create-windy 0.8.3 → 0.9.1

package/template/apps/agent-server/documents/smoke.py

@@ -0,0 +1,177 @@
+"""Synthetic local file round-trips, not a DSH/model/customer acceptance test."""
+
+import argparse
+import copy
+import json
+import platform
+from datetime import datetime
+from decimal import Decimal
+from importlib.metadata import version
+from pathlib import Path
+from tempfile import mkdtemp
+
+from docx import Document
+from openpyxl import Workbook, load_workbook
+from openpyxl.xml import DEFUSEDXML
+from reportlab.pdfbase import pdfmetrics
+from reportlab.pdfbase.cidfonts import UnicodeCIDFont
+from reportlab.pdfgen.canvas import Canvas
+
+from office import digest, read_text, save_new, summarize_excel, write_revision
+from query_report import generate_report, validate_snapshot
+
+
+def require(condition: bool, message: str) -> None:
+    if not condition:
+        raise AssertionError(message)
+
+
+def rejects(action, message: str) -> None:
+    try:
+        action()
+    except (ValueError, FileExistsError):
+        return
+    raise AssertionError(message)
+
+
+def fixture_snapshot() -> dict:
+    return {
+        "schemaVersion": 1,
+        "source": {"kind": "synthetic-fixture", "tool": "fixture.query",
+                   "queryId": "synthetic-query-001", "capturedAt": "2026-10-15T08:00:00Z",
+                   "scope": "合成案件 SYNTHETIC-001", "unit": "元", "query": "合成记录，金额单位为元"},
+        "complete": True, "errors": [], "total": 3,
+        "pages": [
+            {"cursor": None, "nextCursor": "page-2", "status": "success", "truncated": False,
+             "records": [{"id": "001", "label": "样例甲", "amount": "10.10",
+                          "sourceRef": "fixture://SYNTHETIC-001/001"},
+                         {"id": "002", "label": "样例乙", "amount": "20.20",
+                          "sourceRef": "fixture://SYNTHETIC-001/002"}]},
+            {"cursor": "page-2", "nextCursor": None, "status": "success", "truncated": False,
+             "records": [{"id": "003", "label": "样例丙", "amount": "0.03",
+                          "sourceRef": "fixture://SYNTHETIC-001/003"}]},
+        ],
+    }
+
+
+def document_checks(directory: Path) -> dict:
+    original = directory / "original.docx"
+    document = Document()
+    document.add_heading("合成材料", 0)
+    document.add_paragraph("初稿：甲事项尚待整理。")
+    save_new(document, original)
+    source_hash = digest(original)
+    revision, continued = directory / "revision-1.docx", directory / "revision-2.docx"
+    write_revision(original, revision, read_text(original).replace("尚待整理", "已完成整理"), "修订稿")
+    write_revision(revision, continued, read_text(revision) + "\n续改：补充核对记录。", "续改稿")
+    require("已完成整理" in read_text(continued) and "补充核对记录" in read_text(continued),
+            "DOCX continuation did not round-trip")
+    require(digest(original) == source_hash, "original DOCX was modified")
+    rejects(lambda: write_revision(original, original, "覆盖", "覆盖"), "original overwrite accepted")
+    rejects(lambda: write_revision(original, revision, "覆盖", "覆盖"), "revision overwrite accepted")
+    pdf = directory / "original.pdf"
+    pdfmetrics.registerFont(UnicodeCIDFont("STSong-Light"))
+    canvas = Canvas(str(pdf), invariant=1)
+    canvas.setFont("STSong-Light", 12)
+    canvas.drawString(72, 750, "合成 PDF：金额 30.33 元。")
+    canvas.save()
+    pdf_hash = digest(pdf)
+    extracted = read_text(pdf)
+    require("30.33" in extracted and "合成" in extracted, "PDF text extraction failed")
+    pdf_revision = directory / "pdf-revision.docx"
+    write_revision(pdf, pdf_revision, extracted + "\n已核对金额与来源。", "PDF 改写稿")
+    require("已核对金额" in read_text(pdf_revision), "PDF-to-DOCX read-back failed")
+    require(digest(pdf) == pdf_hash, "original PDF was modified")
+    return {"docxContinuation": "passed", "pdfTextToDocx": "passed",
+            "sourcePreservation": "passed", "existingOutputRefusal": "passed"}
+
+
+def excel_checks(directory: Path) -> dict:
+    original, result = directory / "original.xlsx", directory / "summary.xlsx"
+    workbook = Workbook()
+    sheet = workbook.active
+    sheet.append(["编号", "名称", "日期", "金额"])
+    for identifier, label, amount in (("000001", "样例甲", "10.10"),
+                                      ("000002", "样例乙", "20.20"),
+                                      ("000003", "样例丙", "0.03")):
+        sheet.append([identifier, label, datetime(2026, 10, 15), amount])
+        sheet.cell(sheet.max_row, 1).number_format = "@"
