@timurproko/a1 0.1.0 → 0.1.1-dev.10

package/dist/src/foundation/release/release-gc.js

@@ -14,4 +14,3 @@ export async function collectRelease(store, dataDir, releaseId, externalReferenc
     await store.removeUnreferencedRelease(releaseId, externalReferences);
     await rm(release.releaseRoot, { recursive: true, force: false });
 }
-//# sourceMappingURL=release-gc.js.map

package/dist/src/foundation/release/release-store.d.ts

@@ -1,11 +1,43 @@
-import { type AddOneReleaseIdentity } from "./release.js";
-export declare const RELEASE_MANIFEST = ".addone-release.json";
-export interface MaterializedRelease extends AddOneReleaseIdentity {
+import { type ReleaseIdentity } from "./release.js";
+export declare const RELEASE_MANIFEST_FILENAME: string;
+export interface MaterializedRelease extends ReleaseIdentity {
     readonly releaseRoot: string;
 }
-export declare function materializeRelease(packageRoot: string, dataDir: string): Promise<MaterializedRelease>;
+export type ReleaseContentOperation = "source-read" | "candidate-write" | "verification-read";
+export interface ReleaseContentOperationEvent {
+    readonly operation: ReleaseContentOperation;
+    readonly path: string;
+    readonly bytes: number;
+}
+export interface MaterializeReleaseOptions {
+    readonly onProgress?: (progress: {
+        readonly phase: "copying";
+        readonly fileCount: number;
+    }) => void;
+    readonly onOperation?: (event: ReleaseContentOperationEvent) => void;
+    /** Test seam for deterministic write-failure coverage. */
+    readonly writeCandidateFile?: (path: string, bytes: Uint8Array, mode: number) => Promise<void>;
+}
+export interface VerifyMaterializedReleaseOptions {
+    readonly onOperation?: (event: ReleaseContentOperationEvent) => void;
+}
+export interface CertifiedReleaseRecord {
+    readonly releaseId: string;
+    readonly releaseRoot: string;
+    readonly packageVersion?: string;
+    readonly contentDigest: string;
+}
+export declare function materializeRelease(packageRoot: string, dataDir: string, options?: MaterializeReleaseOptions): Promise<MaterializedRelease>;
+/** Consume proof that this exact object was freshly materialized or fully verified in this process. */
+export declare function consumeMaterializationProof(release: MaterializedRelease): boolean;
 export declare function readMaterializedRelease(releaseRoot: string): Promise<MaterializedRelease>;
-export declare function verifyMaterializedRelease(releaseRoot: string, expected?: AddOneReleaseIdentity, selectedStoreRoot?: string): Promise<MaterializedRelease>;
+/**
+ * Load metadata for a release whose bytes were already certified by the
+ * current parent process or an authenticated live supervisor. Callers must
+ * establish one of those preconditions; untrusted releases require full
+ * verification.
+ */
+export declare function readCertifiedReleaseManifest(record: CertifiedReleaseRecord, selectedStoreRoot: string): Promise<MaterializedRelease>;
+export declare function verifyMaterializedRelease(releaseRoot: string, expected?: ReleaseIdentity, selectedStoreRoot?: string, options?: VerifyMaterializedReleaseOptions): Promise<MaterializedRelease>;
 export declare function assertImmutableExecutionRoot(release: MaterializedRelease, dataDir: string): Promise<void>;
 export declare function resolveReleaseEntryPoint(release: MaterializedRelease, entryPoint: string): Promise<string>;
-//# sourceMappingURL=release-store.d.ts.map

