@tiangong-lca/cli 0.1.9 → 0.1.10

package/dist/src/lib/runtime/files.js

@@ -0,0 +1,91 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { CliError } from '../errors.js';
+export function runtimeError(code, message) {
+    throw new CliError(message, { code, exitCode: 69 });
+}
+export function contentHash(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+/** Hash one descriptor without loading the whole executable or following a selected symlink. */
+export function hashRuntimeFile(file, label) {
+    const before = fs.lstatSync(file, { bigint: true });
+    if (before.isSymbolicLink() || !before.isFile() || before.size > 512 * 1024 * 1024) {
+        runtimeError('RUNTIME_FILE_INVALID', 'Runtime files must be bounded regular files.');
+    }
+    const fd = fs.openSync(file, 'r');
+    try {
+        const opened = fs.fstatSync(fd, { bigint: true });
+        if (opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size) {
+            runtimeError('RUNTIME_FILE_CHANGED', 'Runtime file changed before it could be inspected.');
+        }
+        const hash = createHash('sha256');
+        const buffer = Buffer.allocUnsafe(1024 * 1024);
+        let bytes = 0;
+        while (true) {
+            const read = fs.readSync(fd, buffer, 0, buffer.length, null);
+            if (read === 0)
+                break;
+            bytes += read;
+            if (bytes > before.size)
+                runtimeError('RUNTIME_FILE_CHANGED', 'Runtime file grew during inspection.');
+            hash.update(buffer.subarray(0, read));
+        }
+        const after = fs.fstatSync(fd, { bigint: true });
+        const selected = fs.lstatSync(file, { bigint: true });
+        if (BigInt(bytes) !== before.size ||
+            after.size !== before.size ||
+            after.mtimeNs !== before.mtimeNs ||
+            selected.dev !== before.dev ||
+            selected.ino !== before.ino ||
+            selected.isSymbolicLink() ||
+            !selected.isFile()) {
+            runtimeError('RUNTIME_FILE_CHANGED', 'Runtime file changed during inspection.');
+        }
+        return Object.freeze({ path: label, bytes, sha256: hash.digest('hex') });
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+export function assertInventoryBudget(count, bytes) {
+    if (count > 50_000 || bytes > 2 * 1024 * 1024 * 1024) {
+        runtimeError('RUNTIME_INVENTORY_LIMIT', 'Runtime inventory exceeds its bounded file or byte budget.');
+    }
+}
+export function listRuntimeFiles(root) {
+    const files = [
+        hashRuntimeFile(path.join(root, 'package.json'), 'package.json'),
+    ];
+    let totalBytes = files[0].bytes;
+    const directoryPath = (relative) => {
+        const directory = path.join(root, relative);
+        const stat = fs.lstatSync(directory);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            runtimeError('RUNTIME_DIRECTORY_INVALID', 'Runtime directories cannot be symlinks.');
+        return directory;
+    };
+    // The initial subtree skips this container; inspect it before following dist/src.
+    directoryPath('dist');
+    const walk = (relative) => {
+        const directory = directoryPath(relative);
+        for (const name of fs.readdirSync(directory).sort()) {
+            const item = `${relative}/${name}`;
+            const file = path.join(root, item);
+            const child = fs.lstatSync(file);
+            if (child.isDirectory())
+                walk(item);
+            else {
+                const fact = hashRuntimeFile(file, item);
+                files.push(fact);
+                totalBytes += fact.bytes;
+                assertInventoryBudget(files.length, totalBytes);
+            }
+        }
+    };
+    for (const directory of ['bin', 'dist/src', 'assets'])
+        walk(directory);
+    return Object.freeze(files.sort((left, right) => (left.path < right.path ? -1 : 1)));
+}
+//# sourceMappingURL=files.js.map