+        sheet.cell(sheet.max_row, 3).number_format = "yyyy-mm-dd"
+    save_new(workbook, original)
+    original_hash = digest(original)
+    require(summarize_excel(original, result, unit="元") == Decimal("30.33"), "decimal total mismatch")
+    check = load_workbook(result, read_only=True, data_only=True)
+    try:
+        rows = list(check.active.values)
+        require(rows[1][0] == "000001" and rows[1][1] == "样例甲", "Chinese/leading zeros lost")
+        require(rows[1][2] == datetime(2026, 10, 15), "Excel date lost")
+        require(rows[-1][3] == "30.33", "decimal summary did not round-trip exactly")
+    finally:
+        check.close()
+    require(digest(original) == original_hash, "original Excel was modified")
+    sheet["D2"] = "=1+2"
+    formula = directory / "formula.xlsx"
+    save_new(workbook, formula)
+    rejects(lambda: summarize_excel(formula, directory / "formula-result.xlsx", unit="元"),
+            "unverified formula engine accepted")
+    return {"chineseDateLeadingZeros": "passed", "decimalTotal": "30.33",
+            "formulaRefusal": "passed"}
+
+
+def query_checks(directory: Path) -> dict:
+    snapshot = fixture_snapshot()
+    source, output = directory / "query-snapshot.json", directory / "query-report.docx"
+    source.write_text(json.dumps(snapshot, ensure_ascii=False, indent=2), encoding="utf-8")
+    result = generate_report(source, output)
+    text = read_text(output)
+    require(result["records"] == 3 and result["total"] == "30.33", "query totals differ")
+    require(digest(source) in text and "fixture://SYNTHETIC-001/003" in text,
+            "report source attribution missing")
+    require("金额合计：30.33 元" in text, "source unit was not preserved")
+    invalid = []
+    for field, value in (("complete", False), ("errors", ["failed page"]), ("total", 4)):
+        candidate = copy.deepcopy(snapshot)
+        candidate[field] = value
+        invalid.append(candidate)
+    for field, value in (("truncated", True), ("status", "failed"),
+                         ("cursor", "missing-page"), ("nextCursor", "not-finished")):
+        candidate = copy.deepcopy(snapshot)
+        candidate["pages"][-1][field] = value
+        invalid.append(candidate)
+    duplicate = copy.deepcopy(snapshot)
+    duplicate["pages"][-1]["records"][0]["id"] = "001"
+    invalid.append(duplicate)
+    missing_unit = copy.deepcopy(snapshot)
+    del missing_unit["source"]["unit"]
+    invalid.append(missing_unit)
+    for candidate in invalid:
+        rejects(lambda: validate_snapshot(candidate), "incomplete/invalid query export accepted")
+    return {"sourceCoverage": "passed", "invalidSnapshotsRejected": len(invalid), **result}
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output-dir", type=Path,
+                        help="must be new; defaults to an isolated directory under /tmp")
+    arguments = parser.parse_args()
+    directory = arguments.output_dir or Path(mkdtemp(prefix="dsh-documents-"))
+    if arguments.output_dir:
+        directory.mkdir(parents=True, exist_ok=False)
+    require(DEFUSEDXML, "openpyxl must use installed defusedxml protection")
+    checks = {"documents": document_checks(directory), "excel": excel_checks(directory),
+              "queryReport": query_checks(directory)}
+    evidence = {"validation": "synthetic-library-round-trip", "outputDirectory": str(directory),
+                "runtime": {"python": platform.python_version(), "platform": platform.platform(),
+                            "packages": {name: version(name) for name in (
+                                "python-docx", "openpyxl", "pypdf", "reportlab", "defusedxml",
+                                "lxml", "typing-extensions", "et-xmlfile", "pillow", "charset-normalizer")}},
+                "checks": checks, "visualQuality": "not-verified", "realModel": "not-invoked",
+                "liveMcpAuthorization": "not-verified", "automaticBusinessArchive": False,
+                "files": {file.name: digest(file) for file in directory.iterdir() if file.is_file()}}
+    (directory / "evidence.json").write_text(json.dumps(evidence, ensure_ascii=False, indent=2),
+                                              encoding="utf-8")
+    print(json.dumps(evidence, ensure_ascii=False, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/template/apps/agent-server/documents/test_boundaries.py

@@ -0,0 +1,185 @@
+"""Focused document regressions; no model, server, browser, or live MCP is involved."""
