@volter/world-runtime 3.0.162 → 3.0.164

package/dist/src/lifecycle-record.d.ts

@@ -19,7 +19,7 @@ export declare function assertLifecycleStartable(root: string, world: string): v
 /** A missing process is not successful teardown; records persist until explicit release. */
 export declare function beginWorldLifecycle(root: string, world: string, instanceCreatedAt: string, owner?: string): void;
 export declare function handoffWorldLifecycle(root: string, world: string, pids: number[]): void;
-export declare function retainWorldLifecycleForCleanup(root: string, world: string): void;
+export declare function retainWorldLifecycleForCleanup(root: string, world: string, onError?: (error: unknown) => void): void;
 export declare function recordWorldLifecycleEvent(root: string, world: string, message: string): void;
 /** Called only after verified cleanup. Never touches legacy records. */
 export declare function releaseWorldLifecycle(root: string, world: string, receipt?: string): void;
@@ -46,4 +46,8 @@ export declare function inspectWorldLifecycles(): {
     warnings: string[];
 };
 /** Runtime phase is meaningful only for the same instance generation; it is not a health probe. */
+/** An instrument: what `isWorldLifecycleRunning` read, for a refusal that says only "is not running": where the
+ *  record is looked for (under VOLTER_HOME, else the home), whether it is there, and its phase and instance beside
+ *  the instance asked for. It changes no answer. */
+export declare function describeWorldLifecycle(root: string, world: string, instanceCreatedAt: string): string;
 export declare function isWorldLifecycleRunning(root: string, world: string, instanceCreatedAt: string): boolean;

package/dist/src/lifecycle-record.js

@@ -1,10 +1,10 @@
 // Durable ownership of one World. This inventory does not allocate or reserve capacity.
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
-import { volterHome } from '@volter/world-core/runtime';
+import { volterHome } from '@volter/world-core/runtime-state';
 import { hostname } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
-import { stateDirName, withFileLock } from '@volter/world-core/runtime';
+import { stateDirName, withFileLock } from '@volter/world-core/runtime-state';
 import { checkedOwner } from "./consumers.js";
 const directory = () => join(volterHome(), 'world-lifecycles');
 /** One directory is one root however it is spelled: macOS's /tmp is /private/tmp, and a caller's cwd is the real path
@@ -77,12 +77,19 @@ function update(root, world, change) {
 export function handoffWorldLifecycle(root, world, pids) {
     update(root, world, record => ({ ...record, phase: 'running', pids: [...new Set(pids.filter(pid => pid > 0))] }));
 }
-export function retainWorldLifecycleForCleanup(root, world) {
+export function retainWorldLifecycleForCleanup(root, world, onError) {
     if (existsSync(legacyPath(root, world)))
         throw new Error(`World "${world}" has legacy ownership; use its pinned runtime for teardown`);
     if (!existsSync(recordPath(root, world)))
         return;
-    update(root, world, record => ({ ...record, phase: 'cleanup-pending' }));
+    try {
+        update(root, world, record => ({ ...record, phase: 'cleanup-pending' }));
+    }
+    catch (error) {
+        if (!onError)
+            throw error;
+        onError(error);
+    }
 }
 export function recordWorldLifecycleEvent(root, world, message) {
     const path = lifecycleLogPath(root, world);
@@ -208,6 +215,22 @@ export function inspectWorldLifecycles() {
     return { worlds, legacyRecords, warnings };
 }
 /** Runtime phase is meaningful only for the same instance generation; it is not a health probe. */
+/** An instrument: what `isWorldLifecycleRunning` read, for a refusal that says only "is not running": where the
+ *  record is looked for (under VOLTER_HOME, else the home), whether it is there, and its phase and instance beside
+ *  the instance asked for. It changes no answer. */
+export function describeWorldLifecycle(root, world, instanceCreatedAt) {
+    const path = recordPath(root, world);
+    const home = `VOLTER_HOME ${process.env.VOLTER_HOME === undefined || process.env.VOLTER_HOME === '' ? 'unset' : process.env.VOLTER_HOME}`;
+    if (!existsSync(path))
+        return `its lifecycle record ${path} is not there (${home})`;
+    try {
+        const record = read(path);
+        return `its lifecycle record ${path} (${home}) says phase ${record.phase}, instance created ${record.instanceCreatedAt}${record.instanceCreatedAt === instanceCreatedAt ? '' : `, where ${instanceCreatedAt} is asked for`}${record.identity === identity(root, world) ? '' : ', under another identity'}`;
+    }
+    catch (error) {
+        return `its lifecycle record ${path} (${home}) could not be read: ${error instanceof Error ? error.message : String(error)}`;
+    }
+}
 export function isWorldLifecycleRunning(root, world, instanceCreatedAt) {
     try {
         const record = read(recordPath(root, world));