package/dist/src/lib/runtime/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../../../src/lib/runtime/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACnF,YAAY,CAAC,sBAAsB,EAAE,8CAA8C,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1F,YAAY,CAAC,sBAAsB,EAAE,oDAAoD,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7D,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM;YACtB,KAAK,IAAI,IAAI,CAAC;YACd,IAAI,KAAK,GAAG,MAAM,CAAC,IAAI;gBACrB,YAAY,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,CAAC;YAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IACE,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI;YAC7B,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YAC1B,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAChC,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAC3B,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAC3B,QAAQ,CAAC,cAAc,EAAE;YACzB,CAAC,QAAQ,CAAC,MAAM,EAAE,EAClB,CAAC;YACD,YAAY,CAAC,sBAAsB,EAAE,yCAAyC,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,KAAa;IAChE,IAAI,KAAK,GAAG,MAAM,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACrD,YAAY,CACV,yBAAyB,EACzB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAsB;QAC/B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,cAAc,CAAC;KACjE,CAAC;IACF,IAAI,UAAU,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC;IACjC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAU,EAAE;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAC9C,YAAY,CAAC,2BAA2B,EAAE,yCAAyC,CAAC,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,kFAAkF;IAClF,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAQ,EAAE;QACtC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC/B,CAAC;gBACJ,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC;gBACzB,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC;QAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport { createHash } from 'node:crypto';\nimport { CliError } from '../errors.js';\nimport type { RuntimeFileFact } from './types.js';\n\nexport function runtimeError(code: string, message: string): never {\n  throw new CliError(message, { code, exitCode: 69 });\n}\n\nexport function contentHash(value: unknown): string {\n  return createHash('sha256').update(JSON.stringify(value)).digest('hex');\n}\n\n/** Hash one descriptor without loading the whole executable or following a selected symlink. */\nexport function hashRuntimeFile(file: string, label: string): RuntimeFileFact {\n  const before = fs.lstatSync(file, { bigint: true });\n  if (before.isSymbolicLink() || !before.isFile() || before.size > 512 * 1024 * 1024) {\n    runtimeError('RUNTIME_FILE_INVALID', 'Runtime files must be bounded regular files.');\n  }\n  const fd = fs.openSync(file, 'r');\n  try {\n    const opened = fs.fstatSync(fd, { bigint: true });\n    if (opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size) {\n      runtimeError('RUNTIME_FILE_CHANGED', 'Runtime file changed before it could be inspected.');\n    }\n    const hash = createHash('sha256');\n    const buffer = Buffer.allocUnsafe(1024 * 1024);\n    let bytes = 0;\n    while (true) {\n      const read = fs.readSync(fd, buffer, 0, buffer.length, null);\n      if (read === 0) break;\n      bytes += read;\n      if (bytes > before.size)\n        runtimeError('RUNTIME_FILE_CHANGED', 'Runtime file grew during inspection.');\n      hash.update(buffer.subarray(0, read));\n    }\n    const after = fs.fstatSync(fd, { bigint: true });\n    const selected = fs.lstatSync(file, { bigint: true });\n    if (\n      BigInt(bytes) !== before.size ||\n      after.size !== before.size ||\n      after.mtimeNs !== before.mtimeNs ||\n      selected.dev !== before.dev ||\n      selected.ino !== before.ino ||\n      selected.isSymbolicLink() ||\n      !selected.isFile()\n    ) {\n      runtimeError('RUNTIME_FILE_CHANGED', 'Runtime file changed during inspection.');\n    }\n    return Object.freeze({ path: label, bytes, sha256: hash.digest('hex') });\n  } finally {\n    fs.closeSync(fd);\n  }\n}\n\nexport function assertInventoryBudget(count: number, bytes: number): void {\n  if (count > 50_000 || bytes > 2 * 1024 * 1024 * 1024) {\n    runtimeError(\n      'RUNTIME_INVENTORY_LIMIT',\n      'Runtime inventory exceeds its bounded file or byte budget.',\n    );\n  }\n}\n\nexport function listRuntimeFiles(root: string): readonly RuntimeFileFact[] {\n  const files: RuntimeFileFact[] = [\n    hashRuntimeFile(path.join(root, 'package.json'), 'package.json'),\n  ];\n  let totalBytes = files[0]!.bytes;\n  const directoryPath = (relative: string): string => {\n    const directory = path.join(root, relative);\n    const stat = fs.lstatSync(directory);\n    if (stat.isSymbolicLink() || !stat.isDirectory())\n      runtimeError('RUNTIME_DIRECTORY_INVALID', 'Runtime directories cannot be symlinks.');\n    return directory;\n  };\n  // The initial subtree skips this container; inspect it before following dist/src.\n  directoryPath('dist');\n  const walk = (relative: string): void => {\n    const directory = directoryPath(relative);\n    for (const name of fs.readdirSync(directory).sort()) {\n      const item = `${relative}/${name}`;\n      const file = path.join(root, item);\n      const child = fs.lstatSync(file);\n      if (child.isDirectory()) walk(item);\n      else {\n        const fact = hashRuntimeFile(file, item);\n        files.push(fact);\n        totalBytes += fact.bytes;\n        assertInventoryBudget(files.length, totalBytes);\n      }\n    }\n  };\n  for (const directory of ['bin', 'dist/src', 'assets']) walk(directory);\n  return Object.freeze(files.sort((left, right) => (left.path < right.path ? -1 : 1)));\n}\n"]}

package/dist/src/lib/runtime/host.d.ts

@@ -0,0 +1,8 @@
+import type { RuntimeHost, TrustedRuntimeManifest } from './manifest-types.js';
+declare function compareVersions(left: string, right: string): number;
+export declare function inspectRuntimeHost(): RuntimeHost;
+export declare function assertRuntimeHost(value: TrustedRuntimeManifest, host: RuntimeHost): void;
+export declare const runtimeHostInternals: {
+    compareVersions: typeof compareVersions;
+};
+export {};

package/dist/src/lib/runtime/host.js

@@ -0,0 +1,37 @@
+import os from 'node:os';
+import { runtimePlatform } from './descriptor.js';
+import { assertTrustedManifest } from './manifest.js';
+import { runtimeError } from './files.js';
+function compareVersions(left, right) {
+    const a = left.split(/[.-]/u).slice(0, 3).map(Number), b = right.split('.').map(Number);
+    if (a.some((value) => !Number.isSafeInteger(value) || value < 0))
+        return -1;
+    for (let i = 0; i < 3; i++) {
+        const delta = (a[i] ?? 0) - (b[i] ?? 0);
+        if (delta !== 0)
+            return delta;
+    }
+    return 0;
+}
+export function inspectRuntimeHost() {
+    const platform = runtimePlatform(process.platform, process.arch);
+    let glibc = null;
+    if (process.platform === 'linux') {
+        // Project only the ABI header; never serialize a diagnostic report or its environment.
+        const report = process.report.getReport();
+        if (typeof report.header?.glibcVersionRuntime === 'string')
+            glibc = report.header.glibcVersionRuntime;
+    }
+    return Object.freeze({ platform, osRelease: os.release(), glibc });
+}
+export function assertRuntimeHost(value, host) {
+    assertTrustedManifest(value);
+    const minimum = value.manifest.minimum_hosts[host.platform];
+    if (!minimum ||
+        compareVersions(host.osRelease, minimum.os_release) < 0 ||
+        (host.platform.startsWith('linux-') &&
+            (!host.glibc || !minimum.glibc || compareVersions(host.glibc, minimum.glibc) < 0)))
+        runtimeError('RUNTIME_HOST_UNSUPPORTED', 'The selected release does not support this host OS/architecture/ABI.');
+}
+export const runtimeHostInternals = { compareVersions };
+//# sourceMappingURL=host.js.map

