@standardagents/code 0.14.1-issue.650.d27328 → 0.14.1-issue.653.6647dc-linux-x64-gnu

package/licenses/THIRD-PARTY.txt

@@ -0,0 +1,152 @@
+libevent.txt
+============
+Libevent is available for use under the following license, commonly known
+as the 3-clause (or "modified") BSD license:
+
+==============================
+Copyright (c) 2000-2007 Niels Provos <provos@citi.umich.edu>
+Copyright (c) 2007-2012 Niels Provos and Nick Mathewson
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. The name of the author may not be used to endorse or promote products
+   derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+==============================
+
+Portions of Libevent are based on works by others, also made available by
+them under the three-clause BSD license above.  The copyright notices are
+available in the corresponding source files; the license is as above.  Here's
+a list:
+
+log.c:
+   Copyright (c) 2000 Dug Song <dugsong@monkey.org>
+   Copyright (c) 1993 The Regents of the University of California.
+
+strlcpy.c:
+   Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
+
+win32select.c:
+   Copyright (c) 2003 Michael A. Davis <mike@datanerds.net>
+
+evport.c:
+   Copyright (c) 2007 Sun Microsystems
+
+ht-internal.h:
+   Copyright (c) 2002 Christopher Clark
+
+minheap-internal.h:
+   Copyright (c) 2006 Maxim Yegorushkin <maxim.yegorushkin@gmail.com>
+
+==============================
+
+The arc4module is available under the following, sometimes called the
+"OpenBSD" license:
+
+   Copyright (c) 1996, David Mazieres <dm@uun.org>
+   Copyright (c) 2008, Damien Miller <djm@openbsd.org>
+
+   Permission to use, copy, modify, and distribute this software for any
+   purpose with or without fee is hereby granted, provided that the above
+   copyright notice and this permission notice appear in all copies.
+
+   THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+   WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+   MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+   ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+==============================
+
+The Windows timer code is based on code from libutp, which is
+distributed under this license, sometimes called the "MIT" license.
+
+
+Copyright (c) 2010 BitTorrent, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+
+ncurses.txt
+===========
+Copyright 2018-2024,2025 Thomas E. Dickey
+Copyright 1998-2017,2018 Free Software Foundation, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, distribute with modifications, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR
+THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+Except as contained in this notice, the name(s) of the above copyright
+holders shall not be used in advertising or otherwise to promote the
+sale, use or other dealings in this Software without prior written
+authorization.
+
+-- vile:txtmode fc=72
+-- $Id: COPYING,v 1.14 2025/01/04 10:53:46 tom Exp $
+
+
+tmux.txt
+========
+Copyright (c) Various Authors
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER
+IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
+OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+

