@tiangong-lca/cli 0.1.9 → 0.1.11

package/dist/src/lib/runtime/manifest-values.js

@@ -0,0 +1,124 @@
+import { runtimeError } from './files.js';
+import { RUNTIME_PLATFORMS } from './types.js';
+export function record(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        invalid(label);
+    return value;
+}
+export function invalid(label) {
+    return runtimeError('RUNTIME_MANIFEST_INVALID', `Runtime manifest has invalid ${label}.`);
+}
+export function exact(value, keys, label) {
+    if (Object.keys(value).length !== keys.length || keys.some((key) => !Object.hasOwn(value, key)))
+        invalid(label);
+}
+export function text(value, label, max = 256) {
+    if (typeof value !== 'string' ||
+        !value ||
+        value.length > max ||
+        value.split('').some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+        invalid(label);
+    return value;
+}
+export function id(value) {
+    const result = text(value, 'identifier', 64);
+    if (!/^[a-z0-9][a-z0-9._-]*$/u.test(result) || result === '.' || result === '..')
+        invalid('identifier');
+    return result;
+}
+export function version(value) {
+    const result = text(value, 'version', 40);
+    if (!/^(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)$/u.test(result))
+        invalid('exact stable version');
+    return result;
+}
+export function sha(value) {
+    const result = text(value, 'SHA-256', 64);
+    if (!/^[0-9a-f]{64}$/u.test(result))
+        invalid('SHA-256');
+    return result;
+}
+export function integer(value, max, minimum = 0) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < minimum || value > max)
+        invalid('bounded integer');
+    return value;
+}
+export function array(value, max, minimum = 0) {
+    if (!Array.isArray(value) || value.length > max || value.length < minimum)
+        invalid('bounded array');
+    return value;
+}
+export function platform(value) {
+    if (!RUNTIME_PLATFORMS.includes(value))
+        invalid('platform');
+    return value;
+}
+export function relativeFile(value) {
+    const result = text(value, 'portable file path', 255);
+    if (Buffer.byteLength(result) > 255 ||
+        result.includes('\\') ||
+        result.includes(':') ||
+        result.startsWith('/') ||
+        result
+            .split('/')
+            .some((part) => !part ||
+            part === '.' ||
+            part === '..' ||
+            /^(?:\.env(?:\..*)?|\.git|\.npmrc|\.ssh)$/iu.test(part) ||
+            /[. ]$/u.test(part) ||
+            /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu.test(part)))
+        invalid('portable file path');
+    const segments = result.split('/');
+    if (segments.length > 32 ||
+        Buffer.byteLength(segments.at(-1)) > 100 ||
+        (Buffer.byteLength(result) > 100 &&
+            !segments
+                .slice(0, -1)
+                .some((_, i) => Buffer.byteLength(segments.slice(0, i + 1).join('/')) <= 155 &&
+                Buffer.byteLength(segments.slice(i + 1).join('/')) <= 100)))
+        invalid('USTAR path');
+    return result;
+}
+export function unique(values, label) {
+    if (new Set(values).size !== values.length)
+        invalid(`duplicate ${label}`);
+}
+export function distributionUrl(value, redirected = false) {
+    const input = text(value, 'distribution URL', 4096);
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        invalid('distribution URL');
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || url.hash || url.port)
+        invalid('distribution URL');
+    const primary = ['github.com', 'nodejs.org', 'registry.npmjs.org'];
+    const redirects = ['release-assets.githubusercontent.com', 'objects.githubusercontent.com'];
+    if (!primary.includes(url.hostname) && !(redirected && redirects.includes(url.hostname)))
+        invalid('distribution origin');
+    if (!redirected) {
+        if (url.search || /\/(?:latest|heads)(?:\/|$)/u.test(url.pathname))
+            invalid('immutable distribution URL');
+        if (url.hostname === 'github.com' &&
+            !/^\/[^/]+\/[^/]+\/releases\/download\/[^/]+\/[^/]+$/u.test(url.pathname))
+            invalid('release asset URL');
+        if (url.hostname === 'nodejs.org' &&
+            !/^\/dist\/v[0-9]+\.[0-9]+\.[0-9]+\/[^/]+$/u.test(url.pathname))
+            invalid('Node release URL');
+        if (url.hostname === 'registry.npmjs.org' &&
+            !/\/-\/[^/]+-[0-9]+\.[0-9]+\.[0-9]+\.tgz$/u.test(url.pathname))
+            invalid('registry tarball URL');
+    }
+    return url.href;
+}
+export function deepFreeze(value) {
+    if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+        for (const item of Object.values(value))
+            deepFreeze(item);
+        Object.freeze(value);
+    }
+    return value;
+}
+//# sourceMappingURL=manifest-values.js.map

