string;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+export declare const supervisorRustFix: string;
+/** cargo and rustc on PATH, new enough, and the target rustc builds for by default. */
+export declare function readSupervisorRust(env: SupervisorEnvironment, signal: AbortSignal | undefined, run?: SupervisorToolRunner): Promise<SupervisorRust>;
+/**
+ * Asks a built supervisor for its version line, which must name this version and the target it was built for.
+ *
+ * @example await probeSupervisor(executable, 'x86_64-pc-windows-msvc', { env: process.env }) // undefined
+ */
+export declare function probeSupervisor(executable: string, target: string, options: SupervisorToolOptions, run?: SupervisorToolRunner): Promise<string | undefined>;
+//# sourceMappingURL=supervisor-tools.d.ts.map

package/dist/cli/install/supervisor-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-tools.d.ts","sourceRoot":"","sources":["../../../src/cli/install/supervisor-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAWnE,MAAM,MAAM,qBAAqB,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,CAAA;AACnO,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;AASvI;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBAkB/B,CAAA;AAcD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAa5J;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAC7M,eAAO,MAAM,iBAAiB,EAAE,MAAsJ,CAAA;AAEtL,uFAAuF;AACvF,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,EAAE,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,GAAE,oBAAwC,GAAG,OAAO,CAAC,cAAc,CAAC,CAc5K;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,GAAE,oBAAwC,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAMpL"}