package/dist/src/lib/runtime/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../../../src/lib/runtime/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG1C,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EACnD,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAC5E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,uFAAuF;QACvF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAoD,CAAC;QAC5F,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE,mBAAmB,KAAK,QAAQ;YACxD,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,KAA6B,EAAE,IAAiB;IAChF,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IACE,CAAC,OAAO;QACR,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvD,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAEpF,YAAY,CACV,0BAA0B,EAC1B,sEAAsE,CACvE,CAAC;AACN,CAAC;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,eAAe,EAAE,CAAC","sourcesContent":["import os from 'node:os';\nimport { runtimePlatform } from './descriptor.js';\nimport { assertTrustedManifest } from './manifest.js';\nimport { runtimeError } from './files.js';\nimport type { RuntimeHost, TrustedRuntimeManifest } from './manifest-types.js';\n\nfunction compareVersions(left: string, right: string): number {\n  const a = left.split(/[.-]/u).slice(0, 3).map(Number),\n    b = right.split('.').map(Number);\n  if (a.some((value) => !Number.isSafeInteger(value) || value < 0)) return -1;\n  for (let i = 0; i < 3; i++) {\n    const delta = (a[i] ?? 0) - (b[i] ?? 0);\n    if (delta !== 0) return delta;\n  }\n  return 0;\n}\nexport function inspectRuntimeHost(): RuntimeHost {\n  const platform = runtimePlatform(process.platform, process.arch);\n  let glibc: string | null = null;\n  if (process.platform === 'linux') {\n    // Project only the ABI header; never serialize a diagnostic report or its environment.\n    const report = process.report.getReport() as { header?: { glibcVersionRuntime?: unknown } };\n    if (typeof report.header?.glibcVersionRuntime === 'string')\n      glibc = report.header.glibcVersionRuntime;\n  }\n  return Object.freeze({ platform, osRelease: os.release(), glibc });\n}\nexport function assertRuntimeHost(value: TrustedRuntimeManifest, host: RuntimeHost): void {\n  assertTrustedManifest(value);\n  const minimum = value.manifest.minimum_hosts[host.platform];\n  if (\n    !minimum ||\n    compareVersions(host.osRelease, minimum.os_release) < 0 ||\n    (host.platform.startsWith('linux-') &&\n      (!host.glibc || !minimum.glibc || compareVersions(host.glibc, minimum.glibc) < 0))\n  )\n    runtimeError(\n      'RUNTIME_HOST_UNSUPPORTED',\n      'The selected release does not support this host OS/architecture/ABI.',\n    );\n}\nexport const runtimeHostInternals = { compareVersions };\n"]}

package/dist/src/lib/runtime/leases.d.ts

@@ -0,0 +1,12 @@
+export type RuntimeLease = Readonly<{
+    schema: 'tiangong-lca.runtime-lease.v1';
+    id: string;
+    owner: string;
+    components: readonly string[];
+}>;
+export declare function runtimeLeaseKey(id: string): string;
+export declare function withRuntimeLeaseLock<T>(root: string, operation: () => Promise<T> | T): Promise<T>;
+export declare function readRuntimeLease(root: string, key: string): RuntimeLease;
+export declare function acquireRuntimeLease(root: string, id: string, owner: string, components: readonly string[]): Promise<RuntimeLease>;
+export declare function releaseRuntimeLease(root: string, id: string, owner: string): Promise<boolean>;
+export declare function leasedRuntimeKeys(root: string): Set<string>;

package/dist/src/lib/runtime/leases.js

@@ -0,0 +1,72 @@
+import fs from 'node:fs';
+import { withBatchRunLock } from '../../batch.js';
+import { contentHash, runtimeError } from './files.js';
+import { array, exact, record, sha, text, unique } from './manifest-values.js';
+import { cachePath, readCacheJson, writeOnce } from './storage.js';
+export function runtimeLeaseKey(id) {
+    return contentHash(text(id, 'lease id', 256));
+}
+export async function withRuntimeLeaseLock(root, operation) {
+    return withBatchRunLock({
+        runPath: cachePath(root, 'locks/leases.json'),
+        identity: { schema: 'runtime-lease-lock.v1' },
+        reason: 'Runtime component lease mutation',
+    }, operation);
+}
+export function readRuntimeLease(root, key) {
+    sha(key);
+    const value = record(readCacheJson(root, `leases/${key}.json`), 'lease');
+    exact(value, ['schema', 'id', 'owner', 'components'], 'lease');
+    if (value.schema !== 'tiangong-lca.runtime-lease.v1')
+        runtimeError('RUNTIME_LEASE_INVALID', 'Unknown runtime lease schema.');
+    const id = text(value.id, 'lease id', 256), owner = text(value.owner, 'lease owner', 4096), components = array(value.components, 128, 1).map(sha);
+    unique(components, 'lease component');
+    if (runtimeLeaseKey(id) !== key)
+        runtimeError('RUNTIME_LEASE_INVALID', 'Runtime lease identity changed.');
+    return { schema: 'tiangong-lca.runtime-lease.v1', id, owner, components };
+}
+export async function acquireRuntimeLease(root, id, owner, components) {
+    const lease = {
+        schema: 'tiangong-lca.runtime-lease.v1',
+        id: text(id, 'lease id', 256),
+        owner: text(owner, 'lease owner', 4096),
+        components: [...components].sort(),
+    };
+    array(components, 128, 1).forEach(sha);
+    unique(components, 'lease component');
+    return withRuntimeLeaseLock(root, () => {
+        const key = runtimeLeaseKey(id), file = cachePath(root, `leases/${key}.json`);
+        if (fs.existsSync(file) && contentHash(readRuntimeLease(root, key)) !== contentHash(lease))
+            runtimeError('RUNTIME_LEASE_CONFLICT', 'Existing lease pins another owner or component set; release it explicitly before replacement.');
+        writeOnce(root, `leases/${key}.json`, Buffer.from(JSON.stringify(lease) + '\n'));
+        return Object.freeze(lease);
+    });
+}
+export async function releaseRuntimeLease(root, id, owner) {
+    return withRuntimeLeaseLock(root, () => {
+        const key = runtimeLeaseKey(id), file = cachePath(root, `leases/${key}.json`);
+        if (!fs.existsSync(file))
+            return false;
+        if (readRuntimeLease(root, key).owner !== owner)
+            runtimeError('RUNTIME_LEASE_OWNER', 'Only the same explicit lease owner can release a runtime pin.');
+        fs.unlinkSync(file);
+        return true;
+    });
+}
+export function leasedRuntimeKeys(root) {
+    const directory = cachePath(root, 'leases');
+    if (!fs.existsSync(directory))
+        return new Set();
+    const names = fs.readdirSync(directory);
+    if (names.length > 10_000)
+        runtimeError('RUNTIME_LEASE_LIMIT', 'Lease inventory exceeds its bound.');
+    const keys = new Set();
+    for (const name of names) {
+        if (!/^[0-9a-f]{64}\.json$/u.test(name))
+            runtimeError('RUNTIME_LEASE_INVALID', 'Unknown lease record prevents cache pruning.');
+        for (const key of readRuntimeLease(root, name.slice(0, -5)).components)
+            keys.add(key);
+    }
+    return keys;
+}
+//# sourceMappingURL=leases.js.map