package/dist/src/lib/runtime/manifest-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-values.js","sourceRoot":"","sources":["../../../../src/lib/runtime/manifest-values.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAC;AAErE,MAAM,UAAU,MAAM,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAChF,OAAO,KAAgC,CAAC;AAC1C,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,YAAY,CAAC,0BAA0B,EAAE,gCAAgC,KAAK,GAAG,CAAC,CAAC;AAC5F,CAAC;AACD,MAAM,UAAU,KAAK,CACnB,KAA8B,EAC9B,IAAuB,EACvB,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7F,OAAO,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AACD,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,KAAa,EAAE,GAAG,GAAG,GAAG;IAC3D,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK;QACN,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QAErF,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,EAAE,CAAC,KAAc;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI;QAC9E,OAAO,CAAC,YAAY,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,4DAA4D,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5E,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,GAAG,CAAC,KAAc;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,KAAc,EAAE,GAAW,EAAE,OAAO,GAAG,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO,IAAI,KAAK,GAAG,GAAG;QAC7F,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,KAAK,CAAC,KAAc,EAAE,GAAW,EAAE,OAAO,GAAG,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO;QACvE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAwB,CAAC;QAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,OAAO,KAAwB,CAAC;AAClC,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACtD,IACE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,GAAG;QAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QACtB,MAAM;aACH,KAAK,CAAC,GAAG,CAAC;aACV,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI;YACL,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,IAAI;YACb,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YACnB,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC,CAChE;QAEH,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IACE,QAAQ,CAAC,MAAM,GAAG,EAAE;QACpB,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,GAAG;QACzC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,GAAG;YAC9B,CAAC,QAAQ;iBACN,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;iBACZ,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG;gBAC5D,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAC5D,CAAC;QAEN,OAAO,CAAC,YAAY,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,MAAyB,EAAE,KAAa;IAC7D,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC;AAC5E,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,UAAU,GAAG,KAAK;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI;QACnF,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,CAAC,sCAAsC,EAAE,+BAA+B,CAAC,CAAC;IAC5F,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtF,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,MAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAChE,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACxC,IACE,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC7B,CAAC,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAEzE,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC/B,IACE,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC7B,CAAC,2CAA2C,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAE/D,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9B,IACE,GAAG,CAAC,QAAQ,KAAK,oBAAoB;YACrC,CAAC,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAE9D,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AACD,MAAM,UAAU,UAAU,CAAI,KAAQ;IACpC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { runtimeError } from './files.js';\nimport { RUNTIME_PLATFORMS, type RuntimePlatform } from './types.js';\n\nexport function record(value: unknown, label: string): Record<string, unknown> {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) invalid(label);\n  return value as Record<string, unknown>;\n}\nexport function invalid(label: string): never {\n  return runtimeError('RUNTIME_MANIFEST_INVALID', `Runtime manifest has invalid ${label}.`);\n}\nexport function exact(\n  value: Record<string, unknown>,\n  keys: readonly string[],\n  label: string,\n): void {\n  if (Object.keys(value).length !== keys.length || keys.some((key) => !Object.hasOwn(value, key)))\n    invalid(label);\n}\nexport function text(value: unknown, label: string, max = 256): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    value.length > max ||\n    value.split('').some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127)\n  )\n    invalid(label);\n  return value;\n}\nexport function id(value: unknown): string {\n  const result = text(value, 'identifier', 64);\n  if (!/^[a-z0-9][a-z0-9._-]*$/u.test(result) || result === '.' || result === '..')\n    invalid('identifier');\n  return result;\n}\nexport function version(value: unknown): string {\n  const result = text(value, 'version', 40);\n  if (!/^(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)$/u.test(result))\n    invalid('exact stable version');\n  return result;\n}\nexport function sha(value: unknown): string {\n  const result = text(value, 'SHA-256', 64);\n  if (!/^[0-9a-f]{64}$/u.test(result)) invalid('SHA-256');\n  return result;\n}\nexport function integer(value: unknown, max: number, minimum = 0): number {\n  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < minimum || value > max)\n    invalid('bounded integer');\n  return value;\n}\nexport function array(value: unknown, max: number, minimum = 0): unknown[] {\n  if (!Array.isArray(value) || value.length > max || value.length < minimum)\n    invalid('bounded array');\n  return value;\n}\nexport function platform(value: unknown): RuntimePlatform {\n  if (!RUNTIME_PLATFORMS.includes(value as RuntimePlatform)) invalid('platform');\n  return value as RuntimePlatform;\n}\nexport function relativeFile(value: unknown): string {\n  const result = text(value, 'portable file path', 255);\n  if (\n    Buffer.byteLength(result) > 255 ||\n    result.includes('\\\\') ||\n    result.includes(':') ||\n    result.startsWith('/') ||\n    result\n      .split('/')\n      .some(\n        (part) =>\n          !part ||\n          part === '.' ||\n          part === '..' ||\n          /^(?:\\.env(?:\\..*)?|\\.git|\\.npmrc|\\.ssh)$/iu.test(part) ||\n          /[. ]$/u.test(part) ||\n          /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\\.|$)/iu.test(part),\n      )\n  )\n    invalid('portable file path');\n  const segments = result.split('/');\n  if (\n    segments.length > 32 ||\n    Buffer.byteLength(segments.at(-1)!) > 100 ||\n    (Buffer.byteLength(result) > 100 &&\n      !segments\n        .slice(0, -1)\n        .some(\n          (_, i) =>\n            Buffer.byteLength(segments.slice(0, i + 1).join('/')) <= 155 &&\n            Buffer.byteLength(segments.slice(i + 1).join('/')) <= 100,\n        ))\n  )\n    invalid('USTAR path');\n  return result;\n}\nexport function unique(values: readonly string[], label: string): void {\n  if (new Set(values).size !== values.length) invalid(`duplicate ${label}`);\n}\nexport function distributionUrl(value: unknown, redirected = false): string {\n  const input = text(value, 'distribution URL', 4096);\n  let url: URL;\n  try {\n    url = new URL(input);\n  } catch {\n    invalid('distribution URL');\n  }\n  if (url.protocol !== 'https:' || url.username || url.password || url.hash || url.port)\n    invalid('distribution URL');\n  const primary = ['github.com', 'nodejs.org', 'registry.npmjs.org'];\n  const redirects = ['release-assets.githubusercontent.com', 'objects.githubusercontent.com'];\n  if (!primary.includes(url.hostname) && !(redirected && redirects.includes(url.hostname)))\n    invalid('distribution origin');\n  if (!redirected) {\n    if (url.search || /\\/(?:latest|heads)(?:\\/|$)/u.test(url.pathname))\n      invalid('immutable distribution URL');\n    if (\n      url.hostname === 'github.com' &&\n      !/^\\/[^/]+\\/[^/]+\\/releases\\/download\\/[^/]+\\/[^/]+$/u.test(url.pathname)\n    )\n      invalid('release asset URL');\n    if (\n      url.hostname === 'nodejs.org' &&\n      !/^\\/dist\\/v[0-9]+\\.[0-9]+\\.[0-9]+\\/[^/]+$/u.test(url.pathname)\n    )\n      invalid('Node release URL');\n    if (\n      url.hostname === 'registry.npmjs.org' &&\n      !/\\/-\\/[^/]+-[0-9]+\\.[0-9]+\\.[0-9]+\\.tgz$/u.test(url.pathname)\n    )\n      invalid('registry tarball URL');\n  }\n  return url.href;\n}\nexport function deepFreeze<T>(value: T): T {\n  if (value && typeof value === 'object' && !Object.isFrozen(value)) {\n    for (const item of Object.values(value)) deepFreeze(item);\n    Object.freeze(value);\n  }\n  return value;\n}\n"]}