package/manifest.json

@@ -0,0 +1 @@
+{"schema":2,"format":"standard-npm-native-target-v2","repository":"standardagents/code-rs","commit":"6647dc62cf91b02086fdfef2250843f06b65d042","version":"0.14.1-issue.653.6647dc","target":"x86_64-unknown-linux-gnu","runtime":{"tmuxVersion":"3.7","tmuxSha256":"27f6336520fb81d4a4a495b74ae60cb502203cce5a5c4411b2bc320d38855954","accountUpdateProtocol":1,"minimumGlibc":"2.28"},"signing":{"algorithm":"ed25519","keyId":"team-2026-1","platformCodeSignature":"ed25519-only"},"files":[{"path":"bin/standard","size":40005472,"sha256":"cb4f816dac37596499700b15a2162e238c5fb4b2cf4ff379f6c585eea3fdebef"},{"path":"bin/standardd","size":48737664,"sha256":"95df8467976181501e5457346ac48ce46b9492a2ec0782d3855bc408d955b3a4"},{"path":"bin/tmux","size":1433024,"sha256":"27f6336520fb81d4a4a495b74ae60cb502203cce5a5c4411b2bc320d38855954"},{"path":"licenses/THIRD-PARTY.txt","size":6779,"sha256":"fc410e91ff375a3057837d3029ec2626e6110a05f69b6fee7ca4e9f588b1a294"},{"path":"lib/standard-plugin-runner/index.mjs","size":43643,"sha256":"27b33908c2450d03035eca8ff6b1b0795de411d6f7d3845c75c6d3055da79cb8"},{"path":"lib/standard-plugin-runner/worker.mjs","size":66854,"sha256":"ea98bb6824394bef31231820dbff4c51bee02a6bb7b6c925acf67f35a1ffac3b"},{"path":"lib/standard-plugin-runner/loader.mjs","size":9941496,"sha256":"9d8b50fd453aff0e2d0e09124e70b4f8474450abbf32570ed012daae453cf1b7"},{"path":"lib/standard-plugin-runner/sdk.mjs","size":27145,"sha256":"9367dde0ef6b22b7aa3f7e5ad1f67bdfa9c0eb89626442564ee200b98b17b3b7"},{"path":"lib/standard-plugin-runner/runtime.json","size":291,"sha256":"1e243a4eb585411818b42b451651cee9c07ee2945b5a9dd592710346384061f0"},{"path":"lib/standard-plugin-runner/THIRD-PARTY.txt","size":47041,"sha256":"99747b97f9fe386da34e92120cec7ce1806c515409db20adc546b6ecc434f1ca"}]}

package/manifest.sig

@@ -0,0 +1 @@
+mNxWTrx0k1aAEuKikj7Uksl5Mcqkxtzn8r7qF4s7QT24daLxReZzwZxbrpcFZA+qE+AXwUx3lL1kzIofuI/hDw==

package/package.json

@@ -1,42 +1,30 @@
 {
   "name": "@standardagents/code",
-  "version": "0.14.1-issue.650.d27328",
-  "description": "Platform launcher for the Standard universal terminal network.",
-  "type": "module",
-  "license": "UNLICENSED",
+  "version": "0.14.1-issue.653.6647dc-linux-x64-gnu",
+  "description": "Standard native binaries for linux-x64-gnu.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/standardagents/code-rs.git"
   },
-  "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org/"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "bin": {
-    "standard": "bin/standard.mjs",
-    "standardd": "bin/standardd.mjs"
-  },
+  "license": "UNLICENSED",
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "x64"
+  ],
+  "libc": [
+    "glibc"
+  ],
   "files": [
     "bin",
+    "licenses",
     "lib",
-    "postinstall.mjs"
+    "manifest.json",
+    "manifest.sig"
   ],
-  "scripts": {
-    "postinstall": "node postinstall.mjs"
-  },
-  "optionalDependencies": {
-    "@standardagents/code-darwin-arm64": "npm:@standardagents/code@0.14.1-issue.650.d27328-darwin-arm64",
-    "@standardagents/code-linux-x64-gnu": "npm:@standardagents/code@0.14.1-issue.650.d27328-linux-x64-gnu"
-  },
-  "standardUpgrade": {
-    "schema": 1,
-    "reader": 1,
-    "bridge": {
-      "version": "0.14.1-canary.76909e",
-      "commit": "76909e97ec56c2ba5490932135642962c4035596"
-    }
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
   }
 }

package/bin/standard.mjs

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { main } from '../lib/launcher.mjs'
-
-main('standard')

package/bin/standardd.mjs

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { main } from '../lib/launcher.mjs'
-
-main('standardd')