package/dist/src/local-branches.js

@@ -185,7 +185,7 @@ export class LocalBranches {
                         if (!meta?.parent)
                             throw new Error(`cloning ${parent}: ${service}/${state.name} has no parent`);
                         writeBranchMeta(state.name, { ...meta, parent: { ...meta.parent, at: join(base.dirs.data, service), viewDirectory: directory } }, control);
-                    });
+                    }, { operation: 'branch-pointer adjustment' });
                 }
             }
             inheritWorldBrowsers(base.dirs.data, child.dirs.data);

package/dist/src/mariadb-bootstrap.d.ts

@@ -0,0 +1,32 @@
+export interface MariaDBCredentials {
+    database: string;
+    user: string;
+    password: string;
+    rootPassword: string;
+}
+export interface MariaDBPrograms {
+    server: string;
+    client: string;
+    admin: string;
+    installDb: string;
+    basedir: string;
+}
+/** Only for a fresh owned datadir. Resume compares the private issued policy
+ * before invoking anything; it never runs install-db or overwrites users. */
+export declare function mariaDBBootstrap(programs: MariaDBPrograms, credentials: MariaDBCredentials, datadir: string, extraSql: string): {
+    command: string;
+    args: string[];
+    privateSql: string;
+};
+/** Write as 0600, never in receipts/logs; readiness uses the application actor.
+ * It does not enable root over TCP or grant the application shutdown rights. */
+export declare function mariaDBClientOptions(credentials: MariaDBCredentials, host: string, port: number): string;
+/** The actual client proves version, port and datadir over an authenticated wire.
+ * The lifecycle joins this answer to its child identity and the server pidfile. */
+export declare function mariaDBReadinessCommand(programs: MariaDBPrograms, optionsFile: string): {
+    command: string;
+    args: string[];
+};
+/** Provider aliases must issue one policy. Unconsumed vendor entrypoint flags
+ * remain gaps, including localhost health-user/grant generation. */
+export declare function mariaDBCredentials(environment: Record<string, unknown>): MariaDBCredentials;