package/dist/src/lib/runtime/manifest.d.ts

@@ -0,0 +1,8 @@
+import type { RuntimeComponent, RuntimeManifest, TrustedRuntimeManifest, WorkspaceCompatibility } from './manifest-types.js';
+export declare function parseRuntimeManifest(value: unknown): RuntimeManifest;
+export declare function trustRuntimeManifest(bytes: Uint8Array, expectedSha256: string): TrustedRuntimeManifest;
+export declare function loadTrustedRuntimeManifest(file: string, expectedSha256: string): TrustedRuntimeManifest;
+export declare function assertTrustedManifest(value: TrustedRuntimeManifest): void;
+export declare function copyTrustedRuntimeManifestBytes(value: TrustedRuntimeManifest): Buffer;
+export declare function componentKey(value: RuntimeComponent): string;
+export declare function assertWorkspaceCompatibility(value: TrustedRuntimeManifest, request: WorkspaceCompatibility, access: 'read' | 'write'): void;

package/dist/src/lib/runtime/manifest.js

@@ -0,0 +1,239 @@
+import fs from 'node:fs';
+import { createHash } from 'node:crypto';
+import { contentHash, runtimeError } from './files.js';
+import { array, deepFreeze, distributionUrl, exact, id, integer, invalid, platform, record, relativeFile, sha, text, unique, version, } from './manifest-values.js';
+import { RUNTIME_ARCHIVE_FORMAT, RUNTIME_BOOTSTRAP_PROTOCOL, RUNTIME_MANIFEST_SCHEMA, RUNTIME_HOST_CONTEXT_PROTOCOL, } from './manifest-types.js';
+const trusted = new WeakMap();
+function compatibility(value) {
+    const result = array(value, 32).map((item) => {
+        const entry = record(item, 'workspace compatibility');
+        exact(entry, ['schema', 'features'], 'workspace compatibility');
+        const features = array(entry.features, 64).map((value) => text(value, 'workspace feature', 128));
+        unique(features, 'workspace feature');
+        return { schema: text(entry.schema, 'workspace schema', 128), features };
+    });
+    unique(result.map((entry) => entry.schema), 'workspace schema');
+    return result;
+}
+function component(value) {
+    const item = record(value, 'component');
+    exact(item, [
+        'id',
+        'version',
+        'platform',
+        'archive',
+        'files',
+        'content_sha256',
+        'production_lock',
+        'sbom',
+        'licenses',
+        'provenance',
+        'protocols',
+        'asset_fingerprints',
+    ], 'component');
+    const archive = record(item.archive, 'archive');
+    exact(archive, ['format', 'url', 'bytes', 'sha256'], 'archive');
+    if (archive.format !== RUNTIME_ARCHIVE_FORMAT)
+        invalid('archive format');
+    let total = 0;
+    const files = array(item.files, 50_000, 1).map((value) => {
+        const file = record(value, 'component file');
+        exact(file, ['path', 'bytes', 'sha256', 'mode'], 'component file');
+        if (file.mode !== 420 && file.mode !== 493)
+            invalid('file mode');
+        const bytes = integer(file.bytes, 512 * 1024 * 1024);
+        total += bytes;
+        return { path: relativeFile(file.path), bytes, sha256: sha(file.sha256), mode: file.mode };
+    });
+    if (total > 2 * 1024 * 1024 * 1024)
+        invalid('unpacked size');
+    const paths = files.map((file) => file.path);
+    unique(paths.map((path) => path.toLowerCase()), 'case-folded file path');
+    if (JSON.stringify(paths) !== JSON.stringify([...paths].sort()))
+        invalid('file order');
+    const pathSet = new Set(paths.map((path) => path.toLowerCase()));
+    for (const file of paths) {
+        const parts = file.split('/');
+        for (let i = 1; i < parts.length; i++)
+            if (pathSet.has(parts.slice(0, i).join('/').toLowerCase()))
+                invalid('file/directory collision');
+    }
+    const content = sha(item.content_sha256);
+    if (content !== contentHash(files))
+        invalid('component content SHA-256');
+    const requiredFile = (value) => {
+        const file = relativeFile(value);
+        if (!paths.includes(file))
+            invalid('metadata file reference');
+        return file;
+    };
+    const licenses = array(item.licenses, 64, 1).map(requiredFile), provenance = array(item.provenance, 64, 1).map(requiredFile);
+    unique(licenses, 'license');
+    unique(provenance, 'provenance');
+    const protocols = array(item.protocols, 32, 1).map((value) => text(value, 'component protocol', 128));
+    unique(protocols, 'protocol');
+    const fingerprints = record(item.asset_fingerprints, 'asset fingerprints');
+    if (Object.keys(fingerprints).length > 64)
+        invalid('fingerprint count');
+    const asset_fingerprints = Object.fromEntries(Object.entries(fingerprints).map(([key, value]) => [id(key), sha(value)]));
+    return {
+        id: id(item.id),
+        version: version(item.version),
+        platform: platform(item.platform),
+        archive: {
+            format: RUNTIME_ARCHIVE_FORMAT,
+            url: distributionUrl(archive.url),
+            bytes: integer(archive.bytes, 512 * 1024 * 1024, 1),
+            sha256: sha(archive.sha256),
+        },
+        files,
+        content_sha256: content,
+        production_lock: requiredFile(item.production_lock),
+        sbom: requiredFile(item.sbom),
+        licenses,
+        provenance,
+        protocols,
+        asset_fingerprints,
+    };
+}
+function componentPath(value, components, target, executable = false) {
+    const entry = record(value, 'component path');
+    exact(entry, ['component', 'path'], 'component path');
+    const componentId = id(entry.component), file = relativeFile(entry.path);
+    const owner = components.find((item) => item.platform === target && item.id === componentId);
+    const fact = owner?.files.find((item) => item.path === file);
+    if (!fact || (executable && fact.mode !== 493))
+        invalid('launch file reference');
+    return { component: componentId, path: file };
+}
+export function parseRuntimeManifest(value) {
+    const item = record(value, 'manifest');
+    exact(item, [
+        'schema',
+        'bootstrap_protocol',
+        'product',
+        'minimum_hosts',
+        'workspace',
+        'components',
