nestweaver 9.1.0 → 9.3.0

package/README.md

@@ -3,36 +3,45 @@
 Code knowledge graph for AI agents — 42 MCP tools, 32 languages, graph
 visualization.
 
-This package is a thin wrapper. Its `postinstall` downloads the NestWeaver
-binary matching this package's version from the project's GitHub Releases,
-verifies it against the SHA-256 published alongside the archive, and puts a
-`nestweaver` executable on your PATH.
-
-**Lifecycle scripts must be enabled.** The binary is fetched in `postinstall`,
-so `npm install --ignore-scripts` — and **pnpm 10+, which blocks lifecycle
-scripts by default** — leave you with a wrapper and no binary. `nestweaver` then
-exits 1 saying the binary was not found. With pnpm, allow it explicitly:
-
-```jsonc
-// package.json
-{ "pnpm": { "onlyBuiltDependencies": ["nestweaver"] } }
-```
-
-If your organisation disallows install scripts outright, install a release
-archive from GitHub or build from source (`cargo install --locked --path .`)
-instead.
+This package is a thin wrapper with **no install-time (`postinstall`) script**.
+It ships one prebuilt-binary package per platform —
+`nestweaver-darwin-arm64`, `nestweaver-darwin-x64`, `nestweaver-linux-arm64`,
+`nestweaver-linux-x64` — as an `optionalDependencies` entry, the same pattern
+esbuild, swc, and Rollup use. npm, pnpm, and Yarn each install only the one
+matching your machine's `os`/`cpu` through their own ordinary dependency
+resolution; the `nestweaver` executable on your PATH resolves and runs
+whichever one actually landed, at invocation time.
+
+**No lifecycle scripts to allow.** There is nothing for
+`npm install --ignore-scripts` to skip, and pnpm 10+'s default block on
+lifecycle scripts (which used to leave a wrapper with no binary and no
+`pnpm.onlyBuiltDependencies` clue why) no longer applies — there is no script
+to block.
+
+If your package manager skipped optional dependencies entirely
+(`--omit=optional`, `--no-optional`, or a lockfile resolved without one),
+`nestweaver` exits 1 and names the exact optional package to install instead
+of silently doing nothing. If your organisation disallows this platform
+package entirely, install a release archive from GitHub or build from source
+(`cargo install --locked --path .`) instead.
 
 ## Platforms
 
-macOS and Linux, on x86_64 and arm64. On any other platform the install step
-FAILS and prints the supported targets, rather than leaving you with a wrapper
-that cannot run; use a release archive or a source build instead.
+macOS and Linux, on x86_64 and arm64. Every other platform has no published
+optional package, so `nestweaver` FAILS with the supported-targets list at
+invocation time rather than leaving you with a wrapper that silently cannot
+run; use a release archive or a source build instead. The two Linux platform
+packages additionally declare `libc: ["glibc"]` (musl/Alpine is not
+currently supported). Declaring `libc` is safe on a Linux-only package; it was
+not safe on the earlier combined macOS+Linux wrapper, where it made npm reject
+every macOS install with `EBADPLATFORM` because `libc` is not a concept on
+macOS. The field itself was never the problem — the package it sat on was.
 
 Linux builds target **glibc 2.35**, which covers Ubuntu 22.04 LTS and newer and
-Debian 12. The archive includes the GCC 13 runtime LadybugDB needs and the npm
-installer preserves it beside the binary. Check your glibc with `ldd --version`;
-on anything older the binary will not start and the error names a missing
-`GLIBC_` symbol. macOS builds target **13.3**.
+Debian 12. The platform package includes the GCC 13 runtime LadybugDB needs
+beside the binary. Check your glibc with `ldd --version`; on anything older
+the binary will not start and the error names a missing `GLIBC_` symbol.
+macOS builds target **13.3**.
 
