@vascend/talos 0.1.0 → 0.1.1

package/dist/core/package-update.js

@@ -2,6 +2,8 @@ import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { delimiter, dirname, join } from "node:path";
 import { homeDirFromEnv } from "./env-paths.js";
 import { runUpdateCommand } from "./update-process.js";
+import { downloadVerifiedPackage } from "./signed-release.js";
+import { finalizeCliInstallation } from "./cli-installation.js";
 const PACKAGE = "@vascend/talos";
 const REGISTRY = "https://registry.npmjs.org";
 export function managerCommand(manager, env) {
@@ -56,13 +58,13 @@ function npmPrefix(root) {
         return null;
     }
 }
-export function packageUpdateArgs(manager, version, prefix) {
-    const target = `${PACKAGE}@${version}`;
+export function packageUpdateArgs(manager, target, prefix) {
+    const security = ["--ignore-scripts", `--registry=${REGISTRY}`];
     if (manager === "npm")
-        return ["install", "--global", target, `--registry=${REGISTRY}`, ...(prefix ? ["--prefix", prefix] : [])];
+        return ["install", "--global", target, ...security, "--no-audit", "--no-fund", ...(prefix ? ["--prefix", prefix] : [])];
     if (manager === "yarn")
-        return ["global", "add", target, `--registry=${REGISTRY}`];
-    return ["add", "--global", target, `--registry=${REGISTRY}`];
+        return ["global", "add", target, ...security];
+    return ["add", "--global", target, ...security];
 }
 export async function installPackageUpdate(update, options) {
     const { root, env } = options;
@@ -109,13 +111,24 @@ export async function installPackageUpdate(update, options) {
         }
         if (!matches)
             continue;
+        let artifact;
         try {
-            await run(command(packageUpdateArgs(manager, update.version, prefix), true));
+            artifact = await (options.download ?? downloadVerifiedPackage)(update.version);
+        }
+        catch {
+            return { ok: false, reason: "verification", changed: false };
+        }
+        try {
+            await run(command(packageUpdateArgs(manager, artifact.path, prefix), true));
+            finalizeCliInstallation(root, update.version);
             return { ok: true };
         }
         catch {
             return { ok: false, reason: "install", changed: true };
         }
+        finally {
+            await artifact.dispose();
+        }
     }
     return { ok: false, reason: "unsupported", changed: false };
 }

package/dist/core/self-update.d.ts

@@ -1,7 +1,7 @@
 import { type TalosUpdate } from "./update-check.js";
 import { type UpdateRunner } from "./update-process.js";
 export declare const TALOS_INSTALL_ROOT: string;
-export type UpdateFailure = "unsupported" | "modified" | "diverged" | "version" | "download" | "build" | "install";
+export type UpdateFailure = "unsupported" | "modified" | "diverged" | "version" | "download" | "build" | "install" | "verification";
 export type UpdateResult = {
     readonly ok: true;
 } | {

package/dist/core/signed-release.d.ts

@@ -0,0 +1,33 @@
+export declare const TALOS_DOWNLOAD_ORIGIN = "https://vascend.it";
+export declare const STABLE_VERSION: RegExp;
+export interface SignedRelease {
+    readonly name: "@vascend/talos";
+    readonly version: string;
+    readonly dist: {
+        readonly integrity: string;
+        readonly signatures: readonly {
+            keyid: string;
+            sig: string;
+        }[];
+    };
+}
+export declare function stableVersion(value: unknown): value is string;
+export declare function verifyRelease(bytes: Uint8Array, registryKeys: unknown, options?: {
+    now?: number;
+    version?: string;
+}): SignedRelease;
+export declare function verifyPackage(bytes: Uint8Array, release: SignedRelease): void;
+export declare function fetchReleaseBytes(url: string, limit: number, options?: {
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<Buffer>;
+export declare function fetchSignedRelease(version?: string, options?: {
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<SignedRelease>;
+export declare function downloadVerifiedPackage(version: string, options?: {
+    fetch?: typeof fetch;
+}): Promise<{
+    path: string;
+    dispose: () => Promise<void>;
+}>;

