@ricsam/r5d-macos-vm 0.0.0 → 0.0.54

package/README.md

@@ -1,45 +1,69 @@
 # @ricsam/r5d-macos-vm
 
-## ⚠️ IMPORTANT NOTICE ⚠️
+`r5d-macos-vm` creates and runs a local macOS VM for r5d.dev on Apple silicon. The npm package contains the CLI and guest bootstrap scripts, but no Apple software or prebuilt VM image. It downloads a signed and notarized r5d native runner from `downloads.r5d.dev`; that runner downloads the current compatible macOS restore image directly from Apple and installs it locally.
 
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+## Requirements
 
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+- An Apple-silicon Mac running macOS 14 or newer.
+- Node.js 18 or newer.
+- Enough free storage for the Apple restore image and the VM disk. The default disk is sparse, but macOS installation can still use tens of gigabytes.
+- Internet access to Apple, r5d.dev, npm, and `downloads.r5d.dev`.
 
-## Purpose
+No Xcode installation, Apple Developer account, or prebuilt macOS image is required on the user's Mac.
 
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@ricsam/r5d-macos-vm`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
+## Quick start
 
-## What is OIDC Trusted Publishing?
+```bash
+npx @ricsam/r5d-macos-vm doctor
+npx @ricsam/r5d-macos-vm create
+```
 
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
+The default VM is named `r5d-macos`. To use a different name or size:
 
-## Setup Instructions
+```bash
+r5d-macos-vm create build-mac \
+  --cpus 4 \
+  --memory-bytes 8589934592 \
+  --disk-bytes 85899345920
+```
 
-To properly configure OIDC trusted publishing for this package:
+Complete macOS Setup Assistant in the VM, then double-click `/Volumes/My Shared Files/r5d Setup/Install r5d.command`. The shared bootstrap opens a visible Terminal, installs Homebrew and the r5d command-line tools, and starts worker enrollment. On another device, visit `https://r5d.dev/auth` and enter the displayed code, or scan its QR code. The worker starts only after authorization succeeds.
 
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
+Useful commands:
 
-## DO NOT USE THIS PACKAGE
+```bash
+r5d-macos-vm list
+r5d-macos-vm status build-mac
+r5d-macos-vm start build-mac
+r5d-macos-vm stop build-mac
+r5d-macos-vm delete build-mac --yes          # move the VM to Trash
+r5d-macos-vm delete build-mac --yes --purge  # permanently delete it
+r5d-macos-vm cache prune                     # remove restore images and old native runners
+```
 
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
+Add `--json` for newline-delimited progress events suitable for automation. `--state-root <path>` and `--bootstrap-dir <path>` are development/test overrides.
 
-## More Information
+## Storage and security
 
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
+- VM bundles: `~/Library/Application Support/r5d/macos-vms/`
+- Apple restore-image cache: `~/Library/Caches/dev.r5d.macos-vm/restore/`
+- Versioned native runners: `~/Library/Caches/dev.r5d.macos-vm/runtimes/<package-version>/`
 
----
+Every npm version pins the native archive's exact HTTPS URL, SHA-256, byte length, Apple Team ID, bundle ID, arm64 architecture, and macOS deployment target. Before execution, the CLI uses built-in macOS security tools to verify the checksum, Mach-O metadata, Developer ID signature, exact virtualization-only entitlement set, hardened runtime, stapled notarization ticket, and Gatekeeper's notarization assessment. It does not invoke Xcode or its command-line tools. Downloads and extraction are locked and promoted into the cache atomically.
 
