create-principles-disciple 1.121.8 → 1.121.9

package/dist/update/release-asset-manifest.js

@@ -0,0 +1,161 @@
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import * as path from 'node:path';
+export class ReleaseAssetManifestError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ReleaseAssetManifestError';
+        this.code = code;
+    }
+}
+function isSafeRelativePath(value) {
+    return value.length > 0
+        && !path.isAbsolute(value)
+        && !value.split(/[\\/]/).some((segment) => segment.length === 0 || segment === '.' || segment === '..');
+}
+function listPayloadFilePaths(assetDir) {
+    const rootDir = path.resolve(assetDir);
+    if (!fs.existsSync(rootDir) || !fs.statSync(rootDir).isDirectory()) {
+        throw new ReleaseAssetManifestError('asset_directory_missing', `Release asset directory does not exist: ${rootDir}`);
+    }
+    const files = [];
+    const visit = (directory) => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+            const absolutePath = path.resolve(directory, entry.name);
+            // Containment guard: enumeration must never escape the asset root.
+            if (absolutePath !== rootDir && !absolutePath.startsWith(rootDir + path.sep)) {
+                throw new ReleaseAssetManifestError('asset_path_unsafe', `Release asset enumeration escaped the asset root: ${absolutePath}`);
+            }
+            const relativePath = path.relative(rootDir, absolutePath).split(path.sep).join('/');
+            if (relativePath === '_release')
+                continue;
+            // Depth-0 node_modules is the package's own toolchain install, excluded
+            // from the manifest by build-release-asset — the verifier must apply
+            // the identical rule or every packaged install would report unexpected
+            // files.
+            if (relativePath === 'node_modules')
+                continue;
+            if (entry.isSymbolicLink()) {
+                throw new ReleaseAssetManifestError('asset_path_unsafe', `Release asset must not contain symlinks: ${relativePath}`);
+            }
+            if (entry.isDirectory()) {
+                visit(absolutePath);
+                continue;
+            }
+            if (!entry.isFile() || !isSafeRelativePath(relativePath)) {
+                throw new ReleaseAssetManifestError('asset_path_unsafe', `Release asset contains an unsafe entry: ${relativePath}`);
+            }
+            files.push({ absolutePath, relativePath });
+        }
+    };
+    visit(rootDir);
+    return files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+}
+function readPayloadFiles(assetDir) {
+    return listPayloadFilePaths(assetDir).map(({ absolutePath, relativePath }) => {
+        const bytes = fs.readFileSync(absolutePath);
+        return {
+            path: relativePath,
+            sha256: createHash('sha256').update(bytes).digest('hex'),
+            size: bytes.length,
+        };
+    });
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function parseReleaseAssetManifest(value) {
+    if (!isRecord(value) || value.schemaVersion !== 1 || !Array.isArray(value.files)) {
+        throw new ReleaseAssetManifestError('asset_manifest_invalid', 'Release asset manifest has an unsupported schema.');
+    }
+    const files = [];
+    const seenPaths = new Set();
+    for (const file of value.files) {
+        if (!isRecord(file)) {
+            throw new ReleaseAssetManifestError('asset_manifest_invalid', 'Release asset manifest contains an invalid file record.');
+        }
+        const { path: filePath, sha256, size } = file;
+        if (typeof filePath !== 'string' || !isSafeRelativePath(filePath) || seenPaths.has(filePath)) {
+            throw new ReleaseAssetManifestError('asset_manifest_invalid', 'Release asset manifest contains an unsafe or duplicate path.');
+        }
+        if (typeof size !== 'number' || !Number.isSafeInteger(size) || size < 0 || typeof sha256 !== 'string' || !/^[a-f0-9]{64}$/i.test(sha256)) {
+            throw new ReleaseAssetManifestError('asset_manifest_invalid', `Release asset manifest has invalid integrity data for ${filePath}.`);
+        }
+        seenPaths.add(filePath);
+        files.push({ path: filePath, size, sha256: sha256.toLowerCase() });
+    }
+    return { schemaVersion: 1, files };
+}
+export function parseReleaseAssetIdentity(value) {
+    if (!isRecord(value) || value.schemaVersion !== 1) {
+        throw new ReleaseAssetManifestError('asset_identity_invalid', 'Release asset identity has an unsupported schema.');
+    }
+    const platform = Object.hasOwn(value, 'platform') ? value.platform : undefined;
+    const arch = Object.hasOwn(value, 'arch') ? value.arch : undefined;
+    const nodeAbi = Object.hasOwn(value, 'nodeAbi') ? value.nodeAbi : undefined;
