@svp-labs/talos 0.0.0 → 0.1.1

package/dist/tools/lock.js

@@ -0,0 +1,100 @@
+import { readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { fetchInto } from './fetch.js';
+import { downloadFor, lockedTool, parseLock, } from './lockfile.js';
+import { installArgs, pypiStamp, venvArgs, venvProgram } from './pypi.js';
+import { ensureDir } from './store.js';
+import { EngineError } from '../core/check.js';
+import { cacheRoot } from '../version/cache.js';
+const INSTALL_TIMEOUT = 30 * 60 * 1000;
+/** `tools.lock` sits at the package's root, two levels above this module in `src` and `dist`. */
+function shippedLock() {
+    return fileURLToPath(new URL('../../tools.lock', import.meta.url));
+}
+function loadLock(file) {
+    let text;
+    try {
+        text = readFileSync(file, 'utf8');
+    }
+    catch {
+        throw new EngineError(`cannot read ${file}`);
+    }
+    return parseLock(text, file);
+}
+async function fileTool(session, name, tool) {
+    const download = downloadFor(tool, name, session.key);
+    const dir = join(session.cache, name, tool.version);
+    await ensureDir(dir, download.sha256, async (work) => {
+        session.log.info(`downloading ${name} ${tool.version}`);
+        await fetchInto(session, { name, tool, download, work });
+    });
+    return join(dir, download.path);
+}
+async function uvStep(session, args, cwd) {
+    const uv = await session.path('uv');
+    const env = { UV_PYTHON_INSTALL_DIR: join(session.cache, 'python') };
+    const result = await session.exec(uv, args, { cwd, env, timeoutMs: INSTALL_TIMEOUT });
+    if (result.code !== 0) {
+        const detail = (result.stderr || result.stdout).trim().split('\n').slice(-10).join('\n');
+        throw new EngineError(`uv ${args.slice(0, 2).join(' ')} failed: ${detail}`);
+    }
+}
+async function pypiTool(session, name, tool) {
+    const requirements = join(dirname(session.lockFile), tool.requirements);
+    let text;
+    try {
+        text = await readFile(requirements, 'utf8');
+    }
+    catch {
+        throw new EngineError(`cannot read ${requirements}, which tools.lock names for ${name}`);
+    }
+    const python = session.lock().runtimes.python;
+    const dir = join(session.cache, name, tool.version);
+    await ensureDir(dir, pypiStamp(python, text), async (work) => {
+        session.log.info(`installing ${name} ${tool.version}`);
+        const venv = join(work, 'venv');
+        await uvStep(session, venvArgs(python, venv), work);
+        await uvStep(session, installArgs(venv, requirements, session.platform), work);
+    });
+    return venvProgram(join(dir, 'venv'), tool.bin, session.platform);
+}
+async function resolveTool(session, name) {
+    const tool = lockedTool(session.lock(), name);
+    return tool.kind === 'pypi' ? pypiTool(session, name, tool) : fileTool(session, name, tool);
+}
+/**
+ * Tools from `tools.lock`: each is fetched into Talos's cache on first use, under
+ * `<name>/<version>`, and refused unless its sha256 is the one the lock pins. One process
+ * fetches a tool once however many checks ask for it at the same time.
+ */
+export function createTools(exec, log, options = {}) {
+    const lockFile = options.lockFile ?? shippedLock();
+    let lock;
+    const pending = new Map();
+    const session = {
+        exec,
+        log,
+        env: process.env,
+        platform: process.platform,
+        lockFile,
+        cache: options.cacheDir ?? join(cacheRoot(process.env), 'tools'),
+        key: options.platform ?? `${process.platform}-${process.arch}`,
+        lock: () => (lock ??= loadLock(lockFile)),
+        path: (name) => {
+            let found = pending.get(name);
+            if (found === undefined) {
+                found = resolveTool(session, name);
+                pending.set(name, found);
+                found.catch(() => pending.delete(name));
+            }
+            return found;
+        },
+    };
+    return {
+        path: (name) => session.path(name),
+        version: (name) => lockedTool(session.lock(), name).version,
+    };
+}
+//# sourceMappingURL=lock.js.map