+
+import copy
+import json
+import re
+import tempfile
+import unittest
+from datetime import datetime
+from decimal import Decimal
+from pathlib import Path
+from zipfile import ZipFile
+
+from docx import Document
+from openpyxl import Workbook, load_workbook
+from reportlab.pdfgen.canvas import Canvas
+
+from office import digest, read_text, save_new, summarize_excel, write_revision
+from query_report import generate_report, validate_snapshot
+from smoke import fixture_snapshot
+
+
+class DocumentBoundaries(unittest.TestCase):
+    def setUp(self):
+        self.temporary = tempfile.TemporaryDirectory(prefix="dsh-document-boundaries-")
+        self.directory = Path(self.temporary.name)
+
+    def tearDown(self):
+        self.temporary.cleanup()
+
+    def workbook(self, path: Path, *, literal: bool = False, formula: bool = False):
+        workbook = Workbook()
+        sheet = workbook.active
+        sheet.title = "来源数据"
+        sheet.append(["编号", "名称", "日期", "金额"])
+        sheet.append(["000001", '=HYPERLINK("https://example.invalid/","样例")',
+                      datetime(2026, 10, 16), "10.10"])
+        sheet["B2"].data_type = "s" if literal else "f"
+        if not literal and not formula:
+            sheet["B2"] = "普通样例"
+        sheet.append(["000002", "第二行", datetime(2026, 10, 16), "20.20"])
+        save_new(workbook, path)
+
+    def test_literal_equals_text_stays_text_with_source_and_unit(self):
+        source, output = self.directory / "source.xlsx", self.directory / "summary.xlsx"
+        self.workbook(source, literal=True)
+        before = digest(source)
+        self.assertEqual(summarize_excel(source, output, unit="万元"), Decimal("30.30"))
+        workbook = load_workbook(output, data_only=False)
+        try:
+            self.assertEqual(workbook.active["B2"].data_type, "s")
+            self.assertEqual(workbook.active["B2"].value,
+                             '=HYPERLINK("https://example.invalid/","样例")')
+            self.assertEqual(workbook.active["A2"].value, "000001")
+            self.assertIn("万元", workbook.active["D1"].comment.text)
+            provenance = dict(workbook["来源说明"].values)
+            self.assertEqual(provenance["金额单位"], "万元")
+            self.assertEqual(provenance["单位转换"], "未转换")
+            self.assertEqual(provenance["来源 SHA256"], before)
+            self.assertEqual(provenance["来源范围"], "来源数据!A1:D3")
+            self.assertEqual(provenance["Decimal 合计"], "30.30")
+        finally:
+            workbook.close()
+        self.assertEqual(digest(source), before)
+
+    def test_real_formula_and_missing_unit_are_rejected_without_output(self):
+        source, output = self.directory / "formula.xlsx", self.directory / "rejected.xlsx"
+        self.workbook(source, formula=True)
+        with self.assertRaisesRegex(ValueError, "formula"):
+            summarize_excel(source, output, unit="元")
+        self.assertFalse(output.exists())
+        with self.assertRaisesRegex(ValueError, "unit"):
+            summarize_excel(source, output, unit="")
+        self.assertFalse(output.exists())
+
+    def test_false_xlsx_dimensions_do_not_silently_drop_rows(self):
+        source = self.directory / "source.xlsx"
+        self.workbook(source)
+        forged = self.directory / "understated-dimensions.xlsx"
+        with ZipFile(source) as original, ZipFile(forged, "w") as target:
+            for entry in original.infolist():
+                content = original.read(entry.filename)
+                if entry.filename == "xl/worksheets/sheet1.xml":
+                    content = re.sub(rb'<dimension ref="[^"]+"', b'<dimension ref="A1:D1"', content)
+                target.writestr(entry, content)
+        output = self.directory / "complete-summary.xlsx"
+        self.assertEqual(summarize_excel(forged, output, unit="元"), Decimal("30.30"))
+        workbook = load_workbook(output, read_only=True)
+        try:
+            self.assertEqual(workbook.active["A3"].value, "000002")
+            self.assertEqual(dict(workbook["来源说明"].values)["数据行数"], "2")
+        finally:
+            workbook.close()
+
+    def test_excel_error_cell_is_rejected_but_literal_error_name_is_kept(self):
+        source = self.directory / "error.xlsx"
+        self.workbook(source)
+        workbook = load_workbook(source)
+        try:
+            workbook.active["B2"] = "#REF!"