package/dist/src/lib/runtime/leases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leases.js","sourceRoot":"","sources":["../../../../src/lib/runtime/leases.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQnE,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,SAA+B;IAE/B,OAAO,gBAAgB,CACrB;QACE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC;QAC7C,QAAQ,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE;QAC7C,MAAM,EAAE,kCAAkC;KAC3C,EACD,SAAS,CACV,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,GAAW;IACxD,GAAG,CAAC,GAAG,CAAC,CAAC;IACT,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,+BAA+B;QAClD,YAAY,CAAC,uBAAuB,EAAE,+BAA+B,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,EACxC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EAC9C,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACtC,IAAI,eAAe,CAAC,EAAE,CAAC,KAAK,GAAG;QAC7B,YAAY,CAAC,uBAAuB,EAAE,iCAAiC,CAAC,CAAC;IAC3E,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC5E,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,EAAU,EACV,KAAa,EACb,UAA6B;IAE7B,MAAM,KAAK,GAAiB;QAC1B,MAAM,EAAE,+BAA+B;QACvC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC;QACvC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;KACnC,CAAC;IACF,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACtC,OAAO,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE;QACrC,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,CAAC,EAC7B,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC;YACxF,YAAY,CACV,wBAAwB,EACxB,+FAA+F,CAChG,CAAC;QACJ,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,EAAU,EACV,KAAa;IAEb,OAAO,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE;QACrC,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,CAAC,EAC7B,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,KAAK;YAC7C,YAAY,CACV,qBAAqB,EACrB,+DAA+D,CAChE,CAAC;QACJ,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QACvB,YAAY,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,YAAY,CAAC,uBAAuB,EAAE,8CAA8C,CAAC,CAAC;QACxF,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import fs from 'node:fs';\nimport { withBatchRunLock } from '../../batch.js';\nimport { contentHash, runtimeError } from './files.js';\nimport { array, exact, record, sha, text, unique } from './manifest-values.js';\nimport { cachePath, readCacheJson, writeOnce } from './storage.js';\n\nexport type RuntimeLease = Readonly<{\n  schema: 'tiangong-lca.runtime-lease.v1';\n  id: string;\n  owner: string;\n  components: readonly string[];\n}>;\nexport function runtimeLeaseKey(id: string): string {\n  return contentHash(text(id, 'lease id', 256));\n}\nexport async function withRuntimeLeaseLock<T>(\n  root: string,\n  operation: () => Promise<T> | T,\n): Promise<T> {\n  return withBatchRunLock(\n    {\n      runPath: cachePath(root, 'locks/leases.json'),\n      identity: { schema: 'runtime-lease-lock.v1' },\n      reason: 'Runtime component lease mutation',\n    },\n    operation,\n  );\n}\nexport function readRuntimeLease(root: string, key: string): RuntimeLease {\n  sha(key);\n  const value = record(readCacheJson(root, `leases/${key}.json`), 'lease');\n  exact(value, ['schema', 'id', 'owner', 'components'], 'lease');\n  if (value.schema !== 'tiangong-lca.runtime-lease.v1')\n    runtimeError('RUNTIME_LEASE_INVALID', 'Unknown runtime lease schema.');\n  const id = text(value.id, 'lease id', 256),\n    owner = text(value.owner, 'lease owner', 4096),\n    components = array(value.components, 128, 1).map(sha);\n  unique(components, 'lease component');\n  if (runtimeLeaseKey(id) !== key)\n    runtimeError('RUNTIME_LEASE_INVALID', 'Runtime lease identity changed.');\n  return { schema: 'tiangong-lca.runtime-lease.v1', id, owner, components };\n}\nexport async function acquireRuntimeLease(\n  root: string,\n  id: string,\n  owner: string,\n  components: readonly string[],\n): Promise<RuntimeLease> {\n  const lease: RuntimeLease = {\n    schema: 'tiangong-lca.runtime-lease.v1',\n    id: text(id, 'lease id', 256),\n    owner: text(owner, 'lease owner', 4096),\n    components: [...components].sort(),\n  };\n  array(components, 128, 1).forEach(sha);\n  unique(components, 'lease component');\n  return withRuntimeLeaseLock(root, () => {\n    const key = runtimeLeaseKey(id),\n      file = cachePath(root, `leases/${key}.json`);\n    if (fs.existsSync(file) && contentHash(readRuntimeLease(root, key)) !== contentHash(lease))\n      runtimeError(\n        'RUNTIME_LEASE_CONFLICT',\n        'Existing lease pins another owner or component set; release it explicitly before replacement.',\n      );\n    writeOnce(root, `leases/${key}.json`, Buffer.from(JSON.stringify(lease) + '\\n'));\n    return Object.freeze(lease);\n  });\n}\nexport async function releaseRuntimeLease(\n  root: string,\n  id: string,\n  owner: string,\n): Promise<boolean> {\n  return withRuntimeLeaseLock(root, () => {\n    const key = runtimeLeaseKey(id),\n      file = cachePath(root, `leases/${key}.json`);\n    if (!fs.existsSync(file)) return false;\n    if (readRuntimeLease(root, key).owner !== owner)\n      runtimeError(\n        'RUNTIME_LEASE_OWNER',\n        'Only the same explicit lease owner can release a runtime pin.',\n      );\n    fs.unlinkSync(file);\n    return true;\n  });\n}\nexport function leasedRuntimeKeys(root: string): Set<string> {\n  const directory = cachePath(root, 'leases');\n  if (!fs.existsSync(directory)) return new Set();\n  const names = fs.readdirSync(directory);\n  if (names.length > 10_000)\n    runtimeError('RUNTIME_LEASE_LIMIT', 'Lease inventory exceeds its bound.');\n  const keys = new Set<string>();\n  for (const name of names) {\n    if (!/^[0-9a-f]{64}\\.json$/u.test(name))\n      runtimeError('RUNTIME_LEASE_INVALID', 'Unknown lease record prevents cache pruning.');\n    for (const key of readRuntimeLease(root, name.slice(0, -5)).components) keys.add(key);\n  }\n  return keys;\n}\n"]}