+        'launches',
+    ], 'manifest');
+    if (item.schema !== RUNTIME_MANIFEST_SCHEMA ||
+        item.bootstrap_protocol !== RUNTIME_BOOTSTRAP_PROTOCOL)
+        invalid('manifest protocol version');
+    const product = record(item.product, 'product');
+    exact(product, ['id', 'version'], 'product');
+    const workspace = record(item.workspace, 'workspace');
+    exact(workspace, ['read', 'write'], 'workspace');
+    const read = compatibility(workspace.read), write = compatibility(workspace.write);
+    for (const entry of write)
+        if (!read.some((candidate) => candidate.schema === entry.schema &&
+            entry.features.every((feature) => candidate.features.includes(feature))))
+            invalid('write compatibility outside read support');
+    const components = array(item.components, 128, 1).map(component);
+    unique(components.map((item) => `${item.platform}:${item.id}`), 'platform component');
+    const minimum = record(item.minimum_hosts, 'minimum hosts');
+    const minimum_hosts = Object.fromEntries(Object.entries(minimum).map(([key, value]) => {
+        const target = platform(key), host = record(value, 'minimum host');
+        exact(host, ['os_release', 'glibc'], 'minimum host');
+        if ((target.startsWith('linux-') && typeof host.glibc !== 'string') ||
+            (!target.startsWith('linux-') && host.glibc !== null))
+            invalid('host ABI');
+        const glibc = host.glibc === null ? null : text(host.glibc, 'glibc version', 40);
+        if (glibc !== null && !/^[0-9]+\.[0-9]+$/u.test(glibc))
+            invalid('glibc version');
+        return [target, { os_release: version(host.os_release), glibc }];
+    }));
+    const supported = [...new Set(components.map((item) => item.platform))].sort();
+    if (JSON.stringify(Object.keys(minimum_hosts).sort()) !== JSON.stringify(supported))
+        invalid('host/component platform coverage');
+    const launches = array(item.launches, 64, 1).map((value) => {
+        const launch = record(value, 'launch');
+        const hasContext = Object.hasOwn(launch, 'context_protocol');
+        exact(launch, [
+            'id',
+            'platform',
+            'executable',
+            'environment',
+            'argv',
+            ...(hasContext ? ['context_protocol'] : []),
+        ], 'launch');
+        if (hasContext && launch.context_protocol !== RUNTIME_HOST_CONTEXT_PROTOCOL)
+            invalid('host context protocol');
+        if (launch.environment !== 'isolated' && launch.environment !== 'cli-auth')
+            invalid('launch environment');
+        const target = platform(launch.platform);
+        const argv = array(launch.argv, 32).map((value) => {
+            const arg = record(value, 'launch argument');
+            if (Object.hasOwn(arg, 'literal')) {
+                exact(arg, ['literal'], 'literal argument');
+                return { literal: text(arg.literal, 'literal argument', 4096) };
+            }
+            return componentPath(arg, components, target);
+        });
+        return {
+            id: id(launch.id),
+            platform: target,
+            executable: componentPath(launch.executable, components, target, true),
+            environment: launch.environment,
+            ...(hasContext ? { context_protocol: RUNTIME_HOST_CONTEXT_PROTOCOL } : {}),
+            argv,
+        };
+    });
+    unique(launches.map((item) => `${item.platform}:${item.id}`), 'platform launch');
+    for (const target of supported)
+        if (!launches.some((launch) => launch.platform === target))
+            invalid('platform launch coverage');
+    return deepFreeze({
+        schema: RUNTIME_MANIFEST_SCHEMA,
+        bootstrap_protocol: RUNTIME_BOOTSTRAP_PROTOCOL,
+        product: { id: id(product.id), version: version(product.version) },
+        minimum_hosts,
+        workspace: { read, write },
+        components,
+        launches,
+    });
+}
+export function trustRuntimeManifest(bytes, expectedSha256) {
+    sha(expectedSha256);
+    if (bytes.byteLength > 32 * 1024 * 1024)
+        runtimeError('RUNTIME_MANIFEST_INTEGRITY', 'Runtime manifest bytes do not match the independent trust anchor.');
+    const snapshot = Buffer.from(bytes);
+    if (createHash('sha256').update(snapshot).digest('hex') !== expectedSha256)
+        runtimeError('RUNTIME_MANIFEST_INTEGRITY', 'Runtime manifest bytes do not match the independent trust anchor.');
+    let value;
+    try {
+        value = JSON.parse(snapshot.toString('utf8'));
+    }
+    catch {
+        invalid('JSON');
+    }
+    const result = Object.freeze({ sha256: expectedSha256, manifest: parseRuntimeManifest(value) });
+    trusted.set(result, snapshot);
+    return result;
+}
+export function loadTrustedRuntimeManifest(file, expectedSha256) {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 32 * 1024 * 1024)
+        runtimeError('RUNTIME_MANIFEST_FILE', 'Runtime manifest must be a bounded regular file.');
+    return trustRuntimeManifest(fs.readFileSync(file), expectedSha256);
+}
+export function assertTrustedManifest(value) {
+    if (!value || !trusted.has(value))
+        runtimeError('RUNTIME_MANIFEST_UNTRUSTED', 'Supply a manifest verified against an independent trusted digest.');
+}
+export function copyTrustedRuntimeManifestBytes(value) {
+    const bytes = trusted.get(value);
+    if (!bytes)
+        runtimeError('RUNTIME_MANIFEST_UNTRUSTED', 'Supply a manifest verified against an independent trusted digest.');
+    return Buffer.from(bytes);
+}
+export function componentKey(value) {
+    return contentHash(value);
+}
+export function assertWorkspaceCompatibility(value, request, access) {
+    assertTrustedManifest(value);
+    const support = value.manifest.workspace[access]?.find((entry) => entry.schema === request.schema);
+    if (!support || !request.features.every((feature) => support.features.includes(feature)))
+        runtimeError('RUNTIME_WORKSPACE_INCOMPATIBLE', 'The selected runtime does not support the requested workspace access/schema/features.');
+}
+//# sourceMappingURL=manifest.js.map