package/dist/tools/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../src/tools/lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAqB,SAAS,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,WAAW,EAEX,UAAU,EACV,SAAS,GAGV,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAWvC,iGAAiG;AACjG,SAAS,WAAW;IAClB,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAYD,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,IAAY,EAAE,IAAc;IACpE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,IAAuB,EAAE,GAAW;IAC1E,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,EAAE,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzF,MAAM,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,IAAY,EAAE,IAAc;IACpE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,eAAe,YAAY,gCAAgC,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,IAAY;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAU,EAAE,GAAW,EAAE,UAAwB,EAAE;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IACnD,IAAI,IAA2B,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,OAAO,GAAY;QACvB,IAAI;QACJ,GAAG;QACH,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;QAChE,GAAG,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;QAC9D,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YACb,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACzB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;IACF,OAAO;QACL,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,OAAO;KAC5D,CAAC;AACJ,CAAC"}

package/dist/tools/lockfile.js

@@ -0,0 +1,81 @@
+import { z } from 'zod';
+import { EngineError } from '../core/check.js';
+/** Node's `<process.platform>-<process.arch>` for each machine Talos runs on, or `any`. */
+const PLATFORMS = [
+    'linux-x64',
+    'linux-arm64',
+    'darwin-x64',
+    'darwin-arm64',
+    'win32-x64',
+    'any',
+];
+const inside = z
+    .string()
+    .min(1)
+    .refine((path) => !/^([/\\]|[a-z]:)/i.test(path) && !path.split(/[/\\]/).includes('..'), 'must be a relative path that stays inside its directory');
+const download = z.strictObject({
+    url: z.string().regex(/^(https|file):\/\/\S+$/, 'must be an https URL'),
+    sha256: z.string().regex(/^[0-9a-f]{64}$/, 'must be a lowercase hexadecimal sha256'),
+    /** The executable inside the archive; for a single file, the name it is saved under. */
+    path: inside,
+});
+const fileTool = z.strictObject({
+    version: z.string().min(1),
+    /**
+     * `archive`: a tar or zip, unpacked whole; `binary`: the download is the tool itself;
+     * `psgallery`: a PowerShell Gallery package, a zip whose `path` is the module manifest.
+     */
+    kind: z.enum(['archive', 'binary', 'psgallery']),
+    platforms: z
+        .partialRecord(z.enum(PLATFORMS), download)
+        .refine((platforms) => Object.keys(platforms).length > 0, 'must list at least one download'),
+});
+const pypiTool = z.strictObject({
+    version: z.string().min(1),
+    kind: z.literal('pypi'),
+    /** Relative to `tools.lock`: requirements with a hash for every distribution. */
+    requirements: inside,
+    /** The console script the package installs. */
+    bin: z.string().regex(/^[\w.-]+$/, 'must be a program name'),
+});
+const lockSchema = z.strictObject({
+    '//': z.string().optional(),
+    /** The interpreters Talos installs tools into; the runtime checks read them too. */
+    runtimes: z.strictObject({
+        python: z.string().regex(/^\d+\.\d+\.\d+$/, 'must be an exact version'),
+    }),
+    tools: z.record(z.string().regex(/^[a-z][a-z0-9-]*$/, 'must be a lowercase name'), z.union([fileTool, pypiTool])),
+});
+/** Reads `tools.lock`; anything malformed is an engine error naming where. */
+export function parseLock(text, where) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new EngineError(`${where} is not valid JSON`);
+    }
+    const parsed = lockSchema.safeParse(raw);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        const at = issue === undefined ? '' : issue.path.map(String).join('.');
+        throw new EngineError(`${where} is invalid at ${at}: ${issue?.message ?? 'unknown problem'}`);
+    }
+    return parsed.data;
+}
+export function lockedTool(lock, name) {
+    const tool = lock.tools[name];
+    if (tool === undefined)
+        throw new EngineError(`${name} is not in tools.lock`);
+    return tool;
+}
+/** The download for this machine, or the one that serves every machine. */
+export function downloadFor(tool, name, platform) {
+    const own = PLATFORMS.find((key) => key === platform);
+    const chosen = (own === undefined ? undefined : tool.platforms[own]) ?? tool.platforms.any;
+    if (chosen === undefined) {
+        throw new EngineError(`tools.lock has no ${name} ${tool.version} for ${platform}`);
+    }
+    return chosen;
+}
+//# sourceMappingURL=lockfile.js.map