package/lib/artifact.mjs

@@ -1,326 +0,0 @@
-import { createHash, createPublicKey, verify } from 'node:crypto'
-import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, readdirSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import { isPreviewBuild, normalizeBackendProfile } from './backend-profile.mjs'
-
-export const ARTIFACT_FORMAT = 'standard-npm-native-target-v2'
-export const ARTIFACT_FILES = Object.freeze([
-  'bin/standard', 'bin/standardd', 'bin/tmux', 'licenses/THIRD-PARTY.txt',
-])
-export const BUNDLE_ARTIFACT_FORMAT = 'standard-npm-native-target-v3'
-export const BUNDLE_ARTIFACT_FILES = Object.freeze([
-  // Stapled notarization tickets are distinct from the code signature seals.
-  'Standard Code.app/Contents/CodeResources',
-  'Standard Code.app/Contents/Info.plist',
-  'Standard Code.app/Contents/MacOS/standard',
-  'Standard Code.app/Contents/_CodeSignature/CodeResources',
-  'Standard Code Daemon.app/Contents/CodeResources',
-  'Standard Code Daemon.app/Contents/Info.plist',
-  'Standard Code Daemon.app/Contents/MacOS/standardd',
-  'Standard Code Daemon.app/Contents/Helpers/tmux',
-  'Standard Code Daemon.app/Contents/_CodeSignature/CodeResources',
-  ...['TMUX-ARTIFACT-MANIFEST.sha256', 'TMUX-ARTIFACT-METADATA.txt',
-    'TMUX-BUILD-TOOLS.txt', 'TMUX-OTOOL-L.txt', 'TMUX-SIGNED-RUNTIME.sha256',
-    'licenses/libevent.txt', 'licenses/tmux.txt',
-  ].map(path => `Standard Code Daemon.app/Contents/Resources/tmux/${path}`),
-  'licenses/THIRD-PARTY.txt',
-])
-
-export const RUNNER_ASSET_NAMES = Object.freeze([
-  'index.mjs', 'worker.mjs', 'loader.mjs', 'sdk.mjs', 'runtime.json', 'THIRD-PARTY.txt',
-])
-export const MAX_RUNNER_ASSET_BYTES = 16 * 1024 * 1024
-export const RUNNER_ARTIFACT_FILES = Object.freeze([
-  ...ARTIFACT_FILES, ...RUNNER_ASSET_NAMES.map(name => `lib/standard-plugin-runner/${name}`),
-])
-export const BUNDLE_RUNNER_ARTIFACT_FILES = Object.freeze([
-  ...BUNDLE_ARTIFACT_FILES,
-  ...RUNNER_ASSET_NAMES.map(name => `Standard Code Daemon.app/Contents/Resources/plugin-runner/${name}`),
-])
-
-export function artifactFiles(manifest) {
-  const hasRunner = manifest.files?.some(file => file.path?.includes('/plugin-runner/') || file.path?.startsWith('lib/standard-plugin-runner/'))
-  if (manifest.schema === 2 && manifest.format === ARTIFACT_FORMAT
-    && manifest.target?.endsWith('-unknown-linux-gnu')) return hasRunner ? RUNNER_ARTIFACT_FILES : ARTIFACT_FILES
-  if (manifest.schema === 3 && manifest.format === BUNDLE_ARTIFACT_FORMAT
-    && manifest.target?.endsWith('-apple-darwin')) return hasRunner ? BUNDLE_RUNNER_ARTIFACT_FILES : BUNDLE_ARTIFACT_FILES
-  throw new Error('Native artifact identity is invalid')
-}
-
-export function artifactBinaryPath(manifest, command) {
-  if (!['standard', 'standardd', 'tmux'].includes(command)) throw new Error('Invalid artifact command')
-  artifactFiles(manifest)
-  if (manifest.target.endsWith('-unknown-linux-gnu')) return `bin/${command}`
-  if (command === 'tmux') return 'Standard Code Daemon.app/Contents/Helpers/tmux'
-  return `${command === 'standard' ? 'Standard Code' : 'Standard Code Daemon'}.app/Contents/MacOS/${command}`
-}
-
-export function artifactDirectories(files) {
-  const directories = new Set()
-  for (const file of files) {
-    for (let directory = dirname(file); directory !== '.'; directory = dirname(directory)) directories.add(directory)
-  }
-  return [...directories].sort()
-}
-
-// Bundle signatures seal resources too: reject unmanifested contents and links