 ## Upgrading an existing graph
 

package/bin/nestweaver

@@ -1,11 +1,172 @@
-#!/usr/bin/env bash
-set -e
-DIR="$(cd "$(dirname "$0")/.." && pwd)"
-BINARY="$DIR/.nestweaver-bin/nestweaver"
+#!/usr/bin/env node
+"use strict";
 
-if [ ! -x "$BINARY" ]; then
-  echo "NestWeaver binary not found. Install a verified GitHub Release archive, or from a source checkout run: cargo install --locked --path ." >&2
-  exit 1
-fi
+const path = require("path");
 
-exec "$BINARY" "$@"
+// ── Decision logic ──────────────────────────────────────────────────────
+// Pure, exported, and covered by nestweaver.test.js. Everything below the
+// `main()` boundary does I/O (module resolution, process spawn) and is not
+// directly testable; keeping the judgements out here is what makes the
+// launcher assertable at all.
+//
+// nw-425 / nw-433: this package used to have a `postinstall` that downloaded
+// the matching GitHub Release archive at install time. pnpm 10+ blocks
+// lifecycle scripts by default, so `pnpm add nestweaver` silently produced a
+// wrapper with no binary and no indication why -- the documented workaround
+// (`"pnpm": {"onlyBuiltDependencies": ["nestweaver"]}`) required knowing the
+// failure existed in the first place. There is now no lifecycle script at
+// all. Each supported platform ships as its own optionalDependency (the
+// esbuild/@rollup/swc pattern): npm/pnpm/yarn install ONLY the one whose
+// package.json `os`/`cpu` match the current machine, entirely through their
+// own normal dependency resolution -- nothing here runs at install time.
+// This file is what runs at INVOCATION time: it resolves which platform
+// package actually landed and execs its binary.
+
+const PLATFORM_PACKAGES = {
+  "darwin-x64": "nestweaver-darwin-x64",
+  "darwin-arm64": "nestweaver-darwin-arm64",
+  "linux-x64": "nestweaver-linux-x64",
+  "linux-arm64": "nestweaver-linux-arm64",
+};
+
+function platformKey(platform, arch) {
+  return `${platform}-${arch}`;
+}
+
+/// Which optional platform package this machine should have installed, or
+/// `null` if none is published for it.
+function platformPackageName(platform, arch) {
+  return PLATFORM_PACKAGES[platformKey(platform, arch)] || null;
+}
+
+/// Whether the running system is musl (Alpine and similar), not glibc.
+///
+/// Ported from the retired install.js unchanged (nw-433): `glibcVersionRuntime`
+/// is populated by Node's own `process.report` only when Node itself is linked
+/// against glibc, so a musl-linked Node (Alpine's system Node, every
+/// `node:*-alpine`/`node:*-musl` image) never has it. THREE states, not two:
+/// `reportAvailable` is separate from `glibcVersionRuntime` so "the report
+/// could not be produced at all" (sandboxed container, unusual build) and
+/// "the report WAS produced and shows no glibc" (genuine musl) cannot
+/// collapse into the same `undefined` -- that collapse would refuse a working
+/// glibc-Linux box whenever the report merely couldn't be read. An
+/// unavailable report fails OPEN (false, i.e. "not musl, proceed"); only a
+/// report that was actually read and shows no glibc fails closed.
+function isMuslLinux(platform, glibcVersionRuntime, reportAvailable) {
+  if (platform !== "linux" || !reportAvailable) {
+    return false;
+  }
+  return !glibcVersionRuntime;
+}
+
+function unsupportedPlatformMessage(platform, arch) {
+  return [
+    `Unsupported platform: ${platform}-${arch}`,
+    "Supported: darwin-x64, darwin-arm64, linux-x64, linux-arm64",
+    "Install from a source checkout instead: cargo install --locked --path .",
+  ].join("\n");
+}
+
+function muslMessage(platform, arch) {
+  return [
+    `Unsupported platform: ${platform}-${arch} (musl libc)`,