package/dist/src/foundation/release/release-store.js

@@ -1,46 +1,105 @@
 import { createHash, randomUUID } from "node:crypto";
-import { chmod, copyFile, lstat, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
-import { ADDONE_PACKAGE_NAME, deriveReleaseIdentity, resolveWithin } from "./release.js";
-export const RELEASE_MANIFEST = ".addone-release.json";
-export async function materializeRelease(packageRoot, dataDir) {
-    const identity = await deriveReleaseIdentity(packageRoot);
+import { PRODUCT_PACKAGE_NAME, createReleaseIdentity, digestManifestFiles, discoverReleasePayload, releaseFileIdentity, resolveWithin, } from "./release.js";
+import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
+import { mapWithConcurrency } from "./concurrency.js";
+const RELEASE_FILE_IO_CONCURRENCY = 32;
+const certificationReady = new WeakSet();
+export const RELEASE_MANIFEST_FILENAME = PRODUCT_IDENTITY.manifest.releaseFilename;
+export async function materializeRelease(packageRoot, dataDir, options = {}) {
+    const payload = await discoverReleasePayload(packageRoot, {
+        onSourceRead: (path, bytes) => options.onOperation?.({ operation: "source-read", path, bytes }),
+    });
     const storeRoot = resolve(dataDir, "releases");
     await mkdir(storeRoot, { recursive: true, mode: 0o700 });
-    const releaseRoot = resolveWithin(storeRoot, identity.releaseId);
-    const existing = await lstat(releaseRoot).catch(() => null);
-    if (existing)
-        return await verifyMaterializedRelease(releaseRoot, identity);
-    const candidate = resolveWithin(storeRoot, `.candidate-${identity.releaseId}-${randomUUID()}`);
+    options.onProgress?.({ phase: "copying", fileCount: payload.paths.length });
+    const candidate = resolveWithin(storeRoot, `.candidate-${randomUUID()}`);
     await mkdir(candidate, { recursive: false, mode: 0o700 });
     try {
-        for (const file of identity.files) {
-            const source = resolveWithin(identity.packageRoot, file.path);
-            const destination = resolveWithin(candidate, file.path);
-            await mkdir(dirname(destination), { recursive: true, mode: 0o700 });
-            await copyFile(source, destination);
-            await chmod(destination, file.executable ? 0o500 : 0o400);
+        const directories = [...new Set(payload.paths.map(path => dirname(resolveWithin(candidate, path))))];
+        await mapWithConcurrency(directories, RELEASE_FILE_IO_CONCURRENCY, async (directory) => {
+            await mkdir(directory, { recursive: true, mode: 0o700 });
+        });
+        const files = await mapWithConcurrency(payload.paths, RELEASE_FILE_IO_CONCURRENCY, async (path) => {
+            const source = resolveWithin(payload.packageRoot, path);
+            const destination = resolveWithin(candidate, path);
+            const metadata = await lstat(source);
+            if (!metadata.isFile() || metadata.isSymbolicLink())
+                throw new Error(`release payload is not a regular file: ${path}`);
+            const cached = payload.cachedFiles.get(path);
+            const bytes = cached ?? await readFile(source);
+            if (!cached)
+                options.onOperation?.({ operation: "source-read", path, bytes: bytes.length });
+            const mode = (metadata.mode & 0o111) !== 0 ? 0o500 : 0o400;
+            if (options.writeCandidateFile)
+                await options.writeCandidateFile(destination, bytes, mode);
+            else {
+                await writeFile(destination, bytes, { flag: "wx", mode });
+                await chmod(destination, mode);
+            }
+            options.onOperation?.({ operation: "candidate-write", path, bytes: bytes.length });
+            return releaseFileIdentity(path, bytes, (metadata.mode & 0o111) !== 0);
+        });
+        const identity = createReleaseIdentity(payload.packageRoot, payload.packageVersion, files);
+        const releaseRoot = resolveWithin(storeRoot, identity.releaseId);
+        if (await lstat(releaseRoot).catch(() => null)) {
+            await rm(candidate, { recursive: true, force: true });
+            return certificationReadyRelease(await verifyMaterializedRelease(releaseRoot, identity));
         }
-        await writeFile(resolve(candidate, RELEASE_MANIFEST), JSON.stringify(identity, null, 2), { mode: 0o400, flag: "wx" });
-        await verifyMaterializedRelease(candidate, identity);
-        await rename(candidate, releaseRoot);
-        return await verifyMaterializedRelease(releaseRoot, identity);
+        await writeFile(resolve(candidate, RELEASE_MANIFEST_FILENAME), JSON.stringify(identity, null, 2), { mode: 0o400, flag: "wx" });
+        try {
+            await rename(candidate, releaseRoot);
+        }
+        catch (error) {
+            if (!await lstat(releaseRoot).catch(() => null))
+                throw error;
+            await rm(candidate, { recursive: true, force: true });
+            return certificationReadyRelease(await verifyMaterializedRelease(releaseRoot, identity));
+        }
+        return certificationReadyRelease({ ...identity, releaseRoot: await realpath(releaseRoot) });
     }
     catch (error) {
         await rm(candidate, { recursive: true, force: true });
         throw error;
     }
 }
+/** Consume proof that this exact object was freshly materialized or fully verified in this process. */
+export function consumeMaterializationProof(release) {
+    if (!certificationReady.has(release))
+        return false;
+    certificationReady.delete(release);
+    return true;
+}
 export async function readMaterializedRelease(releaseRoot) {
     const canonical = await realpath(releaseRoot);
-    const manifest = JSON.parse(await readFile(resolve(canonical, RELEASE_MANIFEST), "utf8"));
+    const manifest = JSON.parse(await readFile(resolve(canonical, RELEASE_MANIFEST_FILENAME), "utf8"));
     return await verifyMaterializedRelease(canonical, manifest);
 }
-export async function verifyMaterializedRelease(releaseRoot, expected, selectedStoreRoot) {
+/**
+ * Load metadata for a release whose bytes were already certified by the
+ * current parent process or an authenticated live supervisor. Callers must
+ * establish one of those preconditions; untrusted releases require full
+ * verification.
+ */
+export async function readCertifiedReleaseManifest(record, selectedStoreRoot) {
