@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releasePolicy.js

@@ -1,169 +1,144 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildReleasePolicyMessage = buildReleasePolicyMessage;
-exports.verifyReleasePolicy = verifyReleasePolicy;
-exports.isReleasePolicyCohortEligible = isReleasePolicyCohortEligible;
-exports.assessReleasePolicy = assessReleasePolicy;
-/**
- * Signed multi-component release policy.
- *
- * The daemon artifact manifest authenticates a daemon binary. This envelope
- * authenticates the *decision* to offer that binary to a cohort, and records
- * the component contract that makes a CLI/daemon/desktop combination safe.
- * It is separately signed so it can be added to a v1 artifact manifest without
- * changing the legacy manifest signature bytes or blocking old daemons.
- */
-const node_crypto_1 = require("node:crypto");
-const releaseKeys_js_1 = require("./releaseKeys.js");
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var releasePolicy_exports = {};
+__export(releasePolicy_exports, {
+  assessReleasePolicy: () => assessReleasePolicy,
+  buildReleasePolicyMessage: () => buildReleasePolicyMessage,
+  isReleasePolicyCohortEligible: () => isReleasePolicyCohortEligible,
+  verifyReleasePolicy: () => verifyReleasePolicy
+});
+module.exports = __toCommonJS(releasePolicy_exports);
+var import_node_crypto = require("node:crypto");
+var import_releaseKeys = require("./releaseKeys.js");
 const MAX_SIGS = 8;
 function stableJson(value) {
-    if (value === null ||
-        typeof value === 'boolean' ||
-        typeof value === 'number' ||
-        typeof value === 'string') {
-        return JSON.stringify(value);
-    }
-    if (Array.isArray(value))
-        return `[${value.map(stableJson).join(',')}]`;
-    if (!value || typeof value !== 'object')
-        throw new Error('policy contains an unsupported value');
-    const record = value;
-    return `{${Object.keys(record)
-        .sort()
-        .map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`)
-        .join(',')}}`;
+  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(stableJson).join(",")}]`;
+  if (!value || typeof value !== "object")
+    throw new Error("policy contains an unsupported value");
+  const record = value;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
 }
-/** Canonical, versioned signature message. Never sign JSON.stringify directly. */
 function buildReleasePolicyMessage(policy) {
-    return ['oversky-release-policy', 'v1', stableJson(policy)].join('\n');
+  return ["oversky-release-policy", "v1", stableJson(policy)].join("\n");
 }
 function verifyOne(message, signature, keys) {
-    if (keys.length === 0)
-        return { disabled: true };
-    if (!signature)
-        return { ok: false, reason: 'missing signature' };
-    const messageBytes = Buffer.from(message, 'utf8');
-    const signatureBytes = Buffer.from(signature, 'base64');
-    for (const keySpec of keys) {
-        try {
-            const key = (0, node_crypto_1.createPublicKey)({
-                key: Buffer.from(keySpec.publicKeySpkiB64, 'base64'),
-                format: 'der',
-                type: 'spki',
-            });
-            if ((0, node_crypto_1.verify)(null, messageBytes, key, signatureBytes))
-                return { ok: true };
-        }
-        catch {
-            /* malformed signatures and keys are a verification failure */
-        }
+  if (keys.length === 0)
+    return { disabled: true };
+  if (!signature)
+    return { ok: false, reason: "missing signature" };
+  const messageBytes = Buffer.from(message, "utf8");
+  const signatureBytes = Buffer.from(signature, "base64");
+  for (const keySpec of keys) {
+    try {
+      const key = (0, import_node_crypto.createPublicKey)({
+        key: Buffer.from(keySpec.publicKeySpkiB64, "base64"),
+        format: "der",
+        type: "spki"
+      });
+      if ((0, import_node_crypto.verify)(null, messageBytes, key, signatureBytes))
+        return { ok: true };
+    } catch {
     }
-    return { ok: false, reason: 'signature did not verify against any pinned key' };
+  }
+  return { ok: false, reason: "signature did not verify against any pinned key" };
 }
 function policyShapeIsValid(policy) {
-    if (!policy ||
-        typeof policy !== 'object' ||
-        policy.schemaVersion !== 1 ||
-        !/^[0-9A-Za-z._:-]+$/.test(policy.releaseId) ||
-        !['stable', 'canary', 'beta', 'internal'].includes(policy.channel) ||
-        !Number.isInteger(policy.rolloutBasisPoints) ||
-        policy.rolloutBasisPoints < 0 ||
-        policy.rolloutBasisPoints > 10_000 ||
-        typeof policy.cohortSeed !== 'string' ||
-        policy.cohortSeed.length < 8 ||
-        !policy.components ||
-        typeof policy.components !== 'object' ||