package/dist/src/lib/runtime/managed-command.d.ts

@@ -0,0 +1,6 @@
+import type { FetchLike } from '../http.js';
+export declare function runManagedRuntimeCommand(operation: string, args: string[], fetchImpl?: FetchLike): Promise<{
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}>;

package/dist/src/lib/runtime/managed-command.js

@@ -0,0 +1,99 @@
+import { parseArgs } from 'node:util';
+import fs from 'node:fs';
+import path from 'node:path';
+import { CliError } from '../errors.js';
+import { loadTrustedRuntimeManifest } from './manifest.js';
+import { ensureRuntimeComponents, inspectRuntimeComponents, pruneRuntimeComponents, } from './manager.js';
+import { releaseRuntimeLease } from './leases.js';
+import { defaultRuntimeCache, openRuntimeCache } from './storage.js';
+export async function runManagedRuntimeCommand(operation, args, fetchImpl) {
+    let values;
+    try {
+        values = parseArgs({
+            args,
+            strict: true,
+            allowPositionals: false,
+            options: {
+                help: { type: 'boolean', short: 'h' },
+                json: { type: 'boolean' },
+                manifest: { type: 'string' },
+                'manifest-sha256': { type: 'string' },
+                'cache-dir': { type: 'string' },
+                lease: { type: 'string' },
+                'lease-owner': { type: 'string' },
+                apply: { type: 'boolean' },
+            },
+        }).values;
+    }
+    catch {
+        throw new CliError('Invalid runtime management arguments.', {
+            code: 'RUNTIME_ARGUMENT_INVALID',
+            exitCode: 2,
+        });
+    }
+    if (values.help)
+        return {
+            exitCode: 0,
+            stdout: 'Usage: tiangong-lca runtime ensure|status|prune --manifest <file> --manifest-sha256 <trusted-sha256> [--cache-dir <absolute-dir>] [--json]\nensure accepts --lease <id> --lease-owner <non-secret-owner>. prune requires --apply.\nlease-release requires --lease and --lease-owner. No authentication or task state is created.\n',
+            stderr: '',
+        };
+    const cacheDir = values['cache-dir'] ?? defaultRuntimeCache();
+    if (operation === 'lease-release') {
+        if (!values.lease ||
+            !values['lease-owner'] ||
+            values.manifest ||
+            values['manifest-sha256'] ||
+            values.apply)
+            throw new CliError('Lease release requires only cache, lease id and owner.', {
+                code: 'RUNTIME_ARGUMENT_INVALID',
+                exitCode: 2,
+            });
+        const root = openRuntimeCache(cacheDir, false);
+        const released = fs.existsSync(path.join(root, '.runtime-cache.json'))
+            ? await releaseRuntimeLease(root, values.lease, values['lease-owner'])
+            : false;
+        return {
+            exitCode: 0,
+            stdout: JSON.stringify({ schema: 'tiangong-lca.runtime-lease-release.v1', released }) + '\n',
+            stderr: '',
+        };
+    }
+    if (!values.manifest ||
+        !values['manifest-sha256'] ||
+        Boolean(values.lease) !== Boolean(values['lease-owner']) ||
+        ((values.lease || values['lease-owner']) && operation !== 'ensure') ||
+        (values.apply && operation !== 'prune'))
+        throw new CliError('Select an explicit manifest and independent digest; lease options apply only to ensure.', { code: 'RUNTIME_ARGUMENT_INVALID', exitCode: 2 });
+    const trusted = loadTrustedRuntimeManifest(values.manifest, values['manifest-sha256']);
+    const options = {
+        cacheDir,
+        fetchImpl,
+        ...(values.lease ? { lease: { id: values.lease, owner: values['lease-owner'] } } : {}),
+    };
+    if (operation === 'prune') {
+        if (!values.apply)
+            throw new CliError('Pruning requires an explicit --apply for this manifest component set.', {
+                code: 'RUNTIME_PRUNE_APPLY_REQUIRED',
+                exitCode: 2,
+            });
+        return {
+            exitCode: 0,
+            stdout: JSON.stringify({
+                schema: 'tiangong-lca.runtime-prune.v1',
+                ...(await pruneRuntimeComponents(trusted, options)),
+            }) + '\n',
+            stderr: '',
+        };
+    }
+    const report = operation === 'ensure'
+        ? await ensureRuntimeComponents(trusted, options)
+        : inspectRuntimeComponents(trusted, options);
+    return {
+        exitCode: report.status === 'ready' ? 0 : 69,
+        stdout: values.json
+            ? JSON.stringify(report) + '\n'
+            : `Runtime ${report.status}: ${report.components.map((item) => `${item.id}@${item.version} ${item.status}`).join(', ')}\n`,
+        stderr: '',
+    };
+}
+//# sourceMappingURL=managed-command.js.map