package/dist/core/signed-release.js

@@ -0,0 +1,121 @@
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+export const TALOS_DOWNLOAD_ORIGIN = "https://vascend.it";
+export const STABLE_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+export function stableVersion(value) {
+    return typeof value === "string" && value.length <= 40 && STABLE_VERSION.exec(value)?.[0] === value;
+}
+export function verifyRelease(bytes, registryKeys, options = {}) {
+    if (bytes.length > 64 * 1024)
+        throw new Error("Release metadata is too large.");
+    const data = JSON.parse(Buffer.from(bytes).toString("utf8"));
+    if (!data || data.name !== "@vascend/talos" || !stableVersion(data.version)
+        || (options.version !== undefined && data.version !== options.version))
+        throw new Error("Unexpected release version.");
+    if (typeof data.dist?.integrity !== "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(data.dist.integrity)
+        || data.dist.integrity.length !== 95 || !Array.isArray(data.dist.signatures) || data.dist.signatures.length > 10)
+        throw new Error("Invalid npm release signature.");
+    const keys = registryKeys?.keys;
+    if (!Array.isArray(keys) || keys.length > 30)
+        throw new Error("Invalid npm signing keys.");
+    const payload = Buffer.from(`${data.name}@${data.version}:${data.dist.integrity}`);
+    for (const signature of data.dist.signatures) {
+        if (typeof signature?.sig !== "string" || signature.sig.length > 256 || typeof signature.keyid !== "string")
+            continue;
+        for (const trusted of keys) {
+            if (!trusted || trusted.keyid !== signature.keyid || trusted.keytype !== "ecdsa-sha2-nistp256"
+                || trusted.scheme !== "ecdsa-sha2-nistp256" || typeof trusted.key !== "string" || trusted.key.length > 512
+                || (trusted.expires !== null && !(Date.parse(trusted.expires) > (options.now ?? Date.now()))))
+                continue;
+            try {
+                const key = createPublicKey({ key: Buffer.from(trusted.key, "base64"), format: "der", type: "spki" });
+                if (key.asymmetricKeyType === "ec" && key.asymmetricKeyDetails?.namedCurve === "prime256v1"
+                    && verify("sha256", payload, key, Buffer.from(signature.sig, "base64")))
+                    return data;
+            }
+            catch { /* Try another current registry key; never accept an unverified release. */ }
+        }
+    }
+    throw new Error("The npm registry signature is invalid.");
+}
+export function verifyPackage(bytes, release) {
+    if (`sha512-${createHash("sha512").update(bytes).digest("base64")}` !== release.dist.integrity) {
+        throw new Error("Release checksum does not match. Installation refused.");
+    }
+}
+export async function fetchReleaseBytes(url, limit, options = {}) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 20_000);
+    try {
+        const response = await (options.fetch ?? fetch)(url, { redirect: "error", signal: controller.signal, headers: { Accept: "application/octet-stream" } });
+        if (!response.ok || !response.body) {
+            await response.body?.cancel();
+            throw new Error("Release download is unavailable.");
+        }
+        if (Number(response.headers.get("content-length")) > limit) {
+            await response.body.cancel();
+            throw new Error("Release download is too large.");
+        }
+        const reader = response.body.getReader();
+        const chunks = [];
+        let length = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                length += value.length;
+                if (length > limit)
+                    throw new Error("Release download is too large.");
+                chunks.push(value);
+            }
+        }
+        finally {
+            await reader.cancel();
+        }
+        return Buffer.concat(chunks);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export async function fetchSignedRelease(version = "latest", options = {}) {
+    if (version !== "latest" && !stableVersion(version))
+        throw new Error("Invalid Talos version.");
+    // npm is the authority for both freshness and signatures. A stale/compromised
+    // mirror cannot hide a release by replaying older, correctly signed metadata.
+    const [metadata, keys] = await Promise.all([
+        fetchReleaseBytes(`https://registry.npmjs.org/@vascend%2ftalos/${version}`, 64 * 1024, options),
+        fetchReleaseBytes("https://registry.npmjs.org/-/npm/v1/keys", 64 * 1024, options),
+    ]);
+    return verifyRelease(metadata, JSON.parse(keys.toString("utf8")), version === "latest" ? {} : { version });
+}
+export async function downloadVerifiedPackage(version, options = {}) {
+    const release = await fetchSignedRelease(version, options);
+    const filename = `vascend-talos-${release.version}.tgz`;
+    let bytes;
+    try {
+        bytes = await fetchReleaseBytes(`${TALOS_DOWNLOAD_ORIGIN}/talos/releases/${release.version}/${filename}`, 32 * 1024 * 1024, options);
+        verifyPackage(bytes, release);
+    }
+    catch {
+        // This fixed npm URL also supports historical versions and a mirror that is
+        // still deploying. Never follow a tarball URL supplied by remote metadata.
+        bytes = await fetchReleaseBytes(`https://registry.npmjs.org/@vascend/talos/-/talos-${release.version}.tgz`, 32 * 1024 * 1024, options);
+        verifyPackage(bytes, release);
+    }
+    // npm receives only a private, verified local archive. No scripts or remote tarball URLs.
+    const directory = await mkdtemp(join(tmpdir(), "talos-verified-"));
+    const dispose = () => rm(directory, { recursive: true, force: true });
+    try {
+        const path = join(directory, filename);
+        await writeFile(path, bytes, { flag: "wx", mode: 0o600 });
+        return { path, dispose };
+    }
+    catch (error) {
+        await dispose();
+        throw error;
+    }
+}