-        Array.isArray(policy.components)) {
-        return false;
-    }
-    const issued = Date.parse(policy.issuedAt);
-    const expires = Date.parse(policy.expiresAt);
-    if (!Number.isFinite(issued) || !Number.isFinite(expires) || expires <= issued)
-        return false;
-    return Object.values(policy.components).every((component) => component &&
-        typeof component === 'object' &&
-        !Array.isArray(component) &&
-        (!component.contracts ||
-            (typeof component.contracts === 'object' && !Array.isArray(component.contracts))) &&
-        typeof component.version === 'string' &&
-        component.version.length > 0 &&
-        Object.values(component.contracts ?? {}).every((range) => range &&
-            typeof range === 'object' &&
-            !Array.isArray(range) &&
-            Number.isInteger(range.minimum) &&
-            Number.isInteger(range.maximum) &&
-            range.minimum >= 0 &&
-            range.maximum >= range.minimum));
+  if (!policy || typeof policy !== "object" || policy.schemaVersion !== 1 || !/^[0-9A-Za-z._:-]+$/.test(policy.releaseId) || !["stable", "canary", "beta", "internal"].includes(policy.channel) || !Number.isInteger(policy.rolloutBasisPoints) || policy.rolloutBasisPoints < 0 || policy.rolloutBasisPoints > 1e4 || typeof policy.cohortSeed !== "string" || policy.cohortSeed.length < 8 || !policy.components || typeof policy.components !== "object" || Array.isArray(policy.components)) {
+    return false;
+  }
+  const issued = Date.parse(policy.issuedAt);
+  const expires = Date.parse(policy.expiresAt);
+  if (!Number.isFinite(issued) || !Number.isFinite(expires) || expires <= issued)
+    return false;
+  return Object.values(policy.components).every((component) => component && typeof component === "object" && !Array.isArray(component) && (!component.contracts || typeof component.contracts === "object" && !Array.isArray(component.contracts)) && typeof component.version === "string" && component.version.length > 0 && Object.values(component.contracts ?? {}).every((range) => range && typeof range === "object" && !Array.isArray(range) && Number.isInteger(range.minimum) && Number.isInteger(range.maximum) && range.minimum >= 0 && range.maximum >= range.minimum));
 }
-function verifyReleasePolicy(policy, keys = releaseKeys_js_1.OVERSKY_RELEASE_PUBLIC_KEYS) {
-    if (!policyShapeIsValid(policy))
-        return { ok: false, reason: 'invalid release-policy shape' };
-    const { sig, sigs, ...unsigned } = policy;
-    const message = buildReleasePolicyMessage(unsigned);
-    if (Array.isArray(sigs) && sigs.length > 0) {
-        if (keys.length === 0)
-            return { disabled: true };
-        for (const entry of sigs.slice(0, MAX_SIGS)) {
-            if (!entry || typeof entry.sig !== 'string')
-                continue;
-            const verdict = verifyOne(message, entry.sig, keys);
-            if ('ok' in verdict && verdict.ok)
-                return verdict;
-        }
-        return { ok: false, reason: 'no policy multi-signature verified against a pinned key' };
+function verifyReleasePolicy(policy, keys = import_releaseKeys.OVERSKY_RELEASE_PUBLIC_KEYS) {
+  if (!policyShapeIsValid(policy))
+    return { ok: false, reason: "invalid release-policy shape" };
+  const { sig, sigs, ...unsigned } = policy;
+  const message = buildReleasePolicyMessage(unsigned);
+  if (Array.isArray(sigs) && sigs.length > 0) {
+    if (keys.length === 0)
+      return { disabled: true };
+    for (const entry of sigs.slice(0, MAX_SIGS)) {
+      if (!entry || typeof entry.sig !== "string")
+        continue;
+      const verdict = verifyOne(message, entry.sig, keys);
+      if ("ok" in verdict && verdict.ok)
+        return verdict;
     }
-    return verifyOne(message, sig, keys);
+    return { ok: false, reason: "no policy multi-signature verified against a pinned key" };
+  }
+  return verifyOne(message, sig, keys);
 }
 function isReleasePolicyCohortEligible(policy, subject) {
-    if (!subject || policy.rolloutBasisPoints === 0)
-        return false;
-    if (policy.rolloutBasisPoints === 10_000)
-        return true;
-    const bucket = (0, node_crypto_1.createHash)('sha256')
-        .update(`${policy.releaseId}\n${policy.cohortSeed}\n${subject}`, 'utf8')
-        .digest()
-        .readUInt32BE(0) % 10_000;
-    return bucket < policy.rolloutBasisPoints;
+  if (!subject || policy.rolloutBasisPoints === 0)
+    return false;
+  if (policy.rolloutBasisPoints === 1e4)
+    return true;
+  const bucket = (0, import_node_crypto.createHash)("sha256").update(`${policy.releaseId}
+${policy.cohortSeed}
+${subject}`, "utf8").digest().readUInt32BE(0) % 1e4;
+  return bucket < policy.rolloutBasisPoints;
 }
-/**
- * Verify expiry, daemon target binding, contract ranges, channel, and cohort.
