berimor 0.9.0

package/README.md

@@ -0,0 +1,39 @@
+# bootstrap
+
+npm-пакет установщика Berimor — см. `docs/arch/deployment.md` §2–3, ADR-0025.
+
+## Первая установка: скачивание, верификация, распаковка (D3)
+
+При первом запуске (`dist/index.js`) bootstrap определяет платформу
+(`platform.ts`), проверяет локальный кэш (`~/.cache/berimor/bin` на Linux,
+`~/Library/Caches/berimor/bin` на macOS, `%LOCALAPPDATA%\berimor\bin` на
+Windows — `cache-dir.ts`), при отсутствии — скачивает платформенный архив с
+GitHub Releases (`download.ts`), сверяет его SHA-256 с записью в
+`checksums.json` (`checksum.ts` + `checksums-manifest.ts`) и только затем
+атомарно распаковывает (`extract.ts`: временная директория рядом с целевой +
+`rename` одной операцией). Несовпадение хэша или отсутствие записи в
+`checksums.json` — явный отказ, ничего не распаковывается.
+
+`checksums.json` пишется не разработчиком, а CI (`release.yml`, job
+`publish`) на этапе публикации — сравнение идёт с независимым от GitHub
+Release каналом (npm), см. `docs/ROADMAP.md` §14 (D3) для полного разбора,
+почему верификация через уже существующий `verify.ts` (`berimor verify`,
+делегирование нативному бинарнику) циркулярна именно на первой установке и
+не используется здесь; `verify.ts` остаётся заделом для D4 (само-обновление).
+
+```sh
+npm run build
+npm test    # node:test, встроенный в Node ≥20 — новых dev-зависимостей нет
+```
+
+## Локальная разработка
+
+`postinstall` запускает `dist/postinstall.js`, поэтому при первом клоне репозитория нужна сборка до `npm install` от зависимостей:
+
+```sh
+npm install --ignore-scripts
+npm run build
+npm install   # теперь postinstall находит dist/ и проходит
+```
+
+В опубликованном пакете `dist/` уже собран и входит в тарбол — этот порядок нужен только локально, до первого `npm run build`.

package/checksums.json

@@ -0,0 +1,6 @@
+{
+  "berimor-v0.9.0-darwin-arm64.tar.gz": "89ba8ce69974bc35d1081afbd99035eec58095a266f0f305d7d4777c95e481ce",
+  "berimor-v0.9.0-linux-arm64.tar.gz": "9cef54507cf5654dfd64baeb43b862a48bfcd13433b8b335c10189a47fa330dc",
+  "berimor-v0.9.0-linux-x64.tar.gz": "b25e3055ce795475389cf67addb851c411bc89889ea3b6e78149bcc74f20dea2",
+  "berimor-v0.9.0-win32-x64.zip": "abceb5824b153d0326770164c4441d3823d1f99b6a2c701c850616c3aed6f8fd"
+}

package/dist/cache-dir.js

@@ -0,0 +1,28 @@
+/**
+ * Локальный кэш скачанных и распакованных платформенных артефактов.
+ *
+ * Источник: docs/arch/deployment.md §2 (bootstrap кэширует результат
+ * определения платформы и — здесь — сами скачанные бинарники, повторный
+ * запуск с уже установленной версией не должен снова обращаться к сети).
+ * ROADMAP: D3.
+ */
+import path from "node:path";
+export function resolveCacheDir(platform, env) {
+    if (platform === "win32") {
+        const base = env.localAppData ?? path.join(env.home, "AppData", "Local");
+        return path.join(base, "berimor", "bin");
+    }
+    if (platform === "darwin") {
+        return path.join(env.home, "Library", "Caches", "berimor", "bin");
+    }
+    const base = env.xdgCacheHome ?? path.join(env.home, ".cache");
+    return path.join(base, "berimor", "bin");
+}
+export function currentEnv() {
+    return {
+        home: process.env.HOME ?? process.env.USERPROFILE ?? "",
+        xdgCacheHome: process.env.XDG_CACHE_HOME,
+        localAppData: process.env.LOCALAPPDATA,
+    };
+}
+//# sourceMappingURL=cache-dir.js.map

package/dist/cache-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-dir.js","sourceRoot":"","sources":["../src/cache-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,GAAgB;IAClE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE;QACvD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QACxC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;KACvC,CAAC;AACJ,CAAC"}