package/dist/core/update-check.d.ts

@@ -7,7 +7,7 @@ export interface TalosUpdate {
     readonly version: string;
     readonly tag: string;
 }
-export type UpdateSource = "github" | "npm";
+export type UpdateSource = "github" | "npm" | "vascend";
 export declare function parseUpdateVersion(value: unknown): {
     version: string;
     core: readonly bigint[];

package/dist/core/update-check.js

@@ -1,4 +1,5 @@
 import { runUpdateCommand } from "./update-process.js";
+import { fetchSignedRelease } from "./signed-release.js";
 export const TALOS_REPOSITORY = "VascendTechnologies/vascend-talos";
 export const TALOS_RELEASES_URL = `https://github.com/${TALOS_REPOSITORY}/releases`;
 const RELEASE_ENDPOINT = `https://api.github.com/repos/${TALOS_REPOSITORY}/releases/latest`;
@@ -43,27 +44,29 @@ export function shouldCheckForUpdate(args, env, inputIsTTY, outputIsTTY) {
 export async function checkForTalosUpdate(options) {
     if (!parseUpdateVersion(options.currentVersion))
         return null;
+    if (options.source === "vascend" || options.source === "npm") {
+        try {
+            const release = await fetchSignedRelease("latest", { fetch: options.fetch, timeoutMs: options.timeoutMs ?? 2_500 });
+            return updateFromRelease(options.currentVersion, { tag_name: `v${release.version}`, draft: false, prerelease: false });
+        }
+        catch {
+            return null;
+        }
+    }
     const budget = options.timeoutMs ?? 2_500;
     const deadline = Date.now() + budget;
-    const fromNpm = options.source === "npm";
-    const token = fromNpm ? undefined : options.env.GH_TOKEN || options.env.GITHUB_TOKEN;
+    const token = options.env.GH_TOKEN || options.env.GITHUB_TOKEN;
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), Math.max(1, Math.floor(budget / (fromNpm ? 1 : 2))));
+    const timer = setTimeout(() => controller.abort(), Math.max(1, Math.floor(budget / 2)));
     try {
-        const response = await (options.fetch ?? fetch)(fromNpm ? "https://registry.npmjs.org/@vascend%2ftalos/latest" : RELEASE_ENDPOINT, {
-            headers: { Accept: fromNpm ? "application/json" : "application/vnd.github+json", "User-Agent": "vascend-talos-update",
+        const response = await (options.fetch ?? fetch)(RELEASE_ENDPOINT, {
+            headers: { Accept: "application/vnd.github+json", "User-Agent": "vascend-talos-update",
                 ...(token ? { Authorization: `Bearer ${token}` } : {}) },
             redirect: "error",
             signal: controller.signal,
         });
         if (response.ok) {
-            const data = await response.json();
-            if (!fromNpm)
-                return updateFromRelease(options.currentVersion, data);
-            const pkg = data;
-            return pkg?.name === "@vascend/talos"
-                ? updateFromRelease(options.currentVersion, { tag_name: pkg.version, draft: false, prerelease: false })
-                : null;
+            return updateFromRelease(options.currentVersion, await response.json());
         }
         await response.body?.cancel();
     }
@@ -71,8 +74,6 @@ export async function checkForTalosUpdate(options) {
     finally {
         clearTimeout(timer);
     }
-    if (fromNpm)
-        return null;
     const remaining = deadline - Date.now();
     if (remaining <= 0)
         return null;