package/dist/src/lib/runtime/managed-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-command.js","sourceRoot":"","sources":["../../../../src/lib/runtime/managed-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAiB,EACjB,IAAc,EACd,SAAqB;IAErB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC;YACjB,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,gBAAgB,EAAE,KAAK;YACvB,OAAO,EAAE;gBACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;gBACrC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACrC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACjC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;aAC3B;SACF,CAAC,CAAC,MAAM,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,uCAAuC,EAAE;YAC1D,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,IAAI;QACb,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,MAAM,EACJ,oUAAoU;YACtU,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,mBAAmB,EAAE,CAAC;IAC9D,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,IACE,CAAC,MAAM,CAAC,KAAK;YACb,CAAC,MAAM,CAAC,aAAa,CAAC;YACtB,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,iBAAiB,CAAC;YACzB,MAAM,CAAC,KAAK;YAEZ,MAAM,IAAI,QAAQ,CAAC,wDAAwD,EAAE;gBAC3E,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YACpE,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YACtE,CAAC,CAAC,KAAK,CAAC;QACV,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,uCAAuC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI;YAC5F,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,QAAQ;QAChB,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,SAAS,KAAK,QAAQ,CAAC;QACnE,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,KAAK,OAAO,CAAC;QAEvC,MAAM,IAAI,QAAQ,CAChB,yFAAyF,EACzF,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,CAClD,CAAC;IACJ,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG;QACd,QAAQ;QACR,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxF,CAAC;IACF,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK;YACf,MAAM,IAAI,QAAQ,CAAC,uEAAuE,EAAE;gBAC1F,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,MAAM,EACJ,IAAI,CAAC,SAAS,CAAC;gBACb,MAAM,EAAE,+BAA+B;gBACvC,GAAG,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;aACpD,CAAC,GAAG,IAAI;YACX,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,SAAS,KAAK,QAAQ;QACpB,CAAC,CAAC,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC;QACjD,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QAC5C,MAAM,EAAE,MAAM,CAAC,IAAI;YACjB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI;YAC/B,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC5H,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC","sourcesContent":["import { parseArgs } from 'node:util';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { CliError } from '../errors.js';\nimport type { FetchLike } from '../http.js';\nimport { loadTrustedRuntimeManifest } from './manifest.js';\nimport {\n  ensureRuntimeComponents,\n  inspectRuntimeComponents,\n  pruneRuntimeComponents,\n} from './manager.js';\nimport { releaseRuntimeLease } from './leases.js';\nimport { defaultRuntimeCache, openRuntimeCache } from './storage.js';\n\nexport async function runManagedRuntimeCommand(\n  operation: string,\n  args: string[],\n  fetchImpl?: FetchLike,\n): Promise<{ exitCode: number; stdout: string; stderr: string }> {\n  let values;\n  try {\n    values = parseArgs({\n      args,\n      strict: true,\n      allowPositionals: false,\n      options: {\n        help: { type: 'boolean', short: 'h' },\n        json: { type: 'boolean' },\n        manifest: { type: 'string' },\n        'manifest-sha256': { type: 'string' },\n        'cache-dir': { type: 'string' },\n        lease: { type: 'string' },\n        'lease-owner': { type: 'string' },\n        apply: { type: 'boolean' },\n      },\n    }).values;\n  } catch {\n    throw new CliError('Invalid runtime management arguments.', {\n      code: 'RUNTIME_ARGUMENT_INVALID',\n      exitCode: 2,\n    });\n  }\n  if (values.help)\n    return {\n      exitCode: 0,\n      stdout:\n        'Usage: tiangong-lca runtime ensure|status|prune --manifest <file> --manifest-sha256 <trusted-sha256> [--cache-dir <absolute-dir>] [--json]\\nensure accepts --lease <id> --lease-owner <non-secret-owner>. prune requires --apply.\\nlease-release requires --lease and --lease-owner. No authentication or task state is created.\\n',\n      stderr: '',\n    };\n  const cacheDir = values['cache-dir'] ?? defaultRuntimeCache();\n  if (operation === 'lease-release') {\n    if (\n      !values.lease ||\n      !values['lease-owner'] ||\n      values.manifest ||\n      values['manifest-sha256'] ||\n      values.apply\n    )\n      throw new CliError('Lease release requires only cache, lease id and owner.', {\n        code: 'RUNTIME_ARGUMENT_INVALID',\n        exitCode: 2,\n      });\n    const root = openRuntimeCache(cacheDir, false);\n    const released = fs.existsSync(path.join(root, '.runtime-cache.json'))\n      ? await releaseRuntimeLease(root, values.lease, values['lease-owner'])\n      : false;\n    return {\n      exitCode: 0,\n      stdout: JSON.stringify({ schema: 'tiangong-lca.runtime-lease-release.v1', released }) + '\\n',\n      stderr: '',\n    };\n  }\n  if (\n    !values.manifest ||\n    !values['manifest-sha256'] ||\n    Boolean(values.lease) !== Boolean(values['lease-owner']) ||\n    ((values.lease || values['lease-owner']) && operation !== 'ensure') ||\n    (values.apply && operation !== 'prune')\n  )\n    throw new CliError(\n      'Select an explicit manifest and independent digest; lease options apply only to ensure.',\n      { code: 'RUNTIME_ARGUMENT_INVALID', exitCode: 2 },\n    );\n  const trusted = loadTrustedRuntimeManifest(values.manifest, values['manifest-sha256']);\n  const options = {\n    cacheDir,\n    fetchImpl,\n    ...(values.lease ? { lease: { id: values.lease, owner: values['lease-owner']! } } : {}),\n  };\n  if (operation === 'prune') {\n    if (!values.apply)\n      throw new CliError('Pruning requires an explicit --apply for this manifest component set.', {\n        code: 'RUNTIME_PRUNE_APPLY_REQUIRED',\n        exitCode: 2,\n      });\n    return {\n      exitCode: 0,\n      stdout:\n        JSON.stringify({\n          schema: 'tiangong-lca.runtime-prune.v1',\n          ...(await pruneRuntimeComponents(trusted, options)),\n        }) + '\\n',\n      stderr: '',\n    };\n  }\n  const report =\n    operation === 'ensure'\n      ? await ensureRuntimeComponents(trusted, options)\n      : inspectRuntimeComponents(trusted, options);\n  return {\n    exitCode: report.status === 'ready' ? 0 : 69,\n    stdout: values.json\n      ? JSON.stringify(report) + '\\n'\n      : `Runtime ${report.status}: ${report.components.map((item) => `${item.id}@${item.version} ${item.status}`).join(', ')}\\n`,\n    stderr: '',\n  };\n}\n"]}