package/dist/tools/lockfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../src/tools/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,2FAA2F;AAC3F,MAAM,SAAS,GAAG;IAChB,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,WAAW;IACX,KAAK;CACG,CAAC;AAEX,MAAM,MAAM,GAAG,CAAC;KACb,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC/E,yDAAyD,CAC1D,CAAC;AAEJ,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,EAAE,sBAAsB,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,wCAAwC,CAAC;IACpF,wFAAwF;IACxF,IAAI,EAAE,MAAM;CACb,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B;;;OAGG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC;SACT,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;SAC1C,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,iCAAiC,CAAC;CAC/F,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,iFAAiF;IACjF,YAAY,EAAE,MAAM;IACpB,+CAA+C;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,wBAAwB,CAAC;CAC7D,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,oFAAoF;IACpF,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;KACxE,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,MAAM,CACb,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,0BAA0B,CAAC,EACjE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAC9B;CACF,CAAC,CAAC;AAQH,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvE,MAAM,IAAI,WAAW,CAAC,GAAG,KAAK,kBAAkB,EAAE,KAAK,KAAK,EAAE,OAAO,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,IAAY,EAAE,QAAgB;IACxE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IAC3F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CAAC,qBAAqB,IAAI,IAAI,IAAI,CAAC,OAAO,QAAQ,QAAQ,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/tools/pypi.js

@@ -0,0 +1,44 @@
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+/** A virtual environment's program, where the platform puts it. */
+export function venvProgram(venv, name, platform) {
+    return platform === 'win32' ? join(venv, 'Scripts', `${name}.exe`) : join(venv, 'bin', name);
+}
+/**
+ * A relocatable environment, so it still runs after the rename that puts it in the cache, on
+ * uv's own build of the pinned Python, never one the machine happens to have.
+ */
+export function venvArgs(python, venv) {
+    return [
+        'venv',
+        '--no-config',
+        '--no-project',
+        '--relocatable',
+        '--managed-python',
+        '--python',
+        python,
+        '--quiet',
+        venv,
+    ];
+}
+/** Installs only what the requirements pin, each distribution checked against its hash. */
+export function installArgs(venv, requirements, platform) {
+    return [
+        'pip',
+        'install',
+        '--no-config',
+        '--require-hashes',
+        '--only-binary',
+        ':all:',
+        '--python',
+        venvProgram(venv, 'python', platform),
+        '--quiet',
+        '--requirement',
+        requirements,
+    ];
+}
+/** What a cached environment was built from: the Python and the exact requirements. */
+export function pypiStamp(python, requirements) {
+    return createHash('sha256').update(`${python}\n${requirements}`).digest('hex');
+}
+//# sourceMappingURL=pypi.js.map

package/dist/tools/pypi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pypi.js","sourceRoot":"","sources":["../../src/tools/pypi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,QAAyB;IAC/E,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAY;IACnD,OAAO;QACL,MAAM;QACN,aAAa;QACb,cAAc;QACd,eAAe;QACf,kBAAkB;QAClB,UAAU;QACV,MAAM;QACN,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,YAAoB,EACpB,QAAyB;IAEzB,OAAO;QACL,KAAK;QACL,SAAS;QACT,aAAa;QACb,kBAAkB;QAClB,eAAe;QACf,OAAO;QACP,UAAU;QACV,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACrC,SAAS;QACT,eAAe;QACf,YAAY;KACb,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,YAAoB;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC"}