package/dist/core/vibe-modes.js

@@ -363,19 +363,19 @@ export function renderVibeModeBlock(route) {
     const spec = MODES[route.resolved];
     const rules = spec.operatingRules.map((rule, index) => `@regola[${index + 1}]: "${escapeValue(rule)}"`);
     const gates = spec.completionGates.map((gate, index) => `@gate[${index + 1}]: "${escapeValue(gate)}"`);
-    return `[VIBE_MODE]
-INDICE
-1 = profilo
-2 = processo
-3 = gate
-
-DEFINIZIONI
-@profilo[attivo]: id=${spec.id}, nome="${escapeValue(spec.label)}", confidence=${route.confidence.toFixed(2)}
-@profilo[scopo]: "${escapeValue(spec.summary)}"
-@azione[prima]: "${escapeValue(spec.firstMove)}"
-${rules.join("\n")}
-${gates.join("\n")}
-
+    return `[VIBE_MODE]
+INDICE
+1 = profilo
+2 = processo
+3 = gate
+
+DEFINIZIONI
+@profilo[attivo]: id=${spec.id}, nome="${escapeValue(spec.label)}", confidence=${route.confidence.toFixed(2)}
+@profilo[scopo]: "${escapeValue(spec.summary)}"
+@azione[prima]: "${escapeValue(spec.firstMove)}"
+${rules.join("\n")}
+${gates.join("\n")}
+
 OUTPUT: applica davvero processo e gate del profilo; non limitarti a citarne il nome.`;
 }
 function escapeValue(value) {

package/dist/distribution/install.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/distribution/install.js

@@ -0,0 +1,31 @@
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { downloadVerifiedPackage, fetchSignedRelease } from "../core/signed-release.js";
+import { managerCommand, packageUpdateArgs } from "../core/package-update.js";
+import { runUpdateCommand } from "../core/update-process.js";
+import { finalizeCliInstallation, installationPrefix } from "../core/cli-installation.js";
+async function install() {
+    if (Number(process.versions.node.split(".")[0]) < 20)
+        throw new Error("Talos requires Node.js 20 or newer, including npm: https://nodejs.org");
+    const npm = managerCommand("npm", process.env);
+    if (!npm)
+        throw new Error("npm is missing. Install Node.js with npm from https://nodejs.org");
+    const version = process.env.TALOS_VERSION || "latest";
+    const release = await fetchSignedRelease(version);
+    const prefix = installationPrefix(process.env.TALOS_INSTALL_DIR || (process.platform === "win32"
+        ? join(process.env.LOCALAPPDATA || join(homedir(), "AppData", "Local"), "Programs", "Talos") : join(homedir(), ".local")));
+    console.log(`Installing Talos ${release.version} in ${prefix}`);
+    const artifact = await downloadVerifiedPackage(release.version);
+    try {
+        await runUpdateCommand({ ...npm, args: [...npm.args, ...packageUpdateArgs("npm", artifact.path, prefix)],
+            cwd: homedir(), env: process.env, inherit: true, timeoutMs: 300_000 });
+        const entry = join(prefix, ...(process.platform === "win32" ? [] : ["lib"]), "node_modules", "@vascend", "talos", "dist", "index.js");
+        finalizeCliInstallation(join(prefix, ...(process.platform === "win32" ? [] : ["lib"]), "node_modules", "@vascend", "talos"), release.version);
+        await runUpdateCommand({ command: process.execPath, args: [entry, "--version"], cwd: homedir(), env: process.env, inherit: true, timeoutMs: 10_000 });
+        console.log("Talos installed. npm registry signature and SHA-512 verified.");
+    }
+    finally {
+        await artifact.dispose();
+    }
+}
+install().catch(error => { console.error(error instanceof Error ? error.message : "Installation failed."); process.exitCode = 1; });