- * `autonomous=false` intentionally bypasses cohort gating: an operator who
- * explicitly runs an update may recover a machine outside the staged cohort,
- * but cannot bypass invalid signatures, an expired policy, or incompatibility.
- */
 function assessReleasePolicy(args) {
-    const now = args.now ?? new Date();
-    if (Date.parse(args.policy.expiresAt) <= now.getTime()) {
-        return { valid: false, eligible: false, reason: `policy expired at ${args.policy.expiresAt}` };
-    }
-    if (args.policy.channel !== args.channel) {
-        return {
-            valid: false,
-            eligible: false,
-            reason: `policy channel ${args.policy.channel} does not match ${args.channel}`,
-        };
-    }
-    const componentName = args.targetComponent ?? 'daemon';
-    const daemon = args.policy.components[componentName];
-    if (!daemon || daemon.version !== args.targetDaemonVersion) {
-        return {
-            valid: false,
-            eligible: false,
-            reason: `policy ${componentName} component does not bind the target artifact version`,
-        };
-    }
-    for (const [name, range] of Object.entries(daemon.contracts ?? {})) {
-        const actual = args.contracts[name];
-        if (!Number.isInteger(actual) || actual < range.minimum || actual > range.maximum) {
-            return {
-                valid: false,
-                eligible: false,
-                reason: `local contract ${name}=${String(actual)} is outside policy range ${range.minimum}..${range.maximum}`,
-            };
-        }
+  const now = args.now ?? /* @__PURE__ */ new Date();
+  if (Date.parse(args.policy.expiresAt) <= now.getTime()) {
+    return { valid: false, eligible: false, reason: `policy expired at ${args.policy.expiresAt}` };
+  }
+  if (args.policy.channel !== args.channel) {
+    return {
+      valid: false,
+      eligible: false,
+      reason: `policy channel ${args.policy.channel} does not match ${args.channel}`
+    };
+  }
+  const componentName = args.targetComponent ?? "daemon";
+  const daemon = args.policy.components[componentName];
+  if (!daemon || daemon.version !== args.targetDaemonVersion) {
+    return {
+      valid: false,
+      eligible: false,
+      reason: `policy ${componentName} component does not bind the target artifact version`
+    };
+  }
+  for (const [name, range] of Object.entries(daemon.contracts ?? {})) {
+    const actual = args.contracts[name];
+    if (!Number.isInteger(actual) || actual < range.minimum || actual > range.maximum) {
+      return {
+        valid: false,
+        eligible: false,
+        reason: `local contract ${name}=${String(actual)} is outside policy range ${range.minimum}..${range.maximum}`
+      };
     }
-    const eligible = !args.autonomous || isReleasePolicyCohortEligible(args.policy, args.cohortSubject);
-    return eligible
-        ? { valid: true, eligible: true }
-        : { valid: true, eligible: false, reason: 'machine is outside rollout cohort' };
+  }
+  const eligible = !args.autonomous || isReleasePolicyCohortEligible(args.policy, args.cohortSubject);
+  return eligible ? { valid: true, eligible: true } : { valid: true, eligible: false, reason: "machine is outside rollout cohort" };
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  assessReleasePolicy,
+  buildReleasePolicyMessage,
+  isReleasePolicyCohortEligible,
+  verifyReleasePolicy
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releaseVersions.js

@@ -1,44 +1,67 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.compareReleaseVersions = compareReleaseVersions;
-/** SemVer precedence shared by every local release consumer. Invalid inputs are never ordered. */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var releaseVersions_exports = {};
+__export(releaseVersions_exports, {
+  compareReleaseVersions: () => compareReleaseVersions
+});
+module.exports = __toCommonJS(releaseVersions_exports);
 function compareReleaseVersions(a, b) {
-    const parse = (value) => {
-        if (typeof value !== 'string')
-            return null;
-        const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value.trim());
-        if (!match)
-            return null;
-        const prerelease = match[4]?.split('.') ?? [];
-        if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part[0] === '0'))
-            return null;