+    const canonical = await realpath(record.releaseRoot);
+    assertContained(await realpath(selectedStoreRoot), canonical, "release root is outside the selected release store");
+    const manifest = JSON.parse(await readFile(resolveWithin(canonical, RELEASE_MANIFEST_FILENAME), "utf8"));
+    validateManifest(manifest);
+    if (manifest.releaseId !== record.releaseId || manifest.contentDigest !== record.contentDigest
+        || (record.packageVersion !== undefined && manifest.packageVersion !== record.packageVersion)) {
+        throw new Error(`certified release record differs from manifest for ${canonical}`);
+    }
+    if (canonical.split(sep).at(-1) !== manifest.releaseId)
+        throw new Error(`release directory does not match identity ${manifest.releaseId}`);
+    return { ...manifest, releaseRoot: canonical };
+}
+export async function verifyMaterializedRelease(releaseRoot, expected, selectedStoreRoot, options = {}) {
     const canonical = await realpath(releaseRoot);
     if (selectedStoreRoot)
         assertContained(await realpath(selectedStoreRoot), canonical, "release root is outside the selected release store");
-    const manifestPath = resolveWithin(canonical, RELEASE_MANIFEST);
+    const manifestPath = resolveWithin(canonical, RELEASE_MANIFEST_FILENAME);
     const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
     validateManifest(manifest);
     if (expected && (manifest.releaseId !== expected.releaseId || manifest.contentDigest !== expected.contentDigest)) {
@@ -49,20 +108,23 @@ export async function verifyMaterializedRelease(releaseRoot, expected, selectedS
     if (canonical.split(sep).at(-1) !== manifest.releaseId && !canonical.split(sep).at(-1)?.startsWith(`.candidate-${manifest.releaseId}-`)) {
         throw new Error(`release directory does not match identity ${manifest.releaseId}`);
     }
-    for (const file of manifest.files)
-        await verifyFile(canonical, file);
+    await mapWithConcurrency(manifest.files, RELEASE_FILE_IO_CONCURRENCY, async (file) => {
+        await verifyFile(canonical, file, options);
+    });
     const recomputed = digestManifestFiles(manifest.files);
     if (recomputed !== manifest.contentDigest)
         throw new Error(`release content digest mismatch for ${manifest.releaseId}`);
     return { ...manifest, releaseRoot: canonical };
 }
 export async function assertImmutableExecutionRoot(release, dataDir) {
-    await verifyMaterializedRelease(release.releaseRoot, release, resolve(dataDir, "releases"));
-    if (!process.env.ADDONE_RELEASE_ROOT)
-        throw new Error("persistent AddOne process has no immutable release root");
-    const selected = await realpath(process.env.ADDONE_RELEASE_ROOT);
+    const storeRoot = await realpath(resolve(dataDir, "releases"));
+    assertContained(storeRoot, release.releaseRoot, "release root is outside the selected release store");
+    const selectedRoot = process.env[PRODUCT_IDENTITY.environment.releaseRoot];
+    if (!selectedRoot)
+        throw new Error(PRODUCT_TEXT.diagnostic("persistent process has no immutable release root"));
+    const selected = await realpath(selectedRoot);
     if (selected !== release.releaseRoot)
-        throw new Error("persistent AddOne process selected a different immutable release root");
+        throw new Error(PRODUCT_TEXT.diagnostic("persistent process selected a different immutable release root"));
 }
 export async function resolveReleaseEntryPoint(release, entryPoint) {
     const normalized = entryPoint.split("\\").join("/").replace(/^\.\//, "");
@@ -73,22 +135,28 @@ export async function resolveReleaseEntryPoint(release, entryPoint) {
     assertContained(release.releaseRoot, canonical, "entry point resolves outside the selected release root");
     return canonical;
 }
-async function verifyFile(root, file) {
+async function verifyFile(root, file, options) {
     const path = resolveWithin(root, file.path);
     const metadata = await lstat(path).catch(() => null);
     if (!metadata?.isFile() || metadata.isSymbolicLink())
         throw new Error(`release candidate is incomplete: ${file.path}`);
     if (metadata.size !== file.bytes)
         throw new Error(`release file size mismatch: ${file.path}`);
-    const digest = createHash("sha256").update(await readFile(path)).digest("hex");
+    const bytes = await readFile(path);
+    options.onOperation?.({ operation: "verification-read", path: file.path, bytes: bytes.length });
+    const digest = createHash("sha256").update(bytes).digest("hex");
     if (digest !== file.sha256)
         throw new Error(`release file digest mismatch: ${file.path}`);
 }
+function certificationReadyRelease(release) {
+    certificationReady.add(release);
+    return release;
+}
 function validateManifest(value) {
-    if (value.packageName !== ADDONE_PACKAGE_NAME || typeof value.packageVersion !== "string")
-        throw new Error("invalid AddOne release manifest metadata");
+    if (value.packageName !== PRODUCT_PACKAGE_NAME || typeof value.packageVersion !== "string")
+        throw new Error(PRODUCT_TEXT.diagnostic("release manifest metadata is invalid"));
     if (!/^[a-f0-9]{64}$/.test(value.contentDigest) || !/^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/.test(value.releaseId))
-        throw new Error("invalid AddOne release identity");
+        throw new Error(PRODUCT_TEXT.diagnostic("release identity is invalid"));
     if (!Array.isArray(value.files) || value.files.length === 0)
         throw new Error("release manifest contains no files");
     for (const file of value.files) {
@@ -99,17 +167,9 @@ function validateManifest(value) {
             throw new Error(`invalid release manifest file identity: ${file.path}`);
     }
 }
-function digestManifestFiles(files) {
-    const digest = createHash("sha256");
-    for (const file of [...files].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0)) {
-        digest.update(`${file.path}\0${file.bytes}\0${file.sha256}\0${file.executable ? 1 : 0}\n`);
-    }
-    return digest.digest("hex");
-}
 function assertContained(parent, child, message) {
     const fromParent = relative(parent, child);
     if (fromParent === "" || (!fromParent.startsWith(`..${sep}`) && fromParent !== ".." && !isAbsolute(fromParent)))
         return;
     throw new Error(`${message}: ${child}`);
 }
-//# sourceMappingURL=release-store.js.map