+            error_file = self.directory / "actual-error.xlsx"
+            save_new(workbook, error_file)
+            with self.assertRaisesRegex(ValueError, "error cells"):
+                summarize_excel(error_file, self.directory / "rejected-error.xlsx", unit="元")
+            workbook.active["B2"].data_type = "s"
+            literal_file = self.directory / "literal-error.xlsx"
+            save_new(workbook, literal_file)
+        finally:
+            workbook.close()
+        output = self.directory / "literal-error-result.xlsx"
+        summarize_excel(literal_file, output, unit="元")
+        result = load_workbook(output, data_only=False)
+        try:
+            self.assertEqual((result.active["B2"].value, result.active["B2"].data_type), ("#REF!", "s"))
+        finally:
+            result.close()
+
+    def test_docx_body_table_order_and_original_revision_are_preserved(self):
+        source = self.directory / "source.docx"
+        document = Document()
+        document.add_paragraph("正文前段")
+        document.add_table(rows=1, cols=1).cell(0, 0).text = "表格中段"
+        document.add_paragraph("正文后段")
+        save_new(document, source)
+        text = read_text(source)
+        self.assertLess(text.index("正文前段"), text.index("表格中段"))
+        self.assertLess(text.index("表格中段"), text.index("正文后段"))
+        before = digest(source)
+        revision, continued = self.directory / "v1.docx", self.directory / "v2.docx"
+        write_revision(source, revision, text + "\n首轮修改", "首轮")
+        revision_before = digest(revision)
+        write_revision(revision, continued, read_text(revision) + "\n续改", "续改")
+        with self.assertRaises(FileExistsError):
+            write_revision(source, revision, "不得覆盖", "错误覆盖")
+        self.assertEqual(digest(source), before)
+        self.assertEqual(digest(revision), revision_before)
+        self.assertIn(revision_before, Document(continued).core_properties.subject)
+
+    def test_pdf_page_without_text_cannot_be_claimed_as_complete_read(self):
+        source = self.directory / "mixed-pages.pdf"
+        canvas = Canvas(str(source))
+        canvas.drawString(72, 720, "Readable first page")
+        canvas.showPage()
+        canvas.rect(72, 600, 200, 100)
+        canvas.showPage()
+        canvas.save()
+        with self.assertRaisesRegex(ValueError, "without extractable text"):
+            read_text(source)
+
+    def test_query_coverage_and_mixed_units_fail_before_output(self):
+        for mutation in ("partial", "truncated", "mixed-unit"):
+            snapshot = copy.deepcopy(fixture_snapshot())
+            if mutation == "mixed-unit":
+                snapshot["pages"][0]["records"][0]["unit"] = "万元"
+            else:
+                snapshot[mutation] = True
+            source = self.directory / f"{mutation}.json"
+            source.write_text(json.dumps(snapshot), encoding="utf-8")
+            output = self.directory / f"{mutation}.docx"
+            with self.subTest(mutation=mutation), self.assertRaises(ValueError):
+                generate_report(source, output)
+            self.assertFalse(output.exists())
+
+    def test_declared_unit_is_kept_without_conversion(self):
+        snapshot = fixture_snapshot()
+        snapshot["source"]["unit"] = "万元"
+        snapshot["pages"][0]["records"][0]["unit"] = "万元"
+        self.assertEqual(validate_snapshot(snapshot)[2], Decimal("30.33"))
+        source, output = self.directory / "wan.json", self.directory / "wan.docx"
+        source.write_text(json.dumps(snapshot), encoding="utf-8")
+        self.assertEqual(generate_report(source, output)["unit"], "万元")
+        self.assertIn("金额合计：30.33 万元", read_text(output))
+
+    def test_oversized_output_is_rejected_before_file_is_created(self):
+        class OversizedDocument:
+            def save(self, stream):