package/dist/tools/store.js

@@ -0,0 +1,62 @@
+import { mkdir, mkdtemp, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+import { EngineError } from '../core/check.js';
+/** The file in a cached tool's directory naming what was installed there. */
+export const STAMP = '.talos-tool';
+async function stamped(dir, stamp) {
+    try {
+        return (await readFile(join(dir, STAMP), 'utf8')) === stamp;
+    }
+    catch {
+        return false;
+    }
+}
+async function moved(from, to) {
+    try {
+        await rename(from, to);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Puts the filled work directory in place. When the rename fails, either another process
+ * placed the same tool first, which is kept, or an older or broken entry is in the way, which
+ * is moved aside and replaced.
+ */
+async function settle(work, dir, stamp) {
+    if (await moved(work, dir))
+        return;
+    if (await stamped(dir, stamp))
+        return;
+    const aside = `${work}.old`;
+    await moved(dir, aside);
+    const landed = await moved(work, dir);
+    await rm(aside, { recursive: true, force: true });
+    if (!landed && !(await stamped(dir, stamp))) {
+        throw new EngineError(`could not put a tool in place at ${dir}`);
+    }
+}
+/**
+ * Makes `dir` hold what `fill` writes into an empty directory, marked with `stamp`. The work
+ * happens beside `dir` under a temporary name and lands with one rename, so a directory with
+ * the stamp is always complete, and processes filling it at once all end with one copy.
+ * Returns whether it had to fill it.
+ */
+export async function ensureDir(dir, stamp, fill) {
+    if (await stamped(dir, stamp))
+        return false;
+    await mkdir(dirname(dir), { recursive: true });
+    const work = await mkdtemp(join(dirname(dir), `.${basename(dir)}-`));
+    try {
+        await fill(work);
+        await writeFile(join(work, STAMP), stamp);
+        await settle(work, dir, stamp);
+    }
+    finally {
+        await rm(work, { recursive: true, force: true });
+    }
+    return true;
+}
+//# sourceMappingURL=store.js.map

package/dist/tools/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/tools/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC;AAEnC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,KAAa;IAC/C,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,EAAU;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa;IAC5D,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO;IACnC,IAAI,MAAM,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,OAAO;IACtC,MAAM,KAAK,GAAG,GAAG,IAAI,MAAM,CAAC;IAC5B,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,KAAa,EACb,IAAqC;IAErC,IAAI,MAAM,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/tools.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tools.js.map

package/dist/tools/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/tools/tools.ts"],"names":[],"mappings":""}

package/dist/version/cache.js

@@ -0,0 +1,18 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Talos's cache directory on this machine: `TALOS_CACHE`, else the platform's user cache
+ * (`%LOCALAPPDATA%\talos\cache`, `~/Library/Caches/talos`, `$XDG_CACHE_HOME/talos`).
+ */
+export function cacheRoot(env, platform = process.platform, home = homedir()) {
+    if (env.TALOS_CACHE !== undefined && env.TALOS_CACHE !== '')
+        return env.TALOS_CACHE;
+    if (platform === 'win32') {
+        return join(env.LOCALAPPDATA ?? join(home, 'AppData', 'Local'), 'talos', 'cache');
+    }
+    if (platform === 'darwin')
+        return join(home, 'Library', 'Caches', 'talos');
+    const xdg = env.XDG_CACHE_HOME;
+    return join(xdg !== undefined && xdg !== '' ? xdg : join(home, '.cache'), 'talos');
+}
+//# sourceMappingURL=cache.js.map

package/dist/version/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/version/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,GAAiD,EACjD,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAe,OAAO,EAAE;IAExB,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC,WAAW,CAAC;IACpF,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC;IAC/B,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACrF,CAAC"}