package/dist/src/foundation/release/release.d.ts

@@ -1,24 +1,38 @@
-export declare const ADDONE_PACKAGE_NAME = "@timurproko/a1";
+export declare const PRODUCT_PACKAGE_NAME: string;
 export interface ReleaseFileIdentity {
     readonly path: string;
     readonly bytes: number;
     readonly sha256: string;
     readonly executable: boolean;
 }
-export interface AddOneReleaseIdentity {
-    readonly packageName: typeof ADDONE_PACKAGE_NAME;
+export interface ReleaseIdentity {
+    readonly packageName: typeof PRODUCT_PACKAGE_NAME;
     readonly packageVersion: string;
     readonly contentDigest: string;
     readonly releaseId: string;
     readonly packageRoot: string;
     readonly files: readonly ReleaseFileIdentity[];
 }
+export interface DiscoveredReleasePayload {
+    readonly packageRoot: string;
+    readonly packageVersion: string;
+    readonly paths: readonly string[];
+    /** Package manifests already read to discover the dependency closure. */
+    readonly cachedFiles: ReadonlyMap<string, Buffer>;
+}
+export interface DiscoverReleasePayloadOptions {
+    readonly onSourceRead?: (path: string, bytes: number) => void;
+}
+/** Discover the complete payload without reading ordinary file contents. */
+export declare function discoverReleasePayload(packageRoot: string, options?: DiscoverReleasePayloadOptions): Promise<DiscoveredReleasePayload>;
 /**
- * Derive AddOne execution identity only from installed distribution metadata and
+ * Derive release execution identity only from installed distribution metadata and
  * bytes. The version remains display metadata; the digest selects executable
  * content.
  */
-export declare function deriveReleaseIdentity(packageRoot: string): Promise<AddOneReleaseIdentity>;
+export declare function deriveReleaseIdentity(packageRoot: string): Promise<ReleaseIdentity>;
+export declare function createReleaseIdentity(packageRoot: string, packageVersion: string, files: readonly ReleaseFileIdentity[]): ReleaseIdentity;
+export declare function releaseFileIdentity(path: string, bytes: Uint8Array, executable: boolean): ReleaseFileIdentity;
+export declare function digestManifestFiles(files: readonly ReleaseFileIdentity[]): string;
 export declare function resolveWithin(root: string, candidate: string): string;
 export declare function packageRootFromModule(moduleUrl: string): string;
-//# sourceMappingURL=release.d.ts.map

