@timurproko/a1 0.1.0

package/dist/src/foundation/release/release-store.d.ts

@@ -0,0 +1,11 @@
+import { type AddOneReleaseIdentity } from "./release.js";
+export declare const RELEASE_MANIFEST = ".addone-release.json";
+export interface MaterializedRelease extends AddOneReleaseIdentity {
+    readonly releaseRoot: string;
+}
+export declare function materializeRelease(packageRoot: string, dataDir: string): Promise<MaterializedRelease>;
+export declare function readMaterializedRelease(releaseRoot: string): Promise<MaterializedRelease>;
+export declare function verifyMaterializedRelease(releaseRoot: string, expected?: AddOneReleaseIdentity, selectedStoreRoot?: string): Promise<MaterializedRelease>;
+export declare function assertImmutableExecutionRoot(release: MaterializedRelease, dataDir: string): Promise<void>;
+export declare function resolveReleaseEntryPoint(release: MaterializedRelease, entryPoint: string): Promise<string>;
+//# sourceMappingURL=release-store.d.ts.map

package/dist/src/foundation/release/release-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-store.d.ts","sourceRoot":"","sources":["../../../../src/foundation/release/release-store.ts"],"names":[],"mappings":"AAGA,OAAO,EAA6D,KAAK,qBAAqB,EAA4B,MAAM,cAAc,CAAC;AAE/I,eAAO,MAAM,gBAAgB,yBAAyB,CAAC;AAEvD,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA0B3G;AAED,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAI/F;AAED,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,qBAAqB,EAChC,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAgB9B;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/G;AAED,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOhH"}