package/dist/version/enforced.js

@@ -0,0 +1,54 @@
+import { VersionError } from './errors.js';
+import { lookupMode, pinFinder } from './pin.js';
+import { releaseFromEnvironment, versionAt } from './release.js';
+import { github, GitHubError, tokenFromEnvironment } from '../github/api.js';
+import { identities } from '../github/identities.js';
+const NO_REPOSITORY = 'no GitHub repository here: run inside a clone whose origin is on github.com, ' +
+    'pass --repo owner/name, or set GITHUB_REPOSITORY';
+const NO_TOKEN = 'finding the enforced Talos version reads the repository’s rulesets, which needs GitHub ' +
+    'access: set GITHUB_TOKEN (or GH_TOKEN), or run `gh auth login`. Tasks without credentials ' +
+    'get TALOS_VERSION and TALOS_SHA from Thea’s hub; TALOS_DEV=1 runs this copy as it is';
+/** Why an API failure stopped the lookup, said so a person knows what to fix. */
+function explainApiError(error, repo) {
+    if (error.status === 401)
+        return new VersionError(`the GitHub token was refused: ${NO_TOKEN}`);
+    if (error.status === 403 || error.status === 404) {
+        return new VersionError(`the token can't read ${repo}'s rulesets or the Talos repository (${error.message})`);
+    }
+    return new VersionError(`GitHub failed while finding the enforced version (${error.message})`);
+}
+async function lookUp(gh, repo, env) {
+    const mode = lookupMode(env);
+    const { talosRepo } = identities(env);
+    const lookup = await pinFinder(gh, talosRepo, mode)(repo);
+    if (!lookup.found)
+        throw new VersionError(`${repo}: ${lookup.reason}; run \`talos doctor\``);
+    const version = await versionAt(gh, talosRepo, lookup.pin.sha);
+    return { version, sha: lookup.pin.sha, from: mode, pin: lookup.pin };
+}
+/**
+ * The Talos release a repository enforces: `TALOS_VERSION` and `TALOS_SHA` when Thea's hub
+ * handed them over, else the repository's pin and `package.json` at it.
+ */
+export async function enforcedRelease(ctx) {
+    const given = releaseFromEnvironment(ctx.env);
+    if (given !== undefined)
+        return { ...given, from: 'environment' };
+    if (ctx.repo === undefined)
+        throw new VersionError(NO_REPOSITORY);
+    let token;
+    try {
+        token = await tokenFromEnvironment(ctx.env);
+    }
+    catch {
+        throw new VersionError(NO_TOKEN);
+    }
+    const gh = (ctx.client ?? github)(token);
+    try {
+        return await lookUp(gh, ctx.repo, ctx.env);
+    }
+    catch (error) {
+        throw error instanceof GitHubError ? explainApiError(error, ctx.repo) : error;
+    }
+}
+//# sourceMappingURL=enforced.js.map

package/dist/version/enforced.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforced.js","sourceRoot":"","sources":["../../src/version/enforced.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAY,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAgB,sBAAsB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAe,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAiBrD,MAAM,aAAa,GACjB,+EAA+E;IAC/E,kDAAkD,CAAC;AAErD,MAAM,QAAQ,GACZ,yFAAyF;IACzF,4FAA4F;IAC5F,sFAAsF,CAAC;AAEzF,iFAAiF;AACjF,SAAS,eAAe,CAAC,KAAkB,EAAE,IAAY;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,YAAY,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACjD,OAAO,IAAI,YAAY,CACrB,wBAAwB,IAAI,wCAAwC,KAAK,CAAC,OAAO,GAAG,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,qDAAqD,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAU,EAAE,IAAY,EAAE,GAA2B;IACzE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,wBAAwB,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoB;IACxD,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAClE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/version/errors.js