+    "NestWeaver's published Linux packages are glibc-only (nestweaver-linux-x64, nestweaver-linux-arm64). musl/Alpine is not currently supported.",
+    "Build from a source checkout instead: cargo install --locked --path .",
+  ].join("\n");
+}
+
+/// Why `require.resolve` on the platform package's binary failed. This is
+/// reached only when `platformPackageName` already matched a real target --
+/// the package manager should have installed it -- so the likely causes are
+/// operator-controlled (optional dependencies were explicitly skipped) rather
+/// than "wrong platform", and the message says so instead of guessing.
+function missingPlatformPackageMessage(pkgName, version) {
+  return [
+    `NestWeaver binary not found: optional dependency "${pkgName}@${version}" is not installed.`,
+    "This usually means your package manager skipped optional dependencies",
+    "(npm/yarn --omit=optional or --no-optional, or a lockfile resolved without it).",
+    `Install it explicitly: npm install ${pkgName}@${version}`,
+    "Or install from a source checkout instead: cargo install --locked --path .",
+  ].join("\n");
+}
+
+/// Resolve the platform package's binary via Node's own module resolution
+/// (`resolveFn`, ordinarily `require.resolve`) rather than constructing a
+/// path by hand. Module resolution is what makes this correct under every
+/// package manager's node_modules layout -- including pnpm's strict,
+/// symlinked store, which is exactly the layout a hand-built relative path
+/// would get wrong and the reason nw-425 existed. Takes `resolveFn` as a
+/// parameter so this is testable without a real installed dependency tree.
+function resolveBinaryPath(pkgName, resolveFn) {
+  try {
+    return { binaryPath: resolveFn(`${pkgName}/bin/nestweaver`), error: null };
+  } catch (err) {
+    return { binaryPath: null, error: err };
+  }
+}
+
+module.exports = {
+  PLATFORM_PACKAGES,
+  platformKey,
+  platformPackageName,
+  isMuslLinux,
+  unsupportedPlatformMessage,
+  muslMessage,
+  missingPlatformPackageMessage,
+  resolveBinaryPath,
+};
+
+// ── Execution ────────────────────────────────────────────────────────────
+
+function main() {
+  const { spawnSync } = require("child_process");
+  const platform = process.platform;
+  const arch = process.arch;
+
+  if (platform === "linux") {
+    let glibcVersionRuntime;
+    let reportAvailable = false;
+    try {
+      if (process.report && typeof process.report.getReport === "function") {
+        glibcVersionRuntime = process.report.getReport().header.glibcVersionRuntime;
+        reportAvailable = true;
+      }
+    } catch {
+      reportAvailable = false;
+    }
+    if (isMuslLinux(platform, glibcVersionRuntime, reportAvailable)) {
+      console.error(muslMessage(platform, arch));
+      process.exit(1);
+    }
+  }
+
+  const pkgName = platformPackageName(platform, arch);
+  if (!pkgName) {
+    console.error(unsupportedPlatformMessage(platform, arch));
+    process.exit(1);
+  }
+
+  const version = require(path.join(__dirname, "..", "package.json")).version;
+  const { binaryPath, error } = resolveBinaryPath(pkgName, (specifier) =>
+    require.resolve(specifier),
+  );
+  if (error) {
+    console.error(missingPlatformPackageMessage(pkgName, version));
+    process.exit(1);
+  }
+
+  const result = spawnSync(binaryPath, process.argv.slice(2), { stdio: "inherit" });
+  if (result.error) {
+    console.error(
+      `Failed to execute NestWeaver binary at ${binaryPath}: ${result.error.message}`,
+    );
+    process.exit(1);
+  }
+  process.exit(result.status === null ? 1 : result.status);
+}
+
+// Only run when executed as the npm bin entry point; `require` must be free
+// of side effects so the decision logic above can be tested at all.
+if (require.main === module) {
+  main();
+}