package/dist/cli/install/supervisor-tools.js

@@ -0,0 +1,114 @@
+import { execFile } from 'node:child_process';
+import { constants } from 'node:fs';
+import { access, stat } from 'node:fs/promises';
+import { delimiter, isAbsolute, join, resolve } from 'node:path';
+import { describeCommand } from "../../native/processes.js";
+import { errorCode } from "../../shared/error-code.js";
+import { rustAtLeast } from "./media-tools.js";
+import { minimumSupervisorRust, supervisorVersion } from "./supervisor-pins.js";
+import { supervisorInstallCommand } from "./supervisor-locate.js";
+// What cargo and the MSVC linker need to find themselves and their caches on Windows, and nothing that carries a
+// credential: no test or evaluator variable reaches the build.
+const toolVariables = ['PATH', 'PATHEXT', 'SystemRoot', 'SystemDrive', 'windir', 'USERPROFILE', 'HOMEDRIVE', 'HOMEPATH', 'LOCALAPPDATA', 'APPDATA', 'ProgramData', 'ProgramFiles', 'ProgramFiles(x86)', 'ProgramW6432', 'CommonProgramFiles', 'CommonProgramFiles(x86)', 'TEMP', 'TMP', 'CARGO_HOME', 'CARGO_NET_OFFLINE', 'RUSTUP_HOME', 'RUSTUP_TOOLCHAIN', 'NUMBER_OF_PROCESSORS', 'PROCESSOR_ARCHITECTURE', 'HOME', 'TMPDIR'];
+// How much a build tool may print before it is stopped; a release build of the crate prints a few kilobytes.
+const toolOutputLimit = 16 * 1024 * 1024;
+/**
+ * Runs a build tool with only the variables `toolVariables` names, whatever case the environment spells them in. This
+ * is the one start on Windows no job holds, since the job's supervisor is what it builds: the tool is held by Node's own
+ * handle on it, which ends it at the deadline or the stop and lets no other process stand behind its pid, and the
+ * compilers it starts finish their own work. Nothing a test starts runs this way.
+ */
+export const runSupervisorTool = (command, args, options) => {
+    const environment = {};
+    for (const name of toolVariables) {
+        const value = valueOf(options.env, name);
+        if (value !== undefined)
+            environment[name] = value;
+    }
+    const { promise, resolve: settle } = Promise.withResolvers();
+    const ended = { code: null, signal: null, stdout: '', stderr: '', timedOut: false, stopped: false, started: true, cleanupProblems: [] };
+    if (options.signal?.aborted === true)
+        return Promise.resolve({ ...ended, stopped: true, started: false });
+    execFile(command, [...args], { env: { ...environment, ...options.environment }, ...(options.cwd === undefined ? {} : { cwd: options.cwd }), timeout: options.timeoutMs ?? 10_000, maxBuffer: toolOutputLimit, windowsHide: true, encoding: 'utf8', ...(options.signal === undefined ? {} : { signal: options.signal }) }, (error, stdout, stderr) => {
+        if (error === null)
+            return settle({ ...ended, code: 0, stdout, stderr });
+        if (errorCode(error) === 'ENOENT')
+            return settle({ ...ended, code: 127, stderr: error.message, started: false });
+        const stopped = options.signal?.aborted === true;
+        const exitCode = 'code' in error && typeof error.code === 'number' ? error.code : null;
+        const signal = 'signal' in error && typeof error.signal === 'string' ? error.signal : null;
+        settle({ ...ended, code: exitCode, signal: isSignal(signal) ? signal : null, stdout, stderr, stopped, timedOut: !stopped && 'killed' in error && error.killed === true });
+    });
+    return promise;
+};
+function isSignal(name) {
+    return name !== null && /^SIG[A-Z0-9]+$/.test(name);
+}
+// Windows treats variable names without regard to case; a copied environment does not.
+function valueOf(env, name) {
+    const exact = env[name];
+    if (exact !== undefined)
+        return exact;
+    const wanted = name.toLowerCase();
+    return Object.entries(env).find(([key]) => key.toLowerCase() === wanted)?.[1];
+}
+/**
+ * A tool on PATH, by its own name, or by that name and `.exe` on Windows. A name with a folder in it is taken as given.
+ *
+ * @example await findSupervisorTool('cargo', process.env) // 'C:\\Users\\ada\\.cargo\\bin\\cargo.exe'
+ */
+export async function findSupervisorTool(name, env, platform = process.platform) {
+    const names = platform === 'win32' && !name.toLowerCase().endsWith('.exe') ? [`${name}.exe`, name] : [name];
+    const paths = isAbsolute(name) || name.includes('/') || name.includes('\\')
+        ? [resolve(name)]
+        : (valueOf(env, 'PATH') ?? '').split(delimiter).filter((part) => isAbsolute(part)).flatMap((part) => names.map((each) => join(part, each)));
+    for (const path of paths) {
+        try {
+            if (!(await stat(path)).isFile())
+                continue;
+            await access(path, constants.X_OK);
+            return path;
+        }
+        catch {
+            continue;
+        }
+    }
+    return undefined;
+}
+export const supervisorRustFix = `Install Rust ${minimumSupervisorRust} or later with the MSVC toolchain, with cargo and rustc on PATH, then run ${supervisorInstallCommand}.`;
+/** cargo and rustc on PATH, new enough, and the target rustc builds for by default. */
+export async function readSupervisorRust(env, signal, run = runSupervisorTool) {
+    const cargo = await findSupervisorTool('cargo', env);
+    if (cargo === undefined)
+        return { ok: false, message: `cargo is missing from PATH. ${supervisorRustFix}` };
+    const rustc = await findSupervisorTool('rustc', env);
+    if (rustc === undefined)
+        return { ok: false, message: `rustc is missing from PATH. ${supervisorRustFix}` };
+    const cargoVersion = await run(cargo, ['--version'], { env, signal });
+    if (cargoVersion.stopped || cargoVersion.timedOut || cargoVersion.cleanupProblems.length > 0)
+        return { ok: false, message: `${describeCommand('cargo --version', cargoVersion)}. ${supervisorRustFix}` };
+    if (cargoVersion.code !== 0 || !rustAtLeast(cargoVersion.stdout, minimumSupervisorRust))
+        return { ok: false, message: `cargo is unreadable or older than Rust ${minimumSupervisorRust}. ${supervisorRustFix}` };
+    const rust = await run(rustc, ['-vV'], { env, signal });
+    if (rust.code !== 0 || rust.stopped || rust.timedOut || rust.cleanupProblems.length > 0)
+        return { ok: false, message: `${describeCommand('rustc -vV', rust)}. ${supervisorRustFix}` };
+    const version = rust.stdout.split(/\r?\n/)[0]?.trim() ?? '';
+    const target = /^host: ([a-z0-9_-]+)\r?$/m.exec(rust.stdout)?.[1];
+    if (!rustAtLeast(version, minimumSupervisorRust) || target === undefined)
+        return { ok: false, message: `rustc is unreadable or older than Rust ${minimumSupervisorRust}. ${supervisorRustFix}` };
+    return { ok: true, cargo, rustc, rustcVersion: version, target };
+}
+/**
+ * Asks a built supervisor for its version line, which must name this version and the target it was built for.
+ *
+ * @example await probeSupervisor(executable, 'x86_64-pc-windows-msvc', { env: process.env }) // undefined
+ */
+export async function probeSupervisor(executable, target, options, run = runSupervisorTool) {
+    const result = await run(executable, ['--version'], options);
+    if (result.code !== 0 || result.stopped || result.timedOut || result.cleanupProblems.length > 0)
+        return `${describeCommand('retest-supervisor --version', result)}. Nothing was installed.`;
+    const line = result.stdout.trim();
+    if (!line.startsWith(`retest-supervisor ${supervisorVersion} (${target},`))
+        return `The built supervisor names itself ${JSON.stringify(line.slice(0, 200))}, not retest-supervisor ${supervisorVersion} for ${target}. Nothing was installed.`;
+    return undefined;
+}