package/dist/cache-dir.test.js

@@ -0,0 +1,25 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import path from "node:path";
+import { resolveCacheDir } from "./cache-dir.js";
+test("linux: XDG_CACHE_HOME задан", () => {
+    const dir = resolveCacheDir("linux", { home: "/home/u", xdgCacheHome: "/custom/cache" });
+    assert.equal(dir, path.join("/custom/cache", "berimor", "bin"));
+});
+test("linux: XDG_CACHE_HOME не задан — падаем на ~/.cache", () => {
+    const dir = resolveCacheDir("linux", { home: "/home/u" });
+    assert.equal(dir, path.join("/home/u", ".cache", "berimor", "bin"));
+});
+test("darwin: Library/Caches", () => {
+    const dir = resolveCacheDir("darwin", { home: "/Users/u" });
+    assert.equal(dir, path.join("/Users/u", "Library", "Caches", "berimor", "bin"));
+});
+test("win32: LOCALAPPDATA задан", () => {
+    const dir = resolveCacheDir("win32", { home: "C:\\Users\\u", localAppData: "C:\\Users\\u\\AppData\\Local" });
+    assert.equal(dir, path.join("C:\\Users\\u\\AppData\\Local", "berimor", "bin"));
+});
+test("win32: LOCALAPPDATA не задан — падаем на home/AppData/Local", () => {
+    const dir = resolveCacheDir("win32", { home: "C:\\Users\\u" });
+    assert.equal(dir, path.join("C:\\Users\\u", "AppData", "Local", "berimor", "bin"));
+});
+//# sourceMappingURL=cache-dir.test.js.map

package/dist/cache-dir.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-dir.test.js","sourceRoot":"","sources":["../src/cache-dir.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,IAAI,CAAC,6BAA6B,EAAE,GAAG,EAAE;IACvC,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;IACzF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;IAC/D,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;IAClC,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACrC,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAC7G,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACrF,CAAC,CAAC,CAAC"}

package/dist/checksum.js

@@ -0,0 +1,28 @@
+/**
+ * Верификация скачанного архива по SHA-256 из checksums.json (см.
+ * checksums-manifest.ts) — решение циркулярности первой установки: см.
+ * docstring verify.ts и ROADMAP D3. Сравнение — константным временем, раз
+ * один из операндов получен из недоверенного источника (скачанный файл).
+ */
+import crypto from "node:crypto";
+import fs from "node:fs";
+export function sha256Hex(filePath) {
+    const hash = crypto.createHash("sha256");
+    hash.update(fs.readFileSync(filePath));
+    return hash.digest("hex");
+}
+export class ChecksumMismatchError extends Error {
+    constructor(filePath, expectedHex, actualHex) {
+        super(`контрольная сумма не совпала для ${filePath}: ожидалось ${expectedHex}, получено ${actualHex} — файл не распаковывается`);
+        this.name = "ChecksumMismatchError";
+    }
+}
+export function verifyChecksum(filePath, expectedHex) {
+    const actualHex = sha256Hex(filePath);
+    const expected = Buffer.from(expectedHex, "hex");
+    const actual = Buffer.from(actualHex, "hex");
+    if (expected.length !== actual.length || !crypto.timingSafeEqual(expected, actual)) {
+        throw new ChecksumMismatchError(filePath, expectedHex, actualHex);
+    }
+}
+//# sourceMappingURL=checksum.js.map

package/dist/checksum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksum.js","sourceRoot":"","sources":["../src/checksum.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,QAAgB,EAAE,WAAmB,EAAE,SAAiB;QAClE,KAAK,CACH,oCAAoC,QAAQ,eAAe,WAAW,cAAc,SAAS,4BAA4B,CAC1H,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,WAAmB;IAClE,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;AACH,CAAC"}

package/dist/checksum.test.js

@@ -0,0 +1,31 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { sha256Hex, verifyChecksum, ChecksumMismatchError } from "./checksum.js";
+function tempFileWith(content) {
+    const p = path.join(os.tmpdir(), `berimor-checksum-test-${crypto.randomUUID()}`);
+    fs.writeFileSync(p, content);
+    return p;
+}
+test("sha256Hex совпадает с независимо посчитанным хэшем", () => {
+    const p = tempFileWith("hello berimor");
+    const expected = crypto.createHash("sha256").update("hello berimor").digest("hex");
+    assert.equal(sha256Hex(p), expected);
+    fs.rmSync(p);
+});
+test("verifyChecksum не бросает на совпадающем хэше", () => {
+    const p = tempFileWith("ok");
+    const hex = crypto.createHash("sha256").update("ok").digest("hex");
+    assert.doesNotThrow(() => verifyChecksum(p, hex));
+    fs.rmSync(p);
+});
+test("verifyChecksum бросает ChecksumMismatchError на несовпадающем хэше", () => {
+    const p = tempFileWith("tampered");
+    const wrongHex = crypto.createHash("sha256").update("original").digest("hex");
+    assert.throws(() => verifyChecksum(p, wrongHex), ChecksumMismatchError);
+    fs.rmSync(p);
+});
+//# sourceMappingURL=checksum.test.js.map