-**Maintained for OIDC setup purposes only**
+The package never distributes an IPSW, installed macOS disk, auxiliary storage, hardware model, or machine identifier. Restore images come from Apple and remain in the local cache only when requested or needed for installation.
+
+## Updating and removing
+
+Updating the npm package installs a new versioned native runner and does not modify existing VM bundles. The guest's `r5d-worker` and `r5dctl` use their normal r5d update flow.
+
+`npm uninstall -g @ricsam/r5d-macos-vm` removes only the CLI. For complete removal, revoke the worker in r5d.dev, delete or purge each VM, run `r5d-macos-vm cache prune`, and then uninstall the npm package. Native runtime caches can be removed manually after the CLI is uninstalled; VM bundles are intentionally never removed by npm lifecycle scripts.
+
+## Troubleshooting
+
+- Run `r5d-macos-vm doctor --json` for machine-readable host and Virtualization.framework diagnostics.
+- A checksum, signature, Team ID, entitlement, or notarization error is treated as unsafe. Reinstall the npm package and retry; do not bypass the check.
+- If an install was interrupted, rerun `create` with the same name. After acquiring the per-VM lock, the CLI moves incomplete staging data to Trash, rebuilds it from scratch, and reuses the resumable restore-image cache.
+- Clipboard sharing is not required for enrollment; use the short code or QR code shown in the guest Terminal.
+
+Use of macOS virtual machines is subject to Apple's software license terms. This tool is intended for eligible local use on Apple-branded hardware; it does not grant rights to host or relay macOS environments as a service.

package/bootstrap/Install r5d.command

@@ -0,0 +1,81 @@
+#!/bin/zsh
+set -euo pipefail
+
+SCRIPT_DIR="${0:A:h}"
+STATE_DIR="$HOME/Library/Application Support/r5d"
+LOG_DIR="$HOME/Library/Logs/r5d"
+LOG_FILE="$LOG_DIR/bootstrap.log"
+WORKER_LABEL="macos-vm"
+VM_NAME="r5d-macos"
+
+mkdir -p "$STATE_DIR" "$LOG_DIR"
+chmod 700 "$STATE_DIR" "$LOG_DIR"
+exec > >(tee -a "$LOG_FILE") 2>&1
+
+if [[ -f "$SCRIPT_DIR/.r5d-worker-label" ]]; then
+  configured_label="$(tr -d '[:space:]' < "$SCRIPT_DIR/.r5d-worker-label")"
+  if [[ "$configured_label" =~ '^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$' ]]; then
+    WORKER_LABEL="$configured_label"
+  fi
+fi
+if [[ -f "$SCRIPT_DIR/.r5d-vm-name" ]]; then
+  configured_name="$(tr -d '[:space:]' < "$SCRIPT_DIR/.r5d-vm-name")"
+  if [[ "$configured_name" =~ '^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$' ]]; then
+    VM_NAME="$configured_name"
+  fi
+fi
+
+print
+print "r5d macOS VM setup"
+print "Worker label: $WORKER_LABEL"
+print
+
+if [[ "$(uname -s)" != "Darwin" || "$(uname -m)" != "arm64" ]]; then
+  print -u2 "This installer requires macOS on Apple silicon (arm64)."
+  exit 1
+fi
+
+print "Checking outbound network access…"
+if ! /usr/bin/curl --fail --silent --show-error --location --head --max-time 20 https://r5d.dev/ >/dev/null; then
+  print -u2 "Could not reach r5d.dev. Check this VM's network connection, then run the installer again."
+  exit 1
+fi
+
+if ! xcode-select -p >/dev/null 2>&1; then
+  print "Apple Command Line Tools are required. macOS will open its installer."
+  print "Complete that installer, then run this command again."
+  xcode-select --install >/dev/null 2>&1 || true
+  read -r "?Press Return after the Command Line Tools installation finishes, or close this window and retry later: "
+  if ! xcode-select -p >/dev/null 2>&1; then
+    print "Command Line Tools are not installed yet. Run this setup again after installation completes."
+    exit 1
+  fi
+fi
+
+if [[ ! -x /opt/homebrew/bin/brew ]]; then
+  print "Installing Homebrew. macOS may ask for the local account password."
+  /bin/bash -c "$(/usr/bin/curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+fi
+
+eval "$(/opt/homebrew/bin/brew shellenv)"
+brew update
+brew install gh node bun
+
+print "Installing r5d command-line tools."
+npm install --global --omit=dev @ricsam/r5dctl @ricsam/r5d-worker @ricsam/r5d-browser
+
+gh --version >/dev/null
+node --version >/dev/null
+bun --version >/dev/null
+r5dctl --version >/dev/null
+r5d-worker --version >/dev/null
+r5d-browser --version >/dev/null
+
+print
+"$SCRIPT_DIR/install-worker-launch-agent.sh" "$WORKER_LABEL" "$VM_NAME"
+
+touch "$STATE_DIR/bootstrap-complete"
+chmod 600 "$STATE_DIR/bootstrap-complete"
+print
+print "Tools installed. The visible r5d worker Terminal is opening for authorization and startup…"
+print "You may close this setup window."