package/package.json

@@ -1,18 +1,14 @@
 {
   "name": "nestweaver",
-  "version": "9.1.0",
+  "version": "9.3.0",
   "description": "Code knowledge graph for AI agents — 42 MCP tools, 32 languages, graph visualization",
   "bin": {
     "nestweaver": "bin/nestweaver"
   },
   "files": [
     "bin/",
-    "install.js",
     "README.md"
   ],
-  "scripts": {
-    "postinstall": "node install.js"
-  },
   "os": [
     "darwin",
     "linux"
@@ -21,9 +17,15 @@
     "x64",
     "arm64"
   ],
-  "libc": [
-    "glibc"
-  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "optionalDependencies": {
+    "nestweaver-darwin-arm64": "9.3.0",
+    "nestweaver-darwin-x64": "9.3.0",
+    "nestweaver-linux-arm64": "9.3.0",
+    "nestweaver-linux-x64": "9.3.0"
+  },
   "keywords": [
     "mcp",
     "code-graph",

package/install.js

@@ -1,368 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-
-const { execFileSync } = require("child_process");
-const fs = require("fs");
-const path = require("path");
-
-const PLATFORM_MAP = {
-  "darwin-x64": "x86_64-apple-darwin",
-  "darwin-arm64": "aarch64-apple-darwin",
-  "linux-x64": "x86_64-unknown-linux-gnu",
-  "linux-arm64": "aarch64-unknown-linux-gnu",
-};
-
-const repo = "Kehl-io/nestweaver";
-
-// ── Decision logic ──────────────────────────────────────────────────────
-// Pure, exported, and covered by install.test.js. Everything below the
-// `main()` boundary does I/O and is not directly testable; keeping the
-// judgements out here is what makes the installer assertable at all.
-
-/// Explicit boolean parsing for operator-facing env vars. `0`, `false`, `no`,
-/// `off` and blank all mean OFF; anything else non-blank means ON.
-function isTruthyEnv(value) {
-  const normalized = String(value || "").trim().toLowerCase();
-  if (normalized.length === 0) {
-    return false;
-  }
-  return !["0", "false", "no", "off"].includes(normalized);
-}
-
-/// Whether a GitHub Release may be trusted to anchor its own checksum.
-///
-/// The checksum lives beside the archive in the same release, so an actor who
-/// can replace release assets can replace both. Only an IMMUTABLE release makes
-/// the checksum tamper-evidence rather than a self-signed claim.
-///
-/// A wrong tag is always fatal. A non-immutable release is DISCLOSED, not
-/// refused: immutable releases were enabled on this repository only recently,
-/// so every version already on the npm registry reports `immutable: false`
-/// (verified against the live API for v9.0.0, v9.0.4 and v9.0.5). Refusing them
-/// would make `npm install nestweaver` fail for every published version --
-/// a self-inflicted outage, not a security control. The checksum is still
-/// fetched and still enforced; what is absent is tamper-evidence, and saying so
-/// is the honest form. `NESTWEAVER_REQUIRE_IMMUTABLE_RELEASE=1` opts into the
-/// strict contract for callers who want it.
-function assessReleaseTrust(release, tag, env) {
-  const actualTag = release && release.tag_name;
-  if (actualTag !== tag) {
-    return {
-      failure: `GitHub Release tag ${JSON.stringify(actualTag)} does not match the requested ${tag}`,
-      warning: null,
-    };
-  }
-  if (release.immutable === true) {
-    return { failure: null, warning: null };
-  }
-  // Any non-blank value used to mean "strict", so an operator writing
-  // NESTWEAVER_REQUIRE_IMMUTABLE_RELEASE=0 to opt OUT was opted IN and every
-  // build failed.
-  const strict = isTruthyEnv(env && env.NESTWEAVER_REQUIRE_IMMUTABLE_RELEASE);
-  const detail =
-    `GitHub Release ${tag} is not immutable, so its published SHA-256 could have been ` +
-    `replaced together with its archive. The checksum is still verified, but it is not ` +
-    `tamper-evidence. Releases published before immutable releases were enabled on this ` +
-    `repository all report this.`;
-  if (strict) {
-    return {
-      failure: `${detail} NESTWEAVER_REQUIRE_IMMUTABLE_RELEASE is set, so this install is refused.`,
-      warning: null,
-    };
-  }
-  return {
-    failure: null,
-    warning: `${detail} Set NESTWEAVER_REQUIRE_IMMUTABLE_RELEASE=1 to refuse instead of warn.`,
-  };
-}
-
-/// Whether the binary that was just installed IS the version this package
-/// claims. Executing `--version` only proves the file runs; comparing its