package/dist/checksum.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksum.test.js","sourceRoot":"","sources":["../src/checksum.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEjF,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,yBAAyB,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjF,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;IACzD,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAC9E,MAAM,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACxE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACf,CAAC,CAAC,CAAC"}

package/dist/checksums-manifest.js

@@ -0,0 +1,44 @@
+/**
+ * Пин SHA-256 платформенных артефактов внутри самого npm-пакета.
+ *
+ * Публикуется в checksums.json рядом с package.json на этапе `publish` job
+ * release.yml (см. комментарий там) — доверие к первой установке приходит
+ * из npm-канала, независимого от GitHub Release, который эти же файлы
+ * раздаёт (см. docstring verify.ts и ROADMAP D3 про циркулярность). Нет
+ * файла или нет записи под конкретный артефакт — явный отказ, не молчаливый
+ * пропуск верификации (тот же принцип, что и в остальном проекте).
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+function defaultManifestPath() {
+    const distDir = path.dirname(fileURLToPath(import.meta.url));
+    return path.join(distDir, "..", "checksums.json");
+}
+export class ChecksumsManifestMissingError extends Error {
+    constructor(manifestPath) {
+        super(`не найден список контрольных сумм (${manifestPath}) — bootstrap не может верифицировать первую установку, скачивание отклонено`);
+        this.name = "ChecksumsManifestMissingError";
+    }
+}
+export class ChecksumMissingForAssetError extends Error {
+    constructor(assetName, manifestPath) {
+        super(`в списке контрольных сумм (${manifestPath}) нет записи для ${assetName} — скачивание отклонено`);
+        this.name = "ChecksumMissingForAssetError";
+    }
+}
+export function loadChecksums(manifestPath = defaultManifestPath()) {
+    if (!fs.existsSync(manifestPath)) {
+        throw new ChecksumsManifestMissingError(manifestPath);
+    }
+    const raw = fs.readFileSync(manifestPath, "utf-8");
+    return JSON.parse(raw);
+}
+export function expectedChecksumFor(manifest, assetName, manifestPath = defaultManifestPath()) {
+    const hex = manifest[assetName];
+    if (!hex) {
+        throw new ChecksumMissingForAssetError(assetName, manifestPath);
+    }
+    return hex;
+}
+//# sourceMappingURL=checksums-manifest.js.map

package/dist/checksums-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksums-manifest.js","sourceRoot":"","sources":["../src/checksums-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,YAAoB;QAC9B,KAAK,CACH,sCAAsC,YAAY,8EAA8E,CACjI,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,SAAiB,EAAE,YAAoB;QACjD,KAAK,CACH,8BAA8B,YAAY,oBAAoB,SAAS,yBAAyB,CACjG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,eAAuB,mBAAmB,EAAE;IACxE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,6BAA6B,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAA2B,EAC3B,SAAiB,EACjB,eAAuB,mBAAmB,EAAE;IAE5C,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,4BAA4B,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/checksums-manifest.test.js

@@ -0,0 +1,35 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { loadChecksums, expectedChecksumFor, ChecksumsManifestMissingError, ChecksumMissingForAssetError, } from "./checksums-manifest.js";
+function tempManifest(content) {
+    const p = path.join(os.tmpdir(), `berimor-checksums-test-${crypto.randomUUID()}.json`);
+    fs.writeFileSync(p, JSON.stringify(content));
+    return p;
+}
+test("loadChecksums бросает ChecksumsManifestMissingError на отсутствующем файле", () => {
+    const missing = path.join(os.tmpdir(), `berimor-does-not-exist-${crypto.randomUUID()}.json`);
+    assert.throws(() => loadChecksums(missing), ChecksumsManifestMissingError);
+});
+test("loadChecksums читает существующий файл", () => {
+    const p = tempManifest({ "asset.tar.gz": "deadbeef" });
+    const manifest = loadChecksums(p);
+    assert.equal(manifest["asset.tar.gz"], "deadbeef");
+    fs.rmSync(p);
+});
+test("expectedChecksumFor бросает ChecksumMissingForAssetError на отсутствующей записи", () => {
+    const p = tempManifest({ "other.tar.gz": "deadbeef" });
+    const manifest = loadChecksums(p);
+    assert.throws(() => expectedChecksumFor(manifest, "asset.tar.gz", p), ChecksumMissingForAssetError);
+    fs.rmSync(p);
+});
+test("expectedChecksumFor возвращает значение на существующей записи", () => {
+    const p = tempManifest({ "asset.tar.gz": "cafebabe" });
+    const manifest = loadChecksums(p);
+    assert.equal(expectedChecksumFor(manifest, "asset.tar.gz", p), "cafebabe");
+    fs.rmSync(p);
+});
+//# sourceMappingURL=checksums-manifest.test.js.map