package/dist/src/mariadb-bootstrap.js

@@ -0,0 +1,90 @@
+function text(value, name) {
+    if (typeof value !== 'string' || !value || value.includes('\0'))
+        throw new Error(`native MariaDB requires a nonempty ${name} without NUL`);
+    return value;
+}
+// NO_BACKSLASH_ESCAPES is set before these literals; quotes are doubled.
+const literal = (value) => "'" + value.replaceAll("'", "''") + "'";
+const databaseIdentifier = (value) => '`' + value.replaceAll('`', '``') + '`';
+const option = (value) => '"' + value.replaceAll('\\', '\\\\')
+    .replaceAll('"', '\\"').replaceAll('\n', '\\n').replaceAll('\r', '\\r').replaceAll('\t', '\\t') + '"';
+/** Only for a fresh owned datadir. Resume compares the private issued policy
+ * before invoking anything; it never runs install-db or overwrites users. */
+export function mariaDBBootstrap(programs, credentials, datadir, extraSql) {
+    // Identifier length/charset belongs to the actual selected server's parser.
+    const database = text(credentials.database, 'database');
+    if (['mysql', 'sys', 'information_schema', 'performance_schema'].includes(database.toLowerCase()))
+        throw new Error('native MariaDB application policy requires its own database, not a system schema');
+    const user = text(credentials.user, 'user');
+    const password = text(credentials.password, 'password');
+    const rootPassword = text(credentials.rootPassword, 'root password');
+    if ([database, user, password, rootPassword].some(value => value.includes('@current_hostname')))
+        throw new Error('native MariaDB cross-bootstrap SQL filter cannot carry this issued policy');
+    if (user === 'root')
+        throw new Error('native MariaDB application user must differ from the provider-only root');
+    const account = literal(user) + "@'%'";
+    // The vendor script consumes these statements after its genuine system SQL.
+    // A root policy is installed while --bootstrap has no network listener.
+    const privateSql = [
+        // 12.3.3's mariadb_system_tables_data.sql:20 selects latin1. Explicitly
+        // interpret this UTF-8 extra file before reading any issued actor/value.
+        'SET NAMES utf8mb4;',
+        "SET SESSION sql_mode = 'NO_BACKSLASH_ESCAPES';",
+        // --bootstrap starts with opt_noacl. Load the genuine system tables the
+        // vendor script just created before its account APIs become available.
+        'FLUSH PRIVILEGES;',
+        "ALTER USER 'root'@'localhost' IDENTIFIED BY " + literal(rootPassword) + ';',
+        // 10.11.19 mysql_system_tables_data.sql:35-39 and 12.3.3's
+        // mariadb_system_tables_data.sql:37-41 create three normal root accounts.
+        // Retire the two passwordless TCP actors through the genuine account API.
+        "DROP USER IF EXISTS 'root'@'127.0.0.1', 'root'@'::1';",
+        'CREATE DATABASE IF NOT EXISTS ' + databaseIdentifier(database) + ';',
+        'CREATE USER ' + account + ' IDENTIFIED BY ' + literal(password) + ';',
+        'GRANT ALL PRIVILEGES ON ' + databaseIdentifier(database) + '.* TO ' + account + ';',
+        'FLUSH PRIVILEGES;', '',
+    ].join('\n');
+    return { command: programs.installDb, args: ['--no-defaults', '--basedir=' + programs.basedir,
+            '--datadir=' + datadir, '--auth-root-authentication-method=normal', '--skip-test-db',
+            // This is the vendor's source-defined cross-bootstrap branch: host-specific
+            // grant rows are excluded. @HOSTNAME@ is the runtime command "uname -n",
+            // not a builder hostname literal (scripts/CMakeLists.txt:180).
+            '--cross-bootstrap', '--extra-file=' + extraSql], privateSql };
+}
+/** Write as 0600, never in receipts/logs; readiness uses the application actor.
+ * It does not enable root over TCP or grant the application shutdown rights. */
+export function mariaDBClientOptions(credentials, host, port) {
+    text(credentials.user, 'user');
+    text(credentials.password, 'password');
+    if (!/^127(?:\.\d{1,3}){3}$/u.test(host) || host.split('.').some(piece => Number(piece) > 255)
+        || !Number.isInteger(port) || port < 1 || port > 65535)
+        throw new Error('native MariaDB client requires its allocated loopback endpoint');
+    return ['[client]', 'user=' + option(credentials.user), 'password=' + option(credentials.password),
+        'default-character-set=utf8mb4',
+        'database=' + option(text(credentials.database, 'database')),
+        'host=' + host, 'port=' + port, 'protocol=tcp', ''].join('\n');
+}
+/** The actual client proves version, port and datadir over an authenticated wire.
+ * The lifecycle joins this answer to its child identity and the server pidfile. */
+export function mariaDBReadinessCommand(programs, optionsFile) {
+    return { command: programs.client, args: ['--defaults-file=' + optionsFile, '--batch', '--skip-column-names',
+            '--execute=SELECT VERSION(), @@port, @@datadir, HEX(CURRENT_USER())'] };
+}
+/** Provider aliases must issue one policy. Unconsumed vendor entrypoint flags
+ * remain gaps, including localhost health-user/grant generation. */
+export function mariaDBCredentials(environment) {
+    const names = ['DATABASE', 'USER', 'PASSWORD', 'ROOT_PASSWORD'];
+    for (const name of Object.keys(environment))
+        if (/^(?:MYSQL|MARIADB)_/u.test(name)
+            && !names.some(suffix => name === 'MYSQL_' + suffix || name === 'MARIADB_' + suffix))
+            throw new Error('native MariaDB provider-start-input gap: ' + name);
+    const issued = (suffix) => {
+        const first = environment['MYSQL_' + suffix], second = environment['MARIADB_' + suffix];
+        if (first !== undefined && second !== undefined && first !== second)
+            throw new Error('native MariaDB provider aliases disagree for ' + suffix);
+        const value = first ?? second;
+        if (typeof value !== 'string' || value.includes('${'))
+            throw new Error('native MariaDB requires a literal issued ' + suffix);
+        return text(value, suffix);
+    };
+    return { database: issued('DATABASE'), user: issued('USER'), password: issued('PASSWORD'), rootPassword: issued('ROOT_PASSWORD') };
+}