package/dist/src/foundation/release/release.js

@@ -1,54 +1,82 @@
 import { createHash } from "node:crypto";
 import { lstat, readFile, readdir, realpath } from "node:fs/promises";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
-export const ADDONE_PACKAGE_NAME = "@timurproko/a1";
+import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
+import { mapWithConcurrency } from "./concurrency.js";
+const RELEASE_FILE_IO_CONCURRENCY = 32;
+export const PRODUCT_PACKAGE_NAME = PRODUCT_IDENTITY.packageName;
+/** Discover the complete payload without reading ordinary file contents. */
+export async function discoverReleasePayload(packageRoot, options = {}) {
+    const canonicalRoot = await realpath(packageRoot);
+    const cachedFiles = new Map();
+    const readManifest = async (manifestRoot) => {
+        const manifestPath = resolve(manifestRoot, "package.json");
+        const bytes = await readFile(manifestPath);
+        const path = normalizeRelative(relative(canonicalRoot, manifestPath));
+        cachedFiles.set(path, bytes);
+        options.onSourceRead?.(path, bytes.length);
+        return JSON.parse(bytes.toString("utf8"));
+    };
+    const manifest = await readManifest(canonicalRoot);
+    if (manifest.name !== PRODUCT_PACKAGE_NAME)
+        throw new Error(`unexpected ${PRODUCT_TEXT.displayName} package name: ${String(manifest.name)}`);
+    if (typeof manifest.version !== "string" || manifest.version.length === 0)
+        throw new Error(PRODUCT_TEXT.diagnostic("package metadata has no version"));
+    const roots = distributionRoots(manifest);
+    const paths = new Set(["package.json"]);
+    for (const root of roots)
+        await collectFiles(canonicalRoot, resolveWithin(canonicalRoot, root), paths);
+    await collectDependencyClosure(canonicalRoot, canonicalRoot, manifest, paths, new Set(), readManifest);
+    return {
+        packageRoot: canonicalRoot,
+        packageVersion: manifest.version,
+        paths: [...paths].sort(),
+        cachedFiles,
+    };
+}
 /**
- * Derive AddOne execution identity only from installed distribution metadata and
+ * Derive release execution identity only from installed distribution metadata and
  * bytes. The version remains display metadata; the digest selects executable
  * content.
  */
 export async function deriveReleaseIdentity(packageRoot) {
-    const canonicalRoot = await realpath(packageRoot);
-    const manifestPath = resolve(canonicalRoot, "package.json");
-    const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
-    if (manifest.name !== ADDONE_PACKAGE_NAME)
-        throw new Error(`unexpected AddOne package name: ${String(manifest.name)}`);
-    if (typeof manifest.version !== "string" || manifest.version.length === 0)
-        throw new Error("AddOne package metadata has no version");
-    const roots = distributionRoots(manifest);
-    const paths = new Set(["package.json"]);
-    for (const root of roots) {
-        const absolute = resolveWithin(canonicalRoot, root);
-        await collectFiles(canonicalRoot, absolute, paths);
-    }
-    await collectDependencyClosure(canonicalRoot, canonicalRoot, manifest, paths, new Set());
-    const files = [];
-    for (const path of [...paths].sort()) {
-        const absolute = resolveWithin(canonicalRoot, path);
+    const payload = await discoverReleasePayload(packageRoot);
+    const files = await mapWithConcurrency(payload.paths, RELEASE_FILE_IO_CONCURRENCY, async (path) => {
+        const absolute = resolveWithin(payload.packageRoot, path);
         const metadata = await lstat(absolute);
-        if (!metadata.isFile())
+        if (!metadata.isFile() || metadata.isSymbolicLink())
             throw new Error(`release payload is not a regular file: ${path}`);
-        const bytes = await readFile(absolute);
-        files.push({
-            path: normalizeRelative(path),
-            bytes: bytes.length,
-            sha256: createHash("sha256").update(bytes).digest("hex"),
-            executable: (metadata.mode & 0o111) !== 0,
-        });
-    }
-    const digest = createHash("sha256");
-    for (const file of files)
-        digest.update(`${file.path}\0${file.bytes}\0${file.sha256}\0${file.executable ? 1 : 0}\n`);
-    const contentDigest = digest.digest("hex");
+        const bytes = payload.cachedFiles.get(path) ?? await readFile(absolute);
+        return releaseFileIdentity(path, bytes, (metadata.mode & 0o111) !== 0);
+    });
+    return createReleaseIdentity(payload.packageRoot, payload.packageVersion, files);
+}
+export function createReleaseIdentity(packageRoot, packageVersion, files) {
+    const contentDigest = digestManifestFiles(files);
     return {
-        packageName: ADDONE_PACKAGE_NAME,
-        packageVersion: manifest.version,
+        packageName: PRODUCT_PACKAGE_NAME,
+        packageVersion,
         contentDigest,
-        releaseId: `${manifest.version}-${contentDigest.slice(0, 20)}`,