package/dist/checksums-manifest.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksums-manifest.test.js","sourceRoot":"","sources":["../src/checksums-manifest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AAEjC,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,0BAA0B,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACvF,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,IAAI,CAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,0BAA0B,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,6BAA6B,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;IAClD,MAAM,CAAC,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,CAAC;IACnD,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,CAAC,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;IACpG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,CAAC,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3E,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACf,CAAC,CAAC,CAAC"}

package/dist/download.js

@@ -0,0 +1,24 @@
+/**
+ * Скачивание платформенного артефакта с GitHub Releases репозитория проекта.
+ *
+ * Источник: docs/arch/deployment.md §2–3. ROADMAP: D3. Верификация — не
+ * здесь: вызывающий код (index.ts) сверяет скачанный файл с пином из
+ * checksums-manifest.ts ДО распаковки (checksum.ts) — эта функция только
+ * переносит байты, ничего не проверяет и не исполняет.
+ */
+import fs from "node:fs";
+export const RELEASE_REPOSITORY = "devpilgrin/berimor";
+export function releaseAssetUrl(version, assetName) {
+    return `https://github.com/${RELEASE_REPOSITORY}/releases/download/v${version}/${assetName}`;
+}
+export class DownloadError extends Error {
+}
+export async function downloadAsset(url, destPath, fetchImpl = fetch) {
+    const response = await fetchImpl(url);
+    if (!response.ok) {
+        throw new DownloadError(`скачивание ${url} завершилось с HTTP ${response.status}`);
+    }
+    const buffer = Buffer.from(await response.arrayBuffer());
+    fs.writeFileSync(destPath, buffer);
+}
+//# sourceMappingURL=download.js.map

package/dist/download.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"download.js","sourceRoot":"","sources":["../src/download.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,SAAiB;IAChE,OAAO,sBAAsB,kBAAkB,uBAAuB,OAAO,IAAI,SAAS,EAAE,CAAC;AAC/F,CAAC;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;CAAG;AAE3C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,QAAgB,EAChB,YAA0B,KAAK;IAE/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,cAAc,GAAG,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC"}

package/dist/download.test.js

@@ -0,0 +1,26 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { downloadAsset, releaseAssetUrl, DownloadError, RELEASE_REPOSITORY } from "./download.js";
+function tempDestPath() {
+    return path.join(os.tmpdir(), `berimor-download-test-${crypto.randomUUID()}`);
+}
+test("releaseAssetUrl строит URL на GitHub Releases репозитория проекта", () => {
+    const url = releaseAssetUrl("1.2.3", "berimor-1.2.3-linux-x64.tar.gz");
+    assert.equal(url, `https://github.com/${RELEASE_REPOSITORY}/releases/download/v1.2.3/berimor-1.2.3-linux-x64.tar.gz`);
+});
+test("downloadAsset пишет тело успешного ответа в destPath", async () => {
+    const dest = tempDestPath();
+    const fakeFetch = (async () => new Response(new Blob([Buffer.from("archive-bytes")]), { status: 200 }));
+    await downloadAsset("https://example.invalid/asset", dest, fakeFetch);
+    assert.equal(fs.readFileSync(dest, "utf-8"), "archive-bytes");
+    fs.rmSync(dest, { force: true });
+});
+test("downloadAsset бросает DownloadError на не-2xx ответе", async () => {
+    const fakeFetch = (async () => new Response(null, { status: 404 }));
+    await assert.rejects(() => downloadAsset("https://example.invalid/missing", tempDestPath(), fakeFetch), DownloadError);
+});
+//# sourceMappingURL=download.test.js.map

package/dist/download.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"download.test.js","sourceRoot":"","sources":["../src/download.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAElG,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,yBAAyB,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,kBAAkB,0DAA0D,CAAC,CAAC;AACxH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;IACtE,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAC5B,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAiB,CAAC;IAC3F,MAAM,aAAa,CAAC,+BAA+B,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;IAC9D,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;IACtE,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAiB,CAAC;IACpF,MAAM,MAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CAAC,aAAa,CAAC,iCAAiC,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,EACjF,aAAa,CACd,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/extract.js