package/dist/src/lib/runtime/manager.d.ts

@@ -0,0 +1,33 @@
+import { type DownloadOptions } from './download.js';
+import type { RuntimeComponent, RuntimeHost, TrustedRuntimeManifest } from './manifest-types.js';
+export type RuntimeManagerOptions = DownloadOptions & {
+    cacheDir?: string;
+    host?: RuntimeHost;
+    lease?: {
+        id: string;
+        owner: string;
+    };
+    archiveSeeds?: Readonly<Record<string, string>>;
+};
+export type RuntimeComponentStatus = {
+    id: string;
+    version: string;
+    key: string;
+    status: 'ready' | 'missing' | 'unverified' | 'corrupt';
+    root: string;
+    reason: string | null;
+};
+export type RuntimeManagerReport = {
+    schema: 'tiangong-lca.runtime-status.v1';
+    manifest_sha256: string;
+    platform: string;
+    status: 'ready' | 'missing' | 'blocked';
+    components: RuntimeComponentStatus[];
+};
+export declare function verifyRuntimeComponent(root: string, component: RuntimeComponent, platform: string): void;
+export declare function inspectRuntimeComponents(value: TrustedRuntimeManifest, options?: RuntimeManagerOptions): RuntimeManagerReport;
+export declare function ensureRuntimeComponents(value: TrustedRuntimeManifest, options?: RuntimeManagerOptions): Promise<RuntimeManagerReport>;
+export declare function pruneRuntimeComponents(value: TrustedRuntimeManifest, options?: RuntimeManagerOptions): Promise<{
+    removed: string[];
+    retained: string[];
+}>;