-/// output is what proves identity, and the previous implementation piped that
-/// output straight to the terminal and compared nothing.
-function runtimeVersionFailure(versionOutput, expected) {
-  // First line only, and the version must be reported AS the version -- i.e.
-  // `<name> <version>`. Accepting the token anywhere in the output let prose
-  // such as "9.0.6 is not this build; actual 1.0.0" pass.
-  const firstLine = String(versionOutput || "").trim().split(/\r?\n/)[0] || "";
-  const tokens = firstLine.split(/\s+/).filter(Boolean);
-  if (tokens.length === 0) {
-    return `the installed binary printed no version output; expected ${expected}`;
-  }
-  // The version must sit where a version goes: `<name> <version>` (the shape
-  // `nestweaver --version` actually prints), or a bare version on its own.
-  // Exact token match, so 9.0.60 can never satisfy a request for 9.0.6.
-  const reported = tokens.length === 1 ? tokens[0] : tokens[1];
-  if (reported === expected) {
-    return null;
-  }
-  return `the installed binary reports ${JSON.stringify(
-    String(versionOutput).trim(),
-  )}, which does not contain the expected version ${expected}`;
-}
-
-/// Headers for the release-metadata call.
-///
-/// Unauthenticated api.github.com allows 60 requests/hour/IP, so a shared CI
-/// egress or a corporate NAT exhausts it and every install behind that address
-/// fails. A token raises the ceiling to 5,000 and is already present in
-/// virtually every CI environment.
-///
-/// TWO SEPARATE PROPERTIES, and only one of them is about the URL. The URL is a
-/// fixed api.github.com constant, so the credential cannot be sent anywhere
-/// else. But the credential must also not be EXPOSED where it is sent from:
-/// passing it as a curl argv element publishes it to every local user through
-/// the process table (`/proc/<pid>/cmdline` is world-readable on Linux, which
-/// is what CI runners are), so `fetchRelease` feeds these to curl on stdin via
-/// `--config -` rather than as `-H` arguments.
-function githubApiHeaders(env) {
-  const headers = [
-    "Accept: application/vnd.github+json",
-    "X-GitHub-Api-Version: 2026-03-10",
-  ];
-  const token = [env && env.GITHUB_TOKEN, env && env.GH_TOKEN]
-    .map((value) => String(value || "").trim())
-    .find((value) => value.length > 0);
-  if (token) {
-    headers.push(`Authorization: Bearer ${token}`);
-  }
-  return headers;
-}
-
-/// Turn a failed release-metadata call into something the caller can act on.
-/// Failing closed is correct; failing closed without naming the remedy is what
-/// makes a rate limit look like a broken package.
-function describeReleaseApiFailure(failure, env) {
-  const status = failure && failure.status;
-  const body = String((failure && failure.body) || "").trim();
-  const authenticated = githubApiHeaders(env).some((header) =>
-    header.startsWith("Authorization"),
-  );
-  if (status === 401) {
-    return authenticated
-      ? `GitHub rejected the credential in GITHUB_TOKEN/GH_TOKEN (HTTP 401: ${body}). This endpoint needs no credential for a public repository -- unset that variable, or replace the expired or wrong-scope token.`
-      : `GitHub returned HTTP 401 for an unauthenticated request: ${body}`;
-  }
-  if ((status === 403 || status === 429) && /rate limit/i.test(body)) {
-    return authenticated
-      ? `the GitHub API rate limit was exhausted for the credential in use; wait for the limit to reset and retry: ${body}`
-      : `the GitHub API rate limit was exhausted for this IP address (unauthenticated callers get 60 requests/hour, and a shared CI or NAT egress exhausts that quickly). Export GITHUB_TOKEN or GH_TOKEN to raise it, or wait for the limit to reset: ${body}`;
-  }
-  if (status === 404) {
-    return `the GitHub Release was not found (HTTP 404); the tag may not be published yet: ${body}`;
-  }
-  return `could not read GitHub Release metadata${status ? ` (HTTP ${status})` : ""}: ${body}`;
-}
-
-module.exports = {
-  assessReleaseTrust,
-  runtimeVersionFailure,
-  githubApiHeaders,
-  describeReleaseApiFailure,
-};
-
-// ── Installation ────────────────────────────────────────────────────────
-
-/// One release-metadata request. Returns `{ status, body }`; never throws for