-        return { core: match.slice(1, 4).map(BigInt), prerelease };
-    };
-    const left = parse(a);
-    const right = parse(b);
-    if (!left || !right)
-        return null;
-    for (let i = 0; i < 3; i++) {
-        if (left.core[i] !== right.core[i])
-            return left.core[i] < right.core[i] ? -1 : 1;
-    }
-    if (!left.prerelease.length || !right.prerelease.length) {
-        return left.prerelease.length === right.prerelease.length ? 0 : left.prerelease.length ? -1 : 1;
-    }
-    for (let i = 0; i < Math.max(left.prerelease.length, right.prerelease.length); i++) {
-        const l = left.prerelease[i];
-        const r = right.prerelease[i];
-        if (l === undefined || r === undefined)
-            return l === r ? 0 : l === undefined ? -1 : 1;
-        if (l === r)
-            continue;
-        const ln = /^\d+$/.test(l);
-        const rn = /^\d+$/.test(r);
-        if (ln && rn)
-            return BigInt(l) < BigInt(r) ? -1 : 1;
-        if (ln !== rn)
-            return ln ? -1 : 1;
-        return l < r ? -1 : 1;
-    }
-    return 0;
+  const parse = (value) => {
+    if (typeof value !== "string")
+      return null;
+    const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value.trim());
+    if (!match)
+      return null;
+    const prerelease = match[4]?.split(".") ?? [];
+    if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part[0] === "0"))
+      return null;
+    return { core: match.slice(1, 4).map(BigInt), prerelease };
+  };
+  const left = parse(a);
+  const right = parse(b);
+  if (!left || !right)
+    return null;
+  for (let i = 0; i < 3; i++) {
+    if (left.core[i] !== right.core[i])
+      return left.core[i] < right.core[i] ? -1 : 1;
+  }
+  if (!left.prerelease.length || !right.prerelease.length) {
+    return left.prerelease.length === right.prerelease.length ? 0 : left.prerelease.length ? -1 : 1;
+  }
+  for (let i = 0; i < Math.max(left.prerelease.length, right.prerelease.length); i++) {
+    const l = left.prerelease[i];
+    const r = right.prerelease[i];
+    if (l === void 0 || r === void 0)
+      return l === r ? 0 : l === void 0 ? -1 : 1;
+    if (l === r)
+      continue;
+    const ln = /^\d+$/.test(l);
+    const rn = /^\d+$/.test(r);
+    if (ln && rn)
+      return BigInt(l) < BigInt(r) ? -1 : 1;
+    if (ln !== rn)
+      return ln ? -1 : 1;
+    return l < r ? -1 : 1;
+  }
+  return 0;
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  compareReleaseVersions
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/restartArtifact.d.ts

@@ -0,0 +1,10 @@
+export interface RestartArtifact {
+    path: string;
+    mtimeMs: number;
+    sha256: string;
+}
+/**
+ * First-party build readiness identity; dependency/assets integrity remains the
+ * signed installer's authority. JS binds build files, not just index.js.
+ */
+export declare function captureRestartArtifact(input: string): RestartArtifact;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/restartArtifact.js

@@ -0,0 +1,148 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var restartArtifact_exports = {};
+__export(restartArtifact_exports, {
+  captureRestartArtifact: () => captureRestartArtifact
+});
+module.exports = __toCommonJS(restartArtifact_exports);
+var import_node_crypto = require("node:crypto");
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+const CODE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".cjs", ".mjs", ".json", ".node", ".wasm"]);
+const OMIT_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", ".git", "__tests__", "__fixtures__"]);
+const MAX_FILES = 25e3;
+const MAX_BYTES = 256 * 1024 * 1024;
+const MAX_DEPTH = 32;
+const MAX_ENTRIES = 5e4;
+function stamp(file) {
+  const value = (0, import_node_fs.statSync)(file, { bigint: true });
+  return `${value.dev}:${value.ino}:${value.size}:${value.mtimeNs}:${value.ctimeNs}`;
+}
+function executableHeader(bytes) {
+  const magic = bytes.subarray(0, 4).toString("hex");
+  return bytes.subarray(0, 2).toString() === "MZ" || ["7f454c46", "feedface", "cefaedfe", "feedfacf", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca"].includes(magic);
+}
+function captureRestartArtifact(input) {
+  const path = (0, import_node_path.resolve)(input);
+  const entry = (0, import_node_fs.realpathSync)(path);
+  const initialEntry = stamp(entry);
+  const extension = (0, import_node_path.extname)(entry);