package/dist/src/foundation/release/release-store.js

@@ -0,0 +1,115 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, copyFile, lstat, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { ADDONE_PACKAGE_NAME, deriveReleaseIdentity, resolveWithin } from "./release.js";
+export const RELEASE_MANIFEST = ".addone-release.json";
+export async function materializeRelease(packageRoot, dataDir) {
+    const identity = await deriveReleaseIdentity(packageRoot);
+    const storeRoot = resolve(dataDir, "releases");
+    await mkdir(storeRoot, { recursive: true, mode: 0o700 });
+    const releaseRoot = resolveWithin(storeRoot, identity.releaseId);
+    const existing = await lstat(releaseRoot).catch(() => null);
+    if (existing)
+        return await verifyMaterializedRelease(releaseRoot, identity);
+    const candidate = resolveWithin(storeRoot, `.candidate-${identity.releaseId}-${randomUUID()}`);
+    await mkdir(candidate, { recursive: false, mode: 0o700 });
+    try {
+        for (const file of identity.files) {
+            const source = resolveWithin(identity.packageRoot, file.path);
+            const destination = resolveWithin(candidate, file.path);
+            await mkdir(dirname(destination), { recursive: true, mode: 0o700 });
+            await copyFile(source, destination);
+            await chmod(destination, file.executable ? 0o500 : 0o400);
+        }
+        await writeFile(resolve(candidate, RELEASE_MANIFEST), JSON.stringify(identity, null, 2), { mode: 0o400, flag: "wx" });
+        await verifyMaterializedRelease(candidate, identity);
+        await rename(candidate, releaseRoot);
+        return await verifyMaterializedRelease(releaseRoot, identity);
+    }
+    catch (error) {
+        await rm(candidate, { recursive: true, force: true });
+        throw error;
+    }
+}
+export async function readMaterializedRelease(releaseRoot) {
+    const canonical = await realpath(releaseRoot);
+    const manifest = JSON.parse(await readFile(resolve(canonical, RELEASE_MANIFEST), "utf8"));
+    return await verifyMaterializedRelease(canonical, manifest);
+}
+export async function verifyMaterializedRelease(releaseRoot, expected, selectedStoreRoot) {
+    const canonical = await realpath(releaseRoot);
+    if (selectedStoreRoot)
+        assertContained(await realpath(selectedStoreRoot), canonical, "release root is outside the selected release store");
+    const manifestPath = resolveWithin(canonical, RELEASE_MANIFEST);
+    const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+    validateManifest(manifest);
+    if (expected && (manifest.releaseId !== expected.releaseId || manifest.contentDigest !== expected.contentDigest)) {
+        throw new Error(`release identity mismatch for ${canonical}`);
+    }
+    if (canonical.split(sep).at(-1) !== manifest.releaseId && !canonical.split(sep).at(-1)?.startsWith(`.candidate-${manifest.releaseId}-`)) {
+        throw new Error(`release directory does not match identity ${manifest.releaseId}`);
+    }
+    for (const file of manifest.files)
+        await verifyFile(canonical, file);
+    const recomputed = digestManifestFiles(manifest.files);
+    if (recomputed !== manifest.contentDigest)
+        throw new Error(`release content digest mismatch for ${manifest.releaseId}`);
+    return { ...manifest, releaseRoot: canonical };
+}
+export async function assertImmutableExecutionRoot(release, dataDir) {
+    await verifyMaterializedRelease(release.releaseRoot, release, resolve(dataDir, "releases"));
+    if (!process.env.ADDONE_RELEASE_ROOT)
+        throw new Error("persistent AddOne process has no immutable release root");
+    const selected = await realpath(process.env.ADDONE_RELEASE_ROOT);
+    if (selected !== release.releaseRoot)
+        throw new Error("persistent AddOne process selected a different immutable release root");
+}
+export async function resolveReleaseEntryPoint(release, entryPoint) {
+    const normalized = entryPoint.split("\\").join("/").replace(/^\.\//, "");
+    if (!release.files.some(file => file.path === normalized))
+        throw new Error(`entry point is not in the verified release manifest: ${entryPoint}`);
+    const path = resolveWithin(release.releaseRoot, normalized);
+    const canonical = await realpath(path);
+    assertContained(release.releaseRoot, canonical, "entry point resolves outside the selected release root");
+    return canonical;
+}
+async function verifyFile(root, file) {
+    const path = resolveWithin(root, file.path);
+    const metadata = await lstat(path).catch(() => null);
+    if (!metadata?.isFile() || metadata.isSymbolicLink())
+        throw new Error(`release candidate is incomplete: ${file.path}`);
+    if (metadata.size !== file.bytes)
+        throw new Error(`release file size mismatch: ${file.path}`);
+    const digest = createHash("sha256").update(await readFile(path)).digest("hex");
+    if (digest !== file.sha256)
+        throw new Error(`release file digest mismatch: ${file.path}`);
+}
+function validateManifest(value) {
+    if (value.packageName !== ADDONE_PACKAGE_NAME || typeof value.packageVersion !== "string")
+        throw new Error("invalid AddOne release manifest metadata");
+    if (!/^[a-f0-9]{64}$/.test(value.contentDigest) || !/^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/.test(value.releaseId))
+        throw new Error("invalid AddOne release identity");
+    if (!Array.isArray(value.files) || value.files.length === 0)
+        throw new Error("release manifest contains no files");
+    for (const file of value.files) {
+        if (typeof file.path !== "string" || file.path.length === 0 || file.path.includes("\\") || file.path.startsWith("/") || file.path.split("/").includes("..")) {
+            throw new Error(`invalid release manifest path: ${String(file.path)}`);
+        }
+        if (!Number.isSafeInteger(file.bytes) || file.bytes < 0 || !/^[a-f0-9]{64}$/.test(file.sha256))
+            throw new Error(`invalid release manifest file identity: ${file.path}`);
+    }
+}
+function digestManifestFiles(files) {
+    const digest = createHash("sha256");
+    for (const file of [...files].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0)) {
+        digest.update(`${file.path}\0${file.bytes}\0${file.sha256}\0${file.executable ? 1 : 0}\n`);
+    }
+    return digest.digest("hex");
+}
+function assertContained(parent, child, message) {
+    const fromParent = relative(parent, child);
+    if (fromParent === "" || (!fromParent.startsWith(`..${sep}`) && fromParent !== ".." && !isAbsolute(fromParent)))
+        return;
+    throw new Error(`${message}: ${child}`);
+}
+//# sourceMappingURL=release-store.js.map