package/dist/src/mariadb-supplier.d.ts

@@ -0,0 +1,23 @@
+import type { MariaDBPrograms } from './mariadb-bootstrap.js';
+export interface NativeMariaDBReference {
+    version: 1;
+    implementation: 'mariadb';
+    directory: string;
+    release: string;
+    receiptSha256: string;
+    sourceSha256: string;
+    recipe: {
+        path: string;
+        sha256: string;
+    };
+}
+export declare function nativeMariaDBReference(value: unknown): NativeMariaDBReference;
+/** These are the external commands in the selected install-db branch:
+ * mysql_install_db.sh:47-48,136-138,436,538-542,601-609 (12.3.3).
+ * The pre-existing datadir and absent --user avoid mkdir/chmod/chown branches.
+ * Presence and WALI bytes do not grant admission: every actual exec still
+ * passes the attached kernel's selected program/import/profile checks. */
+export declare function nativeMariaDBShellEnvironment(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Only the made World's measured supply is eligible. This performs no
+ * compiler lookup, PATH search, initialization or readiness claim. */
+export declare function nativeMariaDBSupplier(worldDirectory: string, image: string, reference: NativeMariaDBReference): MariaDBPrograms;

package/dist/src/mariadb-supplier.js

@@ -0,0 +1,215 @@
+// Supply identity is separate from execution admission. The attached kernel
+// owns its WALI profiles/import/memory checks on every actual program launch.
+import { createHash } from 'node:crypto';
+import { lstatSync, readFileSync, readlinkSync, readdirSync, realpathSync } from 'node:fs';
+import { delimiter, isAbsolute, join, posix, relative } from 'node:path';
+const digest = (value) => typeof value === 'string' && /^[a-f0-9]{64}$/u.test(value);
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+const relativeName = (value) => typeof value === 'string' && !!value
+    && !isAbsolute(value) && !value.includes('\\') && !value.includes('\0')
+    && posix.normalize(value) === value && !value.split('/').some(part => !part || part === '.' || part === '..');
+// Exact vendor initialization policies read for these archives. Supply for any
+// later release remains separate from this lifecycle's bootstrap coverage.
+const POLICY_SOURCE = {
+    '10.11.19': 'b8e543ee69d380fb1cfd563226f49e0fe96e4d67e7b7a9045ee514a168ed2066',
+    '12.3.3': 'e99d739fd4a55f9a11dea7bd2287a262673e287550af3071c8469dd2bec0c163',
+};
+export function nativeMariaDBReference(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('native MariaDB needs a typed supplier reference');
+    const row = value;
+    if (row.version !== 1 || row.implementation !== 'mariadb' || !relativeName(row.directory) || typeof row.release !== 'string'
+        || !/^\d+\.\d+\.\d+$/u.test(row.release) || !digest(row.receiptSha256) || !digest(row.sourceSha256)
+        || !relativeName(row.recipe?.path) || !digest(row.recipe?.sha256))
+        throw new Error('native MariaDB supplier reference is incomplete or invalid');
+    const known = ['version', 'implementation', 'directory', 'release', 'receiptSha256', 'sourceSha256', 'recipe'];
+    if (Object.keys(row).some(key => !known.includes(key)))
+        throw new Error('native MariaDB supplier reference has unknown fields');
+    if (Object.keys(row.recipe).some(key => !['path', 'sha256'].includes(key)))
+        throw new Error('native MariaDB recipe reference has unknown fields');
+    return row;
+}
+/** These are the external commands in the selected install-db branch:
+ * mysql_install_db.sh:47-48,136-138,436,538-542,601-609 (12.3.3).
+ * The pre-existing datadir and absent --user avoid mkdir/chmod/chown branches.
+ * Presence and WALI bytes do not grant admission: every actual exec still
+ * passes the attached kernel's selected program/import/profile checks. */
+export function nativeMariaDBShellEnvironment(env) {
+    if (env.MYSQLD_BOOTSTRAP !== undefined)
+        throw new Error('native MariaDB provider-start-input gap: MYSQLD_BOOTSTRAP overrides the selected server');
+    const executable = (path) => {
+        try {
+            const file = realpathSync(path), stat = lstatSync(file);
+            return stat.isFile() && (stat.mode & 0o111) !== 0
+                && readFileSync(file).subarray(0, 8).equals(Buffer.from([0, 97, 115, 109, 1, 0, 0, 0]));
+        }
+        catch {
+            return false;
+        }
+    };
+    if (!executable('/bin/sh'))
+        throw new Error('native MariaDB initialization needs the installed real WALI /bin/sh');
+    const directories = (env.PATH ?? '').split(delimiter);
+    if (directories.some(directory => !isAbsolute(directory)))
+        throw new Error('native MariaDB initialization requires an explicit absolute helper PATH');
+    for (const name of ['dirname', 'sed', 'uname', 'cat']) {
+        // Shell PATH stops at the first executable, even if that file cannot be
+        // admitted. Never look past a conflicting earlier non-WALI command.
+        const directory = directories.find(directory => {
+            try {
+                const stat = lstatSync(realpathSync(join(directory, name)));