+                stream.write(b"x" * (20 * 1024 * 1024 + 1))
+
+        output = self.directory / "too-large.docx"
+        with self.assertRaisesRegex(ValueError, "download budget"):
+            save_new(OversizedDocument(), output)
+        self.assertFalse(output.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/template/apps/agent-server/host-contracts.ts

@@ -0,0 +1,56 @@
+/** Deployment-owned extension points. Secrets and authorization remain in the Host. */
+export interface DshHostConfiguration {
+  /** Stable deployment preset identity; retain it when adopting existing sessions. */
+  readonly presetId?: string;
+  readonly assistantName: string;
+  readonly assistantDescription: string;
+  readonly workspaceLabel: string;
+  readonly instructions: readonly string[];
+  /** Read-only, deployment-owned skill roots relative to the Agent Server. */
+  readonly skillDirectories: readonly string[];
+  /** Additional trusted Host plugins; use public DSH services and lifecycle effects. */
+  readonly plugins: readonly {
+    readonly key: string;
+    readonly path: string;
+    readonly config?: Readonly<Record<string, unknown>>;
+    readonly replaces?: readonly "session-controller"[];
+  }[];
+  /** Fixed project endpoints behind the current worker identity. */
+  readonly boundaryRoutes?: readonly DshBoundaryRoute[];
+}
+
+export interface DshBoundaryRequest {
+  readonly method: "GET" | "POST";
+  readonly path: string;
+  readonly parameters: Readonly<Record<string, string>>;
+  readonly searchParams: URLSearchParams;
+  readonly body: Uint8Array;
+  readonly signal: AbortSignal;
+}
+
+export interface DshProductRequest {
+  readonly method?: "GET" | "POST";
+  readonly body?: string | Uint8Array;
+  readonly contentType?: "application/json" | "application/octet-stream";
+}
+
+export interface DshBoundaryContext {
+  readonly actorId: string;
+  readonly signal: AbortSignal;
+  /** Fixed product origin, current login, no caller-selected credentials or redirects. */
+  fetchProduct(path: string, input?: DshProductRequest): Promise<Response>;
+}
+
+export interface DshBoundaryRoute {
+  readonly key: string;
+  readonly method: "GET" | "POST";
+  /** Literal path segments and optional :identifier parameters; no wildcards. */
+  readonly path: string;
+  readonly maxBodyBytes?: number;
+  readonly maxResponseBytes?: number;
+  readonly timeoutMs?: number;
+  readonly handle: (
+    request: DshBoundaryRequest,
+    context: DshBoundaryContext,
+  ) => Promise<Response>;
+}

package/template/apps/agent-server/install-native.ts

@@ -0,0 +1,167 @@
+import { downloadNativePackage } from "./native-download";
+import { createHash } from "node:crypto";
+import {
+  mkdtemp,
+  mkdir,
+  readFile,
+  rename,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { join, dirname } from "node:path";
+import { tmpdir } from "node:os";
+
+interface NativePackage {
+  name: string;
+  version: string;
+  integrity: string;
+  archive: string;
+}
+type Lock = { packages: Record<string, [string, string, unknown, string]> };
+
+/** Fixed Debian prerequisites, including the official Linux Office WASM engine. */
+export function nativePackages(
+  lock: Lock,
+  architecture: string,
+): NativePackage[] {
+  if (!["arm64", "x64"].includes(architecture))
+    throw new Error("Unsupported H1 native architecture");
+  const names = [
+    `node-addon-require-builtin-linux-${architecture}-gnu`,
+    `@deepseek-ai/node-addon-system-linux-${architecture}`,
+    `@koromix/koffi-linux-${architecture}`,
+    `@vscode/ripgrep-linux-${architecture}`,
+    `@img/sharp-linux-${architecture}`,
+    `@img/sharp-libvips-linux-${architecture}`,
+    "@deepseek-ai/libreoffice-kit-wasm",
+  ];
+  return names.map((name) => {
+    const item = lock.packages[name];
+    const version = item?.[0].slice(name.length + 1);
+    if (
+      !item ||