package/dist/src/foundation/release/release-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-store.js","sourceRoot":"","sources":["../../../../src/foundation/release/release-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAwD,MAAM,cAAc,CAAC;AAE/I,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAMvD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAe;IAC3E,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,QAAQ;QAAE,OAAO,MAAM,yBAAyB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE5E,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,cAAc,QAAQ,CAAC,SAAS,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/F,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,MAAM,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACpC,MAAM,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtH,MAAM,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACrC,OAAO,MAAM,yBAAyB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,WAAmB;IAC/D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAA0B,CAAC;IACnH,OAAO,MAAM,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAmB,EACnB,QAAgC,EAChC,iBAA0B;IAE1B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,iBAAiB;QAAE,eAAe,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,oDAAoD,CAAC,CAAC;IAC3I,MAAM,YAAY,GAAG,aAAa,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAA0B,CAAC;IAC3F,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,cAAc,QAAQ,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACxI,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK;QAAE,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,QAAQ,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACxH,OAAO,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAA4B,EAAE,OAAe;IAC9F,MAAM,yBAAyB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACjH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjE,IAAI,QAAQ,KAAK,OAAO,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAA4B,EAAE,UAAkB;IAC7F,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,UAAU,EAAE,CAAC,CAAC;IACjJ,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,wDAAwD,CAAC,CAAC;IAC1G,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAyB;IAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvH,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA4B;IACpD,IAAI,KAAK,CAAC,WAAW,KAAK,mBAAmB,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvJ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAChK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnH,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5J,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1K,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAqC;IAChE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClH,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,KAAa,EAAE,OAAe;IACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO;IACxH,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;AAC1C,CAAC"}

package/dist/src/foundation/release/release.d.ts

@@ -0,0 +1,24 @@
+export declare const ADDONE_PACKAGE_NAME = "@timurproko/a1";
+export interface ReleaseFileIdentity {
+    readonly path: string;
+    readonly bytes: number;
+    readonly sha256: string;
+    readonly executable: boolean;
+}
+export interface AddOneReleaseIdentity {
+    readonly packageName: typeof ADDONE_PACKAGE_NAME;
+    readonly packageVersion: string;
+    readonly contentDigest: string;
+    readonly releaseId: string;
+    readonly packageRoot: string;
+    readonly files: readonly ReleaseFileIdentity[];
+}
+/**
+ * Derive AddOne execution identity only from installed distribution metadata and
+ * bytes. The version remains display metadata; the digest selects executable
+ * content.
+ */
+export declare function deriveReleaseIdentity(packageRoot: string): Promise<AddOneReleaseIdentity>;
+export declare function resolveWithin(root: string, candidate: string): string;
+export declare function packageRootFromModule(moduleUrl: string): string;
+//# sourceMappingURL=release.d.ts.map

package/dist/src/foundation/release/release.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../../src/foundation/release/release.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,OAAO,mBAAmB,CAAC;IACjD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAChD;AAUD;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAwC/F;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAMrE;AA8ED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAS/D"}