+                return stat.isFile() && (stat.mode & 0o111) !== 0;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!directory || !executable(join(directory, name)))
+            throw new Error('native MariaDB initialization needs a selected real WALI helper: ' + name);
+    }
+    return { ...env }; // Keep the exact first-match order the shell will use.
+}
+/** Only the made World's measured supply is eligible. This performs no
+ * compiler lookup, PATH search, initialization or readiness claim. */
+export function nativeMariaDBSupplier(worldDirectory, image, reference) {
+    if (POLICY_SOURCE[reference.release] !== reference.sourceSha256)
+        throw new Error('native MariaDB exact-release initialization policy is not covered');
+    const match = image.match(/^(?:docker\.io\/)?(?:library\/)?mariadb(?::[^@]+)?@sha256:([a-f0-9]{64})$/u);
+    if (!match)
+        throw new Error('native MariaDB requires its exact digest-bound declared image');
+    const world = realpathSync(worldDirectory), directory = join(world, reference.directory);
+    if (!lstatSync(directory).isDirectory())
+        throw new Error('native MariaDB supplier root must be a regular directory');
+    const root = realpathSync(directory), within = relative(world, root);
+    if (!within || within === '..' || within.startsWith('../') || isAbsolute(within))
+        throw new Error('native MariaDB supplier leaves its made World');
+    const file = (name) => {
+        if (!relativeName(name))
+            throw new Error('native MariaDB supplier has an invalid file path');
+        const path = join(root, name), rel = relative(root, realpathSync(path));
+        if (!rel || rel === '..' || rel.startsWith('../') || isAbsolute(rel))
+            throw new Error('native MariaDB supplier file leaves its root');
+        return path;
+    };
+    const body = (name) => {
+        const path = file(name);
+        if (!lstatSync(path).isFile())
+            throw new Error('native MariaDB evidence must be a regular file');
+        return readFileSync(path);
+    };
+    const bytes = body('artifact.json');
+    if (sha(bytes) !== reference.receiptSha256)
+        throw new Error('native MariaDB supplier receipt changed');
+    const receipt = JSON.parse(bytes.toString('utf8')), service = receipt.managedService, binding = receipt.imageBinding;
+    if (receipt.kind !== 'sweep.wali-native-managed-server' || receipt.version !== 1 || receipt.complete !== true
+        || receipt.sourceUnchanged !== true || receipt.target !== 'wasm32-linux-muslwali'
+        || receipt.qualified !== false || receipt.admitted !== false
+        || service?.kind !== 'mysql' || service.implementation !== 'mariadb' || service.version !== reference.release
+        || receipt.source?.sha256 !== reference.sourceSha256 || receipt.source.version !== reference.release
+        || receipt.recipe?.path !== reference.recipe.path || receipt.recipe.sha256 !== reference.recipe.sha256
+        || !binding || ![binding.indexDigest, binding.manifestDigest].includes('sha256:' + match[1]))
+        throw new Error('native MariaDB supplier differs from the declared provider/source/recipe');
+    const prefix = 'prefix/opt/programs/mariadb/' + reference.release;
+    if (receipt.prefix !== prefix || !receipt.files || typeof receipt.files !== 'object' || Array.isArray(receipt.files))
+        throw new Error('native MariaDB supplier has no measured install');
+    if (receipt.buildReceipt?.complete !== true || receipt.buildReceipt.sourceUnchanged !== true
+        || receipt.buildReceipt.source?.sha256 !== reference.sourceSha256
+        || !/^[a-f0-9]{40}$/u.test(receipt.buildReceipt.sourceHead ?? '')
+        || JSON.stringify(receipt.buildReceipt.phases) !== JSON.stringify(['source', 'inputs', 'generators', 'configure', 'build', 'install', 'return']))
+        throw new Error('native MariaDB supplier lacks a complete unchanged-source preparation record');
+    // The common catalog gate authenticates the complete producer return. The
+    // made World carries its pinned source/recipe evidence; execution checks the
+    // actual installed catalog prefix here, never a build-root executable.
+    const installed = '/opt/programs/mariadb/' + reference.release;
+    if (!lstatSync(installed).isDirectory() || realpathSync(installed) !== installed)
+        throw new Error('native MariaDB has no installed regular catalog prefix');
+    const runtimeFile = (name) => {
+        if (!relativeName(name))
+            throw new Error('native MariaDB install has an invalid relative path');
+        const path = join(installed, name), rel = relative(installed, realpathSync(path));
+        if (!rel || rel === '..' || rel.startsWith('../') || isAbsolute(rel))
+            throw new Error('native MariaDB runtime resource leaves its admitted prefix');
+        return path;
+    };
+    const runtimeBody = (name) => {
+        const path = runtimeFile(name);
+        if (!lstatSync(path).isFile())
+            throw new Error('native MariaDB runtime body is not a regular file');