+    if (typeof platform !== 'string' || platform.trim().length === 0
+        || typeof arch !== 'string' || arch.trim().length === 0
+        || typeof nodeAbi !== 'string' || !/^\d+$/.test(nodeAbi)) {
+        throw new ReleaseAssetManifestError('asset_identity_invalid', 'Release asset identity must declare platform, architecture, and numeric Node ABI.');
+    }
+    return { schemaVersion: 1, platform, arch, nodeAbi };
+}
+export function verifyReleaseAssetTarget(identity, target) {
+    const validatedIdentity = parseReleaseAssetIdentity(identity);
+    if (validatedIdentity.platform !== target.platform
+        || validatedIdentity.arch !== target.arch
+        || validatedIdentity.nodeAbi !== target.nodeAbi) {
+        throw new ReleaseAssetManifestError('asset_target_mismatch', `Release asset target ${validatedIdentity.platform}/${validatedIdentity.arch}/abi${validatedIdentity.nodeAbi} does not match this runtime ${target.platform}/${target.arch}/abi${target.nodeAbi}.`);
+    }
+}
+export function createReleaseAssetManifest(assetDir) {
+    return { schemaVersion: 1, files: readPayloadFiles(assetDir) };
+}
+export function verifyReleaseAssetManifest(assetDir, manifest) {
+    const validatedManifest = parseReleaseAssetManifest(manifest);
+    const actualFiles = readPayloadFiles(assetDir);
+    const expectedByPath = new Map(validatedManifest.files.map((file) => [file.path, file]));
+    if (actualFiles.length !== expectedByPath.size) {
+        throw new ReleaseAssetManifestError('asset_file_unexpected', 'Release asset file set does not match its manifest.');
+    }
+    for (const actualFile of actualFiles) {
+        const expectedFile = expectedByPath.get(actualFile.path);
+        if (!expectedFile) {
+            throw new ReleaseAssetManifestError('asset_file_unexpected', `Release asset contains an unexpected file: ${actualFile.path}`);
+        }
+        if (actualFile.size !== expectedFile.size || actualFile.sha256 !== expectedFile.sha256.toLowerCase()) {
+            throw new ReleaseAssetManifestError('asset_digest_mismatch', `Release asset integrity check failed: ${actualFile.path}`);
+        }
+    }
+}
+export async function verifyReleaseAssetManifestAsync(assetDir, manifest) {
+    const validatedManifest = parseReleaseAssetManifest(manifest);
+    const payloadPaths = listPayloadFilePaths(assetDir);
+    const expectedByPath = new Map(validatedManifest.files.map((file) => [file.path, file]));
+    if (payloadPaths.length !== expectedByPath.size) {
+        throw new ReleaseAssetManifestError('asset_file_unexpected', 'Release asset file set does not match its manifest.');
+    }
+    const concurrency = Math.min(64, Math.max(1, payloadPaths.length));
+    let nextIndex = 0;
+    await Promise.all(Array.from({ length: concurrency }, async () => {
+        while (nextIndex < payloadPaths.length) {
+            const index = nextIndex;
+            nextIndex += 1;
+            const payload = payloadPaths[index];
+            if (!payload)
+                throw new ReleaseAssetManifestError('asset_manifest_invalid', 'Release asset verification lost its file cursor.');
+            const expected = expectedByPath.get(payload.relativePath);
+            if (!expected) {
+                throw new ReleaseAssetManifestError('asset_file_unexpected', `Release asset contains an unexpected file: ${payload.relativePath}`);
+            }
+            const bytes = await readFile(payload.absolutePath);
+            const digest = createHash('sha256').update(bytes).digest('hex');
+            if (bytes.length !== expected.size || digest !== expected.sha256) {
+                throw new ReleaseAssetManifestError('asset_digest_mismatch', `Release asset integrity check failed: ${payload.relativePath}`);
+            }
+        }
+    }));
+}
+//# sourceMappingURL=release-asset-manifest.js.map

package/dist/update/release-asset-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-asset-manifest.js","sourceRoot":"","sources":["../../src/update/release-asset-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AA6BlC,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,CAAgC;IAE7C,YAAY,IAAmC,EAAE,OAAe;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;WAClB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;WACvB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AAC5G,CAAC;AAOD,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACxC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACvE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzD,mEAAmE;YACnE,IAAI,YAAY,KAAK,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,EAAE,qDAAqD,YAAY,EAAE,CAAC,CAAC;YAChI,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpF,IAAI,YAAY,KAAK,UAAU;gBAAE,SAAS;YAC1C,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