package/dist/src/foundation/release/release.js

@@ -0,0 +1,151 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir, realpath } from "node:fs/promises";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+export const ADDONE_PACKAGE_NAME = "@timurproko/a1";
+/**
+ * Derive AddOne execution identity only from installed distribution metadata and
+ * bytes. The version remains display metadata; the digest selects executable
+ * content.
+ */
+export async function deriveReleaseIdentity(packageRoot) {
+    const canonicalRoot = await realpath(packageRoot);
+    const manifestPath = resolve(canonicalRoot, "package.json");
+    const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+    if (manifest.name !== ADDONE_PACKAGE_NAME)
+        throw new Error(`unexpected AddOne package name: ${String(manifest.name)}`);
+    if (typeof manifest.version !== "string" || manifest.version.length === 0)
+        throw new Error("AddOne package metadata has no version");
+    const roots = distributionRoots(manifest);
+    const paths = new Set(["package.json"]);
+    for (const root of roots) {
+        const absolute = resolveWithin(canonicalRoot, root);
+        await collectFiles(canonicalRoot, absolute, paths);
+    }
+    await collectDependencyClosure(canonicalRoot, canonicalRoot, manifest, paths, new Set());
+    const files = [];
+    for (const path of [...paths].sort()) {
+        const absolute = resolveWithin(canonicalRoot, path);
+        const metadata = await lstat(absolute);
+        if (!metadata.isFile())
+            throw new Error(`release payload is not a regular file: ${path}`);
+        const bytes = await readFile(absolute);
+        files.push({
+            path: normalizeRelative(path),
+            bytes: bytes.length,
+            sha256: createHash("sha256").update(bytes).digest("hex"),
+            executable: (metadata.mode & 0o111) !== 0,
+        });
+    }
+    const digest = createHash("sha256");
+    for (const file of files)
+        digest.update(`${file.path}\0${file.bytes}\0${file.sha256}\0${file.executable ? 1 : 0}\n`);
+    const contentDigest = digest.digest("hex");
+    return {
+        packageName: ADDONE_PACKAGE_NAME,
+        packageVersion: manifest.version,
+        contentDigest,
+        releaseId: `${manifest.version}-${contentDigest.slice(0, 20)}`,
+        packageRoot: canonicalRoot,
+        files,
+    };
+}
+export function resolveWithin(root, candidate) {
+    if (candidate.includes("\0"))
+        throw new Error("release path contains a null byte");
+    const absolute = resolve(root, candidate);
+    const fromRoot = relative(root, absolute);
+    if (fromRoot === "" || (!isAbsolute(fromRoot) && fromRoot !== ".." && !fromRoot.startsWith(`..${sep}`)))
+        return absolute;
+    throw new Error(`release path escapes selected root: ${candidate}`);
+}
+function distributionRoots(manifest) {
+    if (!Array.isArray(manifest.files))
+        throw new Error("AddOne package metadata has no distribution files list");
+    const roots = manifest.files.map(value => {
+        if (typeof value !== "string" || value.length === 0)
+            throw new Error("AddOne distribution file entry is invalid");
+        const normalized = normalizeRelative(value);
+        if (normalized === "package.json")
+            return normalized;
+        if (isAbsolute(value) || normalized === ".." || normalized.startsWith("../"))
+            throw new Error(`AddOne distribution path escapes package root: ${value}`);
+        return normalized;
+    });
+    return [...new Set(roots)];
+}
+async function collectFiles(root, path, output, skipNodeModules = false) {
+    const metadata = await lstat(path);
+    const relativePath = normalizeRelative(relative(root, path));
+    if (metadata.isSymbolicLink())
+        throw new Error(`release payload contains a symbolic link: ${relativePath}`);
+    if (metadata.isFile()) {
+        output.add(relativePath);
+        return;
+    }
+    if (!metadata.isDirectory())
+        throw new Error(`release payload contains an unsupported entry: ${relativePath}`);
+    for (const entry of await readdir(path)) {
+        if (entry === ".bin" || (skipNodeModules && entry === "node_modules"))
+            continue;
+        await collectFiles(root, resolve(path, entry), output, skipNodeModules);
+    }
+}
+async function collectDependencyClosure(root, requesterRoot, manifest, output, visited) {
+    const required = dependencyNames(manifest.dependencies);
+    const optional = new Set(dependencyNames(manifest.optionalDependencies));
+    for (const name of [...new Set([...required, ...optional])].sort()) {
+        const packagePath = await findInstalledDependency(root, requesterRoot, name);
+        if (!packagePath) {
+            if (optional.has(name))
+                continue;
+            throw new Error(`installed AddOne dependency is missing: ${name}`);
+        }
+        if (visited.has(packagePath))
+            continue;
+        visited.add(packagePath);
+        await collectFiles(root, packagePath, output, true);
+        const dependencyManifest = JSON.parse(await readFile(resolve(packagePath, "package.json"), "utf8"));
+        await collectDependencyClosure(root, packagePath, dependencyManifest, output, visited);
+    }
+}
+async function findInstalledDependency(root, requesterRoot, name) {
+    let directory = requesterRoot;
+    while (true) {
+        const candidate = resolve(directory, "node_modules", name);
+        const fromRoot = relative(root, candidate);
+        if (fromRoot !== ".." && !fromRoot.startsWith(`..${sep}`) && !isAbsolute(fromRoot)) {
+            const metadata = await lstat(candidate).catch(() => null);
+            if (metadata?.isDirectory() && !metadata.isSymbolicLink())
+                return candidate;
+        }
+        if (directory === root)
+            return null;
+        const parent = dirname(directory);
+        if (parent === directory || relative(root, parent).startsWith(".."))
+            return null;
+        directory = parent;
+    }
+}
+function dependencyNames(value) {
+    if (value === undefined)
+        return [];
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new Error("AddOne dependency metadata is invalid");
+    return Object.keys(value);
+}
+function normalizeRelative(path) {
+    return path.split(sep).join("/").replace(/^\.\//, "");
+}
+export function packageRootFromModule(moduleUrl) {
+    const url = new URL(moduleUrl);
+    if (url.protocol !== "file:")
+        throw new Error(`AddOne module URL must be a file URL: ${moduleUrl}`);
+    let directory = dirname(url.pathname.replace(/^\/(.:)/, "$1"));
+    while (basename(directory) !== "") {
+        if (basename(directory) === "dist")
+            return dirname(directory);
+        directory = dirname(directory);
+    }
+    throw new Error("could not derive AddOne package root from module URL");
+}
+//# sourceMappingURL=release.js.map