package/bootstrap/README.txt

@@ -0,0 +1,7 @@
+r5d macOS VM guest setup
+
+After completing macOS Setup Assistant, open “Install r5d.command” from this
+folder. It installs the development tools, asks you to authorize the worker,
+and configures a visible r5d-worker Terminal at each graphical login.
+
+The installer is idempotent and safe to run again after an interrupted step.

package/bootstrap/dev.r5d.worker-terminal.plist.template

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>dev.r5d.worker-terminal</string>
+    <key>LimitLoadToSessionType</key>
+    <string>Aqua</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/usr/bin/open</string>
+        <string>-a</string>
+        <string>Terminal</string>
+        <string>__START_SCRIPT__</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <false/>
+    <key>ProcessType</key>
+    <string>Interactive</string>
+</dict>
+</plist>

package/bootstrap/install-worker-launch-agent.sh

@@ -0,0 +1,47 @@
+#!/bin/zsh
+set -euo pipefail
+
+WORKER_LABEL="${1:-macos-vm}"
+VM_NAME="${2:-r5d-macos}"
+if [[ ! "$WORKER_LABEL" =~ '^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$' ]]; then
+  print -u2 "Invalid worker label: $WORKER_LABEL"
+  exit 2
+fi
+if [[ ! "$VM_NAME" =~ '^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$' ]]; then
+  print -u2 "Invalid VM name: $VM_NAME"
+  exit 2
+fi
+
+STATE_DIR="$HOME/Library/Application Support/r5d"
+LAUNCH_AGENTS_DIR="$HOME/Library/LaunchAgents"
+START_SCRIPT="$STATE_DIR/start-worker.command"
+PLIST="$LAUNCH_AGENTS_DIR/dev.r5d.worker-terminal.plist"
+
+mkdir -p "$STATE_DIR" "$LAUNCH_AGENTS_DIR"
+chmod 700 "$STATE_DIR"
+
+escaped_start_script="${START_SCRIPT//&/&}"
+escaped_start_script="${escaped_start_script//</&lt;}"
+escaped_start_script="${escaped_start_script//>/&gt;}"
+
+temporary_start="$(mktemp "$STATE_DIR/.start-worker.XXXXXX")"
+temporary_plist="$(mktemp "$LAUNCH_AGENTS_DIR/.dev.r5d.worker-terminal.XXXXXX")"
+trap 'rm -f "$temporary_start" "$temporary_plist"' EXIT
+
+sed \
+  -e "s|__WORKER_LABEL__|$WORKER_LABEL|g" \
+  -e "s|__VM_NAME__|$VM_NAME|g" \
+  "${0:A:h}/start-worker.command.template" > "$temporary_start"
+chmod 700 "$temporary_start"
+
+sed \
+  -e "s|__START_SCRIPT__|$escaped_start_script|g" \
+  "${0:A:h}/dev.r5d.worker-terminal.plist.template" > "$temporary_plist"
+chmod 600 "$temporary_plist"
+
+mv -f "$temporary_start" "$START_SCRIPT"
+mv -f "$temporary_plist" "$PLIST"
+trap - EXIT
+
+launchctl bootout "gui/$(id -u)" "$PLIST" >/dev/null 2>&1 || true
+launchctl bootstrap "gui/$(id -u)" "$PLIST"