package/dist/src/lib/runtime/manager.js

@@ -0,0 +1,196 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { withBatchRunLock } from '../../batch.js';
+import { contentHash, hashRuntimeFile, runtimeError } from './files.js';
+import { assertTrustedManifest, componentKey } from './manifest.js';
+import { assertRuntimeHost, inspectRuntimeHost } from './host.js';
+import { cachePath, defaultRuntimeCache, ensureRuntimeCache, openRuntimeCache, readCacheJson, writeOnce, } from './storage.js';
+import { downloadRuntimeArchive } from './download.js';
+import { extractRuntimeArchive } from './archive.js';
+import { acquireRuntimeLease, leasedRuntimeKeys, withRuntimeLeaseLock } from './leases.js';
+function receipt(component) {
+    return {
+        schema: 'tiangong-lca.runtime-component.v1',
+        key: componentKey(component),
+        archive_sha256: component.archive.sha256,
+        content_sha256: component.content_sha256,
+    };
+}
+export function verifyRuntimeComponent(root, component, platform) {
+    const expected = new Map(component.files.map((file) => [file.path, file]));
+    let count = 0;
+    const walk = (relative) => {
+        const directory = relative ? cachePath(root, relative) : root;
+        const stat = fs.lstatSync(directory);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            runtimeError('RUNTIME_COMPONENT_PATH', 'Component directories cannot be links.');
+        for (const name of fs.readdirSync(directory)) {
+            const file = relative ? `${relative}/${name}` : name;
+            const target = cachePath(root, file);
+            const item = fs.lstatSync(target);
+            if (item.isDirectory())
+                walk(file);
+            else {
+                const expectedFile = expected.get(file);
+                if (!expectedFile)
+                    runtimeError('RUNTIME_COMPONENT_EXTRA', 'Component contains an unregistered file.');
+                const actual = hashRuntimeFile(target, file);
+                if (actual.bytes !== expectedFile.bytes ||
+                    actual.sha256 !== expectedFile.sha256 ||
+                    (platform !== 'win32-x64' && (item.mode & 0o777) !== expectedFile.mode))
+                    runtimeError('RUNTIME_COMPONENT_CHANGED', 'Component file bytes, digest or executable mode changed.');
+                count++;
+            }
+        }
+    };
+    walk('');
+    if (count !== component.files.length)
+        runtimeError('RUNTIME_COMPONENT_MISSING', 'Component inventory is incomplete.');
+}
+function inspectComponent(cache, component, platform) {
+    const key = componentKey(component), relative = `components/${key}`, root = cachePath(cache, `${relative}/root`);
+    const base = { id: component.id, version: component.version, key, root };
+    if (!fs.existsSync(cachePath(cache, relative)))
+        return { ...base, status: 'missing', reason: null };
+    try {
+        if (fs
+            .readdirSync(cachePath(cache, relative))
+            .some((name) => !['root', 'receipt.json'].includes(name)))
+            runtimeError('RUNTIME_COMPONENT_EXTRA', 'Component installation directory contains unknown data.');
+        if (!fs.existsSync(cachePath(cache, `${relative}/receipt.json`)))
+            return { ...base, status: 'unverified', reason: 'runtime_install_incomplete' };
+        if (contentHash(readCacheJson(cache, `${relative}/receipt.json`)) !==
+            contentHash(receipt(component)))
+            runtimeError('RUNTIME_RECEIPT_CHANGED', 'Component installation receipt does not match the selected manifest.');
+        verifyRuntimeComponent(root, component, platform);
+        return { ...base, status: 'ready', reason: null };
+    }
+    catch (error) {
+        return {
+            ...base,
+            status: 'corrupt',
+            reason: typeof error.code === 'string'
+                ? error.code
+                : 'runtime_component_invalid',
+        };
+    }
+}
+function selected(value, options) {
+    assertTrustedManifest(value);
+    const host = options.host ?? inspectRuntimeHost();
+    assertRuntimeHost(value, host);
+    return {
+        host,
+        components: value.manifest.components.filter((component) => component.platform === host.platform),
+    };
+}
+export function inspectRuntimeComponents(value, options = {}) {
+    const { host, components } = selected(value, options), cache = openRuntimeCache(options.cacheDir ?? defaultRuntimeCache(), false);
+    const states = components.map((component) => inspectComponent(cache, component, host.platform));
+    return {
+        schema: 'tiangong-lca.runtime-status.v1',
+        manifest_sha256: value.sha256,
+        platform: host.platform,
+        status: states.every((item) => item.status === 'ready')
+            ? 'ready'
+            : states.some((item) => item.status === 'corrupt' || item.status === 'unverified')
+                ? 'blocked'
+                : 'missing',
+        components: states,
+    };
+}
+async function installComponent(cache, component, options, platform) {
+    const key = componentKey(component);
+    await withBatchRunLock({
+        runPath: cachePath(cache, `locks/${key}.json`),
+        identity: { schema: 'runtime-component-lock.v1', key },
+        reason: 'Runtime component installation',
+    }, async () => {
+        const state = inspectComponent(cache, component, platform);
+        if (state.status === 'ready')
+            return;
+        const target = cachePath(cache, `components/${key}`);
+        if (state.status === 'unverified') {
+            // Bootstrap may publish a complete tree before Node can produce the CLI receipt.
+            // It is cache data only: adopt after every declared byte/mode and absence of extra files is proved.
+            verifyRuntimeComponent(state.root, component, platform);
+            writeOnce(cache, `components/${key}/receipt.json`, Buffer.from(JSON.stringify(receipt(component)) + '\n'));
+            return;
+        }
+        if (state.status === 'corrupt')
+            runtimeError('RUNTIME_CACHE_CORRUPT', 'A selected cached component is corrupt; preserve active leases and prune it explicitly.');
+        const staging = cachePath(cache, `tmp/${key}-${randomUUID()}`);
+        fs.mkdirSync(staging, { recursive: true, mode: 0o700 });
+        try {
+            const archive = path.join(staging, 'component.tar.gz'), seed = options.archiveSeeds?.[key];
+            if (seed) {
+                const fact = hashRuntimeFile(seed, 'archive');
+                if (fact.bytes !== component.archive.bytes || fact.sha256 !== component.archive.sha256)
+                    runtimeError('RUNTIME_ARCHIVE_SEED', 'Supplied archive seed differs from the trusted component.');
+                fs.copyFileSync(seed, archive, fs.constants.COPYFILE_EXCL);
+            }
+            else
+                await downloadRuntimeArchive(component.archive, archive, options);
+            await extractRuntimeArchive(archive, path.join(staging, 'root'), component, options.signal);
+            verifyRuntimeComponent(path.join(staging, 'root'), component, platform);
+            fs.unlinkSync(archive);
+            writeOnce(staging, 'receipt.json', Buffer.from(JSON.stringify(receipt(component)) + '\n'));
+            fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+            cachePath(cache, `components/${key}`);
+            if (fs.existsSync(target))
+                runtimeError('RUNTIME_INSTALL_CONFLICT', 'Another component tree appeared outside the installation lock.');
+            fs.renameSync(staging, target);
+        }
+        finally {
+            if (fs.existsSync(staging))
+                fs.rmSync(staging, { recursive: true, force: true });
+        }
+    });
+}
+export async function ensureRuntimeComponents(value, options = {}) {
+    const { host, components } = selected(value, options);
+    options.signal?.throwIfAborted();
+    const cache = await ensureRuntimeCache(options.cacheDir ?? defaultRuntimeCache());
+    if (options.lease)
+        await acquireRuntimeLease(cache, options.lease.id, options.lease.owner, components.map(componentKey));
+    for (const component of components) {
+        options.signal?.throwIfAborted();
+        await installComponent(cache, component, options, host.platform);
+    }
+    return inspectRuntimeComponents(value, { ...options, cacheDir: cache, host });
+}
+export async function pruneRuntimeComponents(value, options = {}) {
+    const { components } = selected(value, options);
+    const cache = openRuntimeCache(options.cacheDir ?? defaultRuntimeCache(), false);
+    if (!fs.existsSync(cachePath(cache, '.runtime-cache.json')))
+        return { removed: [], retained: [] };
+    return withRuntimeLeaseLock(cache, async () => {
+        const pinned = leasedRuntimeKeys(cache), removed = [], retained = [];
+        for (const component of components) {
+            const key = componentKey(component);
+            if (pinned.has(key)) {
+                retained.push(key);
+                continue;
+            }
+            await withBatchRunLock({
+                runPath: cachePath(cache, `locks/${key}.json`),
+                identity: { schema: 'runtime-component-lock.v1', key },
+                reason: 'Explicit unused runtime pruning',
+            }, () => {
+                const target = cachePath(cache, `components/${key}`);
+                if (!fs.existsSync(target))
+                    return;
+                if (fs.readdirSync(target).some((name) => !['root', 'receipt.json'].includes(name)))
+                    runtimeError('RUNTIME_PRUNE_UNOWNED', 'Unknown files must be preserved instead of pruned.');
+                if (contentHash(readCacheJson(cache, `components/${key}/receipt.json`)) !==
+                    contentHash(receipt(component)))
+                    runtimeError('RUNTIME_PRUNE_UNOWNED', 'Only an installation with its exact ownership receipt can be pruned.');
+                fs.rmSync(target, { recursive: true, force: false });
+                removed.push(key);
+            });
+        }
+        return { removed, retained };
+    });
+}
+//# sourceMappingURL=manager.js.map