@ricsam/r5d-macos-vm 0.0.0 → 0.0.55

package/dist/cjs/native-runtime.cjs

@@ -0,0 +1,464 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var native_runtime_exports = {};
+__export(native_runtime_exports, {
+  codeSignatureUsesHardenedRuntime: () => codeSignatureUsesHardenedRuntime,
+  defaultCacheRoot: () => defaultCacheRoot,
+  downloadNativeArtifact: () => downloadNativeArtifact,
+  ensureNativeRuntime: () => ensureNativeRuntime,
+  inspectMachOExecutable: () => inspectMachOExecutable,
+  nativeExecutablePath: () => nativeExecutablePath,
+  pruneObsoleteNativeRuntimes: () => pruneObsoleteNativeRuntimes,
+  runCommand: () => runCommand,
+  runtimeDirectory: () => runtimeDirectory,
+  verifyNativeApp: () => verifyNativeApp
+});
+module.exports = __toCommonJS(native_runtime_exports);
+var import_node_crypto = __toESM(require("node:crypto"), 1);
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_os = __toESM(require("node:os"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_node_child_process = require("node:child_process");
+const LOCK_OWNER_FILE = "owner.json";
+const TEMPORARY_ARCHIVE_SUFFIX = ".download";
+async function ensurePrivateDirectory(directory, description) {
+  try {
+    await import_node_fs.default.promises.mkdir(directory, { recursive: true, mode: 448 });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  const stat = await import_node_fs.default.promises.lstat(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`Refusing to use ${description} because it is not a regular directory: ${directory}`);
+  }
+  const currentUid = process.getuid?.();
+  if (currentUid !== void 0 && stat.uid !== currentUid) {
+    throw new Error(`Refusing to use ${description} because it is not owned by the current user: ${directory}`);
+  }
+  await import_node_fs.default.promises.chmod(directory, 448);
+}
+function defaultCacheRoot() {
+  return import_node_path.default.join(import_node_os.default.homedir(), "Library", "Caches", "dev.r5d.macos-vm");
+}
+function runtimeDirectory(cacheRoot, manifest) {
+  return import_node_path.default.join(cacheRoot, "runtimes", manifest.packageVersion);
+}
+function nativeExecutablePath(runtimeDir, manifest) {
+  return import_node_path.default.join(runtimeDir, manifest.appName, "Contents", "MacOS", manifest.executableName);
+}
+async function pruneObsoleteNativeRuntimes(currentExecutable, cacheRoot = defaultCacheRoot()) {
+  const runtimesRoot = import_node_path.default.resolve(cacheRoot, "runtimes");
+  const currentRuntime = import_node_path.default.resolve(currentExecutable, "../../../../");
+  if (import_node_path.default.dirname(currentRuntime) !== runtimesRoot) {
+    throw new Error("Refusing to prune native runtimes because the active runtime is outside the managed cache.");
+  }
+  await ensurePrivateDirectory(import_node_path.default.resolve(cacheRoot), "native runtime cache");
+  await ensurePrivateDirectory(runtimesRoot, "native runtimes directory");
+  let entries;
+  try {
+    entries = await import_node_fs.default.promises.readdir(runtimesRoot, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  const removed = [];
+  const runtimeNamePattern = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.isSymbolicLink() || !runtimeNamePattern.test(entry.name)) continue;
+    const candidate = import_node_path.default.resolve(runtimesRoot, entry.name);
+    if (candidate === currentRuntime || import_node_path.default.dirname(candidate) !== runtimesRoot) continue;
+    const quarantine = import_node_path.default.join(runtimesRoot, `.prune-${process.pid}-${import_node_crypto.default.randomUUID()}`);
+    try {
+      await import_node_fs.default.promises.rename(candidate, quarantine);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    await import_node_fs.default.promises.rm(quarantine, { recursive: true, force: true });
+    removed.push(entry.name);
+  }
+  return removed;
+}