package/dist/install.mjs

@@ -0,0 +1,271 @@
+// src/distribution/install.ts
+import { join as join4 } from "node:path";
+import { homedir } from "node:os";
+
+// src/core/signed-release.ts
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+var TALOS_DOWNLOAD_ORIGIN = "https://vascend.it";
+var STABLE_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+function stableVersion(value) {
+  return typeof value === "string" && value.length <= 40 && STABLE_VERSION.exec(value)?.[0] === value;
+}
+function verifyRelease(bytes, registryKeys, options = {}) {
+  if (bytes.length > 64 * 1024)
+    throw new Error("Release metadata is too large.");
+  const data = JSON.parse(Buffer.from(bytes).toString("utf8"));
+  if (!data || data.name !== "@vascend/talos" || !stableVersion(data.version) || options.version !== undefined && data.version !== options.version)
+    throw new Error("Unexpected release version.");
+  if (typeof data.dist?.integrity !== "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(data.dist.integrity) || data.dist.integrity.length !== 95 || !Array.isArray(data.dist.signatures) || data.dist.signatures.length > 10)
+    throw new Error("Invalid npm release signature.");
+  const keys = registryKeys?.keys;
+  if (!Array.isArray(keys) || keys.length > 30)
+    throw new Error("Invalid npm signing keys.");
+  const payload = Buffer.from(`${data.name}@${data.version}:${data.dist.integrity}`);
+  for (const signature of data.dist.signatures) {
+    if (typeof signature?.sig !== "string" || signature.sig.length > 256 || typeof signature.keyid !== "string")
+      continue;
+    for (const trusted of keys) {
+      if (!trusted || trusted.keyid !== signature.keyid || trusted.keytype !== "ecdsa-sha2-nistp256" || trusted.scheme !== "ecdsa-sha2-nistp256" || typeof trusted.key !== "string" || trusted.key.length > 512 || trusted.expires !== null && !(Date.parse(trusted.expires) > (options.now ?? Date.now())))
+        continue;
+      try {
+        const key = createPublicKey({ key: Buffer.from(trusted.key, "base64"), format: "der", type: "spki" });
+        if (key.asymmetricKeyType === "ec" && key.asymmetricKeyDetails?.namedCurve === "prime256v1" && verify("sha256", payload, key, Buffer.from(signature.sig, "base64")))
+          return data;
+      } catch {}
+    }
+  }
+  throw new Error("The npm registry signature is invalid.");
+}
+function verifyPackage(bytes, release) {
+  if (`sha512-${createHash("sha512").update(bytes).digest("base64")}` !== release.dist.integrity) {
+    throw new Error("Release checksum does not match. Installation refused.");
+  }
+}
+async function fetchReleaseBytes(url, limit, options = {}) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 20000);
+  try {
+    const response = await (options.fetch ?? fetch)(url, { redirect: "error", signal: controller.signal, headers: { Accept: "application/octet-stream" } });
+    if (!response.ok || !response.body) {
+      await response.body?.cancel();
+      throw new Error("Release download is unavailable.");
+    }
+    if (Number(response.headers.get("content-length")) > limit) {
+      await response.body.cancel();
+      throw new Error("Release download is too large.");
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let length = 0;
+    try {
+      for (;; ) {
+        const { done, value } = await reader.read();
+        if (done)
+          break;
+        length += value.length;
+        if (length > limit)
+          throw new Error("Release download is too large.");
+        chunks.push(value);
+      }
+    } finally {
+      await reader.cancel();
+    }
+    return Buffer.concat(chunks);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function fetchSignedRelease(version = "latest", options = {}) {
+  if (version !== "latest" && !stableVersion(version))
+    throw new Error("Invalid Talos version.");
+  const [metadata, keys] = await Promise.all([
+    fetchReleaseBytes(`https://registry.npmjs.org/@vascend%2ftalos/${version}`, 64 * 1024, options),
+    fetchReleaseBytes("https://registry.npmjs.org/-/npm/v1/keys", 64 * 1024, options)
+  ]);
+  return verifyRelease(metadata, JSON.parse(keys.toString("utf8")), version === "latest" ? {} : { version });
+}