package/dist/src/foundation/release/release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.js","sourceRoot":"","sources":["../../../../src/foundation/release/release.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAElF,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AA0BpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IAC7D,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAoB,CAAC;IACrF,IAAI,QAAQ,CAAC,IAAI,KAAK,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvH,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAErI,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,wBAAwB,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAEzF,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACxD,UAAU,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrH,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO;QACL,WAAW,EAAE,mBAAmB;QAChC,cAAc,EAAE,QAAQ,CAAC,OAAO;QAChC,aAAa;QACb,SAAS,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QAC9D,WAAW,EAAE,aAAa;QAC1B,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,SAAiB;IAC3D,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzH,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAyB;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAClH,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,UAAU,KAAK,cAAc;YAAE,OAAO,UAAU,CAAC;QACrD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,EAAE,CAAC,CAAC;QACzJ,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,MAAmB,EAAE,eAAe,GAAG,KAAK;IAClG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,YAAY,EAAE,CAAC,CAAC;IAC5G,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,YAAY,EAAE,CAAC,CAAC;IAC/G,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,eAAe,IAAI,KAAK,KAAK,cAAc,CAAC;YAAE,SAAS;QAChF,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,IAAY,EACZ,aAAqB,EACrB,QAAyB,EACzB,MAAmB,EACnB,OAAoB;IAEpB,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;QAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,SAAS;QACvC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,MAAM,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAoB,CAAC;QACvH,MAAM,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,aAAqB,EAAE,IAAY;IACtF,IAAI,SAAS,GAAG,aAAa,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;gBAAE,OAAO,SAAS,CAAC;QAC9E,CAAC;QACD,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;IACpG,IAAI,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9D,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAC1E,CAAC"}

package/dist/src/foundation/release/stable-release.d.ts

@@ -0,0 +1,30 @@
+export interface StableReleaseEvidenceInput {
+    readonly packageName: string;
+    readonly version: string;
+    readonly commit: string;
+    readonly tag: string;
+    readonly tarball: string;
+    readonly integrity: string;
+    readonly shasum: string;
+    readonly recordedAt: string;
+}
+export interface StableReleaseEvidence extends StableReleaseEvidenceInput {
+    readonly schema: "addone-stable-release-v1";
+    readonly channel: "latest";
+}
+export interface StableRegistryState {
+    readonly packageName: string | null;
+    readonly version: string | null;
+    readonly latest: string | null;
+    readonly integrity: string | null;
+    readonly shasum: string | null;
+    readonly bins: readonly string[];
+}
+export interface StableRegistryVerificationOptions {
+    readonly attempts?: number;
+    readonly delayMs?: number;
+    readonly delay?: (milliseconds: number) => Promise<void>;
+}
+export declare function createStableReleaseEvidence(input: StableReleaseEvidenceInput): StableReleaseEvidence;
+export declare function verifyStableRegistry(expected: StableReleaseEvidence, observe: () => Promise<StableRegistryState>, options?: StableRegistryVerificationOptions): Promise<void>;
+//# sourceMappingURL=stable-release.d.ts.map

package/dist/src/foundation/release/stable-release.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stable-release.d.ts","sourceRoot":"","sources":["../../../../src/foundation/release/stable-release.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAsB,SAAQ,0BAA0B;IACvE,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,0BAA0B,GAAG,qBAAqB,CAOpG;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,qBAAqB,EAC/B,OAAO,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,EAC3C,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/src/foundation/release/stable-release.js