package/dist/src/lib/runtime/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../src/lib/runtime/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EACL,KAAK,EACL,UAAU,EACV,eAAe,EACf,KAAK,EACL,EAAE,EACF,OAAO,EACP,OAAO,EACP,QAAQ,EACR,MAAM,EACN,YAAY,EACZ,GAAG,EACH,IAAI,EACJ,MAAM,EACN,OAAO,GACR,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAU7B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAkB,CAAC;AAE9C,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QACtD,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACvD,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CACtC,CAAC;QACF,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,MAAM,CACJ,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EACnC,kBAAkB,CACnB,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACxC,KAAK,CACH,IAAI,EACJ;QACE,IAAI;QACJ,SAAS;QACT,UAAU;QACV,SAAS;QACT,OAAO;QACP,gBAAgB;QAChB,iBAAiB;QACjB,MAAM;QACN,UAAU;QACV,YAAY;QACZ,WAAW;QACX,oBAAoB;KACrB,EACD,WAAW,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,sBAAsB;QAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAoB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QACrD,KAAK,IAAI,KAAK,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CACJ,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EACvC,uBAAuB,CACxB,CAAC;IACF,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YACnC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBACxD,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,EAC5D,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/D,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5B,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3D,IAAI,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,CAAC,CACvC,CAAC;IACF,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC9B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAC1E,CAAC;IACF,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,OAAO,EAAE;YACP,MAAM,EAAE,sBAAsB;YAC9B,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;SAC5B;QACD,KAAK;QACL,cAAc,EAAE,OAAO;QACvB,eAAe,EAAE,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC;QACnD,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7B,QAAQ;QACR,UAAU;QACV,SAAS;QACT,kBAAkB;KACnB,CAAC;AACJ,CAAC;AACD,SAAS,aAAa,CACpB,KAAc,EACd,UAAuC,EACvC,MAAc,EACd,UAAU,GAAG,KAAK;IAElB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC9C,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EACrC,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACjF,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACvC,KAAK,CACH,IAAI,EACJ;QACE,QAAQ;QACR,oBAAoB;QACpB,SAAS;QACT,eAAe;QACf,WAAW;QACX,YAAY;QACZ,UAAU;KACX,EACD,UAAU,CACX,CAAC;IACF,IACE,IAAI,CAAC,MAAM,KAAK,uBAAuB;QACvC,IAAI,CAAC,kBAAkB,KAAK,0BAA0B;QAEtD,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACtD,KAAK,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,EACxC,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,KAAK;QACvB,IACE,CAAC,IAAI,CAAC,IAAI,CACR,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YACjC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAC1E;YAED,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,CACJ,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EACvD,oBAAoB,CACrB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CACtC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,EAC1B,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;QACrD,IACE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;YAC/D,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;YAErD,OAAO,CAAC,UAAU,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACjF,OAAO,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CACH,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QACjF,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAoB,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC7D,KAAK,CACH,MAAM,EACN;YACE,IAAI;YACJ,UAAU;YACV,YAAY;YACZ,aAAa;YACb,MAAM;YACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,EACD,QAAQ,CACT,CAAC;QACF,IAAI,UAAU,IAAI,MAAM,CAAC,gBAAgB,KAAK,6BAA6B;YACzE,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU;YACxE,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;gBAClC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,CAAC;gBAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,EAAE,CAAC;YAClE,CAAC;YACD,OAAO,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YACjB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC;YACtE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,IAAI;SACL,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,CACJ,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EACrD,iBAAiB,CAClB,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,SAAS;QAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC;YAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAClG,OAAO,UAAU,CAAC;QAChB,MAAM,EAAE,uBAAuB;QAC/B,kBAAkB,EAAE,0BAA0B;QAC9C,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAClE,aAAa;QACb,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;QAC1B,UAAU;QACV,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,oBAAoB,CAClC,KAAiB,EACjB,cAAsB;IAEtB,GAAG,CAAC,cAAc,CAAC,CAAC;IACpB,IAAI,KAAK,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QACrC,YAAY,CACV,4BAA4B,EAC5B,mEAAmE,CACpE,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,cAAc;QACxE,YAAY,CACV,4BAA4B,EAC5B,mEAAmE,CACpE,CAAC;IACJ,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,0BAA0B,CACxC,IAAY,EACZ,cAAsB;IAEtB,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QACzE,YAAY,CAAC,uBAAuB,EAAE,kDAAkD,CAAC,CAAC;IAC5F,OAAO,oBAAoB,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;AACrE,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,KAA6B;IACjE,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QAC/B,YAAY,CACV,4BAA4B,EAC5B,mEAAmE,CACpE,CAAC;AACN,CAAC;AACD,MAAM,UAAU,+BAA+B,CAAC,KAA6B;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QACR,YAAY,CACV,4BAA4B,EAC5B,mEAAmE,CACpE,CAAC;IACJ,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,KAAuB;IAClD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AACD,MAAM,UAAU,4BAA4B,CAC1C,KAA6B,EAC7B,OAA+B,EAC/B,MAAwB;IAExB,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAC3C,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtF,YAAY,CACV,gCAAgC,EAChC,uFAAuF,CACxF,CAAC;AACN,CAAC","sourcesContent":["import