-        packageRoot: canonicalRoot,
-        files,
+        releaseId: `${packageVersion}-${contentDigest.slice(0, 20)}`,
+        packageRoot,
+        files: [...files].sort(compareReleaseFiles),
     };
 }
+export function releaseFileIdentity(path, bytes, executable) {
+    return {
+        path: normalizeRelative(path),
+        bytes: bytes.length,
+        sha256: createHash("sha256").update(bytes).digest("hex"),
+        executable,
+    };
+}
+export function digestManifestFiles(files) {
+    const digest = createHash("sha256");
+    for (const file of [...files].sort(compareReleaseFiles)) {
+        digest.update(`${file.path}\0${file.bytes}\0${file.sha256}\0${file.executable ? 1 : 0}\n`);
+    }
+    return digest.digest("hex");
+}
 export function resolveWithin(root, candidate) {
     if (candidate.includes("\0"))
         throw new Error("release path contains a null byte");
@@ -60,15 +88,15 @@ export function resolveWithin(root, candidate) {
 }
 function distributionRoots(manifest) {
     if (!Array.isArray(manifest.files))
-        throw new Error("AddOne package metadata has no distribution files list");
+        throw new Error(PRODUCT_TEXT.diagnostic("package metadata has no distribution files list"));
     const roots = manifest.files.map(value => {
         if (typeof value !== "string" || value.length === 0)
-            throw new Error("AddOne distribution file entry is invalid");
+            throw new Error(PRODUCT_TEXT.diagnostic("distribution file entry is invalid"));
         const normalized = normalizeRelative(value);
         if (normalized === "package.json")
             return normalized;
         if (isAbsolute(value) || normalized === ".." || normalized.startsWith("../"))
-            throw new Error(`AddOne distribution path escapes package root: ${value}`);
+            throw new Error(PRODUCT_TEXT.diagnostic(`distribution path escapes package root: ${value}`));
         return normalized;
     });
     return [...new Set(roots)];
@@ -90,7 +118,7 @@ async function collectFiles(root, path, output, skipNodeModules = false) {
         await collectFiles(root, resolve(path, entry), output, skipNodeModules);
     }
 }
-async function collectDependencyClosure(root, requesterRoot, manifest, output, visited) {
+async function collectDependencyClosure(root, requesterRoot, manifest, output, visited, readManifest) {
     const required = dependencyNames(manifest.dependencies);
     const optional = new Set(dependencyNames(manifest.optionalDependencies));
     for (const name of [...new Set([...required, ...optional])].sort()) {
@@ -98,14 +126,13 @@ async function collectDependencyClosure(root, requesterRoot, manifest, output, v
         if (!packagePath) {
             if (optional.has(name))
                 continue;
-            throw new Error(`installed AddOne dependency is missing: ${name}`);
+            throw new Error(`installed ${PRODUCT_TEXT.displayName} dependency is missing: ${name}`);
         }
         if (visited.has(packagePath))
             continue;
         visited.add(packagePath);
         await collectFiles(root, packagePath, output, true);
-        const dependencyManifest = JSON.parse(await readFile(resolve(packagePath, "package.json"), "utf8"));
-        await collectDependencyClosure(root, packagePath, dependencyManifest, output, visited);
+        await collectDependencyClosure(root, packagePath, await readManifest(packagePath), output, visited, readManifest);
     }
 }
 async function findInstalledDependency(root, requesterRoot, name) {
@@ -130,22 +157,24 @@ function dependencyNames(value) {
     if (value === undefined)
         return [];
     if (typeof value !== "object" || value === null || Array.isArray(value))
-        throw new Error("AddOne dependency metadata is invalid");
+        throw new Error(PRODUCT_TEXT.diagnostic("dependency metadata is invalid"));
     return Object.keys(value);
 }
+function compareReleaseFiles(left, right) {
+    return left.path < right.path ? -1 : left.path > right.path ? 1 : 0;
+}
 function normalizeRelative(path) {
     return path.split(sep).join("/").replace(/^\.\//, "");
 }
 export function packageRootFromModule(moduleUrl) {
     const url = new URL(moduleUrl);
     if (url.protocol !== "file:")
-        throw new Error(`AddOne module URL must be a file URL: ${moduleUrl}`);
+        throw new Error(PRODUCT_TEXT.diagnostic(`module URL must be a file URL: ${moduleUrl}`));
     let directory = dirname(url.pathname.replace(/^\/(.:)/, "$1"));
     while (basename(directory) !== "") {
         if (basename(directory) === "dist")
             return dirname(directory);
         directory = dirname(directory);
     }
-    throw new Error("could not derive AddOne package root from module URL");
+    throw new Error(PRODUCT_TEXT.diagnostic("package root could not be derived from module URL"));
 }
-//# sourceMappingURL=release.js.map