-/// an HTTP error, so the caller can decide whether to retry.
-///
-/// `--fail-with-body`, NOT `-f`. Plain `-f` suppresses the response body on an
-/// HTTP error, which left `describeReleaseApiFailure` matching /rate limit/
-/// against a body that could only ever be the three-digit status -- so the
-/// rate-limit branch, the entire reason the token handling exists, was
-/// unreachable. Verified: with `-f` the recovered body is the literal "404".
-///
-/// Headers go over stdin via `--config -` so a bearer token never appears in
-/// this process's argv.
-function requestRelease(url, headers) {
-  // The URL stays a normal argument: it is not a secret, and keeping it in
-  // argv is what lets tooling (and the release gate's fake curl) see which
-  // request is being made. ONLY the headers go over stdin, because that is
-  // where the bearer token lives.
-  const args = [
-    "--fail-with-body",
-    "-sSL",
-    "--write-out",
-    "\n%{http_code}",
-    "--config",
-    "-",
-    url,
-  ];
-  const config = headers
-    .map((header) => `header = ${JSON.stringify(header)}`)
-    .join("\n");
-  let raw;
-  try {
-    raw = execFileSync("curl", args, {
-      input: config,
-      maxBuffer: 32 * 1024 * 1024,
-    }).toString();
-  } catch (error) {
-    const stdout = String((error && error.stdout) || "");
-    if (stdout.length === 0) {
-      // curl never ran, or died before writing: ENOENT / timeout / DNS.
-      // `error.message` is safe to surface here because these arms carry no
-      // argv -- and argv no longer carries the token in any case.
-      return { status: 0, body: String((error && error.message) || error) };
-    }
-    raw = stdout;
-  }
-  const lines = raw.split("\n");
-  const status = Number(lines.pop().trim()) || 0;
-  return { status, body: lines.join("\n").trim() };
-}
-
-function fetchRelease(url, env) {
-  const headers = githubApiHeaders(env);
-  const authenticated = headers.some((header) => header.startsWith("Authorization"));
-  let result = requestRelease(url, headers);
-
-  // This endpoint needs no credential for a public repository, so an ambient
-  // GITHUB_TOKEN/GH_TOKEN can only ever make it worse: `gh auth login` and
-  // composite workflows routinely export a stale or wrong-scope token, which
-  // turns a request that would have succeeded anonymously into a hard 401.
-  // Retry once without it rather than failing on a credential the caller never
-  // asked us to use. Rate-limited responses are NOT retried -- dropping the
-  // token there would make the limit stricter, not looser.
-  if (
-    authenticated &&
-    (result.status === 401 || (result.status === 403 && !/rate limit/i.test(result.body)))
-  ) {
-    const anonymous = headers.filter((header) => !header.startsWith("Authorization"));
-    const retry = requestRelease(url, anonymous);
-    if (retry.status === 200) {
-      result = retry;
-    }
-  }
-
-  if (result.status !== 200) {
-    throw new Error(describeReleaseApiFailure(result, env));
-  }
-  try {
-    return JSON.parse(result.body);
-  } catch (error) {
-    throw new Error(`GitHub Release metadata was not valid JSON: ${error.message}`);
-  }
-}
-
-function main() {
-  const key = `${process.platform}-${process.arch}`;
-  const target = PLATFORM_MAP[key];
-  const binDir = path.join(__dirname, ".nestweaver-bin");
-  const binaryPath = path.join(binDir, "nestweaver");
-  fs.mkdirSync(binDir, { recursive: true });
-  // Never let a failed upgrade leave the newly installed wrapper executing a
-  // binary from an older package version, or a previous run's disclosure
-  // describing a release this run did not install.
-  fs.rmSync(binaryPath, { force: true });
-  fs.rmSync(path.join(binDir, "RELEASE-NOT-IMMUTABLE.txt"), { force: true });
-
-  if (!target) {
-    console.error(`Unsupported platform: ${key}`);
-    console.error("Supported: darwin-x64, darwin-arm64, linux-x64, linux-arm64");
-    console.error(
-      "Unsupported platform. Install a verified GitHub Release archive for a supported target, or from a source checkout: cargo install --locked --path .",
-    );
-    process.exit(1);
-  }
-
-  const version = require("./package.json").version;
-  // Release tags are `v<version>` (release-please config: include-component-in-tag