+        const pin = receipt.files[prefix + '/' + name], data = readFileSync(path);
+        if (!pin || typeof pin !== 'object' || 'symlink' in pin || !Number.isSafeInteger(pin.bytes)
+            || pin.bytes < 0 || !digest(pin.sha256) || data.length !== pin.bytes || sha(data) !== pin.sha256)
+            throw new Error('native MariaDB installed program/resource differs: ' + name);
+        return data;
+    };
+    for (const [name, value] of Object.entries(receipt.files)) {
+        if (!name.startsWith(prefix + '/'))
+            continue;
+        const relative = name.slice(prefix.length + 1), pin = value;
+        if (!pin || typeof pin !== 'object')
+            throw new Error('native MariaDB runtime file has no measurement');
+        if ('symlink' in pin) {
+            const path = runtimeFile(relative);
+            if (typeof pin.symlink !== 'string' || isAbsolute(pin.symlink)
+                || !lstatSync(path).isSymbolicLink() || readlinkSync(path) !== pin.symlink)
+                throw new Error('native MariaDB installed alias changed');
+        }
+        else
+            runtimeBody(relative);
+    }
+    const inspect = (name) => {
+        const path = join(installed, name), stat = lstatSync(path);
+        if (stat.isDirectory()) {
+            for (const child of readdirSync(path))
+                inspect(name ? name + '/' + child : child);
+        }
+        else if (!receipt.files[prefix + '/' + name]) {
+            throw new Error('native MariaDB install contains an unmeasured file: ' + name);
+        }
+    };
+    inspect('');
+    const measured = (name) => {
+        const pin = receipt.files[name], data = body(name);
+        if (!pin || !Number.isSafeInteger(pin.bytes) || data.length !== pin.bytes || sha(data) !== pin.sha256)
+            throw new Error('native MariaDB supplier measurement differs: ' + name);
+        return data;
+    };
+    const indexBytes = measured('recipe-inputs/image-index.json'), manifestBytes = measured('recipe-inputs/image-manifest.json');
+    const configBytes = measured('recipe-inputs/image-config.json');
+    const config = JSON.parse(configBytes.toString('utf8')), index = JSON.parse(indexBytes.toString('utf8'));
+    const manifest = JSON.parse(manifestBytes.toString('utf8'));
+    if ('sha256:' + sha(indexBytes) !== binding.indexDigest || 'sha256:' + sha(manifestBytes) !== binding.manifestDigest
+        || 'sha256:' + sha(configBytes) !== binding.configDigest || manifest.config?.digest !== binding.configDigest
+        || !index.manifests?.some((row) => row.digest === binding.manifestDigest && row.platform?.os === 'linux' && row.platform.architecture === 'amd64')
+        || config.config?.Labels?.['org.opencontainers.image.version'] !== reference.release
+        || !config.config?.Env?.some((value) => typeof value === 'string' && value.startsWith('MARIADB_VERSION=1:' + reference.release + '+')))
+        throw new Error('native MariaDB image release reading differs');
+    const recipeBytes = measured('recipe-inputs/recipe.json');
+    if (sha(recipeBytes) !== reference.recipe.sha256)
+        throw new Error('native MariaDB recipe reading differs');
+    const recipe = JSON.parse(recipeBytes.toString('utf8')), layoutBytes = measured('recipe-inputs/release.json');
+    if (recipe.preparation?.files?.filter((row) => row.path === 'release.json' && row.sha256 === sha(layoutBytes)).length !== 1)
+        throw new Error('native MariaDB installed resources are not declared by the selected recipe');
+    const layout = JSON.parse(layoutBytes.toString('utf8'));
+    const expectedPrograms = ['sbin/mariadbd', 'bin/mariadb', 'bin/mariadb-admin', 'bin/my_print_defaults', 'bin/resolveip'];
+    if (layout.release !== reference.release || recipe.version !== reference.release
+        || !Array.isArray(layout.programs) || layout.programs.length !== expectedPrograms.length
+        || !expectedPrograms.every(name => layout.programs.includes(name))
+        || !Array.isArray(layout.requiredResources) || !layout.requiredResources.length)
+        throw new Error('native MariaDB resource release differs');
+    for (const name of layout.requiredResources)
+        runtimeBody(name);
+    const executable = (name) => {
+        const data = runtimeBody(name), path = runtimeFile(name);
+        if (!data.subarray(0, 8).equals(Buffer.from([0, 97, 115, 109, 1, 0, 0, 0])) || !(lstatSync(path).mode & 0o111))
+            throw new Error('native MariaDB requires an executable measured WALI program: ' + name);
+        return path;
+    };
+    const installDb = runtimeFile('scripts/mariadb-install-db');
+    if (!runtimeBody('scripts/mariadb-install-db').subarray(0, 2).equals(Buffer.from('#!'))
+        || !(lstatSync(installDb).mode & 0o111))
+        throw new Error('native MariaDB install-db is not its executable script');
+    for (const name of expectedPrograms)
+        executable(name);
+    return { server: executable('sbin/mariadbd'), client: executable('bin/mariadb'), admin: executable('bin/mariadb-admin'),
+        installDb, basedir: installed };
+}