+function delay(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+async function removeStaleLock(lockPath, staleLockMs) {
+  let stat;
+  try {
+    stat = await import_node_fs.default.promises.stat(lockPath);
+  } catch (error) {
+    if (error.code === "ENOENT") return true;
+    throw error;
+  }
+  if (Date.now() - stat.mtimeMs < staleLockMs) return false;
+  let ownerPid = null;
+  try {
+    const owner = JSON.parse(await import_node_fs.default.promises.readFile(import_node_path.default.join(lockPath, LOCK_OWNER_FILE), "utf8"));
+    if (Number.isSafeInteger(owner.pid) && owner.pid > 0) ownerPid = owner.pid;
+  } catch {
+  }
+  if (ownerPid !== null) {
+    try {
+      process.kill(ownerPid, 0);
+      return false;
+    } catch (error) {
+      if (error.code === "EPERM") return false;
+    }
+  }
+  const stalePath = `${lockPath}.stale-${process.pid}-${import_node_crypto.default.randomUUID()}`;
+  try {
+    await import_node_fs.default.promises.rename(lockPath, stalePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return true;
+    return false;
+  }
+  await import_node_fs.default.promises.rm(stalePath, { recursive: true, force: true });
+  return true;
+}
+async function withDirectoryLock(lockPath, action, options) {
+  const startedAt = Date.now();
+  await ensurePrivateDirectory(import_node_path.default.dirname(lockPath), "native runtime lock directory");
+  while (true) {
+    try {
+      await import_node_fs.default.promises.mkdir(lockPath, { mode: 448 });
+      await import_node_fs.default.promises.chmod(lockPath, 448);
+      await import_node_fs.default.promises.writeFile(
+        import_node_path.default.join(lockPath, LOCK_OWNER_FILE),
+        `${JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() })}
+`,
+        { mode: 384 }
+      );
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (await removeStaleLock(lockPath, options.staleLockMs)) continue;
+      if (Date.now() - startedAt >= options.timeoutMs) {
+        throw new Error(`Timed out waiting for native runtime installation lock at ${lockPath}.`);
+      }
+      await delay(options.pollMs);
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    await import_node_fs.default.promises.rm(lockPath, { recursive: true, force: true });
+  }
+}
+const runCommand = (executable, args) => new Promise((resolve, reject) => {
+  const child = (0, import_node_child_process.spawn)(executable, [...args], {
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, LANG: "C", LC_ALL: "C" },
+    shell: false
+  });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.setEncoding("utf8").on("data", (chunk) => stdout += chunk);
+  child.stderr.setEncoding("utf8").on("data", (chunk) => stderr += chunk);
+  child.once("error", reject);
+  child.once("close", (code) => resolve({ exitCode: code ?? 1, stdout, stderr }));
+});
+async function requireSuccessfulCommand(runner, executable, args, description) {
+  const result = await runner(executable, args);
+  if (result.exitCode !== 0) {
+    const detail = `${result.stdout}
+${result.stderr}`.trim();
+    throw new Error(`${description} failed${detail ? `: ${detail}` : "."}`);
+  }
+  return result;
+}
+async function downloadNativeArtifact(manifest, destination) {
+  const temporaryDestination = `${destination}${TEMPORARY_ARCHIVE_SUFFIX}`;
+  await import_node_fs.default.promises.rm(temporaryDestination, { force: true });
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 5 * 6e4);
+  let response;
+  try {
+    response = await fetch(manifest.url, {
+      signal: controller.signal,
+      redirect: "follow",
+      headers: { "user-agent": `@ricsam/r5d-macos-vm/${manifest.packageVersion}` }
+    });
+  } catch (error) {
+    clearTimeout(timeout);
+    throw new Error(`Unable to download the native runtime: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  try {
+    if (!response.ok || !response.body) throw new Error(`Native runtime download returned HTTP ${response.status}.`);