,SAAS;YACT,IAAI,YAAY,KAAK,cAAc;gBAAE,SAAS;YAC9C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,EAAE,4CAA4C,YAAY,EAAE,CAAC,CAAC;YACvH,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,KAAK,CAAC,YAAY,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,EAAE,2CAA2C,YAAY,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACxD,IAAI,EAAE,KAAK,CAAC,MAAM;SACnB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,EAAE,mDAAmD,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,EAAE,yDAAyD,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,EAAE,8DAA8D,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzI,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,EAAE,yDAAyD,QAAQ,GAAG,CAAC,CAAC;QACtI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,EAAE,mDAAmD,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;WAC3D,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;WACpD,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,EAAE,mFAAmF,CAAC,CAAC;IACrJ,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAA8B,EAC9B,MAA2D;IAE3D,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,iBAAiB,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WAC7C,iBAAiB,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;WACtC,iBAAiB,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,uBAAuB,EACvB,wBAAwB,iBAAiB,CAAC,QAAQ,IAAI,iBAAiB,CAAC,IAAI,OAAO,iBAAiB,CAAC,OAAO,gCAAgC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,GAAG,CACnM,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,QAA8B;IACzF,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,WAAW,CAAC,MAAM,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,EAAE,qDAAqD,CAAC,CAAC;IACtH,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,EAAE,8CAA8C,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YACrG,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,EAAE,yCAAyC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,QAAgB,EAAE,QAA8B;IACpG,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,EAAE,qDAAqD,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,IAAI,EAAE;QAC/D,OAAO,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,SAAS,CAAC;YACxB,SAAS,IAAI,CAAC,CAAC;YACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,EAAE,kDAAkD,CAAC,CAAC;YAChI,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,EAAE,8CAA8C,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;YACrI,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,IAAI,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACjE,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,EAAE,yCAAyC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;YAChI,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/update/release-identity.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Immutable release identity derivation (SPEC §4.1, §4.3).
+ *
+ * releaseId = sha256 over the canonical identity inputs: product version,
+ * source commit, the sorted platform asset identities, the minimum bootstrap
+ * version, and the digest of the metadata content that excludes releaseId
+ * itself (avoiding circular hashing, per SPEC §4.2's detached-digest rule).
+ * Informational build time is never an identity input.
+ */
+export interface ReleaseAssetIdentity {
+    readonly platform: string;
+    readonly arch: string;
+    readonly nodeAbi: string;
+    readonly archiveSha256: string;
+    readonly archiveSizeBytes: number;
+}
+export interface ReleaseIdentityInputs {
+    readonly productVersion: string;
+    readonly sourceCommit: string;
+    readonly minBootstrapVersion: string;
+    readonly assets: readonly ReleaseAssetIdentity[];
+}
+/** Deterministic JSON: sorted keys, no insignificant whitespace. */
+export declare function canonicalJson(value: unknown): string;
+/** Content digest of the identity-relevant metadata, with `releaseId` removed. */
+export declare function computeReleaseContentDigest(contentWithoutReleaseId: unknown): string;
+/**
+ * Derives the immutable release ID. Same source + same declared inputs MUST
+ * produce the same ID; any input change produces a different ID. Deterministic
+ * across platforms (canonical JSON, sorted assets, LF strings).
+ */
+export declare function deriveReleaseId(inputs: ReleaseIdentityInputs): string;
+//# sourceMappingURL=release-identity.d.ts.map

package/dist/update/release-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-identity.d.ts","sourceRoot":"","sources":["../../src/update/release-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAClD;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAWpD;AAgCD,kFAAkF;AAClF,wBAAgB,2BAA2B,CAAC,uBAAuB,EAAE,OAAO,GAAG,MAAM,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CA6CrE"}

package/dist/update/release-identity.js

@@ -0,0 +1,108 @@
+/**
+ * Immutable release identity derivation (SPEC §4.1, §4.3).