-// at every directory level, including links in an executable's ancestors.
-export function verifyArtifactTree(root, files, metadata = ['manifest.json', 'manifest.sig', 'package.json']) {
-  const allowedFiles = new Set([...files, ...metadata])
-  const allowedDirectories = new Set(artifactDirectories(files))
-  function visit(relative) {
-    const path = join(root, relative)
-    if (!lstatSync(path).isDirectory()) throw new Error(`Invalid artifact directory: ${path}`)
-    for (const name of readdirSync(path)) {
-      const child = relative ? `${relative}/${name}` : name
-      const entry = lstatSync(join(root, child))
-      if (entry.isDirectory() && allowedDirectories.has(child)) visit(child)
-      else if (!entry.isFile() || !allowedFiles.has(child)) throw new Error(`Unexpected artifact content: ${child}`)
-    }
-  }
-  visit('')
-  for (const directory of allowedDirectories) {
-    if (!lstatSync(join(root, directory)).isDirectory()) throw new Error(`Invalid artifact directory: ${directory}`)
-  }
-}
-
-// The four native targets the launcher has ever installed. The two deferred
-// ones stay so their published history verifies.
-export const NATIVE_ARTIFACT_TARGETS = Object.freeze([
-  'aarch64-apple-darwin', 'x86_64-apple-darwin',
-  'aarch64-unknown-linux-gnu', 'x86_64-unknown-linux-gnu',
-])
-// The browser viewer runtime: a fifth, distinct artifact kind that the same
-// build workers compile and sign. It never installs through the launcher.
-export const WEB_ARTIFACT_TARGET = 'wasm32-unknown-unknown'
-export const ARTIFACT_TARGETS = Object.freeze([...NATIVE_ARTIFACT_TARGETS, WEB_ARTIFACT_TARGET])
-
-// Web artifact (schema 4): the wasm-bindgen output, the bundled fonts, their
-// licenses, and the build record, at the artifact root. The font and license
-// sets vary with the pinned font list, so the manifest enumerates what the
-// build produced and the verifier checks each path against these rules.
-export const WEB_ARTIFACT_FORMAT = 'standard-npm-web-target-v1'
-export const WEB_ARTIFACT_SCHEMA = 4
-export const WEB_ARTIFACT_REQUIRED_FILES = Object.freeze([
-  'build.json', 'pkg/standard_web.js', 'pkg/standard_web_bg.wasm',
-])
-export const WEB_ARTIFACT_OPTIONAL_FILES = Object.freeze([
-  'pkg/standard_web.d.ts', 'pkg/standard_web_bg.wasm.d.ts',
-])
-// One level deep, one file kind each; at least one entry of each.
-export const WEB_ARTIFACT_DIRECTORIES = Object.freeze({ fonts: /\.ttf$/, licenses: /\.txt$/ })
-export const WEB_ARTIFACT_FILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/
-export const MAX_WEB_ASSET_BYTES = 64 * 1024 * 1024
-
-// Whether one artifact-relative path may appear in a web artifact.
-export function webArtifactPathAllowed(path) {
-  if (typeof path !== 'string') return false
-  const parts = path.split('/')
-  if (!parts.every(part => WEB_ARTIFACT_FILE_NAME.test(part))) return false
-  if (WEB_ARTIFACT_REQUIRED_FILES.includes(path) || WEB_ARTIFACT_OPTIONAL_FILES.includes(path)) return true
-  return parts.length === 2 && Boolean(WEB_ARTIFACT_DIRECTORIES[parts[0]]?.test(parts[1]))
-}
-
-// Check a complete web file list: every path allowed, every required file
-// present, each directory non-empty, no duplicates. Returns the sorted list.
-export function webArtifactFileList(paths) {
-  if (!Array.isArray(paths) || paths.some(path => !webArtifactPathAllowed(path))) {
-    throw new Error('Web artifact file manifest is invalid')
-  }
-  const files = [...paths].sort()
-  if (new Set(files).size !== files.length) throw new Error('Web artifact file manifest is invalid')