package/dist/src/mongodb-backing.d.ts

@@ -1,8 +1,12 @@
 import type { HostLaunch, InfraService } from './pglite-backing.js';
+import type { ManagedProtocol } from './twin-backing.js';
 /** PATH is the binary contract, as for the native PostgreSQL example and LiveKit. No acquisition at boot. */
 export declare function mongodbArgv(service: InfraService, data: string): string[];
 /** Whether the server answering MongoDB's protocol on the port is this child: its own serverStatus names its pid. A
  *  listener that is not answering yet, or another process's server on the port, is not. */
 export declare function mongodbServes(service: InfraService, pid: number): Promise<boolean>;
+/** MongoDB's two questions for a twin that serves the kind (twin-backing.ts): the same ownership question the
+ *  vendor's own server is asked above, so a pack that serves the kind answers serverStatus with its process's pid. */
+export declare const MONGODB_PROTOCOL: ManagedProtocol;
 /** Ping the server; initialize only an explicitly declared one-member set and await its primary. */
 export declare function mongodbReady(service: InfraService, launch: HostLaunch, deadline: number, initialize?: boolean): Promise<void>;

package/dist/src/mongodb-backing.js

@@ -1,3 +1,25 @@
+import { connect } from 'node:net';
+const PROTOCOL_QUESTION_MS = 1000;
+/** A refused connection cannot answer MongoDB. Ask that negative question before loading the driver,
+ *  whose server selection retries an absent endpoint for the whole protocol question budget.
+ *  A TCP acceptance is only permission to ask the original protocol question below. */
+function portConnects(port) {
+    return new Promise((resolve) => {
+        const socket = connect({ host: '127.0.0.1', port, timeout: PROTOCOL_QUESTION_MS });
+        let settled = false;
+        const finish = (connected) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            resolve(connected);
+        };
+        socket.once('connect', () => finish(true));
+        socket.on('error', () => finish(false));
+        socket.once('timeout', () => finish(false));
+        socket.once('close', () => finish(false));
+    });
+}
 /** PATH is the binary contract, as for the native PostgreSQL example and LiveKit. No acquisition at boot. */
 export function mongodbArgv(service, data) {
     return ['mongod', '--bind_ip', '127.0.0.1', '--port', String(service.hostPort), '--dbpath', data,
@@ -6,8 +28,10 @@ export function mongodbArgv(service, data) {
 /** Whether the server answering MongoDB's protocol on the port is this child: its own serverStatus names its pid. A
  *  listener that is not answering yet, or another process's server on the port, is not. */
 export async function mongodbServes(service, pid) {
+    if (!(await portConnects(service.hostPort)))
+        return false;
     const { MongoClient } = await import('mongodb');
-    const client = new MongoClient(`mongodb://127.0.0.1:${service.hostPort}`, { directConnection: true, timeoutMS: 1000, serverSelectionTimeoutMS: 1000 });
+    const client = new MongoClient(`mongodb://127.0.0.1:${service.hostPort}`, { directConnection: true, timeoutMS: PROTOCOL_QUESTION_MS, serverSelectionTimeoutMS: PROTOCOL_QUESTION_MS });
     try {
         await client.connect();
         const status = await client.db('admin').command({ serverStatus: 1 });