+ *
+ * releaseId = sha256 over the canonical identity inputs: product version,
+ * source commit, the sorted platform asset identities, the minimum bootstrap
+ * version, and the digest of the metadata content that excludes releaseId
+ * itself (avoiding circular hashing, per SPEC §4.2's detached-digest rule).
+ * Informational build time is never an identity input.
+ */
+import { createHash } from 'node:crypto';
+import { assertGitCommit, assertSha256Hex, parseProductVersion, ProductIdentityError, } from './product-identity.js';
+/** Deterministic JSON: sorted keys, no insignificant whitespace. */
+export function canonicalJson(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalJson).join(',')}]`;
+    }
+    if (typeof value === 'object' && value !== null) {
+        const entries = Object.entries(value)
+            .filter(([, v]) => v !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+function validateAssetIdentity(asset, index) {
+    if (typeof asset !== 'object' || asset === null || Array.isArray(asset)) {
+        throw new ProductIdentityError('assets', `assets[${index}] must be an object`);
+    }
+    const record = asset;
+    const { platform } = record;
+    const { arch } = record;
+    const { nodeAbi } = record;
+    const { archiveSha256 } = record;
+    const { archiveSizeBytes } = record;
+    for (const [field, value] of [['platform', platform], ['arch', arch], ['nodeAbi', nodeAbi]]) {
+        if (typeof value !== 'string' || value.length === 0 || !/^[a-z0-9-]+$/.test(value)) {
+            throw new ProductIdentityError('assets', `assets[${index}].${field} must be a non-empty lowercase identifier, got: ${JSON.stringify(value)}`);
+        }
+    }
+    if (typeof nodeAbi !== 'string' || !/^\d+$/.test(nodeAbi)) {
+        throw new ProductIdentityError('assets', `assets[${index}].nodeAbi must be a numeric Node ABI string (e.g. "147"), got: ${JSON.stringify(nodeAbi)}`);
+    }
+    if (typeof archiveSizeBytes !== 'number' || !Number.isSafeInteger(archiveSizeBytes) || archiveSizeBytes <= 0) {
+        throw new ProductIdentityError('assets', `assets[${index}].archiveSizeBytes must be a positive safe integer, got: ${JSON.stringify(archiveSizeBytes)}`);
+    }
+    return {
+        platform,
+        arch,
+        nodeAbi,
+        archiveSha256: assertSha256Hex(archiveSha256, `assets[${index}].archiveSha256`),
+        archiveSizeBytes,
+    };
+}
+/** Content digest of the identity-relevant metadata, with `releaseId` removed. */
+export function computeReleaseContentDigest(contentWithoutReleaseId) {
+    return createHash('sha256').update(canonicalJson(contentWithoutReleaseId), 'utf8').digest('hex');
+}
+/**
+ * Derives the immutable release ID. Same source + same declared inputs MUST
+ * produce the same ID; any input change produces a different ID. Deterministic
+ * across platforms (canonical JSON, sorted assets, LF strings).
+ */
+export function deriveReleaseId(inputs) {
+    const productVersion = parseProductVersion(inputs.productVersion);
+    parseProductVersion(inputs.minBootstrapVersion, 'minBootstrapVersion');
+    assertGitCommit(inputs.sourceCommit, 'sourceCommit');
+    if (!Array.isArray(inputs.assets) || inputs.assets.length === 0) {
+        throw new ProductIdentityError('assets', 'a release must declare at least one platform asset');
+    }
+    const assets = inputs.assets.map(validateAssetIdentity);
+    // Duplicate detection runs BEFORE sorting as an explicit pass — sort
+    // comparators are not guaranteed to compare every element pair, so a
+    // duplicate key could slip into the identity input unnoticed.