@@ -0,0 +1,64 @@
+/**
+ * Атомарная распаковка платформенного архива в кэш.
+ *
+ * Источник: docs/arch/deployment.md §2 («атомарная распаковка»). ROADMAP: D3.
+ * Распаковка — во временную директорию рядом с целевой (та же ФС — условие
+ * атомарности rename), затем переименование на финальное имя одной
+ * операцией: до переименования частично распакованное содержимое никогда
+ * не видно под конечным путём. Используются нативные средства платформы
+ * (`tar` на unix, `Expand-Archive` на Windows), не новая npm-зависимость —
+ * то же соглашение, что и в D1 (нативные раннеры вместо кросс-инструментов).
+ */
+import { randomUUID } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+export class ExtractError extends Error {
+}
+function extractInto(archivePath, tmpDir, platform) {
+    if (platform === "win32") {
+        const escaped = (p) => `'${p.replace(/'/g, "''")}'`;
+        const command = `Expand-Archive -LiteralPath ${escaped(archivePath)} -DestinationPath ${escaped(tmpDir)} -Force`;
+        const result = spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", command], {
+            stdio: "pipe",
+            encoding: "utf-8",
+        });
+        if (result.status !== 0) {
+            throw new ExtractError(`Expand-Archive завершился с ошибкой: ${result.stderr || result.error?.message}`);
+        }
+        return;
+    }
+    const result = spawnSync("tar", ["-xzf", archivePath, "-C", tmpDir], {
+        stdio: "pipe",
+        encoding: "utf-8",
+    });
+    if (result.status !== 0) {
+        throw new ExtractError(`tar завершился с ошибкой: ${result.stderr || result.error?.message}`);
+    }
+}
+export function extractAtomically(archivePath, destDir, platform) {
+    if (fs.existsSync(destDir)) {
+        return;
+    }
+    const parent = path.dirname(destDir);
+    fs.mkdirSync(parent, { recursive: true });
+    const tmpDir = `${destDir}.tmp-${randomUUID()}`;
+    fs.mkdirSync(tmpDir, { recursive: true });
+    try {
+        extractInto(archivePath, tmpDir, platform);
+        fs.renameSync(tmpDir, destDir);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOTEMPTY" || code === "EEXIST") {
+            // Конкурентная/повторная установка уже материализовала destDir между
+            // проверкой существования выше и переименованием — принимаем её как
+            // валидную (она сама появилась тем же атомарным путём), не ошибка.
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+            return;
+        }
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+        throw err;
+    }
+}
+//# sourceMappingURL=extract.js.map

package/dist/extract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.js","sourceRoot":"","sources":["../src/extract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAE1C,SAAS,WAAW,CAAC,WAAmB,EAAE,MAAc,EAAE,QAAkB;IAC1E,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;QAC5D,MAAM,OAAO,GAAG,+BAA+B,OAAO,CAAC,WAAW,CAAC,qBAAqB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QACjH,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;YAC7F,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CAAC,wCAAwC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;QACnE,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC,6BAA6B,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,OAAe,EAAE,QAAkB;IACxF,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,GAAG,OAAO,QAAQ,UAAU,EAAE,EAAE,CAAC;IAChD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,IAAI,CAAC;QACH,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,qEAAqE;YACrE,oEAAoE;YACpE,mEAAmE;YACnE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/extract.test.js

@@ -0,0 +1,42 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { extractAtomically } from "./extract.js";
+const fixturesDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "fixtures", "golden", "bootstrap");
+function tempDestDir() {
+    return path.join(os.tmpdir(), `berimor-extract-test-${crypto.randomUUID()}`);
+}
+test("unix: tar.gz распаковывается в целевую директорию", () => {
+    const archive = path.join(fixturesDir, "sample.tar.gz");
+    const dest = tempDestDir();
+    extractAtomically(archive, dest, "linux");
+    const content = fs.readFileSync(path.join(dest, "hello.txt"), "utf-8");
+    assert.equal(content, "berimor bootstrap fixture\n");
+    fs.rmSync(dest, { recursive: true, force: true });
+});
+test("повторный вызов на уже существующую целевую директорию — не падает", () => {
+    const archive = path.join(fixturesDir, "sample.tar.gz");
+    const dest = tempDestDir();
+    extractAtomically(archive, dest, "linux");
+    assert.doesNotThrow(() => extractAtomically(archive, dest, "linux"));
+    const content = fs.readFileSync(path.join(dest, "hello.txt"), "utf-8");
+    assert.equal(content, "berimor bootstrap fixture\n");
+    fs.rmSync(dest, { recursive: true, force: true });
+});
+test("win32: zip распаковывается в целевую директорию (только на Windows)", (t) => {
+    if (os.platform() !== "win32") {
+        t.skip("Expand-Archive недоступен вне Windows — CI (bootstrap job) прогоняет только ubuntu-latest");
+        return;
+    }
+    const archive = path.join(fixturesDir, "sample.zip");
+    const dest = tempDestDir();
+    extractAtomically(archive, dest, "win32");
+    const content = fs.readFileSync(path.join(dest, "hello.txt"), "utf-8");
+    assert.equal(content, "berimor bootstrap fixture\n");
+    fs.rmSync(dest, { recursive: true, force: true });
+});
+//# sourceMappingURL=extract.test.js.map