+    const contentLength = response.headers.get("content-length");
+    if (contentLength !== null && Number(contentLength) !== manifest.byteLength) {
+      throw new Error(`Native runtime download length ${contentLength} does not match expected ${manifest.byteLength}.`);
+    }
+    const file = await import_node_fs.default.promises.open(temporaryDestination, "wx", 384);
+    const hash = import_node_crypto.default.createHash("sha256");
+    let byteLength = 0;
+    try {
+      for await (const value of response.body) {
+        const chunk = Buffer.from(value);
+        byteLength += chunk.byteLength;
+        if (byteLength > manifest.byteLength) throw new Error("Native runtime download exceeded its signed byte length.");
+        hash.update(chunk);
+        await file.write(chunk);
+      }
+    } finally {
+      await file.close();
+    }
+    if (byteLength !== manifest.byteLength) {
+      throw new Error(`Native runtime download contained ${byteLength} bytes; expected ${manifest.byteLength}.`);
+    }
+    const digest = hash.digest("hex");
+    if (!import_node_crypto.default.timingSafeEqual(Buffer.from(digest, "hex"), Buffer.from(manifest.sha256, "hex"))) {
+      throw new Error("Native runtime checksum verification failed.");
+    }
+    await import_node_fs.default.promises.rename(temporaryDestination, destination);
+  } finally {
+    clearTimeout(timeout);
+    await import_node_fs.default.promises.rm(temporaryDestination, { force: true });
+  }
+}
+function decodePackedVersion(value) {
+  const major = value >>> 16;
+  const minor = value >>> 8 & 255;
+  const patch = value & 255;
+  return patch === 0 ? `${major}.${minor}` : `${major}.${minor}.${patch}`;
+}
+function inspectMachOExecutable(filePath) {
+  const data = import_node_fs.default.readFileSync(filePath);
+  if (data.byteLength < 32 || data.readUInt32LE(0) !== 4277009103) {
+    throw new Error("Native runtime executable is not a thin 64-bit Mach-O file.");
+  }
+  if (data.readInt32LE(4) !== 16777228) throw new Error("Native runtime executable is not arm64.");
+  if (data.readUInt32LE(12) !== 2) throw new Error("Native runtime Mach-O is not an executable.");
+  const commandCount = data.readUInt32LE(16);
+  const commandBytes = data.readUInt32LE(20);
+  if (32 + commandBytes > data.byteLength) throw new Error("Native runtime Mach-O load commands are truncated.");
+  let offset = 32;
+  let minimumMacOSVersion = null;
+  for (let index = 0; index < commandCount; index += 1) {
+    if (offset + 8 > data.byteLength) throw new Error("Native runtime Mach-O load command is truncated.");
+    const command = data.readUInt32LE(offset);
+    const commandSize = data.readUInt32LE(offset + 4);
+    if (commandSize < 8 || offset + commandSize > data.byteLength) throw new Error("Native runtime Mach-O load command is invalid.");
+    if (command === 50) {
+      if (commandSize < 24) throw new Error("Native runtime LC_BUILD_VERSION command is invalid.");
+      if (data.readUInt32LE(offset + 8) !== 1) throw new Error("Native runtime was not built for macOS.");
+      minimumMacOSVersion = decodePackedVersion(data.readUInt32LE(offset + 12));
+    } else if (command === 36 && minimumMacOSVersion === null) {
+      if (commandSize < 16) throw new Error("Native runtime LC_VERSION_MIN_MACOSX command is invalid.");
+      minimumMacOSVersion = decodePackedVersion(data.readUInt32LE(offset + 8));
+    }
+    offset += commandSize;
+  }
+  if (minimumMacOSVersion === null) throw new Error("Native runtime does not declare a minimum macOS version.");
+  return { architecture: "arm64", minimumMacOSVersion };
+}
+function normalizeVersion(value) {
+  const parts = value.trim().split(".").map(Number);
+  while (parts.length > 2 && parts.at(-1) === 0) parts.pop();
+  return parts.join(".");
+}
+function requireRegularFile(filePath, description) {
+  const stat = import_node_fs.default.lstatSync(filePath);
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`${description} is not a regular file.`);