+    const seenKeys = new Set();
+    for (const asset of assets) {
+        const key = `${asset.platform}/${asset.arch}/abi${asset.nodeAbi}`;
+        if (seenKeys.has(key)) {
+            throw new ProductIdentityError('assets', `duplicate platform asset declared: ${key}`);
+        }
+        seenKeys.add(key);
+    }
+    const sortedAssets = [...assets].sort((a, b) => {
+        const keyA = `${a.platform}/${a.arch}/abi${a.nodeAbi}`;
+        const keyB = `${b.platform}/${b.arch}/abi${b.nodeAbi}`;
+        return keyA < keyB ? -1 : keyA > keyB ? 1 : 0;
+    });
+    const identityContent = {
+        kind: 'pd-release-identity-v1',
+        productVersion: productVersion.productVersion,
+        sourceCommit: inputs.sourceCommit,
+        minBootstrapVersion: inputs.minBootstrapVersion,
+        assets: sortedAssets.map((asset) => ({
+            platform: asset.platform,
+            arch: asset.arch,
+            nodeAbi: asset.nodeAbi,
+            archiveSha256: asset.archiveSha256,
+            archiveSizeBytes: asset.archiveSizeBytes,
+        })),
+    };
+    const contentDigest = computeReleaseContentDigest(identityContent);
+    // The SPEC's "release metadata digest" input is the digest of the identity
+    // content above — hashed again with the kind tag so releaseId ≠ any
+    // intermediate digest.
+    return createHash('sha256')
+        .update(`pd-release-id-v1:${contentDigest}`, 'utf8')
+        .digest('hex');
+}
+//# sourceMappingURL=release-identity.js.map

package/dist/update/release-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-identity.js","sourceRoot":"","sources":["../../src/update/release-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAiB/B,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,UAAU,KAAK,qBAAqB,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,EAAC,QAAQ,EAAC,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAC,IAAI,EAAC,GAAG,MAAM,CAAC;IACtB,MAAM,EAAC,OAAO,EAAC,GAAG,MAAM,CAAC;IACzB,MAAM,EAAC,aAAa,EAAC,GAAG,MAAM,CAAC;IAC/B,MAAM,EAAC,gBAAgB,EAAC,GAAG,MAAM,CAAC;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAU,EAAE,CAAC;QACrG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,UAAU,KAAK,KAAK,KAAK,mDAAmD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,UAAU,KAAK,kEAAkE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvJ,CAAC;IACD,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,UAAU,KAAK,4DAA4D,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC1J,CAAC;IACD,OAAO;QACL,QAAQ;QACR,IAAI;QACJ,OAAO;QACP,aAAa,EAAE,eAAe,CAAC,aAAa,EAAE,UAAU,KAAK,iBAAiB,CAAC;QAC/E,gBAAgB;KACO,CAAC;AAC5B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,2BAA2B,CAAC,uBAAgC;IAC1E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAA6B;IAC3D,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAClE,mBAAmB,CAAC,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IACvE,eAAe,CAAC,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACxD,qEAAqE;IACrE,qEAAqE;IACrE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;QAClE,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,sCAAsC,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG;QACtB,IAAI,EAAE,wBAAwB;QAC9B,cAAc,EAAE,cAAc,CAAC,cAAc;QAC7C,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;KACJ,CAAC;IACF,MAAM,aAAa,GAAG,2BAA2B,CAAC,eAAe,CAAC,CAAC;IACnE,2EAA2E;IAC3E,oEAAoE;IACpE,uBAAuB;IACvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,oBAAoB,aAAa,EAAE,EAAE,MAAM,CAAC;SACnD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}

package/dist/update/release-manager.d.ts

@@ -0,0 +1,96 @@
+/**
+ * ReleaseManager — the deep module behind every update surface (SPEC §6.2).
+ *
+ * External surface is intentionally small: inspect / check / apply /
+ * rollback. The module hides metadata validation, download, extraction,
+ * staging, probes, journaling, host control, rollback, and cleanup. In this
+ * phase (shadow mode) apply/rollback refuse read-only: activation lands with
+ * the transaction state machine, never by loosening this gate.
+ *
+ * Every refusal carries a stable reason and an Owner-visible next action
+ * (rc-9) and is computed BEFORE any installation state is mutated.