+async function downloadVerifiedPackage(version, options = {}) {
+  const release = await fetchSignedRelease(version, options);
+  const filename = `vascend-talos-${release.version}.tgz`;
+  let bytes;
+  try {
+    bytes = await fetchReleaseBytes(`${TALOS_DOWNLOAD_ORIGIN}/talos/releases/${release.version}/${filename}`, 32 * 1024 * 1024, options);
+    verifyPackage(bytes, release);
+  } catch {
+    bytes = await fetchReleaseBytes(`https://registry.npmjs.org/@vascend/talos/-/talos-${release.version}.tgz`, 32 * 1024 * 1024, options);
+    verifyPackage(bytes, release);
+  }
+  const directory = await mkdtemp(join(tmpdir(), "talos-verified-"));
+  const dispose = () => rm(directory, { recursive: true, force: true });
+  try {
+    const path = join(directory, filename);
+    await writeFile(path, bytes, { flag: "wx", mode: 384 });
+    return { path, dispose };
+  } catch (error) {
+    await dispose();
+    throw error;
+  }
+}
+
+// src/core/package-update.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
+import { delimiter, dirname as dirname2, join as join3 } from "node:path";
+
+// src/core/update-process.ts
+import { spawn } from "node:child_process";
+var runUpdateCommand = (command) => new Promise((resolve, reject) => {
+  const child = spawn(command.command, [...command.args], {
+    cwd: command.cwd,
+    env: command.env,
+    shell: false,
+    windowsHide: true,
+    stdio: command.inherit ? "inherit" : ["ignore", "pipe", "pipe"],
+    timeout: command.timeoutMs
+  });
+  let output = "";
+  let failed = false;
+  const collect = (data) => {
+    output += data.toString();
+    if (output.length > 2000000) {
+      failed = true;
+      child.kill();
+      reject(new Error("Command output exceeded limit"));
+    }
+  };
+  child.stdout?.on("data", collect);
+  child.stderr?.resume();
+  child.on("error", reject);
+  child.on("close", (code, signal) => {
+    if (failed)
+      return;
+    if (code === 0 && !signal)
+      resolve(output.trim());
+    else
+      reject(new Error(`${command.command} exited with ${signal ?? code}`));
+  });
+});
+
+// src/core/cli-installation.ts
+import { existsSync, lstatSync, readFileSync, realpathSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join as join2, resolve } from "node:path";
+function installationPrefix(value) {
+  const prefix = resolve(value);
+  if (/[\x00-\x1f\x7f]/.test(prefix) || prefix.includes(process.platform === "win32" ? ";" : ":")) {
+    throw new Error("The installation directory cannot be represented safely in PATH.");
+  }
+  return prefix;
+}
+function windowsCliShim() {
+  return `@echo off\r
+"%~dp0.talos-runtime\\node.exe" "%~dp0node_modules\\@vascend\\talos\\dist\\index.js" %*\r
+`;
+}
+function finalizeCliInstallation(root, version) {
+  const pkg = JSON.parse(readFileSync(join2(root, "package.json"), "utf8"));
+  if (pkg.name !== "@vascend/talos" || pkg.version !== version)
+    throw new Error("Installed Talos version differs from the requested release.");
+  if (process.platform !== "win32")
+    return;
+  const modules = dirname(dirname(root));
+  if (dirname(root).split(/[\\/]/).pop() !== "@vascend" || modules.split(/[\\/]/).pop() !== "node_modules")
+    return;
+  const prefix = dirname(modules);
+  const belongsToTalos = (file) => {
+    if (!existsSync(file))
+      return false;
+    const info = lstatSync(file);
+    return info.isFile() && !info.isSymbolicLink() && info.size < 16384 && /node_modules[\\/]@vascend[\\/]talos[\\/]dist[\\/]index\.js/i.test(readFileSync(file, "utf8"));
+  };
+  for (const alias of ["talos", "horizon"]) {
+    const cmd = join2(prefix, `${alias}.cmd`);
+    if (!belongsToTalos(cmd))
+      continue;
+    if (!process.versions.bun) {
+      const runtime = join2(prefix, ".talos-runtime");
+      if (existsSync(runtime)) {
+        if (!lstatSync(runtime).isSymbolicLink())
+          throw new Error("The Talos runtime link is occupied by a regular directory.");
+        if (realpathSync(runtime).toLowerCase() !== realpathSync(dirname(process.execPath)).toLowerCase())
+          unlinkSync(runtime);
+      }
+      if (!existsSync(runtime))
+        symlinkSync(dirname(process.execPath), runtime, "junction");
+      writeFileSync(cmd, windowsCliShim());