@@ -0,0 +1,38 @@
+import { prerelease, valid } from "semver";
+import { ADDONE_PACKAGE_NAME } from "./release.js";
+export function createStableReleaseEvidence(input) {
+    if (input.packageName !== ADDONE_PACKAGE_NAME)
+        throw new Error(`unexpected stable package: ${input.packageName}`);
+    if (valid(input.version) === null || prerelease(input.version) !== null)
+        throw new Error(`stable release requires an exact stable version: ${input.version}`);
+    if (input.tag !== `v${input.version}`)
+        throw new Error(`stable tag ${input.tag} does not match v${input.version}`);
+    if (!/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(input.integrity))
+        throw new Error("stable release integrity is malformed");
+    if (!/^[a-f0-9]{40}$/.test(input.shasum))
+        throw new Error("stable release shasum is malformed");
+    return { schema: "addone-stable-release-v1", channel: "latest", ...input };
+}
+export async function verifyStableRegistry(expected, observe, options = {}) {
+    const attempts = options.attempts ?? 12;
+    const delayMs = options.delayMs ?? 2_000;
+    const delay = options.delay ?? (async (milliseconds) => await new Promise(resolve => setTimeout(resolve, milliseconds)));
+    if (!Number.isInteger(attempts) || attempts < 1)
+        throw new Error(`invalid registry verification attempts: ${attempts}`);
+    let state = null;
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        state = await observe();
+        if (state.packageName === expected.packageName
+            && state.version === expected.version
+            && state.latest === expected.version
+            && state.integrity === expected.integrity
+            && state.shasum === expected.shasum
+            && state.bins.length === 1
+            && state.bins[0] === "a1")
+            return;
+        if (attempt < attempts)
+            await delay(delayMs);
+    }
+    throw new Error(`npm latest did not match accepted ${expected.packageName}@${expected.version} after ${attempts} attempts: ${JSON.stringify(state)}`);
+}
+//# sourceMappingURL=stable-release.js.map

package/dist/src/foundation/release/stable-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stable-release.js","sourceRoot":"","sources":["../../../../src/foundation/release/stable-release.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAiCnD,MAAM,UAAU,2BAA2B,CAAC,KAAiC;IAC3E,IAAI,KAAK,CAAC,WAAW,KAAK,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAClH,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9J,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,GAAG,oBAAoB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnH,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACrH,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChG,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAA+B,EAC/B,OAA2C,EAC3C,UAA6C,EAAE;IAE/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACvH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,EAAE,CAAC,CAAC;IACxH,IAAI,KAAK,GAA+B,IAAI,CAAC;IAC7C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxD,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;eACzC,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;eAClC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,OAAO;eACjC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;eACtC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;eAChC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;eACvB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO;QACpC,IAAI,OAAO,GAAG,QAAQ;YAAE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,UAAU,QAAQ,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACxJ,CAAC"}

package/dist/src/foundation/release/update-transaction.d.ts

@@ -0,0 +1,31 @@
+import type { UpdateChannel } from "./update.js";
+export type UpdateTransactionPhase = "shutdown-intent" | "ownership-released" | "package-installed" | "materialized" | "certified" | "active-reference-committed" | "supervisor-verified";
+export interface UpdateTransaction {
+    readonly schemaVersion: 1;
+    readonly transactionId: string;
+    readonly channel: UpdateChannel;
+    readonly targetVersion: string;
+    readonly packageRoot: string;
+    readonly priorActiveReleaseId: string | null;
+    readonly phase: UpdateTransactionPhase;
+    readonly status: "active" | "completed" | "rolled-back" | "failed";
+    readonly error: string | null;
+    readonly startedAt: string;
+    readonly updatedAt: string;
+}
+export declare class UpdateTransactionStore {
+    #private;
+    readonly path: string;
+    constructor(dataDir: string);
+    read(): Promise<UpdateTransaction | null>;
+    begin(input: {
+        channel: UpdateChannel;
+        targetVersion: string;
+        packageRoot: string;
+        priorActiveReleaseId: string | null;
+    }): Promise<UpdateTransaction>;
+    advance(phase: UpdateTransactionPhase): Promise<UpdateTransaction>;
+    finish(status: "completed" | "rolled-back" | "failed", error?: string | null): Promise<UpdateTransaction>;
+    clearCompleted(): Promise<void>;
+}
+//# sourceMappingURL=update-transaction.d.ts.map