+ */
+import { resolveTrustedReleaseTarget, type TrustedReleaseTarget } from './trust-metadata.js';
+import { buildReleaseMetadata } from './release-metadata.js';
+import { type ReleasePolicyDecision } from './release-policy.js';
+import type { ReleaseChannelName } from './product-identity.js';
+export type ReleaseManagerReason = 'shadow_mode_read_only' | 'bootstrap_not_installed' | 'metadata_refresh_failed' | 'release_metadata_unavailable' | 'release_metadata_invalid' | 'active_record_corrupt';
+export declare class ReleaseManagerError extends Error {
+    readonly reason: ReleaseManagerReason;
+    readonly nextAction: string;
+    constructor(reason: ReleaseManagerReason, message: string, nextAction: string);
+}
+export type InstallationLayout = 'dual-slot' | 'legacy-overlay' | 'none';
+export interface InstallStatus {
+    readonly layout: InstallationLayout;
+    readonly productVersion: string | null;
+    readonly releaseId: string | null;
+    readonly generation: number | null;
+    readonly bootstrapVersion: string | null;
+    readonly channel: ReleaseChannelName;
+}
+/** What the legacy updater decided for the same question (shadow comparison). */
+export interface LegacyUpdaterDecision {
+    readonly source: 'legacy-updater';
+    readonly latestVersion: string | null;
+    readonly updateAvailable: boolean | null;
+}
+export interface UpdateCheck {
+    readonly channel: ReleaseChannelName;
+    readonly candidate: {
+        readonly productVersion: string;
+        readonly releaseId: string;
+        readonly publicationSequence: number;
+        readonly assets: readonly {
+            platform: string;
+            arch: string;
+            nodeAbi: string;
+        }[];
+    } | null;
+    readonly decision: ReleasePolicyDecision;
+    readonly trustedTarget: TrustedReleaseTarget | null;
+    readonly shadowComparison: {
+        readonly legacy: LegacyUpdaterDecision | null;
+        readonly agrees: boolean | null;
+        readonly note: string | null;
+    };
+}
+export interface ReleaseManagerOptions {
+    readonly pdHome: string;
+    readonly metadataBaseUrl: string;
+    readonly fetcher?: Parameters<typeof resolveTrustedReleaseTarget>[0]['fetcher'];
+    readonly now?: () => Date;
+    /** Injected in production from the legacy updater; tests inject fakes. */
+    readonly legacyCheck?: (currentVersion: string) => Promise<LegacyUpdaterDecision | null>;
+    /**
+     * Explicit OpenClaw home directory for legacy-overlay detection.  When
+     * omitted, falls back to `~/.openclaw` relative to the OS home — correct
+     * for standard installs but WRONG for custom pdHome roots (test dirs,
+     * enterprise installs, containers).  Callers that pass a custom pdHome
+     * MUST also pass the matching openclawHome.
+     */
+    readonly openclawHome?: string;
+}
+/**
+ * The signed channel document is fetched from the trusted TUF target
+ * `channels/<channel>.json`; its payload is the ChannelMetadata. The release
+ * metadata document comes from `releases/<release-id>/metadata.json` —
+ * already verified as a trusted target with an exact digest.
+ */
+export declare class ReleaseManager {
+    private readonly paths;
+    private readonly options;
+    constructor(options: ReleaseManagerOptions);
+    inspect(): InstallStatus;
+    check(channel: ReleaseChannelName): Promise<UpdateCheck>;
+    apply(): Promise<never>;
+    rollback(): Promise<never>;
+    private legacyOverlayMarker;
+    private readChannelMetadataPayload;
+    private readActiveReleaseMetadata;
+    private readReleaseMetadataDocument;
+    private compareWithLegacyUpdater;
+}
+/** Producer helper re-exported for the publication pipeline. */
+export { buildReleaseMetadata };
+//# sourceMappingURL=release-manager.d.ts.map

package/dist/update/release-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-manager.d.ts","sourceRoot":"","sources":["../../src/update/release-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,2BAA2B,EAAoD,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE/I,OAAO,EACL,oBAAoB,EAKrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,MAAM,oBAAoB,GAC5B,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,8BAA8B,GAC9B,0BAA0B,GAC1B,uBAAuB,CAAC;AAE5B,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,YAAY,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAK5E;CACF;AAED,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,MAAM,EAAE,SAAS;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACjF,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,gBAAgB,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;QAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzF;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAwCD;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAEhD,YAAY,OAAO,EAAE,qBAAqB,EAGzC;IAED,OAAO,IAAI,aAAa,CAqBvB;IAEK,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwF7D;IAEK,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAO5B;IAEK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAO/B;IAED,OAAO,CAAC,mBAAmB;IAM3B,OAAO,CAAC,0BAA0B;IAelC,OAAO,CAAC,yBAAyB;IASjC,OAAO,CAAC,2BAA2B;YAiCrB,wBAAwB;CA8BvC;AAED,gEAAgE;AAChE,OAAO,EAAE,oBAAoB,EAAE,CAAC"}