package/dist/extract.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.test.js","sourceRoot":"","sources":["../src/extract.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAE3H,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACrD,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACrD,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,CAAC,CAAC,EAAE,EAAE;IAChF,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;QACpG,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACrD,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC"}

package/dist/index.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/**
+ * berimor — bootstrap-точка входа.
+ *
+ * Определяет платформу; при первом запуске скачивает и верифицирует
+ * нативный артефакт по SHA-256, пришпиленному в checksums.json самого
+ * npm-пакета (см. checksums-manifest.ts — почему не через `berimor verify`
+ * на первой установке), атомарно распаковывает; дальше и при повторных
+ * запусках делегирует нативному бинарнику с передачей аргументов.
+ * Источник: docs/arch/deployment.md §5. ROADMAP: D3 (это), D4 (само-
+ * обновление — не здесь).
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { detectPlatform } from "./platform.js";
+import { resolveCacheDir, currentEnv } from "./cache-dir.js";
+import { downloadAsset, releaseAssetUrl } from "./download.js";
+import { verifyChecksum } from "./checksum.js";
+import { loadChecksums, expectedChecksumFor } from "./checksums-manifest.js";
+import { extractAtomically } from "./extract.js";
+export function ownVersion() {
+    const distDir = path.dirname(fileURLToPath(import.meta.url));
+    const packageJsonPath = path.join(distDir, "..", "package.json");
+    const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+    return pkg.version;
+}
+/**
+ * Гарантирует, что нативный бинарник версии `opts.version` присутствует в
+ * `opts.cacheDir` — скачивает, верифицирует по пину и атомарно распаковывает
+ * при необходимости; возвращает путь к бинарнику. Параметры инжектируются
+ * (не читаются из реального окружения напрямую) ради тестируемости без
+ * настоящей сети/npm — см. index.test.ts.
+ */
+export async function ensureInstalled(opts) {
+    const info = detectPlatform(opts.version);
+    const binaryName = info.platform === "win32" ? "berimor.exe" : "berimor";
+    const targetDir = path.join(opts.cacheDir, opts.version);
+    const binaryPath = path.join(targetDir, binaryName);
+    if (fs.existsSync(binaryPath)) {
+        return binaryPath;
+    }
+    const manifest = loadChecksums(opts.manifestPath);
+    const expectedHex = expectedChecksumFor(manifest, info.assetName, opts.manifestPath);
+    const tmpArchivePath = path.join(os.tmpdir(), `${randomUUID()}-${info.assetName}`);
+    await downloadAsset(releaseAssetUrl(opts.version, info.assetName), tmpArchivePath, opts.fetchImpl ?? fetch);
+    try {
+        verifyChecksum(tmpArchivePath, expectedHex);
+        extractAtomically(tmpArchivePath, targetDir, info.platform);
+    }
+    finally {
+        fs.rmSync(tmpArchivePath, { force: true });
+    }
+    return binaryPath;
+}
+function delegate(binaryPath, args) {
+    const result = spawnSync(binaryPath, args, { stdio: "inherit" });
+    process.exitCode = result.status ?? 1;
+}
+async function main() {
+    const version = ownVersion();
+    const binaryPath = await ensureInstalled({
+        version,
+        cacheDir: resolveCacheDir(detectPlatform(version).platform, currentEnv()),
+    });
+    delegate(binaryPath, process.argv.slice(2));
+}
+const isMainModule = process.argv[1] === fileURLToPath(import.meta.url);
+if (isMainModule) {
+    main().catch((err) => {
+        console.error(`[berimor] ${err.message}`);
+        process.exitCode = 1;
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AASjD,MAAM,UAAU,UAAU;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACzF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAA4B;IAChE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAEpD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAErF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;IAE5G,IAAI,CAAC;QACH,cAAc,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC5C,iBAAiB,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB,EAAE,IAAc;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC;QACvC,OAAO;QACP,QAAQ,EAAE,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxE,IAAI,YAAY,EAAE,CAAC;IACjB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,aAAc,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.test.js