@@ -0,0 +1,8 @@
+/**
+ * Why the enforced Talos version can't be found, installed or trusted. Its message is written for
+ * the person or agent running Talos and says what to do; it never quotes a response body.
+ */
+export class VersionError extends Error {
+    name = 'VersionError';
+}
+//# sourceMappingURL=errors.js.map

package/dist/version/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/version/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,cAAc,CAAC;CACzC"}

package/dist/version/install.js

@@ -0,0 +1,149 @@
+import { access, mkdir, mkdtemp, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { z } from 'zod';
+import { cacheRoot } from './cache.js';
+import { VersionError } from './errors.js';
+import { decodeProvenance, PACKAGE, provenanceProblems } from './provenance.js';
+export const MARKER = 'talos-verified.json';
+const SOURCE = 'SVP-Labs/Talos';
+const REGISTRY = 'https://registry.npmjs.org';
+const NPM_TIMEOUT = 10 * 60 * 1000;
+const markerSchema = z.object({ version: z.string(), sha: z.string(), integrity: z.string() });
+const lockSchema = z.object({
+    packages: z.record(z.string(), z.object({ version: z.string(), integrity: z.string() }).partial()),
+});
+const auditSchema = z.object({ invalid: z.array(z.unknown()), missing: z.array(z.unknown()) });
+export function entryFor(cache, release) {
+    return join(cache, 'engine', `${release.version}-${release.sha.slice(0, 12)}`);
+}
+export function binIn(root) {
+    return join(root, 'node_modules', '@svp-labs', 'talos', 'dist', 'bin', 'talos.js');
+}
+/** The integrity npm recorded for the installed package, when it is the expected version. */
+export function lockedIntegrity(lock, version) {
+    const parsed = lockSchema.safeParse(lock);
+    if (!parsed.success)
+        return undefined;
+    const entry = parsed.data.packages[`node_modules/${PACKAGE}`];
+    return entry?.version === version ? entry.integrity : undefined;
+}
+/** What `npm audit signatures --json` objects to; empty when every signature verified. */
+export function auditProblems(code, stdout) {
+    let raw;
+    try {
+        raw = JSON.parse(stdout);
+    }
+    catch {
+        return [`npm audit signatures exited ${code} without a readable report`];
+    }
+    const parsed = auditSchema.safeParse(raw);
+    if (!parsed.success)
+        return [`npm audit signatures exited ${code} without a readable report`];
+    const problems = [
+        ...(parsed.data.invalid.length > 0 ? [`${parsed.data.invalid.length} invalid signatures`] : []),
+        ...(parsed.data.missing.length > 0 ? [`${parsed.data.missing.length} missing signatures`] : []),
+    ];
+    return problems.length === 0 && code !== 0 ? [`npm audit signatures exited ${code}`] : problems;
+}
+async function readJson(path) {
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function exists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** A cache entry verified earlier for this release, still as it was. */
+async function verifiedEntry(root, release) {
+    const marker = markerSchema.safeParse(await readJson(join(root, MARKER)));
+    if (!marker.success)
+        return undefined;
+    const { version, sha, integrity } = marker.data;
+    if (version !== release.version || sha !== release.sha)
+        return undefined;
+    const locked = lockedIntegrity(await readJson(join(root, 'package-lock.json')), version);
+    const bin = binIn(root);
+    if (locked !== integrity || !(await exists(bin)))
+        return undefined;
+    return { version, sha, integrity, root, bin };
+}
+async function npm(exec, args, cwd) {
+    const result = await exec('npm', args, { cwd, timeoutMs: NPM_TIMEOUT });
+    if (result.code !== 0) {
+        throw new VersionError(`npm ${args[0] ?? ''} for ${PACKAGE} exited ${result.code}`);
+    }
+}
+async function verifyProvenance(release, integrity, doFetch) {
+    const url = `${REGISTRY}/-/npm/v1/attestations/${encodeURIComponent(PACKAGE)}@${release.version}`;
+    const response = await doFetch(url, { headers: { accept: 'application/json' } });
+    if (!response.ok) {
+        throw new VersionError(`${PACKAGE}@${release.version} has no provenance on the npm registry`);
+    }
+    const problems = provenanceProblems(decodeProvenance(await response.json()), {
+        name: PACKAGE,
+        version: release.version,
+        repository: SOURCE,
+        commit: release.sha,
+        integrity,
+    });
+    if (problems.length > 0) {
+        throw new VersionError(`refusing ${PACKAGE}@${release.version}: ${problems.join('; ')}`);
+    }
+}
+async function installInto(staging, release, deps) {
+    await writeFile(join(staging, 'package.json'), '{ "private": true }\n');
+    const spec = `${PACKAGE}@${release.version}`;
+    await npm(deps.exec, ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--save-exact', spec], staging);
+    const integrity = lockedIntegrity(await readJson(join(staging, 'package-lock.json')), release.version);
+    if (integrity === undefined)
+        throw new VersionError(`npm installed no ${spec}`);
+    const audit = await deps.exec('npm', ['audit', 'signatures', '--json'], {
+        cwd: staging,
+        timeoutMs: NPM_TIMEOUT,
+    });
+    const problems = auditProblems(audit.code, audit.stdout);
+    if (problems.length > 0)
+        throw new VersionError(`refusing ${spec}: ${problems.join('; ')}`);
+    await verifyProvenance(release, integrity, deps.fetch);
+    return integrity;
+}
+/**
+ * The release installed in Talos's cache and verified: npm's registry signatures and
+ * attestations (`npm audit signatures`), then a provenance naming the Talos repository, the
+ * pinned commit and the installed tarball. A verified entry is reused; a new one is built aside
+ * and moved into place, so concurrent runs never see half an install.
+ */
+export async function ensureVerified(release, deps) {
+    const root = entryFor(cacheRoot(deps.env), release);
+    const cached = await verifiedEntry(root, release);
+    if (cached !== undefined)
+        return cached;
+    await mkdir(dirname(root), { recursive: true });
+    const staging = await mkdtemp(`${root}.staging-`);
+    try {
+        const integrity = await installInto(staging, release, deps);
+        await writeFile(join(staging, MARKER), `${JSON.stringify({ version: release.version, sha: release.sha, integrity })}\n`);
+        // Another run may have settled the same release meanwhile and be running from it.
+        if ((await verifiedEntry(root, release)) === undefined) {
+            await rm(root, { recursive: true, force: true });
+            await rename(staging, root).catch(() => undefined);
+        }
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+    const settled = await verifiedEntry(root, release);
+    if (settled === undefined)
+        throw new VersionError(`${PACKAGE}@${release.version} did not settle`);
+    return settled;
+}
+//# sourceMappingURL=install.js.map