package/bootstrap/start-worker.command.template

@@ -0,0 +1,71 @@
+#!/bin/zsh
+set -euo pipefail
+
+export PATH="/opt/homebrew/bin:$HOME/.bun/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+STATE_DIR="$HOME/Library/Application Support/r5d"
+LOCK_DIR="$STATE_DIR/worker-terminal-__WORKER_LABEL__.lock"
+START_SCRIPT="${0:A}"
+
+mkdir -p "$STATE_DIR"
+chmod 700 "$STATE_DIR"
+
+while ! mkdir "$LOCK_DIR" 2>/dev/null; do
+  existing_pid="$(cat "$LOCK_DIR/pid" 2>/dev/null || true)"
+  if [[ "$existing_pid" == <-> ]] && kill -0 "$existing_pid" 2>/dev/null; then
+    existing_command="$(ps -ww -p "$existing_pid" -o command= 2>/dev/null || true)"
+    if [[ -n "$existing_command" && "$existing_command" == *"$START_SCRIPT"* ]]; then
+      print "r5d-worker is already running in another Terminal (PID $existing_pid)."
+      read -r "?Press Return to close this window: "
+      exit 0
+    fi
+  fi
+
+  # A newly-created lock may not have its PID file yet. Never reap that
+  # acquisition window; only recover ownerless locks that have stayed stale.
+  lock_modified_at="$(stat -f %m "$LOCK_DIR" 2>/dev/null || print 0)"
+  current_epoch="$(date +%s)"
+  if [[ "$lock_modified_at" == <-> ]] && (( current_epoch - lock_modified_at < 60 )); then
+    sleep 1
+    continue
+  fi
+
+  stale_lock="$LOCK_DIR.stale.$$.$RANDOM"
+  if mv "$LOCK_DIR" "$stale_lock" 2>/dev/null; then
+    rm -rf "$stale_lock"
+  else
+    sleep 1
+  fi
+done
+
+print $$ > "$LOCK_DIR/pid"
+chmod 600 "$LOCK_DIR/pid"
+cleanup() { rm -rf "$LOCK_DIR"; }
+trap cleanup EXIT INT TERM HUP
+
+print "Starting r5d-worker (__WORKER_LABEL__)"
+print "Keep this Terminal open while the VM is available to r5d.dev."
+print
+
+auth_source="$(r5dctl --json auth status 2>/dev/null | /usr/bin/sed -n 's/.*"source"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | /usr/bin/head -n 1 || true)"
+if [[ "$auth_source" != "device" ]]; then
+  if [[ -n "$auth_source" ]]; then
+    print "The shared r5d config currently uses '$auth_source' authentication. This VM requires its own revocable device credential."
+    print
+  fi
+  print "Authorize this VM before its worker starts."
+  print
+  r5dctl auth login --no-open --device-name "r5d macOS VM (__VM_NAME__)" --worker-label "__WORKER_LABEL__"
+  print
+fi
+
+r5d-worker start --label "__WORKER_LABEL__" &
+worker_pid=$!
+trap 'kill -INT "$worker_pid" 2>/dev/null || true' INT TERM HUP
+set +e
+wait "$worker_pid"
+worker_status=$?
+set -e
+print
+print "r5d-worker stopped with status $worker_status."
+read -r "?Press Return to close this window: "
+exit "$worker_status"