@@ -0,0 +1,74 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { ensureInstalled } from "./index.js";
+import { detectPlatform } from "./platform.js";
+import { sha256Hex } from "./checksum.js";
+import { ChecksumMismatchError } from "./checksum.js";
+const fixturesDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "fixtures", "golden", "bootstrap");
+const sampleArchive = path.join(fixturesDir, "sample.tar.gz");
+function tempDir() {
+    const p = path.join(os.tmpdir(), `berimor-index-test-${crypto.randomUUID()}`);
+    fs.mkdirSync(p, { recursive: true });
+    return p;
+}
+function writeManifest(dir, assetName, hex) {
+    const p = path.join(dir, "checksums.json");
+    fs.writeFileSync(p, JSON.stringify({ [assetName]: hex }));
+    return p;
+}
+test("ensureInstalled: нет кэша → скачивает (фейковый fetch) → сверяет хэш → распаковывает", async () => {
+    const version = "9.9.9-test";
+    const info = detectPlatform(version);
+    const archiveBytes = fs.readFileSync(sampleArchive);
+    const correctHex = sha256Hex(sampleArchive);
+    const workDir = tempDir();
+    const manifestPath = writeManifest(workDir, info.assetName, correctHex);
+    const cacheDir = path.join(workDir, "cache");
+    const fakeFetch = (async () => new Response(new Blob([archiveBytes]), { status: 200 }));
+    const binaryPath = await ensureInstalled({ version, cacheDir, manifestPath, fetchImpl: fakeFetch });
+    const binaryName = info.platform === "win32" ? "berimor.exe" : "berimor";
+    assert.equal(binaryPath, path.join(cacheDir, version, binaryName));
+    // sample.tar.gz распаковывает hello.txt, не berimor(.exe) — реального
+    // бинарника во фикстуре нет, важна только сама распаковка по месту.
+    assert.equal(fs.readFileSync(path.join(cacheDir, version, "hello.txt"), "utf-8"), "berimor bootstrap fixture\n");
+    fs.rmSync(workDir, { recursive: true, force: true });
+});
+test("ensureInstalled: уже скачанный бинарник в кэше — сеть не трогается", async () => {
+    const version = "9.9.9-cached";
+    const info = detectPlatform(version);
+    const binaryName = info.platform === "win32" ? "berimor.exe" : "berimor";
+    const workDir = tempDir();
+    const cacheDir = path.join(workDir, "cache");
+    fs.mkdirSync(path.join(cacheDir, version), { recursive: true });
+    fs.writeFileSync(path.join(cacheDir, version, binaryName), "already here");
+    const fetchThatMustNotBeCalled = (async () => {
+        throw new Error("сеть не должна была вызываться — бинарник уже в кэше");
+    });
+    const binaryPath = await ensureInstalled({
+        version,
+        cacheDir,
+        manifestPath: path.join(workDir, "does-not-matter.json"),
+        fetchImpl: fetchThatMustNotBeCalled,
+    });
+    assert.equal(binaryPath, path.join(cacheDir, version, binaryName));
+    fs.rmSync(workDir, { recursive: true, force: true });
+});
+test("ensureInstalled: подменённый архив (неверный хэш) — отказ без распаковки", async () => {
+    const version = "9.9.9-tampered";
+    const info = detectPlatform(version);
+    const archiveBytes = fs.readFileSync(sampleArchive);
+    const wrongHex = crypto.createHash("sha256").update("не тот файл").digest("hex");
+    const workDir = tempDir();
+    const manifestPath = writeManifest(workDir, info.assetName, wrongHex);
+    const cacheDir = path.join(workDir, "cache");
+    const fakeFetch = (async () => new Response(new Blob([archiveBytes]), { status: 200 }));
+    await assert.rejects(() => ensureInstalled({ version, cacheDir, manifestPath, fetchImpl: fakeFetch }), ChecksumMismatchError);
+    assert.equal(fs.existsSync(path.join(cacheDir, version)), false);
+    fs.rmSync(workDir, { recursive: true, force: true });
+});
+//# sourceMappingURL=index.test.js.map

package/dist/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC3H,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AAE9D,SAAS,OAAO;IACd,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9E,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,SAAiB,EAAE,GAAW;IAChE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC3C,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,IAAI,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACtG,MAAM,OAAO,GAAG,YAAY,CAAC;IAC7B,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;IAC1B,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAiB,CAAC;IAExG,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAEpG,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,CAAC,KAAK,CACV,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,EACnE,6BAA6B,CAC9B,CAAC;IAEF,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;IACpF,MAAM,OAAO,GAAG,cAAc,CAAC;IAC/B,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzE,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,cAAc,CAAC,CAAC;IAE3E,MAAM,wBAAwB,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC,CAA4B,CAAC;IAE9B,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC;QACvC,OAAO;QACP,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC;QACxD,SAAS,EAAE,wBAAwB;KACpC,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,OAAO,GAAG,gBAAgB,CAAC;IACjC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjF,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;IAC1B,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAiB,CAAC;IAExG,MAAM,MAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAChF,qBAAqB,CACtB,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC"}