package/dist/src/foundation/release/update-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-transaction.d.ts","sourceRoot":"","sources":["../../../../src/foundation/release/update-transaction.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,sBAAsB,GAC9B,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,cAAc,GACd,WAAW,GACX,4BAA4B,GAC5B,qBAAqB,CAAC;AAE1B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,CAAC;IACnE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,sBAAsB;;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM;IAErB,IAAI,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAWzC,KAAK,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,aAAa,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAqBrJ,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAMlE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,QAAQ,EAAE,KAAK,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAM/G,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;CAyBtC"}

package/dist/src/foundation/release/update-transaction.js

@@ -0,0 +1,88 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+export class UpdateTransactionStore {
+    path;
+    constructor(dataDir) { this.path = resolve(dataDir, "update-transaction.json"); }
+    async read() {
+        try {
+            const value = JSON.parse(await readFile(this.path, "utf8"));
+            validate(value);
+            return value;
+        }
+        catch (error) {
+            if (error instanceof Error && "code" in error && error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    async begin(input) {
+        const current = await this.read();
+        if (current?.status === "active") {
+            if (current.targetVersion !== input.targetVersion || current.channel !== input.channel) {
+                throw new Error(`unfinished AddOne update ${current.transactionId} targets ${current.targetVersion}; reconcile it before starting ${input.targetVersion}`);
+            }
+            return current;
+        }
+        const now = new Date().toISOString();
+        return await this.#write({
+            schemaVersion: 1,
+            transactionId: randomUUID(),
+            ...input,
+            phase: "shutdown-intent",
+            status: "active",
+            error: null,
+            startedAt: now,
+            updatedAt: now,
+        });
+    }
+    async advance(phase) {
+        const current = await this.#requiredActive();
+        if (phaseOrder(phase) < phaseOrder(current.phase))
+            return current;
+        return await this.#write({ ...current, phase, updatedAt: new Date().toISOString() });
+    }
+    async finish(status, error = null) {
+        const current = await this.read();
+        if (!current)
+            throw new Error("no AddOne update transaction is recorded");
+        return await this.#write({ ...current, status, error, updatedAt: new Date().toISOString() });
+    }
+    async clearCompleted() {
+        const current = await this.read();
+        if (current && current.status !== "active")
+            await rm(this.path, { force: true });
+    }
+    async #requiredActive() {
+        const current = await this.read();
+        if (!current || current.status !== "active")
+            throw new Error("no active AddOne update transaction is recorded");
+        return current;
+    }
+    async #write(value) {
+        validate(value);
+        await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+        const temporary = `${this.path}.${process.pid}.${randomUUID()}.tmp`;
+        const file = await open(temporary, "wx", 0o600);
+        try {
+            await file.writeFile(JSON.stringify(value, null, 2));
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        await rename(temporary, this.path);
+        return value;
+    }
+}
+function phaseOrder(phase) {
+    return ["shutdown-intent", "ownership-released", "package-installed", "materialized", "certified", "active-reference-committed", "supervisor-verified"].indexOf(phase);
+}
+function validate(value) {
+    if (value.schemaVersion !== 1 || typeof value.transactionId !== "string" || !["stable", "next"].includes(value.channel)
+        || typeof value.targetVersion !== "string" || typeof value.packageRoot !== "string" || typeof value.startedAt !== "string"
+        || typeof value.updatedAt !== "string" || phaseOrder(value.phase) < 0 || !["active", "completed", "rolled-back", "failed"].includes(value.status)) {
+        throw new Error("invalid AddOne update transaction journal");
+    }
+}
+//# sourceMappingURL=update-transaction.js.map