+    }
+    const ps1 = join2(prefix, `${alias}.ps1`);
+    if (belongsToTalos(ps1))
+      unlinkSync(ps1);
+  }
+}
+
+// src/core/package-update.ts
+var REGISTRY = "https://registry.npmjs.org";
+function managerCommand(manager, env) {
+  if (process.platform !== "win32")
+    return { command: manager, args: [] };
+  const path = Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] ?? "";
+  const directories = path.split(delimiter).filter(Boolean).map((directory) => directory.replace(/^"|"$/g, ""));
+  const node = process.versions.bun ? directories.map((directory) => join3(directory, "node.exe")).find((file) => existsSync2(file)) : process.execPath;
+  for (const directory of directories) {
+    const exe = join3(directory, `${manager}.exe`);
+    if (existsSync2(exe))
+      return { command: exe, args: [] };
+    const scripts = {
+      npm: ["npm/bin/npm-cli.js"],
+      pnpm: ["pnpm/bin/pnpm.cjs", "corepack/dist/pnpm.js"],
+      yarn: ["yarn/bin/yarn.js", "corepack/dist/yarn.js"]
+    };
+    if (manager !== "bun")
+      for (const script of scripts[manager]) {
+        const file = join3(directory, "node_modules", script);
+        if (node && existsSync2(file))
+          return { command: node, args: [file] };
+      }
+  }
+  return null;
+}
+function packageUpdateArgs(manager, target, prefix) {
+  const security = ["--ignore-scripts", `--registry=${REGISTRY}`];
+  if (manager === "npm")
+    return ["install", "--global", target, ...security, "--no-audit", "--no-fund", ...prefix ? ["--prefix", prefix] : []];
+  if (manager === "yarn")
+    return ["global", "add", target, ...security];
+  return ["add", "--global", target, ...security];
+}
+
+// src/distribution/install.ts
+async function install() {
+  if (Number(process.versions.node.split(".")[0]) < 20)
+    throw new Error("Talos requires Node.js 20 or newer, including npm: https://nodejs.org");
+  const npm = managerCommand("npm", process.env);
+  if (!npm)
+    throw new Error("npm is missing. Install Node.js with npm from https://nodejs.org");
+  const version = process.env.TALOS_VERSION || "latest";
+  const release = await fetchSignedRelease(version);
+  const prefix = installationPrefix(process.env.TALOS_INSTALL_DIR || (process.platform === "win32" ? join4(process.env.LOCALAPPDATA || join4(homedir(), "AppData", "Local"), "Programs", "Talos") : join4(homedir(), ".local")));
+  console.log(`Installing Talos ${release.version} in ${prefix}`);
+  const artifact = await downloadVerifiedPackage(release.version);
+  try {
+    await runUpdateCommand({
+      ...npm,
+      args: [...npm.args, ...packageUpdateArgs("npm", artifact.path, prefix)],
+      cwd: homedir(),
+      env: process.env,
+      inherit: true,
+      timeoutMs: 300000
+    });
+    const entry = join4(prefix, ...process.platform === "win32" ? [] : ["lib"], "node_modules", "@vascend", "talos", "dist", "index.js");
+    finalizeCliInstallation(join4(prefix, ...process.platform === "win32" ? [] : ["lib"], "node_modules", "@vascend", "talos"), release.version);
+    await runUpdateCommand({ command: process.execPath, args: [entry, "--version"], cwd: homedir(), env: process.env, inherit: true, timeoutMs: 1e4 });
+    console.log("Talos installed. npm registry signature and SHA-512 verified.");
+  } finally {
+    await artifact.dispose();
+  }
+}
+install().catch((error) => {
+  console.error(error instanceof Error ? error.message : "Installation failed.");
+  process.exitCode = 1;
+});

package/dist/node-runtime.json

@@ -0,0 +1,13 @@
+{
+  "version": "24.21.0",
+  "source": "https://nodejs.org/dist/v24.21.0/SHASUMS256.txt",
+  "sha256": {
+    "darwin-arm64": "bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057",
+    "darwin-x64": "1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097",
+    "linux-arm64": "724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5",
+    "linux-x64": "6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff",
+    "linux-x64-musl": "3d63405fc65a0d2d2976c1f0bc2fd27bb0bd07212469e705aac3f03ae5ab4c9c",
+    "win-arm64": "8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921",
+    "win-x64": "158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541"
+  }
+}