fs from 'node:fs';\nimport { createHash } from 'node:crypto';\nimport { contentHash, runtimeError } from './files.js';\nimport {\n  array,\n  deepFreeze,\n  distributionUrl,\n  exact,\n  id,\n  integer,\n  invalid,\n  platform,\n  record,\n  relativeFile,\n  sha,\n  text,\n  unique,\n  version,\n} from './manifest-values.js';\nimport {\n  RUNTIME_ARCHIVE_FORMAT,\n  RUNTIME_BOOTSTRAP_PROTOCOL,\n  RUNTIME_MANIFEST_SCHEMA,\n  RUNTIME_HOST_CONTEXT_PROTOCOL,\n} from './manifest-types.js';\nimport type {\n  ComponentFile,\n  ComponentPath,\n  RuntimeComponent,\n  RuntimeLaunch,\n  RuntimeManifest,\n  TrustedRuntimeManifest,\n  WorkspaceCompatibility,\n} from './manifest-types.js';\nconst trusted = new WeakMap<object, Buffer>();\n\nfunction compatibility(value: unknown): WorkspaceCompatibility[] {\n  const result = array(value, 32).map((item) => {\n    const entry = record(item, 'workspace compatibility');\n    exact(entry, ['schema', 'features'], 'workspace compatibility');\n    const features = array(entry.features, 64).map((value) =>\n      text(value, 'workspace feature', 128),\n    );\n    unique(features, 'workspace feature');\n    return { schema: text(entry.schema, 'workspace schema', 128), features };\n  });\n  unique(\n    result.map((entry) => entry.schema),\n    'workspace schema',\n  );\n  return result;\n}\nfunction component(value: unknown): RuntimeComponent {\n  const item = record(value, 'component');\n  exact(\n    item,\n    [\n      'id',\n      'version',\n      'platform',\n      'archive',\n      'files',\n      'content_sha256',\n      'production_lock',\n      'sbom',\n      'licenses',\n      'provenance',\n      'protocols',\n      'asset_fingerprints',\n    ],\n    'component',\n  );\n  const archive = record(item.archive, 'archive');\n  exact(archive, ['format', 'url', 'bytes', 'sha256'], 'archive');\n  if (archive.format !== RUNTIME_ARCHIVE_FORMAT) invalid('archive format');\n  let total = 0;\n  const files: ComponentFile[] = array(item.files, 50_000, 1).map((value) => {\n    const file = record(value, 'component file');\n    exact(file, ['path', 'bytes', 'sha256', 'mode'], 'component file');\n    if (file.mode !== 420 && file.mode !== 493) invalid('file mode');\n    const bytes = integer(file.bytes, 512 * 1024 * 1024);\n    total += bytes;\n    return { path: relativeFile(file.path), bytes, sha256: sha(file.sha256), mode: file.mode };\n  });\n  if (total > 2 * 1024 * 1024 * 1024) invalid('unpacked size');\n  const paths = files.map((file) => file.path);\n  unique(\n    paths.map((path) => path.toLowerCase()),\n    'case-folded file path',\n  );\n  if (JSON.stringify(paths) !== JSON.stringify([...paths].sort())) invalid('file order');\n  const pathSet = new Set(paths.map((path) => path.toLowerCase()));\n  for (const file of paths) {\n    const parts = file.split('/');\n    for (let i = 1; i < parts.length; i++)\n      if (pathSet.has(parts.slice(0, i).join('/').toLowerCase()))\n        invalid('file/directory collision');\n  }\n  const content = sha(item.content_sha256);\n  if (content !== contentHash(files)) invalid('component content SHA-256');\n  const requiredFile = (value: unknown) => {\n    const file = relativeFile(value);\n    if (!paths.includes(file)) invalid('metadata file reference');\n    return file;\n  };\n  const licenses = array(item.licenses, 64, 1).map(requiredFile),\n    provenance = array(item.provenance, 64, 1).map(requiredFile);\n  unique(licenses, 'license');\n  unique(provenance, 'provenance');\n  const protocols = array(item.protocols, 32, 1).map((value) =>\n    text(value, 'component protocol', 128),\n  );\n  unique(protocols, 'protocol');\n  const fingerprints = record(item.asset_fingerprints, 'asset fingerprints');\n  if (Object.keys(fingerprints).length > 64) invalid('fingerprint count');\n  const asset_fingerprints = Object.fromEntries(\n    Object.entries(fingerprints).map(([key, value]) => [id(key), sha(value)]),\n  );\n  return {\n    id: id(item.id),\n    version: version(item.version),\n    platform: platform(item.platform),\n    archive: {\n      format: RUNTIME_ARCHIVE_FORMAT,\n      url: distributionUrl(archive.url),\n      bytes: integer(archive.bytes, 512 * 1024 * 1024, 1),\n      sha256: sha(archive.sha256),\n    },\n    files,\n    content_sha256: content,\n    production_lock: requiredFile(item.production_lock),\n    sbom: requiredFile(item.sbom),\n    licenses,\n    provenance,\n    protocols,\n    asset_fingerprints,\n  };\n}\nfunction componentPath(\n  value: unknown,\n  components: readonly RuntimeComponent[],\n  target: string,\n  executable = false,\n): ComponentPath {\n  const entry = record(value, 'component path');\n  exact(entry, ['component', 'path'], 'component path');\n  const componentId = id(entry.component),\n    file = relativeFile(entry.path);\n  const owner = components.find((item) => item.platform === target && item.id === componentId);\n  const fact = owner?.files.find((item) => item.path === file);\n  if (!fact || (executable && fact.mode !== 493)) invalid('launch file reference');\n  return { component: componentId, path: file };\n}\nexport function parseRuntimeManifest(value: unknown): RuntimeManifest {\n  const item = record(value, 'manifest');\n  exact(\n    item,\n    [\n      'schema',\n      'bootstrap_protocol',\n      'product',\n      'minimum_hosts',\n      'workspace',\n      'components',\n      'launches',\n    ],\n    'manifest',\n  );\n  if (\n    item.schema !== RUNTIME_MANIFEST_SCHEMA ||\n    item.bootstrap_protocol !