+}
+function parseSigningValue(output, key) {
+  const line = output.split(/\r?\n/).find((candidate) => candidate.startsWith(`${key}=`));
+  return line ? line.slice(key.length + 1).trim() : null;
+}
+function codeSignatureUsesHardenedRuntime(output) {
+  const codeDirectoryLine = output.split(/\r?\n/).find((line) => line.startsWith("CodeDirectory "));
+  if (!codeDirectoryLine) return false;
+  const flags = /\bflags=0x[0-9a-f]+\(([^)]*)\)/i.exec(codeDirectoryLine)?.[1];
+  return flags?.split(",").some((flag) => flag.trim() === "runtime") ?? false;
+}
+async function verifyNativeApp(appPath, manifest, runner = runCommand) {
+  const appStat = import_node_fs.default.lstatSync(appPath);
+  if (!appStat.isDirectory() || appStat.isSymbolicLink()) throw new Error("Native runtime app is not a regular bundle directory.");
+  const infoPlistPath = import_node_path.default.join(appPath, "Contents", "Info.plist");
+  const executablePath = import_node_path.default.join(appPath, "Contents", "MacOS", manifest.executableName);
+  requireRegularFile(infoPlistPath, "Native runtime Info.plist");
+  requireRegularFile(executablePath, "Native runtime executable");
+  const machO = inspectMachOExecutable(executablePath);
+  if (machO.architecture !== manifest.architecture) throw new Error("Native runtime architecture does not match its manifest.");
+  if (normalizeVersion(machO.minimumMacOSVersion) !== normalizeVersion(manifest.minimumMacOSVersion)) {
+    throw new Error(`Native runtime minimum macOS version ${machO.minimumMacOSVersion} does not match ${manifest.minimumMacOSVersion}.`);
+  }
+  const identifier = await requireSuccessfulCommand(
+    runner,
+    "/usr/bin/plutil",
+    ["-extract", "CFBundleIdentifier", "raw", "-o", "-", infoPlistPath],
+    "Reading native runtime bundle identifier"
+  );
+  if (identifier.stdout.trim() !== manifest.bundleIdentifier) throw new Error("Native runtime bundle identifier is invalid.");
+  const minimumVersion = await requireSuccessfulCommand(
+    runner,
+    "/usr/bin/plutil",
+    ["-extract", "LSMinimumSystemVersion", "raw", "-o", "-", infoPlistPath],
+    "Reading native runtime deployment target"
+  );
+  if (normalizeVersion(minimumVersion.stdout) !== normalizeVersion(manifest.minimumMacOSVersion)) {
+    throw new Error("Native runtime Info.plist deployment target is invalid.");
+  }
+  await requireSuccessfulCommand(
+    runner,
+    "/usr/bin/codesign",
+    ["--verify", "--deep", "--strict", "--verbose=2", appPath],
+    "Native runtime code-signature verification"
+  );
+  const signature = await requireSuccessfulCommand(
+    runner,
+    "/usr/bin/codesign",
+    ["--display", "--verbose=4", appPath],
+    "Reading native runtime code signature"
+  );
+  const signatureOutput = `${signature.stdout}
+${signature.stderr}`;
+  if (parseSigningValue(signatureOutput, "Identifier") !== manifest.bundleIdentifier) {
+    throw new Error("Native runtime code-signing identifier is invalid.");
+  }
+  if (parseSigningValue(signatureOutput, "TeamIdentifier") !== manifest.teamIdentifier) {
+    throw new Error("Native runtime Apple Team ID is invalid.");
+  }
+  if (!codeSignatureUsesHardenedRuntime(signatureOutput)) {
+    throw new Error("Native runtime is not signed with the hardened runtime.");
+  }
+  if (parseSigningValue(signatureOutput, "Notarization Ticket") !== "stapled") {
+    throw new Error("Native runtime does not contain a stapled notarization ticket.");
+  }
+  const entitlements = await requireSuccessfulCommand(
+    runner,
+    "/usr/bin/codesign",
+    ["--display", "--entitlements", ":-", appPath],
+    "Reading native runtime entitlements"
+  );
+  const entitlementOutput = `${entitlements.stdout}
+${entitlements.stderr}`;
+  const entitlementKeys = [...entitlementOutput.matchAll(/<key>([^<]+)<\/key>/g)].map((match) => match[1]);
+  if (entitlementKeys.length !== 1 || entitlementKeys[0] !== "com.apple.security.virtualization") {