package/dist/platform.js

@@ -0,0 +1,24 @@
+/**
+ * Определение платформы и имени ожидаемого артефакта.
+ *
+ * Источник: docs/arch/deployment.md §3. ROADMAP: D3.
+ * Определение — кодом (os.platform()/os.arch()), без эвристик; неизвестная
+ * комбинация — явный отказ, а не попытка угадать ближайшую (deployment.md §3).
+ */
+import os from "node:os";
+const SUPPORTED_PLATFORMS = ["linux", "darwin", "win32"];
+const SUPPORTED_ARCHES = ["x64", "arm64"];
+export function detectPlatform(version) {
+    const platform = os.platform();
+    const arch = os.arch();
+    if (!SUPPORTED_PLATFORMS.includes(platform)) {
+        throw new Error(`неподдерживаемая платформа: ${platform}`);
+    }
+    if (!SUPPORTED_ARCHES.includes(arch)) {
+        throw new Error(`неподдерживаемая архитектура: ${arch}`);
+    }
+    const ext = platform === "win32" ? "zip" : "tar.gz";
+    const assetName = `berimor-${version}-${platform}-${arch}.${ext}`;
+    return { platform: platform, arch: arch, assetName };
+}
+//# sourceMappingURL=platform.js.map

package/dist/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AAWzB,MAAM,mBAAmB,GAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACrE,MAAM,gBAAgB,GAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAElD,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IAEvB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAoB,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,OAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;IAElE,OAAO,EAAE,QAAQ,EAAE,QAAoB,EAAE,IAAI,EAAE,IAAY,EAAE,SAAS,EAAE,CAAC;AAC3E,CAAC"}

package/dist/postinstall.js

@@ -0,0 +1,19 @@
+/**
+ * postinstall-хук npm.
+ *
+ * Источник: docs/arch/deployment.md §9 — граница №4: «bootstrap не выполняет
+ * ничего, кроме определения платформы, на этапе установки». Это крупнейшая
+ * типовая поверхность атаки цепочки поставок для npm-пакетов, поэтому здесь
+ * нет ни скачивания, ни исполнения чего-либо — только определение платформы.
+ * Скачивание и верификация — на первом запуске (index.ts), не здесь.
+ */
+import { detectPlatform } from "./platform.js";
+try {
+    const info = detectPlatform(process.env.npm_package_version ?? "0.0.0");
+    console.log(`[berimor] платформа определена: ${info.platform}/${info.arch}`);
+}
+catch (err) {
+    console.error(`[berimor] ${err.message}`);
+    process.exitCode = 1;
+}
+//# sourceMappingURL=postinstall.js.map

package/dist/postinstall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postinstall.js","sourceRoot":"","sources":["../src/postinstall.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,IAAI,CAAC;IACH,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/E,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,KAAK,CAAC,aAAc,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/verify.js

@@ -0,0 +1,25 @@
+/**
+ * Верификация подписи артефакта уже доверенным нативным бинарником.
+ *
+ * Источник: docs/arch/deployment.md §9, ADR-0025 — bootstrap не реализует
+ * криптографическую проверку сам, а вызывает подкоманду `berimor verify`
+ * уже доверенного нативного бинарника, а не переизобретает её на другом
+ * языке (риск расхождения двух независимых реализаций одной проверки).
+ *
+ * Не используется на первой установке (см. checksums-manifest.ts): на первом
+ * запуске ещё нет доверенного нативного бинарника, который мог бы проверить
+ * сам себя — вызов этой функции над только что скачанным, ещё не
+ * верифицированным бинарником циркулярен (поддельный бинарник соврёт на
+ * собственный `verify`). Первая установка верифицируется отдельно, по
+ * SHA-256, пришпиленному в сам npm-пакет (ROADMAP D3, checksum.ts). Эта
+ * функция — задел для D4 (само-обновление): там уже есть предыдущий
+ * доверенный бинарник, который проверяет новый, — не циркулярно.
+ */
+import { spawnSync } from "node:child_process";
+export function verifyArtifact(nativeBinaryPath, artifactPath) {
+    const result = spawnSync(nativeBinaryPath, ["verify", artifactPath], {
+        stdio: "inherit",
+    });
+    return result.status === 0;
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,UAAU,cAAc,CAAC,gBAAwB,EAAE,YAAoB;IAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE;QACnE,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "berimor",
+  "version": "0.9.0",
+  "description": "Bootstrap-установщик Berimor: определение платформы, скачивание и верификация платформенного артефакта, оркестрация само-обновления.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/devpilgrin/berimor",
+    "directory": "bootstrap"
+  },
+  "type": "module",
+  "bin": {
+    "berimor": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "checksums.json"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "postinstall": "node dist/postinstall.js",
+    "test": "node --test dist/*.test.js"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "typescript": "^5.6.0"
+  }
+}