+      !item[0].startsWith(name + "@") ||
+      !/^[0-9A-Za-z.+-]+$/.test(version ?? "") ||
+      !/^sha512-[A-Za-z0-9+/]+=*$/.test(item[3])
+    )
+      throw new Error(
+        "Native dependency must be fixed by the existing runtime lock",
+      );
+    return {
+      name,
+      version,
+      integrity: item[3],
+      archive: name.replaceAll("/", "-") + ".tgz",
+    };
+  });
+}
+
+async function tar(args: string[]) {
+  const child = Bun.spawn(["tar", ...args], { stdout: "pipe", stderr: "pipe" });
+  const [output, , code] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  if (code !== 0) throw new Error("Invalid native package archive");
+  return output;
+}
+
+export async function installNativePackage(
+  pkg: NativePackage,
+  root: string,
+  bytes: Uint8Array,
+) {
+  if (
+    bytes.length > 64 * 1024 * 1024 ||
+    "sha512-" + createHash("sha512").update(bytes).digest("base64") !==
+      pkg.integrity
+  )
+    throw new Error("Native package integrity mismatch");
+  const temporary = await mkdtemp(join(tmpdir(), "dsh-native-"));
+  try {
+    const archive = join(temporary, "package.tgz");
+    await writeFile(archive, bytes);
+    const paths = (await tar(["-tzf", archive])).trim().split("\n");
+    if (
+      !paths.length ||
+      paths.length > 10000 ||
+      paths.some(
+        (path) =>
+          !path.startsWith("package/") ||
+          path.includes("\\") ||
+          path.split("/").some((part) => part === ".." || part === "."),
+      )
+    )
+      throw new Error("Native package archive path denied");
+    const details = (await tar(["--numeric-owner", "-tvzf", archive]))
+      .trim()
+      .split("\n");
+    let total = 0;
+    for (const line of details) {
+      if (!["-", "d"].includes(line[0]))
+        throw new Error("Native package links or special files denied");
+      const columns = line.trim().split(/\s+/);
+      const size = Number(columns[1].includes("/") ? columns[2] : columns[4]);
+      if (!Number.isSafeInteger(size) || size < 0)
+        throw new Error("Invalid native package entry size");
+      total += size;
+    }
+    if (total > 256 * 1024 * 1024)
+      throw new Error("Native package expansion budget exceeded");
+    const unpacked = join(temporary, "unpacked");
+    await mkdir(unpacked);
+    await tar([
+      "-xzf",
+      archive,
+      "--no-same-owner",
+      "--no-same-permissions",
+      "--strip-components=1",
+      "-C",
+      unpacked,
+    ]);
+    const metadata = JSON.parse(
+      await readFile(join(unpacked, "package.json"), "utf8"),
+    );
+    if (metadata.name !== pkg.name || metadata.version !== pkg.version)
+      throw new Error("Native package identity mismatch");
+    const destination = join(root, "node_modules", pkg.name);
+    await mkdir(dirname(destination), { recursive: true });
+    await rename(unpacked, destination);
+  } finally {
+    await rm(temporary, { recursive: true, force: true });
+  }
+}
+
+export async function installNative(
+  root: string,
+  architecture: string,
+  archiveDirectory?: string,
+) {
+  const lock = Bun.JSONC.parse(
+    await readFile(join(root, "bun.lock"), "utf8"),
+  ) as Lock;
+  for (const pkg of nativePackages(lock, architecture)) {
+    let bytes: Uint8Array;
+    if (archiveDirectory)
+      bytes = new Uint8Array(
+        await readFile(join(archiveDirectory, pkg.archive)),
+      );
+    else
+      bytes = await downloadNativePackage(pkg, {
+        cacheDirectory: process.env.DSH_NATIVE_CACHE_DIR,
+        registry: process.env.DSH_NATIVE_REGISTRY,
+      });
+    await installNativePackage(pkg, root, bytes);
+    console.info(
+      `Installed pinned native prerequisite: ${pkg.name}@${pkg.version}`,
+    );
+  }
+}
+
+if (import.meta.main)
+  await installNative(
+    process.cwd(),
+    process.arch,
+    process.env.DSH_NATIVE_ARCHIVE_DIR,
+  );