+    throw new Error("Native runtime contains entitlements other than com.apple.security.virtualization.");
+  }
+  if (!/<key>com\.apple\.security\.virtualization<\/key>\s*<true\s*\/>/s.test(entitlementOutput)) {
+    throw new Error("Native runtime is missing the virtualization entitlement.");
+  }
+  const gatekeeper = await requireSuccessfulCommand(
+    runner,
+    "/usr/sbin/spctl",
+    ["--assess", "--type", "execute", "--verbose=4", appPath],
+    "Native runtime Gatekeeper assessment"
+  );
+  const gatekeeperOutput = `${gatekeeper.stdout}
+${gatekeeper.stderr}`;
+  if (!/source=Notarized Developer ID/.test(gatekeeperOutput)) {
+    throw new Error("Native runtime does not have an accepted Apple notarization assessment.");
+  }
+}
+async function installRuntime(runtimeDir, manifest, dependencies) {
+  const runtimesRoot = import_node_path.default.dirname(runtimeDir);
+  await ensurePrivateDirectory(runtimesRoot, "native runtimes directory");
+  const workDir = await import_node_fs.default.promises.mkdtemp(import_node_path.default.join(runtimesRoot, ".install-"));
+  try {
+    const archivePath = import_node_path.default.join(workDir, manifest.archiveName);
+    await dependencies.download(manifest, archivePath);
+    const extractDir = import_node_path.default.join(workDir, "extract");
+    await import_node_fs.default.promises.mkdir(extractDir, { mode: 448 });
+    await requireSuccessfulCommand(
+      dependencies.commandRunner,
+      "/usr/bin/ditto",
+      ["-x", "-k", "--noqtn", archivePath, extractDir],
+      "Extracting native runtime"
+    );
+    const entries = await import_node_fs.default.promises.readdir(extractDir);
+    if (entries.length !== 1 || entries[0] !== manifest.appName) {
+      throw new Error(`Native runtime archive must contain only ${manifest.appName}.`);
+    }
+    const extractedApp = import_node_path.default.join(extractDir, manifest.appName);
+    await verifyNativeApp(extractedApp, manifest, dependencies.commandRunner);
+    const readyDir = import_node_path.default.join(workDir, "ready");
+    await import_node_fs.default.promises.mkdir(readyDir, { mode: 448 });
+    await import_node_fs.default.promises.rename(extractedApp, import_node_path.default.join(readyDir, manifest.appName));
+    await import_node_fs.default.promises.writeFile(
+      import_node_path.default.join(readyDir, "runtime.json"),
+      `${JSON.stringify({ packageVersion: manifest.packageVersion, sha256: manifest.sha256 }, null, 2)}
+`,
+      { mode: 384 }
+    );
+    await import_node_fs.default.promises.rename(readyDir, runtimeDir);
+  } finally {
+    await import_node_fs.default.promises.rm(workDir, { recursive: true, force: true });
+  }
+}
+async function cachedRuntimeIsValid(runtimeDir, manifest, runner) {
+  try {
+    const marker = JSON.parse(await import_node_fs.default.promises.readFile(import_node_path.default.join(runtimeDir, "runtime.json"), "utf8"));
+    if (marker.packageVersion !== manifest.packageVersion || marker.sha256 !== manifest.sha256) return false;
+    await verifyNativeApp(import_node_path.default.join(runtimeDir, manifest.appName), manifest, runner);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function ensureNativeRuntime(manifest, dependencies = {}) {
+  const cacheRoot = dependencies.cacheRoot ?? defaultCacheRoot();
+  const commandRunner = dependencies.commandRunner ?? runCommand;
+  const download = dependencies.download ?? downloadNativeArtifact;
+  const destination = runtimeDirectory(cacheRoot, manifest);
+  await ensurePrivateDirectory(cacheRoot, "native runtime cache");
+  await ensurePrivateDirectory(import_node_path.default.dirname(destination), "native runtimes directory");
+  if (await cachedRuntimeIsValid(destination, manifest, commandRunner)) {
+    return nativeExecutablePath(destination, manifest);
+  }
+  const lockPath = import_node_path.default.join(cacheRoot, "locks", `${manifest.packageVersion}.lock`);