package/dist/src/foundation/release/update-transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-transaction.js","sourceRoot":"","sources":["../../../../src/foundation/release/update-transaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0B7C,MAAM,OAAO,sBAAsB;IACxB,IAAI,CAAS;IACtB,YAAY,OAAe,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAEzF,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;YACjF,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACtF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAkH;QAC5H,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;gBACvF,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,CAAC,aAAa,YAAY,OAAO,CAAC,aAAa,kCAAkC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;YAC7J,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC;YACvB,aAAa,EAAE,CAAC;YAChB,aAAa,EAAE,UAAU,EAAE;YAC3B,GAAG,KAAK;YACR,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAClE,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA8C,EAAE,QAAuB,IAAI;QACtF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1E,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAChH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAwB;QACnC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAA6B;IAC/C,OAAO,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,4BAA4B,EAAE,qBAAqB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACzK,CAAC;AACD,SAAS,QAAQ,CAAC,KAAwB;IACxC,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;WAClH,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;WACvH,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpJ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC"}

package/dist/src/foundation/release/update.d.ts

@@ -0,0 +1,55 @@
+import { type UpdateTransaction, type UpdateTransactionPhase } from "./update-transaction.js";
+export declare const ADDONE_PACKAGE = "@timurproko/a1";
+export type UpdateChannel = "stable" | "next";
+export interface ProcessRequest {
+    captureStdout: boolean;
+}
+export interface ProcessResult {
+    code: number | null;
+    stdout: string;
+}
+export type UpdateProcessRunner = (command: string, arguments_: readonly string[], request: ProcessRequest) => Promise<ProcessResult>;
+export interface UpdateFileSystem {
+    readFile(path: string): Promise<string>;
+    realpath(path: string): Promise<string>;
+    access?(path: string): Promise<void>;
+}
+export interface UpdateOutput {
+    stdout(message: string): void;
+    stderr(message: string): void;
+}
+export interface SelfUpdateOptions {
+    packageRoot: string;
+    channel?: UpdateChannel;
+    environment?: NodeJS.ProcessEnv;
+    fileSystem?: UpdateFileSystem;
+    output?: UpdateOutput;
+    runner?: UpdateProcessRunner;
+    lifecycle?: UpdateLifecycleCoordinator;
+    transactionStore?: UpdateTransactionJournal;
+}
+export interface UpdateLifecycleCoordinator {
+    targetIsActive(targetVersion: string): Promise<boolean>;
+    shutdownVerifiedOwners(targetVersion: string): Promise<{
+        priorActiveVersion: string | null;
+    }>;
+    verifyPackageUnlocked(packageRoot: string): Promise<void>;
+    activateInstalled(packageRoot: string, targetVersion: string, phase: (phase: UpdateTransactionPhase) => Promise<void>): Promise<void>;
+}
+export interface UpdateTransactionJournal {
+    readonly path: string;
+    read(): Promise<UpdateTransaction | null>;
+    begin(input: {
+        channel: UpdateChannel;
+        targetVersion: string;
+        packageRoot: string;
+        priorActiveReleaseId: string | null;
+    }): Promise<UpdateTransaction>;
+    advance(phase: UpdateTransactionPhase): Promise<UpdateTransaction>;
+    finish(status: "completed" | "rolled-back" | "failed", error?: string | null): Promise<UpdateTransaction>;
+    clearCompleted(): Promise<void>;
+}
+export declare function createNpmProcessRunner(platform?: NodeJS.Platform): UpdateProcessRunner;
+export declare function createUpdateLifecycleCoordinator(environment?: NodeJS.ProcessEnv, fileSystem?: UpdateFileSystem): UpdateLifecycleCoordinator;
+export declare function runSelfUpdate(options: SelfUpdateOptions): Promise<number>;
+//# sourceMappingURL=update.d.ts.map

package/dist/src/foundation/release/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/foundation/release/update.ts"],"names":[],"mappings":"AAoBA,OAAO,EAA0B,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC;AAG9C,MAAM,WAAW,cAAc;IAAG,aAAa,EAAE,OAAO,CAAA;CAAE;AAC1D,MAAM,WAAW,aAAa;IAAG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AACtI,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AACD,MAAM,WAAW,YAAY;IAAG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAC9F,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;CAC7C;AACD,MAAM,WAAW,0BAA0B;IACzC,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC9F,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvI;AACD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC1C,KAAK,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,aAAa,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtJ,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC1G,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAYD,wBAAgB,sBAAsB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,mBAAmB,CAUxG;AAED,wBAAgB,gCAAgC,CAC9C,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,UAAU,GAAE,gBAAoC,GAC/C,0BAA0B,CAwE5B;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiG/E"}