package/dist/src/foundation/release/stable-release.d.ts

@@ -1,3 +1,4 @@
+export declare const STABLE_RELEASE_SCHEMA: string;
 export interface StableReleaseEvidenceInput {
     readonly packageName: string;
     readonly version: string;
@@ -9,7 +10,7 @@ export interface StableReleaseEvidenceInput {
     readonly recordedAt: string;
 }
 export interface StableReleaseEvidence extends StableReleaseEvidenceInput {
-    readonly schema: "addone-stable-release-v1";
+    readonly schema: typeof STABLE_RELEASE_SCHEMA;
     readonly channel: "latest";
 }
 export interface StableRegistryState {
@@ -27,4 +28,3 @@ export interface StableRegistryVerificationOptions {
 }
 export declare function createStableReleaseEvidence(input: StableReleaseEvidenceInput): StableReleaseEvidence;
 export declare function verifyStableRegistry(expected: StableReleaseEvidence, observe: () => Promise<StableRegistryState>, options?: StableRegistryVerificationOptions): Promise<void>;
-//# sourceMappingURL=stable-release.d.ts.map

package/dist/src/foundation/release/stable-release.js

@@ -1,7 +1,9 @@
 import { prerelease, valid } from "semver";
-import { ADDONE_PACKAGE_NAME } from "./release.js";
+import { PRODUCT_PACKAGE_NAME } from "./release.js";
+import { PRODUCT_IDENTITY } from "../../product-identity.js";
+export const STABLE_RELEASE_SCHEMA = PRODUCT_IDENTITY.evidence.stableReleaseSchema;
 export function createStableReleaseEvidence(input) {
-    if (input.packageName !== ADDONE_PACKAGE_NAME)
+    if (input.packageName !== PRODUCT_PACKAGE_NAME)
         throw new Error(`unexpected stable package: ${input.packageName}`);
     if (valid(input.version) === null || prerelease(input.version) !== null)
         throw new Error(`stable release requires an exact stable version: ${input.version}`);
@@ -11,7 +13,7 @@ export function createStableReleaseEvidence(input) {
         throw new Error("stable release integrity is malformed");
     if (!/^[a-f0-9]{40}$/.test(input.shasum))
         throw new Error("stable release shasum is malformed");
-    return { schema: "addone-stable-release-v1", channel: "latest", ...input };
+    return { schema: STABLE_RELEASE_SCHEMA, channel: "latest", ...input };
 }
 export async function verifyStableRegistry(expected, observe, options = {}) {
     const attempts = options.attempts ?? 12;
@@ -28,11 +30,10 @@ export async function verifyStableRegistry(expected, observe, options = {}) {
             && state.integrity === expected.integrity
             && state.shasum === expected.shasum
             && state.bins.length === 1
-            && state.bins[0] === "a1")
+            && state.bins[0] === PRODUCT_IDENTITY.commandName)
             return;
         if (attempt < attempts)
             await delay(delayMs);
     }
     throw new Error(`npm latest did not match accepted ${expected.packageName}@${expected.version} after ${attempts} attempts: ${JSON.stringify(state)}`);
 }
-//# sourceMappingURL=stable-release.js.map