-  const missing = WEB_ARTIFACT_REQUIRED_FILES.filter(path => !files.includes(path))
-  for (const directory of Object.keys(WEB_ARTIFACT_DIRECTORIES)) {
-    if (!files.some(path => path.startsWith(`${directory}/`))) missing.push(`${directory}/`)
-  }
-  if (missing.length) throw new Error(`Web artifact is incomplete: missing ${missing.join(', ')}`)
-  return files
-}
-
-// Enumerate a built web artifact root as the file list its manifest binds.
-// Every entry must be a regular file the rules allow; anything else fails.
-export function webArtifactFilesOnDisk(root, metadata = ['manifest.json', 'manifest.sig']) {
-  const files = []
-  function visit(relative) {
-    for (const name of readdirSync(join(root, relative))) {
-      const child = relative ? `${relative}/${name}` : name
-      if (!relative && metadata.includes(child)) continue
-      const entry = lstatSync(join(root, child))
-      if (entry.isDirectory() && !relative && Object.hasOwn(WEB_ARTIFACT_DIRECTORIES, child)) visit(child)
-      else if (entry.isDirectory() && !relative && child === 'pkg') visit(child)
-      else if (!entry.isFile() || !webArtifactPathAllowed(child)) throw new Error(`Unexpected artifact content: ${child}`)
-      else files.push(child)
-    }
-  }
-  visit('')
-  return webArtifactFileList(files)
-}
-// Public trust anchor, not a credential. Never obtain the verification key
-// from the package being verified or a mutable registry response.
-export const ARTIFACT_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAk+Ndu0WtdSgUFkraXP5CAUlQqzm+EN/My2AwkoPOMqg=
------END PUBLIC KEY-----
-`
-
-export function validArtifactVersion(version) {
-  return typeof version === 'string'
-    && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version)
-    && (version.match(/^[^-]+-(.*)$/)?.[1].split('.') ?? []).every(part => !/^0\d+$/.test(part))
-}
-
-function regularFile(path, limit) {
-  const descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW)
-  try {
-    const metadata = fstatSync(descriptor)
-    if (!metadata.isFile() || metadata.size < 1 || metadata.size > limit) throw new Error(`Invalid artifact file: ${path}`)
-    return { descriptor, metadata }
-  } catch (error) { closeSync(descriptor); throw error }
-}
-
-function boundedBytes(path, limit) {
-  const { descriptor } = regularFile(path, limit)
-  try {
-    const buffer = Buffer.alloc(limit + 1)
-    let size = 0
-    while (size <= limit) {
-      const count = readSync(descriptor, buffer, size, buffer.length - size, null)
-      if (!count) return buffer.subarray(0, size)
-      size += count
-    }
-    throw new Error(`Artifact exceeds size limit: ${path}`)
-  } finally { closeSync(descriptor) }
-}
-
-// Read and authenticate an artifact's manifest against the pinned key. The
-// bytes that were signed are the bytes parsed; nothing is trusted before this.
-function signedManifest(root, publicKey, label) {
-  if (!lstatSync(root).isDirectory()) throw new Error(`Invalid artifact directory: ${root}`)
-  const bytes = boundedBytes(join(root, 'manifest.json'), 64 * 1024)
-  const signature = boundedBytes(join(root, 'manifest.sig'), 256).toString('utf8').trim()
-  const key = createPublicKey(publicKey)
-  if (key.asymmetricKeyType !== 'ed25519' || !verify(null, bytes, key, Buffer.from(signature, 'base64'))) {
-    throw new Error(`${label} artifact signature is invalid`)
-  }
-  return JSON.parse(bytes)
-}
-
-// Every manifested file must exist with exactly its signed size and digest.