-  // false) and assets are `nestweaver-v<version>-<target>.tar.gz` (see the
-  // `build` job in .github/workflows/release-please.yml). Keep these in sync.
-  const tag = `v${version}`;
-  const archive = `nestweaver-${tag}-${target}.tar.gz`;
-  const base = `https://github.com/${repo}/releases/download/${tag}`;
-  const url = `${base}/${archive}`;
-  const releaseApiUrl = `https://api.github.com/repos/${repo}/releases/tags/${tag}`;
-  const archivePath = path.join(binDir, archive);
-
-  console.log(`Downloading NestWeaver v${version} for ${target}...`);
-
-  try {
-    const trust = assessReleaseTrust(
-      fetchRelease(releaseApiUrl, process.env),
-      tag,
-      process.env,
-    );
-    if (trust.failure) {
-      throw new Error(trust.failure);
-    }
-    if (trust.warning) {
-      // npm >= 7 HIDES lifecycle-script output unless the script fails or
-      // --foreground-scripts is passed, so a console warning alone does not
-      // reach an ordinary `npm install` user -- which would make "disclosed"
-      // a claim this code does not deliver. Leave it on disk beside the binary
-      // as well, so the disclosure is greppable after the fact.
-      console.warn(`Warning: ${trust.warning}`);
-      try {
-        fs.writeFileSync(
-          path.join(binDir, "RELEASE-NOT-IMMUTABLE.txt"),
-          `${trust.warning}\n\nRelease: ${tag}\nArchive: ${url}\n`,
-        );
-      } catch {
-        // Best effort: a disclosure that cannot be written must not fail an
-        // install whose checksum verified.
-      }
-    }
-
-    execFileSync("curl", ["-fsSL", url, "-o", archivePath], { stdio: "inherit" });
-
-    // Verify the SHA-256 the release ships alongside the archive — a mismatch
-    // means a corrupted or tampered download. Missing, unreadable, or malformed
-    // checksum evidence is equally non-authoritative and must fail closed.
-    const expected = execFileSync("curl", ["-fsSL", `${url}.sha256`])
-      .toString()
-      .trim()
-      .split(/\s+/)[0];
-    const actual = execFileSync("shasum", ["-a", "256", archivePath])
-      .toString()
-      .trim()
-      .split(/\s+/)[0];
-    if (!/^[0-9a-f]{64}$/i.test(expected) || !/^[0-9a-f]{64}$/i.test(actual)) {
-      throw new Error("release checksum evidence is missing or malformed");
-    }
-    if (expected.toLowerCase() !== actual.toLowerCase()) {
-      throw new Error(`checksum mismatch: expected ${expected}, got ${actual}`);
-    }
-
-    execFileSync("tar", ["xz", "-C", binDir, "-f", archivePath], {
-      stdio: "inherit",
-    });
-    if (!fs.existsSync(binaryPath) || !fs.statSync(binaryPath).isFile()) {
-      throw new Error("verified archive did not contain the nestweaver executable");
-    }
-    fs.rmSync(archivePath, { force: true });
-    fs.chmodSync(binaryPath, 0o755);
-
-    // Capture, do not inherit: piping `--version` to the terminal proves the
-    // binary executes and compares nothing.
-    const reported = execFileSync(binaryPath, ["--version"]).toString();
-    const versionFailure = runtimeVersionFailure(reported, version);
-    if (versionFailure) {
-      throw new Error(versionFailure);
-    }
-    console.log(`NestWeaver installed successfully (${reported.trim()}).`);
-    console.log(
-      "Upgrading an existing pre-publication brain? Stop its daemon and run `nestweaver publication rebuild --config /path/to/instance.toml`; the incumbent remains recoverable until validated cutover.",
-    );
-  } catch (err) {
-    fs.rmSync(archivePath, { force: true });
-    // Extraction and the runtime identity check happen after checksum
-    // validation. A failure there must not leave a candidate binary that npm
-    // would expose.
-    fs.rmSync(binaryPath, { force: true });
-    console.error(`Failed to install NestWeaver binary: ${err.message}`);
-    console.error(`  URL: ${url}`);
-    console.error(
-      "Download a verified GitHub Release archive, or build from a source checkout: cargo install --locked --path .",
-    );
-    process.exit(1);
-  }
-}
-
-// Only install when executed as the postinstall script; `require` must be free
-// of side effects so the decision logic above can be tested at all.
-if (require.main === module) {
-  main();
-}