== RUNTIME_BOOTSTRAP_PROTOCOL\n  )\n    invalid('manifest protocol version');\n  const product = record(item.product, 'product');\n  exact(product, ['id', 'version'], 'product');\n  const workspace = record(item.workspace, 'workspace');\n  exact(workspace, ['read', 'write'], 'workspace');\n  const read = compatibility(workspace.read),\n    write = compatibility(workspace.write);\n  for (const entry of write)\n    if (\n      !read.some(\n        (candidate) =>\n          candidate.schema === entry.schema &&\n          entry.features.every((feature) => candidate.features.includes(feature)),\n      )\n    )\n      invalid('write compatibility outside read support');\n  const components = array(item.components, 128, 1).map(component);\n  unique(\n    components.map((item) => `${item.platform}:${item.id}`),\n    'platform component',\n  );\n  const minimum = record(item.minimum_hosts, 'minimum hosts');\n  const minimum_hosts = Object.fromEntries(\n    Object.entries(minimum).map(([key, value]) => {\n      const target = platform(key),\n        host = record(value, 'minimum host');\n      exact(host, ['os_release', 'glibc'], 'minimum host');\n      if (\n        (target.startsWith('linux-') && typeof host.glibc !== 'string') ||\n        (!target.startsWith('linux-') && host.glibc !== null)\n      )\n        invalid('host ABI');\n      const glibc = host.glibc === null ? null : text(host.glibc, 'glibc version', 40);\n      if (glibc !== null && !/^[0-9]+\\.[0-9]+$/u.test(glibc)) invalid('glibc version');\n      return [target, { os_release: version(host.os_release), glibc }];\n    }),\n  );\n  const supported = [...new Set(components.map((item) => item.platform))].sort();\n  if (JSON.stringify(Object.keys(minimum_hosts).sort()) !== JSON.stringify(supported))\n    invalid('host/component platform coverage');\n  const launches: RuntimeLaunch[] = array(item.launches, 64, 1).map((value) => {\n    const launch = record(value, 'launch');\n    const hasContext = Object.hasOwn(launch, 'context_protocol');\n    exact(\n      launch,\n      [\n        'id',\n        'platform',\n        'executable',\n        'environment',\n        'argv',\n        ...(hasContext ? ['context_protocol'] : []),\n      ],\n      'launch',\n    );\n    if (hasContext && launch.context_protocol !== RUNTIME_HOST_CONTEXT_PROTOCOL)\n      invalid('host context protocol');\n    if (launch.environment !== 'isolated' && launch.environment !== 'cli-auth')\n      invalid('launch environment');\n    const target = platform(launch.platform);\n    const argv = array(launch.argv, 32).map((value) => {\n      const arg = record(value, 'launch argument');\n      if (Object.hasOwn(arg, 'literal')) {\n        exact(arg, ['literal'], 'literal argument');\n        return { literal: text(arg.literal, 'literal argument', 4096) };\n      }\n      return componentPath(arg, components, target);\n    });\n    return {\n      id: id(launch.id),\n      platform: target,\n      executable: componentPath(launch.executable, components, target, true),\n      environment: launch.environment,\n      ...(hasContext ? { context_protocol: RUNTIME_HOST_CONTEXT_PROTOCOL } : {}),\n      argv,\n    };\n  });\n  unique(\n    launches.map((item) => `${item.platform}:${item.id}`),\n    'platform launch',\n  );\n  for (const target of supported)\n    if (!launches.some((launch) => launch.platform === target)) invalid('platform launch coverage');\n  return deepFreeze({\n    schema: RUNTIME_MANIFEST_SCHEMA,\n    bootstrap_protocol: RUNTIME_BOOTSTRAP_PROTOCOL,\n    product: { id: id(product.id), version: version(product.version) },\n    minimum_hosts,\n    workspace: { read, write },\n    components,\n    launches,\n  });\n}\nexport function trustRuntimeManifest(\n  bytes: Uint8Array,\n  expectedSha256: string,\n): TrustedRuntimeManifest {\n  sha(expectedSha256);\n  if (bytes.byteLength > 32 * 1024 * 1024)\n    runtimeError(\n      'RUNTIME_MANIFEST_INTEGRITY',\n      'Runtime manifest bytes do not match the independent trust anchor.',\n    );\n  const snapshot = Buffer.from(bytes);\n  if (createHash('sha256').update(snapshot).digest('hex') !== expectedSha256)\n    runtimeError(\n      'RUNTIME_MANIFEST_INTEGRITY',\n      'Runtime manifest bytes do not match the independent trust anchor.',\n    );\n  let value: unknown;\n  try {\n    value = JSON.parse(snapshot.toString('utf8'));\n  } catch {\n    invalid('JSON');\n  }\n  const result = Object.freeze({ sha256: expectedSha256, manifest: parseRuntimeManifest(value) });\n  trusted.set(result, snapshot);\n  return result;\n}\nexport function loadTrustedRuntimeManifest(\n  file: string,\n  expectedSha256: string,\n): TrustedRuntimeManifest {\n  const stat = fs.lstatSync(file);\n  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 32 * 1024 * 1024)\n    runtimeError('RUNTIME_MANIFEST_FILE', 'Runtime manifest must be a bounded regular file.');\n  return trustRuntimeManifest(fs.readFileSync(file), expectedSha256);\n}\nexport function assertTrustedManifest(value: TrustedRuntimeManifest): void {\n  if (!value || !trusted.has(value))\n    runtimeError(\n      'RUNTIME_MANIFEST_UNTRUSTED',\n      'Supply a manifest verified against an independent trusted digest.',\n    );\n}\nexport function copyTrustedRuntimeManifestBytes(value: TrustedRuntimeManifest): Buffer {\n  const bytes = trusted.get(value);\n  if (!bytes)\n    runtimeError(\n      'RUNTIME_MANIFEST_UNTRUSTED',\n      'Supply a manifest verified against an independent trusted digest.',\n    );\n  return Buffer.from(bytes);\n}\nexport function componentKey(value: RuntimeComponent): string {\n  return contentHash(value);\n}\nexport function assertWorkspaceCompatibility(\n  value: TrustedRuntimeManifest,\n  request: WorkspaceCompatibility,\n  access: 'read' | 'write',\n): void {\n  assertTrustedManifest(value);\n  const support = value.manifest.workspace[access]?.find(\n    (entry) => entry.schema === request.schema,\n  );\n  if (!support || !request.features.every((feature) => support.features.includes(feature)))\n    runtimeError(\n      'RUNTIME_WORKSPACE_INCOMPATIBLE',\n      'The selected runtime does not support the requested workspace access/schema/features.',\n    );\n}\n"]}