-function verifyFileDigests(root, manifest, limitFor, label) {
-  const buffer = Buffer.alloc(1024 * 1024)
-  for (const file of manifest.files) {
-    if (!Number.isSafeInteger(file.size) || !/^[0-9a-f]{64}$/.test(file.sha256)) throw new Error(`${label} artifact file metadata is invalid`)
-    const path = join(root, file.path)
-    const { descriptor, metadata } = regularFile(path, limitFor(file.path))
-    try {
-      if (metadata.size !== file.size) throw new Error(`${label} artifact size mismatch: ${file.path}`)
-      const hash = createHash('sha256')
-      let size = 0
-      for (;;) {
-        const count = readSync(descriptor, buffer, 0, buffer.length, null)
-        if (!count) break
-        size += count
-        if (size > file.size) throw new Error(`${label} artifact grew while verifying: ${file.path}`)
-        hash.update(buffer.subarray(0, count))
-      }
-      if (size !== file.size || hash.digest('hex') !== file.sha256) throw new Error(`${label} artifact digest mismatch: ${file.path}`)
-    } finally { closeSync(descriptor) }
-  }
-}
-
-export function verifyNativeArtifact(root, expected = {}, publicKey = ARTIFACT_PUBLIC_KEY) {
-  const manifest = signedManifest(root, publicKey, 'Native')
-  const files = artifactFiles(manifest)
-  if (manifest.repository !== 'standardagents/code-rs'
-    || !NATIVE_ARTIFACT_TARGETS.includes(manifest.target)
-    || !/^[0-9a-f]{40}$/.test(manifest.commit)
-    || !validArtifactVersion(manifest.version)
-    || ['commit', 'version', 'target'].some(name => expected[name] != null && manifest[name] !== expected[name])
-    || manifest.signing?.algorithm !== 'ed25519') throw new Error('Native artifact identity is invalid')
-  if (Object.hasOwn(manifest, 'backendProfile') && (manifest.backendProfile == null || manifest.backendProfile === '')) {
-    throw new Error('Native artifact backend profile cannot be null')
-  }
-  const backendProfile = normalizeBackendProfile(manifest.backendProfile)
-  if (backendProfile && !isPreviewBuild(manifest.version)) {
-    throw new Error('Native artifact preview backend profile is not valid for this version')
-  }
-  if (!Array.isArray(manifest.files) || manifest.files.map(file => file.path).sort().join(',') !== [...files].sort().join(',')) {
-    throw new Error('Native artifact file manifest is invalid')
-  }
-  const runnerFiles = manifest.target.endsWith('-apple-darwin')
-    ? BUNDLE_RUNNER_ARTIFACT_FILES.slice(BUNDLE_ARTIFACT_FILES.length)
-    : RUNNER_ARTIFACT_FILES.slice(ARTIFACT_FILES.length)
-  if (!manifest.files.some(file => runnerFiles.includes(file.path))) {
-    for (const path of runnerFiles) {
-      try { lstatSync(join(root, path)) }
-      catch (error) { if (error.code === 'ENOENT') continue; throw error }
-      throw new Error('Native artifact contains unsigned plugin runner files')
-    }
-  }
-  if (manifest.schema === 3) verifyArtifactTree(root, files)
-  else for (const directory of artifactDirectories(files)) {
-    if (!lstatSync(join(root, directory)).isDirectory()) throw new Error(`Invalid artifact directory: ${directory}`)
-  }
-  const tmux = manifest.files.find(file => file.path === artifactBinaryPath(manifest, 'tmux'))
-  if (manifest.runtime?.tmuxVersion !== '3.7' || manifest.runtime.tmuxSha256 !== tmux.sha256) {
-    throw new Error('Native artifact tmux identity is invalid')
-  }
-  const protocol = manifest.runtime.accountUpdateProtocol
-  if (protocol != null && (!Number.isSafeInteger(protocol) || protocol < 1 || protocol > 0xffff_ffff)) {