+  const javascript = [".js", ".cjs", ".mjs"].includes(extension);
+  const hash = (0, import_node_crypto.createHash)("sha256");
+  const seen = [];
+  let bytes = 0;
+  const addFile = (file, name) => {
+    if (seen.length >= MAX_FILES)
+      throw new Error("Restart build exceeds the file limit");
+    const before = stamp(file);
+    const fd = (0, import_node_fs.openSync)(file, import_node_fs.constants.O_RDONLY | (import_node_fs.constants.O_NOFOLLOW ?? 0));
+    try {
+      const info = (0, import_node_fs.fstatSync)(fd);
+      if (!info.isFile())
+        throw new Error("Restart build contains a linked or special code file");
+      if (info.size > MAX_BYTES - bytes)
+        throw new Error("Restart build exceeds the byte limit");
+      hash.update(JSON.stringify([name, info.size]));
+      const chunk = Buffer.allocUnsafe(64 * 1024);
+      let readBytes = 0;
+      for (; ; ) {
+        const count = (0, import_node_fs.readSync)(fd, chunk, 0, Math.min(chunk.length, MAX_BYTES - bytes + 1), null);
+        if (!count)
+          break;
+        if (!javascript && readBytes === 0 && !executableHeader(chunk.subarray(0, count))) {
+          throw new Error("Restart artifact is not a supported native executable");
+        }
+        bytes += count;
+        readBytes += count;
+        if (bytes > MAX_BYTES)
+          throw new Error("Restart build exceeds the byte limit");
+        hash.update(chunk.subarray(0, count));
+      }
+      if (readBytes !== info.size || !javascript && readBytes === 0 || stamp(file) !== before) {
+        throw new Error("Restart build changed while its identity was captured");
+      }
+    } finally {
+      (0, import_node_fs.closeSync)(fd);
+    }
+    seen.push([file, before]);
+  };
+  if (javascript) {
+    hash.update("skrr-restart-javascript-v1\0");
+    const root = (0, import_node_path.dirname)(entry);
+    const directories = [];
+    let entries = 0;
+    const walk = (dir, depth) => {
+      if (depth > MAX_DEPTH)
+        throw new Error("Restart build exceeds the directory depth limit");
+      directories.push([dir, stamp(dir)]);
+      const names = [];
+      const directory = (0, import_node_fs.opendirSync)(dir);
+      try {
+        for (let item = directory.readSync(); item; item = directory.readSync()) {
+          if (++entries > MAX_ENTRIES)
+            throw new Error("Restart build exceeds the directory entry limit");
+          names.push(item.name);
+        }
+      } finally {
+        directory.closeSync();
+      }
+      for (const name of names.sort()) {
+        if (OMIT_DIRECTORIES.has(name))
+          continue;
+        const file = (0, import_node_path.join)(dir, name);
+        const info = (0, import_node_fs.lstatSync)(file);
+        if (info.isSymbolicLink())
+          throw new Error("Restart build contains a linked or special code file");
+        if (info.isDirectory()) {
+          walk(file, depth + 1);
+        } else if (CODE_EXTENSIONS.has((0, import_node_path.extname)(name)) && !/\.(?:test|spec)\.[cm]?js$/.test(name)) {
+          if (!info.isFile())
+            throw new Error("Restart build contains a linked or special code file");
+          addFile(file, (0, import_node_path.relative)(root, file).split("\\").join("/"));
+        }
+      }
+    };
+    walk(root, 0);
+    for (const name of ["package.json", "dependency-receipt.json"]) {
+      const metadataFile = (0, import_node_path.join)(root, "..", name);
+      try {
+        if ((0, import_node_fs.lstatSync)(metadataFile).isFile())
+          addFile(metadataFile, `../${name}`);
+        else
+          throw new Error("Restart package metadata is not a regular file");
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+      }
+    }
+    if (directories.some(([dir, before]) => stamp(dir) !== before)) {
+      throw new Error("Restart build directory changed while its identity was captured");
+    }
+  } else {
+    addFile(entry, "executable");
+  }
+  if ((0, import_node_fs.realpathSync)(path) !== entry || stamp(entry) !== initialEntry || seen.some(([file, before]) => stamp(file) !== before)) {
+    throw new Error("Restart build changed while its identity was captured");
+  }
+  return { path, mtimeMs: (0, import_node_fs.statSync)(entry).mtimeMs, sha256: hash.digest("hex") };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  captureRestartArtifact
+});