package/dist/src/lib/runtime/process.d.ts

@@ -0,0 +1,4 @@
+import type { FoundryCommandSpecAsyncSpawnOptions, FoundryCommandSpecSpawnResult } from '../../command-spec.js';
+import type { RuntimeHostContext } from './manifest-types.js';
+/** Resolve only after close, including cancellation and output overflow, so callers retain component leases. */
+export declare function spawnRuntimeProcess(executable: string, argv: readonly string[], options: FoundryCommandSpecAsyncSpawnOptions, context?: RuntimeHostContext): Promise<FoundryCommandSpecSpawnResult>;

package/dist/src/lib/runtime/process.js

@@ -0,0 +1,69 @@
+import { spawn } from 'node:child_process';
+import { serveRuntimeHostContext } from './host-context-server.js';
+/** Resolve only after close, including cancellation and output overflow, so callers retain component leases. */
+export function spawnRuntimeProcess(executable, argv, options, context) {
+    return new Promise((resolve) => {
+        const child = spawn(executable, [...argv], {
+            cwd: options.cwd,
+            env: options.env,
+            shell: false,
+            windowsHide: true,
+            stdio: ['ignore', 'pipe', 'pipe', ...(context ? ['ipc'] : [])],
+        });
+        const stdout = [], stderr = [];
+        let bytes = 0;
+        let error;
+        let force;
+        let hostSession;
+        const stop = () => {
+            hostSession?.finish();
+            child.kill('SIGTERM');
+            force ??= setTimeout(() => child.kill('SIGKILL'), 3000);
+        };
+        const abort = () => {
+            error = new Error('Runtime execution was interrupted.');
+            stop();
+        };
+        if (context)
+            child.once('spawn', () => {
+                if (error)
+                    return;
+                hostSession = serveRuntimeHostContext(child, context, (failure) => {
+                    error ??= failure;
+                    stop();
+                });
+            });
+        options.signal.addEventListener('abort', abort, { once: true });
+        if (options.signal.aborted)
+            abort();
+        const capture = (target, chunk) => {
+            bytes += chunk.length;
+            if (bytes > (options.maxBuffer ?? 16 * 1024 * 1024)) {
+                error = new Error('Runtime output exceeded its bound.');
+                stop();
+                return;
+            }
+            target.push(chunk);
+        };
+        child.stdout.on('data', (chunk) => capture(stdout, chunk));
+        child.stderr.on('data', (chunk) => capture(stderr, chunk));
+        child.once('error', (value) => {
+            error = value;
+        });
+        child.once('close', (status, signal) => {
+            const contextError = hostSession?.finish();
+            error ??= contextError;
+            if (force)
+                clearTimeout(force);
+            options.signal.removeEventListener('abort', abort);
+            resolve({
+                stdout: Buffer.concat(stdout).toString('utf8'),
+                stderr: Buffer.concat(stderr).toString('utf8'),
+                status,
+                signal,
+                ...(error ? { error } : {}),
+            });
+        });
+    });
+}
+//# sourceMappingURL=process.js.map

package/dist/src/lib/runtime/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../../../src/lib/runtime/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,gHAAgH;AAChH,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,IAAuB,EACvB,OAA4C,EAC5C,OAA4B;IAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACzC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACxE,CAAC,CAAC;QACH,MAAM,MAAM,GAAa,EAAE,EACzB,MAAM,GAAa,EAAE,CAAC;QACxB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAwB,CAAC;QAC7B,IAAI,KAAiC,CAAC;QACtC,IAAI,WAAmE,CAAC;QACxE,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,WAAW,EAAE,MAAM,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,KAAK,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,KAAK,GAAG,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,IAAI,OAAO;YACT,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACvB,IAAI,KAAK;oBAAE,OAAO;gBAClB,WAAW,GAAG,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;oBAChE,KAAK,KAAK,OAAO,CAAC;oBAClB,IAAI,EAAE,CAAC;gBACT,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,KAAa,EAAE,EAAE;YAClD,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACpD,KAAK,GAAG,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACxD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,YAAY,GAAG,WAAW,EAAE,MAAM,EAAE,CAAC;YAC3C,KAAK,KAAK,YAAY,CAAC;YACvB,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC9C,MAAM;gBACN,MAAM;gBACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport type {\n  FoundryCommandSpecAsyncSpawnOptions,\n  FoundryCommandSpecSpawnResult,\n} from '../../command-spec.js';\nimport type { RuntimeHostContext } from './manifest-types.js';\nimport { serveRuntimeHostContext } from './host-context-server.js';\n\n/** Resolve only after close, including cancellation and output overflow, so callers retain component leases. */\nexport function spawnRuntimeProcess(\n  executable: string,\n  argv: readonly string[],\n  options: FoundryCommandSpecAsyncSpawnOptions,\n  context?: RuntimeHostContext,\n): Promise<FoundryCommandSpecSpawnResult> {\n  return new Promise((resolve) => {\n    const child = spawn(executable, [...argv], {\n      cwd: options.cwd,\n      env: options.env,\n      shell: false,\n      windowsHide: true,\n      stdio: ['ignore', 'pipe', 'pipe', ...(context ? ['ipc' as const] : [])],\n    });\n    const stdout: Buffer[] = [],\n      stderr: Buffer[] = [];\n    let bytes = 0;\n    let error: Error | undefined;\n    let force: NodeJS.Timeout | undefined;\n    let hostSession: ReturnType<typeof serveRuntimeHostContext> | undefined;\n    const stop = () => {\n      hostSession?.finish();\n      child.kill('SIGTERM');\n      force ??= setTimeout(() => child.kill('SIGKILL'), 3000);\n    };\n    const abort = () => {\n      error = new Error('Runtime execution was interrupted.');\n      stop();\n    };\n    if (context)\n      child.once('spawn', () => {\n        if (error) return;\n        hostSession = serveRuntimeHostContext(child, context, (failure) => {\n          error ??= failure;\n          stop();\n        });\n      });\n    options.signal.addEventListener('abort', abort, { once: true });\n    if (options.signal.aborted) abort();\n    const capture = (target: Buffer[], chunk: Buffer) => {\n      bytes += chunk.length;\n      if (bytes > (options.maxBuffer ?? 16 * 1024 * 1024)) {\n        error = new Error('Runtime output exceeded its bound.');\n        stop();\n        return;\n      }\n      target.push(chunk);\n    };\n    child.stdout!.on('data', (chunk: Buffer) => capture(stdout, chunk));\n    child.stderr!.on('data', (chunk: Buffer) => capture(stderr, chunk));\n    child.once('error', (value) => {\n      error = value;\n    });\n    child.once('close', (status, signal) => {\n      const contextError = hostSession?.finish();\n      error ??= contextError;\n      if (force) clearTimeout(force);\n      options.signal.removeEventListener('abort', abort);\n      resolve({\n        stdout: Buffer.concat(stdout).toString('utf8'),\n        stderr: Buffer.concat(stderr).toString('utf8'),\n        status,\n        signal,\n        ...(error ? { error } : {}),\n      });\n    });\n  });\n}\n"]}

package/dist/src/lib/runtime/storage.d.ts

@@ -0,0 +1,8 @@
+export declare function defaultRuntimeCache(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+export declare function canonicalCacheRoot(value: string): string;
+export declare function cachePath(root: string, relative: string): string;
+export declare function writeAll(fd: number, bytes: Uint8Array): void;
+export declare function writeOnce(root: string, relative: string, bytes: Uint8Array): void;
+export declare function openRuntimeCache(value: string, create: boolean): string;
+export declare function readCacheJson(root: string, relative: string, limit?: number): unknown;
+export declare function ensureRuntimeCache(value: string): Promise<string>;