-    throw new Error('Native artifact account update protocol is invalid')
-  }
-  if (manifest.target.endsWith('-apple-darwin')
-    && (manifest.signing.platformCodeSignature !== 'apple-developer-id'
-      || manifest.signing.notarization?.status !== 'Accepted'
-      || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(manifest.signing.notarization?.submissionId ?? ''))) {
-    throw new Error('macOS artifact lacks signed notarization acceptance')
-  }
-  if (manifest.target.endsWith('-unknown-linux-gnu')
-    && !/^\d+\.\d+(?:\.\d+)?$/.test(manifest.runtime.minimumGlibc ?? '')) throw new Error('Linux artifact lacks its glibc requirement')
-  verifyFileDigests(root, manifest, path => runnerFiles.includes(path) ? MAX_RUNNER_ASSET_BYTES : 256 * 1024 * 1024, 'Native')
-  return manifest
-}
-
-// Verify a web artifact root: the Ed25519 signature, the schema-4 identity,
-// the file rules, the exact on-disk file set (nothing unmanifested, no
-// links), the build record, and every digest. Returns the manifest.
-export function verifyWebArtifact(root, expected = {}, publicKey = ARTIFACT_PUBLIC_KEY) {
-  const manifest = signedManifest(root, publicKey, 'Web')
-  if (manifest.schema !== WEB_ARTIFACT_SCHEMA || manifest.format !== WEB_ARTIFACT_FORMAT
-    || manifest.target !== WEB_ARTIFACT_TARGET
-    || manifest.repository !== 'standardagents/code-rs'
-    || !/^[0-9a-f]{40}$/.test(manifest.commit)
-    || !validArtifactVersion(manifest.version)
-    || ['commit', 'version', 'target'].some(name => expected[name] != null && manifest[name] !== expected[name])
-    || manifest.signing?.algorithm !== 'ed25519') throw new Error('Web artifact identity is invalid')
-  if (Object.hasOwn(manifest, 'backendProfile') && (manifest.backendProfile == null || manifest.backendProfile === '')) {
-    throw new Error('Web artifact backend profile cannot be null')
-  }
-  const backendProfile = normalizeBackendProfile(manifest.backendProfile)
-  if (backendProfile && !isPreviewBuild(manifest.version)) {
-    throw new Error('Web artifact preview backend profile is not valid for this version')
-  }
-  if (!Array.isArray(manifest.files)) throw new Error('Web artifact file manifest is invalid')
-  const files = webArtifactFileList(manifest.files.map(file => file?.path))
-  verifyArtifactTree(root, files)
-  verifyFileDigests(root, manifest, () => MAX_WEB_ASSET_BYTES, 'Web')
-  // The build record is the identity the bundle itself reports; it must name
-  // the signed build, not a local or foreign one.
-  let record
-  try { record = JSON.parse(boundedBytes(join(root, 'build.json'), 4096)) } catch { record = null }
-  if (record?.schema !== 1 || record.commit !== manifest.commit || record.version !== manifest.version) {
-    throw new Error('Web artifact build record does not name the signed build')
-  }
-  return manifest
-}
-
-export function requireCompatibleGlibc(manifest, runtimeVersion) {
-  if (!manifest.target.endsWith('-unknown-linux-gnu')) return
-  const minimum = manifest.runtime.minimumGlibc
-  if (!/^\d+\.\d+(?:\.\d+)?$/.test(runtimeVersion ?? '')) throw new Error('Cannot determine this machine’s glibc version')
-  const actual = runtimeVersion.split('.').map(Number)
-  const required = minimum.split('.').map(Number)
-  for (let index = 0; index < 3; index++) {
-    if ((actual[index] ?? 0) > (required[index] ?? 0)) return
-    if ((actual[index] ?? 0) < (required[index] ?? 0)) throw new Error(`This Standard build requires glibc ${minimum}; this machine has ${runtimeVersion}`)
-  }
-}