+  return withDirectoryLock(
+    lockPath,
+    async () => {
+      if (!await cachedRuntimeIsValid(destination, manifest, commandRunner)) {
+        await import_node_fs.default.promises.rm(destination, { recursive: true, force: true });
+        await installRuntime(destination, manifest, { commandRunner, download });
+      }
+      return nativeExecutablePath(destination, manifest);
+    },
+    {
+      pollMs: dependencies.lockPollMs ?? 100,
+      timeoutMs: dependencies.lockTimeoutMs ?? 5 * 6e4,
+      staleLockMs: dependencies.staleLockMs ?? 10 * 6e4
+    }
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  codeSignatureUsesHardenedRuntime,
+  defaultCacheRoot,
+  downloadNativeArtifact,
+  ensureNativeRuntime,
+  inspectMachOExecutable,
+  nativeExecutablePath,
+  pruneObsoleteNativeRuntimes,
+  runCommand,
+  runtimeDirectory,
+  verifyNativeApp
+});

package/dist/cjs/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "@ricsam/r5d-macos-vm",
+  "version": "0.0.55",
+  "type": "commonjs"
+}

package/dist/mjs/artifact-manifest.mjs

@@ -0,0 +1,176 @@
+import fs from "node:fs";
+import path from "node:path";
+const MACOS_VM_PACKAGE_NAME = "@ricsam/r5d-macos-vm";
+const NATIVE_ARCHIVE_NAME = "R5DMacOSVM.app.zip";
+const NATIVE_APP_NAME = "R5DMacOSVM.app";
+const NATIVE_EXECUTABLE_NAME = "R5DMacOSVM";
+const NATIVE_BUNDLE_IDENTIFIER = "dev.r5d.macos-vm";
+const NATIVE_MINIMUM_MACOS_VERSION = "14.0";
+const NATIVE_ARTIFACT_HOST = "downloads.r5d.dev";
+const FORBIDDEN_VM_ARTIFACT_BASENAMES = /* @__PURE__ */ new Set([
+  "auxiliarystorage",
+  "disk.img",
+  "hardwaremodel",
+  "machineidentifier",
+  "restoreimage.ipsw",
+  "savefile.vzvmsave"
+]);
+const FORBIDDEN_VM_ARTIFACT_EXTENSION = /\.(?:img|ipsw|r5dvm|vzvmsave)$/i;
+function expectedArtifactUrl(version) {
+  return `https://${NATIVE_ARTIFACT_HOST}/r5d-macos-vm/${encodeURIComponent(version)}/${NATIVE_ARCHIVE_NAME}`;
+}
+function isForbiddenVirtualMachineArtifactPath(filePath) {
+  const normalized = filePath.replaceAll("\\", "/").replace(/\/+$/, "");
+  const basename = normalized.slice(normalized.lastIndexOf("/") + 1).toLowerCase();
+  return FORBIDDEN_VM_ARTIFACT_BASENAMES.has(basename) || FORBIDDEN_VM_ARTIFACT_EXTENSION.test(basename);
+}
+function findForbiddenVirtualMachineArtifactPaths(paths) {
+  return paths.filter(isForbiddenVirtualMachineArtifactPath);
+}
+function requireObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("The native artifact manifest must contain a JSON object.");
+  }
+  return value;
+}
+function requireString(value, field) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`The native artifact manifest field '${field}' must be a non-empty string.`);
+  }
+  return value;
+}
+function parseNativeArtifactManifest(value, expectedPackageVersion) {
+  const input = requireObject(value);
+  if (input.schemaVersion !== 1) throw new Error("Unsupported native artifact manifest schema.");
+  const packageVersion = requireString(input.packageVersion, "packageVersion");
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(packageVersion)) {
+    throw new Error("Native artifact packageVersion must be a semantic version.");
+  }
+  if (packageVersion !== expectedPackageVersion) {
+    throw new Error(`Native artifact version ${packageVersion} does not match package version ${expectedPackageVersion}.`);
+  }
+  const url = requireString(input.url, "url");
+  if (url !== expectedArtifactUrl(packageVersion)) {
+    throw new Error(`Native artifact URL must be ${expectedArtifactUrl(packageVersion)}.`);
+  }
+  const sha256 = requireString(input.sha256, "sha256").toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(sha256)) throw new Error("Native artifact sha256 must contain 64 hexadecimal characters.");
+  const byteLength = input.byteLength;
+  if (!Number.isSafeInteger(byteLength) || byteLength <= 0 || byteLength > 100 * 1024 * 1024) {
+    throw new Error("Native artifact byteLength must be between 1 byte and 100 MiB.");