package/dist/cjs/artifact-manifest.cjs

@@ -0,0 +1,224 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var artifact_manifest_exports = {};
+__export(artifact_manifest_exports, {
+  MACOS_VM_PACKAGE_NAME: () => MACOS_VM_PACKAGE_NAME,
+  NATIVE_APP_NAME: () => NATIVE_APP_NAME,
+  NATIVE_ARCHIVE_NAME: () => NATIVE_ARCHIVE_NAME,
+  NATIVE_ARTIFACT_HOST: () => NATIVE_ARTIFACT_HOST,
+  NATIVE_BUNDLE_IDENTIFIER: () => NATIVE_BUNDLE_IDENTIFIER,
+  NATIVE_EXECUTABLE_NAME: () => NATIVE_EXECUTABLE_NAME,
+  NATIVE_MINIMUM_MACOS_VERSION: () => NATIVE_MINIMUM_MACOS_VERSION,
+  expectedArtifactUrl: () => expectedArtifactUrl,
+  findFileUpward: () => findFileUpward,
+  findForbiddenVirtualMachineArtifactPaths: () => findForbiddenVirtualMachineArtifactPaths,
+  findPackageRoot: () => findPackageRoot,
+  findPackageVersion: () => findPackageVersion,
+  isForbiddenVirtualMachineArtifactPath: () => isForbiddenVirtualMachineArtifactPath,
+  parseNativeArtifactManifest: () => parseNativeArtifactManifest,
+  readNativeArtifactManifest: () => readNativeArtifactManifest
+});
+module.exports = __toCommonJS(artifact_manifest_exports);
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+const MACOS_VM_PACKAGE_NAME = "@ricsam/r5d-macos-vm";
+const NATIVE_ARCHIVE_NAME = "R5DMacOSVM.app.zip";
+const NATIVE_APP_NAME = "R5DMacOSVM.app";
+const NATIVE_EXECUTABLE_NAME = "R5DMacOSVM";
+const NATIVE_BUNDLE_IDENTIFIER = "dev.r5d.macos-vm";
+const NATIVE_MINIMUM_MACOS_VERSION = "14.0";
+const NATIVE_ARTIFACT_HOST = "downloads.r5d.dev";
+const FORBIDDEN_VM_ARTIFACT_BASENAMES = /* @__PURE__ */ new Set([
+  "auxiliarystorage",
+  "disk.img",
+  "hardwaremodel",
+  "machineidentifier",
+  "restoreimage.ipsw",
+  "savefile.vzvmsave"
+]);
+const FORBIDDEN_VM_ARTIFACT_EXTENSION = /\.(?:img|ipsw|r5dvm|vzvmsave)$/i;
+function expectedArtifactUrl(version) {
+  return `https://${NATIVE_ARTIFACT_HOST}/r5d-macos-vm/${encodeURIComponent(version)}/${NATIVE_ARCHIVE_NAME}`;
+}
+function isForbiddenVirtualMachineArtifactPath(filePath) {
+  const normalized = filePath.replaceAll("\\", "/").replace(/\/+$/, "");
+  const basename = normalized.slice(normalized.lastIndexOf("/") + 1).toLowerCase();
+  return FORBIDDEN_VM_ARTIFACT_BASENAMES.has(basename) || FORBIDDEN_VM_ARTIFACT_EXTENSION.test(basename);
+}
+function findForbiddenVirtualMachineArtifactPaths(paths) {
+  return paths.filter(isForbiddenVirtualMachineArtifactPath);
+}
+function requireObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("The native artifact manifest must contain a JSON object.");
+  }
+  return value;
+}
+function requireString(value, field) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`The native artifact manifest field '${field}' must be a non-empty string.`);
+  }
+  return value;
+}
+function parseNativeArtifactManifest(value, expectedPackageVersion) {
+  const input = requireObject(value);
+  if (input.schemaVersion !== 1) throw new Error("Unsupported native artifact manifest schema.");
+  const packageVersion = requireString(input.packageVersion, "packageVersion");
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(packageVersion)) {
+    throw new Error("Native artifact packageVersion must be a semantic version.");
+  }
+  if (packageVersion !== expectedPackageVersion) {
+    throw new Error(`Native artifact version ${packageVersion} does not match package version ${expectedPackageVersion}.`);
+  }
+  const url = requireString(input.url, "url");
+  if (url !== expectedArtifactUrl(packageVersion)) {
+    throw new Error(`Native artifact URL must be ${expectedArtifactUrl(packageVersion)}.`);
+  }
+  const sha256 = requireString(input.sha256, "sha256").toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(sha256)) throw new Error("Native artifact sha256 must contain 64 hexadecimal characters.");
+  const byteLength = input.byteLength;
+  if (!Number.isSafeInteger(byteLength) || byteLength <= 0 || byteLength > 100 * 1024 * 1024) {
+    throw new Error("Native artifact byteLength must be between 1 byte and 100 MiB.");
+  }
+  const teamIdentifier = requireString(input.teamIdentifier, "teamIdentifier");
+  if (!/^[A-Z0-9]{10}$/.test(teamIdentifier)) {
+    throw new Error("Native artifact teamIdentifier must be a 10-character Apple Team ID.");
+  }
+  const fixedFields = {
+    archiveName: NATIVE_ARCHIVE_NAME,