package/dist/version/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/version/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAIhF,MAAM,CAAC,MAAM,MAAM,GAAG,qBAAqB,CAAC;AAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAC9C,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgBnC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE/F,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAChB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CACnE;CACF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AAE/F,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,OAAgB;IACtD,OAAO,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AACrF,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAAC,IAAa,EAAE,OAAe;IAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;IAC9D,OAAO,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAc;IACxD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,+BAA+B,IAAI,4BAA4B,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,CAAC,+BAA+B,IAAI,4BAA4B,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,OAAgB;IACzD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAChD,IAAI,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACzE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAU,EAAE,IAAuB,EAAE,GAAW;IACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,SAAiB,EACjB,OAAqB;IAErB,MAAM,GAAG,GAAG,GAAG,QAAQ,0BAA0B,kBAAkB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAClG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,GAAG,OAAO,IAAI,OAAO,CAAC,OAAO,wCAAwC,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE;QAC3E,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,SAAS;KACV,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC,YAAY,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,OAAgB,EAAE,IAAiB;IAC7E,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,GAAG,CACP,IAAI,CAAC,IAAI,EACT,CAAC,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,CAAC,EAChF,OAAO,CACR,CAAC;IACF,MAAM,SAAS,GAAG,eAAe,CAC/B,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,EAClD,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE;QACtE,GAAG,EAAE,OAAO;QACZ,SAAS,EAAE,WAAW;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,YAAY,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5F,MAAM,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,IAAiB;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,CACb,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EACrB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,IAAI,CACjF,CAAC;QACF,kFAAkF;QAClF,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,OAAO,IAAI,OAAO,CAAC,OAAO,iBAAiB,CAAC,CAAC;IAClG,OAAO,OAAO,CAAC;AACjB,CAAC"}