@@ -20,6 +44,52 @@ export async function mongodbServes(service, pid) {
         await client.close().catch(() => undefined);
     }
 }
+/** Whether anything speaking MongoDB's protocol answers on the port at all: a ping answered. */
+async function mongodbAnswers(port) {
+    if (!(await portConnects(port)))
+        return false;
+    const { MongoClient } = await import('mongodb');
+    const client = new MongoClient(`mongodb://127.0.0.1:${port}`, { directConnection: true, timeoutMS: PROTOCOL_QUESTION_MS, serverSelectionTimeoutMS: PROTOCOL_QUESTION_MS });
+    try {
+        await client.connect();
+        await client.db('admin').command({ ping: 1 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+/** MongoDB's two questions for a twin that serves the kind (twin-backing.ts): the same ownership question the
+ *  vendor's own server is asked above, so a pack that serves the kind answers serverStatus with its process's pid. */
+export const MONGODB_PROTOCOL = {
+    name: 'MongoDB', answers: mongodbAnswers,
+    async serves(port, pid, service) {
+        if (!(await mongodbServes({ kind: 'mongodb', hostPort: port }, pid)))
+            return false;
+        if (!service?.replicaSet)
+            return true;
+        // PID ownership alone cannot make a standalone listener ready for a replica-set URI. An older pack that
+        // ignores the new CLI option must fail this protocol question before the application is given its address.
+        const { MongoClient } = await import('mongodb');
+        const client = new MongoClient(`mongodb://127.0.0.1:${port}`, { directConnection: true,
+            timeoutMS: PROTOCOL_QUESTION_MS, serverSelectionTimeoutMS: PROTOCOL_QUESTION_MS });
+        try {
+            const hello = await client.db('admin').command({ hello: 1 });
+            const self = `127.0.0.1:${port}`;
+            return hello.setName === service.replicaSet && hello.isWritablePrimary === true && hello.primary === self
+                && Array.isArray(hello.hosts) && hello.hosts.length === 1 && hello.hosts[0] === self;
+        }
+        catch {
+            return false;
+        }
+        finally {
+            await client.close().catch(() => undefined);
+        }
+    },
+};
 /** Ping the server; initialize only an explicitly declared one-member set and await its primary. */
 export async function mongodbReady(service, launch, deadline, initialize = true) {
     const { MongoClient } = await import('mongodb');

package/dist/src/native-mariadb-backing.d.ts

@@ -0,0 +1,13 @@
+import { type MariaDBCredentials } from './mariadb-bootstrap.js';
+import { type NativeMariaDBReference } from './mariadb-supplier.js';
+import type { HostLaunch } from './pglite-backing.js';
+export interface NativeMariaDBService {
+    hostPort: number;
+    image: string;
+    reference: NativeMariaDBReference;
+    credentials: MariaDBCredentials;
+}
+export declare function nativeMariaDBUp(service: NativeMariaDBService, root: string, config: string, launch: HostLaunch): Promise<void>;
+export declare function nativeMariaDBStatus(service: NativeMariaDBService, root: string, config: string, launch: HostLaunch): Promise<boolean>;
+/** The held identity is enough to retire even if the supplier/config is gone. */
+export declare function nativeMariaDBDown(root: string): Promise<void>;