+    appName: NATIVE_APP_NAME,
+    executableName: NATIVE_EXECUTABLE_NAME,
+    bundleIdentifier: NATIVE_BUNDLE_IDENTIFIER,
+    architecture: "arm64",
+    minimumMacOSVersion: NATIVE_MINIMUM_MACOS_VERSION
+  };
+  for (const [field, expected] of Object.entries(fixedFields)) {
+    if (input[field] !== expected) throw new Error(`Native artifact ${field} must be ${expected}.`);
+  }
+  return {
+    schemaVersion: 1,
+    packageVersion,
+    url,
+    sha256,
+    byteLength,
+    archiveName: NATIVE_ARCHIVE_NAME,
+    appName: NATIVE_APP_NAME,
+    executableName: NATIVE_EXECUTABLE_NAME,
+    bundleIdentifier: NATIVE_BUNDLE_IDENTIFIER,
+    teamIdentifier,
+    architecture: "arm64",
+    minimumMacOSVersion: NATIVE_MINIMUM_MACOS_VERSION
+  };
+}
+function readNativeArtifactManifest(filePath, expectedPackageVersion) {
+  let value;
+  try {
+    value = JSON.parse(import_node_fs.default.readFileSync(filePath, "utf8"));
+  } catch (error) {
+    throw new Error(`Unable to read native artifact manifest at ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return parseNativeArtifactManifest(value, expectedPackageVersion);
+}
+function findFileUpward(startPath, fileName) {
+  let current = import_node_path.default.resolve(startPath);
+  try {
+    if (!import_node_fs.default.statSync(current).isDirectory()) current = import_node_path.default.dirname(current);
+  } catch {
+    current = import_node_path.default.dirname(current);
+  }
+  while (true) {
+    const candidate = import_node_path.default.join(current, fileName);
+    if (import_node_fs.default.existsSync(candidate)) return candidate;
+    const parent = import_node_path.default.dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+function findPackageRoot(startPath) {
+  let current = import_node_path.default.resolve(startPath);
+  try {
+    if (!import_node_fs.default.statSync(current).isDirectory()) current = import_node_path.default.dirname(current);
+  } catch {
+    current = import_node_path.default.dirname(current);
+  }
+  let sourceRoot = null;
+  while (true) {
+    const packageJsonPath = import_node_path.default.join(current, "package.json");
+    if (import_node_fs.default.existsSync(packageJsonPath)) {
+      try {
+        const value = JSON.parse(import_node_fs.default.readFileSync(packageJsonPath, "utf8"));
+        if (value.name === MACOS_VM_PACKAGE_NAME && typeof value.bin?.["r5d-macos-vm"] === "string") return current;
+      } catch {
+      }
+    }
+    if (import_node_path.default.basename(current) === "r5d-macos-vm" && import_node_fs.default.existsSync(import_node_path.default.join(import_node_path.default.dirname(current), "VERSION.txt"))) {
+      sourceRoot = current;
+    }
+    const parent = import_node_path.default.dirname(current);
+    if (parent === current) return sourceRoot;
+    current = parent;
+  }
+}
+function findPackageVersion(startPath) {
+  const packageRoot = findPackageRoot(startPath);
+  if (packageRoot) {
+    const packageJsonPath = import_node_path.default.join(packageRoot, "package.json");
+    if (import_node_fs.default.existsSync(packageJsonPath)) {
+      try {
+        const value = JSON.parse(import_node_fs.default.readFileSync(packageJsonPath, "utf8"));
+        if (value.name === MACOS_VM_PACKAGE_NAME && typeof value.version === "string") return value.version;
+      } catch {
+      }
+    }
+    const localVersionPath = import_node_path.default.join(import_node_path.default.dirname(packageRoot), "VERSION.txt");
+    if (import_node_fs.default.existsSync(localVersionPath)) {
+      const version = import_node_fs.default.readFileSync(localVersionPath, "utf8").trim();
+      if (/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) return version;
+    }
+  }
+  throw new Error(`Unable to determine the installed ${MACOS_VM_PACKAGE_NAME} version.`);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MACOS_VM_PACKAGE_NAME,
+  NATIVE_APP_NAME,
+  NATIVE_ARCHIVE_NAME,
+  NATIVE_ARTIFACT_HOST,
+  NATIVE_BUNDLE_IDENTIFIER,
+  NATIVE_EXECUTABLE_NAME,
+  NATIVE_MINIMUM_MACOS_VERSION,
+  expectedArtifactUrl,
+  findFileUpward,
+  findForbiddenVirtualMachineArtifactPaths,
+  findPackageRoot,
+  findPackageVersion,
+  isForbiddenVirtualMachineArtifactPath,
+  parseNativeArtifactManifest,
+  readNativeArtifactManifest
+});