package/dist/src/foundation/release/update-transaction.d.ts

@@ -1,7 +1,8 @@
+export declare const UPDATE_JOURNAL_SCHEMA: string;
 import type { UpdateChannel } from "./update.js";
 export type UpdateTransactionPhase = "shutdown-intent" | "ownership-released" | "package-installed" | "materialized" | "certified" | "active-reference-committed" | "supervisor-verified";
 export interface UpdateTransaction {
-    readonly schemaVersion: 1;
+    readonly schema: typeof UPDATE_JOURNAL_SCHEMA;
     readonly transactionId: string;
     readonly channel: UpdateChannel;
     readonly targetVersion: string;
@@ -28,4 +29,3 @@ export declare class UpdateTransactionStore {
     finish(status: "completed" | "rolled-back" | "failed", error?: string | null): Promise<UpdateTransaction>;
     clearCompleted(): Promise<void>;
 }
-//# sourceMappingURL=update-transaction.d.ts.map

package/dist/src/foundation/release/update-transaction.js

@@ -1,6 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
+import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
+export const UPDATE_JOURNAL_SCHEMA = PRODUCT_IDENTITY.protocol.updateJournalSchema;
 export class UpdateTransactionStore {
     path;
     constructor(dataDir) { this.path = resolve(dataDir, "update-transaction.json"); }
@@ -20,13 +22,13 @@ export class UpdateTransactionStore {
         const current = await this.read();
         if (current?.status === "active") {
             if (current.targetVersion !== input.targetVersion || current.channel !== input.channel) {
-                throw new Error(`unfinished AddOne update ${current.transactionId} targets ${current.targetVersion}; reconcile it before starting ${input.targetVersion}`);
+                throw new Error(PRODUCT_TEXT.diagnostic(`has unfinished update ${current.transactionId} targeting ${current.targetVersion}; reconcile it before starting ${input.targetVersion}`));
             }
             return current;
         }
         const now = new Date().toISOString();
         return await this.#write({
-            schemaVersion: 1,
+            schema: UPDATE_JOURNAL_SCHEMA,
             transactionId: randomUUID(),
             ...input,
             phase: "shutdown-intent",
@@ -45,7 +47,7 @@ export class UpdateTransactionStore {
     async finish(status, error = null) {
         const current = await this.read();
         if (!current)
-            throw new Error("no AddOne update transaction is recorded");
+            throw new Error(`no ${PRODUCT_TEXT.displayName} update transaction is recorded`);
         return await this.#write({ ...current, status, error, updatedAt: new Date().toISOString() });
     }
     async clearCompleted() {
@@ -56,7 +58,7 @@ export class UpdateTransactionStore {
     async #requiredActive() {
         const current = await this.read();
         if (!current || current.status !== "active")
-            throw new Error("no active AddOne update transaction is recorded");
+            throw new Error(`no active ${PRODUCT_TEXT.displayName} update transaction is recorded`);
         return current;
     }
     async #write(value) {
@@ -79,10 +81,9 @@ function phaseOrder(phase) {
     return ["shutdown-intent", "ownership-released", "package-installed", "materialized", "certified", "active-reference-committed", "supervisor-verified"].indexOf(phase);
 }
 function validate(value) {
-    if (value.schemaVersion !== 1 || typeof value.transactionId !== "string" || !["stable", "next"].includes(value.channel)
+    if (value.schema !== UPDATE_JOURNAL_SCHEMA || typeof value.transactionId !== "string" || !["stable", "next"].includes(value.channel)
         || typeof value.targetVersion !== "string" || typeof value.packageRoot !== "string" || typeof value.startedAt !== "string"
         || typeof value.updatedAt !== "string" || phaseOrder(value.phase) < 0 || !["active", "completed", "rolled-back", "failed"].includes(value.status)) {
-        throw new Error("invalid AddOne update transaction journal");
+        throw new Error(`invalid ${PRODUCT_TEXT.displayName} update transaction journal`);
     }
 }
-//# sourceMappingURL=update-transaction.js.map