package/dist/cli/install/unpack.d.ts

@@ -4,6 +4,7 @@ export type UnpackTools = {
     readonly ditto: string;
     readonly unzip: string;
     readonly hdiutil: string;
+    readonly tar: string;
 };
 export declare const systemUnpackTools: UnpackTools;
 /** What `unpackArchive` needs: the verified archive, how it is packed, an empty folder to unpack into, and the host. */
@@ -15,20 +16,39 @@ export type UnpackRequest = {
     readonly tools: UnpackTools;
     readonly signal: AbortSignal;
     readonly timeoutMs: number;
+    /** Where a line goes about something the unpack left behind without failing, such as a copy it could not remove. */
+    readonly report: (line: string) => void;
 };
 /**
  * Unpacks a verified archive into an empty folder, and returns why it could not, or undefined once it has. A zip is
  * unpacked whole, keeping its links and modes; from a disk image, only the app bundle the pin names is copied, and the
- * image is detached again whatever happened.
+ * image is detached again whatever happened; from a Windows installer, only the folder the pin names is unpacked, out
+ * of the 7-Zip archive inside it, and its self-extracting stub never runs.
  *
- * @example await unpackArchive({ archive, format: { format: 'zip' }, into, platform: 'darwin', tools: systemUnpackTools, signal, timeoutMs: 600_000 })
+ * @example await unpackArchive({ archive, format: { format: 'zip' }, into, platform: 'darwin', tools: systemUnpackTools, signal, timeoutMs: 600_000, report: console.log })
  */
 export declare function unpackArchive(request: UnpackRequest): Promise<string | undefined>;
+/** Where a 7-Zip archive starts inside a file, or why none was found there. */
+export type SevenZipStart = {
+    readonly ok: true;
+    readonly offset: number;
+} | {
+    readonly ok: false;
+    readonly problem: string;
+};
+/**
+ * Where the 7-Zip archive inside a file begins: the first place its signature stands, within the stub's reach, with a
+ * start header whose checksum holds and whose index lies inside the file with the checksum the header gives it. A
+ * signature that is only bytes of the stub fails those checks and is passed over.
+ *
+ * @example await sevenZipStart('/…/Firefox Setup 158.0.1.exe') // { ok: true, offset: 131665 }
+ */
+export declare function sevenZipStart(path: string): Promise<SevenZipStart>;
 /**
  * The whole-disk devices `hdiutil info` lists for images mounted on one of `mountPoints`, or attached from one of
  * `images` with no mount point at all. An image mounted elsewhere is not counted.
  *
- * @example attachedDevices(text, { images: ['/…/Firefox 133.0.3.dmg'], mountPoints: ['/private/var/…/retest-install-image-a1b2'] }) // ['/dev/disk6']
+ * @example attachedDevices(text, { images: ['/…/Firefox 158.0.1.dmg'], mountPoints: ['/private/var/…/retest-install-image-a1b2'] }) // ['/dev/disk6']
  */
 export declare function attachedDevices(info: string, names: {
     readonly images: readonly string[];

package/dist/cli/install/unpack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unpack.d.ts","sourceRoot":"","sources":["../../../src/cli/install/unpack.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAY5D,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtG,eAAO,MAAM,iBAAiB,EAAE,WAA+F,CAAA;AAE/H,wHAAwH;AACxH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAKvF;AAyFD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,EAAE,CAY9I"}
+{"version":3,"file":"unpack.d.ts","sourceRoot":"","sources":["../../../src/cli/install/unpack.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAqB5D,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAA;AAM5H,eAAO,MAAM,iBAAiB,EAAE,WAAgH,CAAA;AAEhJ,wHAAwH;AACxH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,oHAAoH;IACpH,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACxC,CAAA;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAOvF;AA8CD,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAQ7H;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAaxE;AAuGD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,EAAE,CAY9I"}