+  }
+  const teamIdentifier = requireString(input.teamIdentifier, "teamIdentifier");
+  if (!/^[A-Z0-9]{10}$/.test(teamIdentifier)) {
+    throw new Error("Native artifact teamIdentifier must be a 10-character Apple Team ID.");
+  }
+  const fixedFields = {
+    archiveName: NATIVE_ARCHIVE_NAME,
+    appName: NATIVE_APP_NAME,
+    executableName: NATIVE_EXECUTABLE_NAME,
+    bundleIdentifier: NATIVE_BUNDLE_IDENTIFIER,
+    architecture: "arm64",
+    minimumMacOSVersion: NATIVE_MINIMUM_MACOS_VERSION
+  };
+  for (const [field, expected] of Object.entries(fixedFields)) {
+    if (input[field] !== expected) throw new Error(`Native artifact ${field} must be ${expected}.`);
+  }
+  return {
+    schemaVersion: 1,
+    packageVersion,
+    url,
+    sha256,
+    byteLength,
+    archiveName: NATIVE_ARCHIVE_NAME,
+    appName: NATIVE_APP_NAME,
+    executableName: NATIVE_EXECUTABLE_NAME,
+    bundleIdentifier: NATIVE_BUNDLE_IDENTIFIER,
+    teamIdentifier,
+    architecture: "arm64",
+    minimumMacOSVersion: NATIVE_MINIMUM_MACOS_VERSION
+  };
+}
+function readNativeArtifactManifest(filePath, expectedPackageVersion) {
+  let value;
+  try {
+    value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch (error) {
+    throw new Error(`Unable to read native artifact manifest at ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return parseNativeArtifactManifest(value, expectedPackageVersion);
+}
+function findFileUpward(startPath, fileName) {
+  let current = path.resolve(startPath);
+  try {
+    if (!fs.statSync(current).isDirectory()) current = path.dirname(current);
+  } catch {
+    current = path.dirname(current);
+  }
+  while (true) {
+    const candidate = path.join(current, fileName);
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+function findPackageRoot(startPath) {
+  let current = path.resolve(startPath);
+  try {
+    if (!fs.statSync(current).isDirectory()) current = path.dirname(current);
+  } catch {
+    current = path.dirname(current);
+  }
+  let sourceRoot = null;
+  while (true) {
+    const packageJsonPath = path.join(current, "package.json");
+    if (fs.existsSync(packageJsonPath)) {
+      try {
+        const value = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+        if (value.name === MACOS_VM_PACKAGE_NAME && typeof value.bin?.["r5d-macos-vm"] === "string") return current;
+      } catch {
+      }
+    }
+    if (path.basename(current) === "r5d-macos-vm" && fs.existsSync(path.join(path.dirname(current), "VERSION.txt"))) {
+      sourceRoot = current;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) return sourceRoot;
+    current = parent;
+  }
+}
+function findPackageVersion(startPath) {
+  const packageRoot = findPackageRoot(startPath);
+  if (packageRoot) {
+    const packageJsonPath = path.join(packageRoot, "package.json");
+    if (fs.existsSync(packageJsonPath)) {
+      try {
+        const value = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+        if (value.name === MACOS_VM_PACKAGE_NAME && typeof value.version === "string") return value.version;
+      } catch {
+      }
+    }
+    const localVersionPath = path.join(path.dirname(packageRoot), "VERSION.txt");
+    if (fs.existsSync(localVersionPath)) {
+      const version = fs.readFileSync(localVersionPath, "utf8").trim();
+      if (/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) return version;
+    }
+  }
+  throw new Error(`Unable to determine the installed ${MACOS_VM_PACKAGE_NAME} version.`);
+}
+export {
+  MACOS_VM_PACKAGE_NAME,
+  NATIVE_APP_NAME,
+  NATIVE_ARCHIVE_NAME,
+  NATIVE_ARTIFACT_HOST,
+  NATIVE_BUNDLE_IDENTIFIER,
+  NATIVE_EXECUTABLE_NAME,
+  NATIVE_MINIMUM_MACOS_VERSION,
+  expectedArtifactUrl,
+  findFileUpward,
+  findForbiddenVirtualMachineArtifactPaths,
+  findPackageRoot,
+  findPackageVersion,
+  isForbiddenVirtualMachineArtifactPath,
+  parseNativeArtifactManifest,
+  readNativeArtifactManifest
+};