runmat 0.6.1 → 0.6.2-dev.1

package/dist/package-cache/private-artifact.js

@@ -0,0 +1,193 @@
+const KEY_WRAP_INFO = new TextEncoder().encode("runmat-package-key-wrap-v1");
+export async function decryptRegistryPrivateArtifact(releaseValue, ciphertext, keys) {
+    const release = releaseValue;
+    const metadata = release.encryption;
+    if (!metadata) {
+        throw new Error("registry release has no private artifact metadata");
+    }
+    validateMetadata(release, metadata);
+    await verifyDigest(release.artifact.digest, ciphertext, "ciphertext");
+    const aad = canonicalArtifactAad(release, metadata);
+    await verifyDigest(metadata.aadDigest, aad, "artifact associated data");
+    const envelopes = release.artifact.keyEnvelopes ?? [];
+    if (envelopes.length === 0) {
+        throw new Error("registry release has no authorized package key envelope");
+    }
+    const subtle = cryptoApi();
+    for (const envelope of envelopes) {
+        validateEnvelope(envelope);
+        const privateKey = await keys.privateKeyForEnvelope({
+            registry: release.registry,
+            namespace: release.namespace,
+            name: release.name,
+            version: release.version,
+            recipientKeyId: envelope.recipientKeyId,
+            recipientKeyFingerprint: envelope.recipientKeyFingerprint
+        });
+        if (!privateKey)
+            continue;
+        validatePrivateKey(privateKey);
+        const context = canonicalEnvelopeContext(metadata, envelope);
+        await verifyDigest(envelope.contextDigest, context, "key envelope context");
+        const ephemeral = await subtle.importKey("raw", ownedBuffer(decodeBase64Url(envelope.ephemeralPublicKey, 65)), { name: "ECDH", namedCurve: "P-256" }, false, []);
+        const shared = new Uint8Array(await subtle.deriveBits({ name: "ECDH", public: ephemeral }, privateKey, 256));
+        try {
+            const wrappingKey = await deriveWrappingKey(subtle, shared, envelope.contextDigest);
+            const contentKeyBytes = new Uint8Array(await subtle.decrypt({
+                name: "AES-GCM",
+                iv: ownedBuffer(decodeBase64Url(envelope.nonce, 12)),
+                additionalData: ownedBuffer(context),
+                tagLength: 128
+            }, wrappingKey, ownedBuffer(decodeBase64Url(envelope.wrappedKey, 48))));
+            try {
+                if (contentKeyBytes.byteLength !== 32) {
+                    throw new Error("package content key has an invalid length");
+                }
+                const contentKey = await subtle.importKey("raw", ownedBuffer(contentKeyBytes), { name: "AES-GCM" }, false, ["decrypt"]);
+                const plaintext = new Uint8Array(await subtle.decrypt({
+                    name: "AES-GCM",
+                    iv: ownedBuffer(decodeBase64Url(metadata.nonce, 12)),
+                    additionalData: ownedBuffer(aad),
+                    tagLength: 128
+                }, contentKey, ownedBuffer(ciphertext)));
+                if (plaintext.byteLength !== metadata.plaintextByteLen) {
+                    plaintext.fill(0);
+                    throw new Error("private artifact plaintext length is invalid");
+                }
+                try {
+                    await verifyDigest(metadata.plaintextDigest, plaintext, "plaintext");
+                }
+                catch (error) {
+                    plaintext.fill(0);
+                    throw error;
+                }
+                return plaintext;
+            }
+            finally {
+                contentKeyBytes.fill(0);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes("digest"))
+                throw error;
+        }
+        finally {
+            shared.fill(0);
+        }
+    }
+    throw new Error("no local private key could decrypt an authorized package key envelope");
+}
+function validateMetadata(release, value) {
+    if (value.schemaVersion !== 1 ||
+        value.contentCipher !== "aes256-gcm" ||
+        !Number.isSafeInteger(value.keyVersion) ||
+        value.keyVersion <= 0 ||
+        !Number.isSafeInteger(value.plaintextByteLen) ||
+        value.plaintextByteLen <= 0 ||
+        typeof release.registry !== "string" ||
+        typeof release.namespace !== "string" ||
+        typeof release.name !== "string" ||
+        typeof release.version !== "string" ||
+        typeof release.artifact?.treeDigest !== "string") {
+        throw new Error("registry release contains invalid private artifact metadata");
+    }
+    decodeBase64Url(value.nonce, 12);
+}
+function validateEnvelope(value) {
+    if (value.schemaVersion !== 1 ||
+        value.algorithm !== "p256-hkdf-sha256-aes256-gcm" ||
+        !value.recipientKeyId) {
+        throw new Error("registry release contains an invalid package key envelope");
+    }
+    decodeBase64Url(value.ephemeralPublicKey, 65);
+    decodeBase64Url(value.nonce, 12);
+    decodeBase64Url(value.wrappedKey, 48);
+}
+function validatePrivateKey(value) {
+    const algorithm = value.algorithm;
+    if (value.type !== "private" ||
+        value.extractable ||
+        algorithm.name !== "ECDH" ||
+        algorithm.namedCurve !== "P-256" ||
+        !value.usages.includes("deriveBits")) {
+        throw new Error("private package keys must be non-extractable P-256 ECDH keys with deriveBits usage");
+    }
+}
+function canonicalArtifactAad(release, metadata) {
+    return jsonBytes({
+        format: "runmat-private-artifact-aad-v1",
+        registry: release.registry,
+        namespace: release.namespace,
+        name: release.name,
+        version: release.version,
+        treeDigest: release.artifact.treeDigest,
+        contentCipher: metadata.contentCipher,
+        keyVersion: metadata.keyVersion,
+        plaintextDigest: metadata.plaintextDigest,
+        plaintextByteLen: metadata.plaintextByteLen
+    });
+}
+function canonicalEnvelopeContext(metadata, envelope) {
+    return jsonBytes({
+        format: "runmat-package-key-envelope-context-v1",
+        artifactAadDigest: metadata.aadDigest,
+        keyVersion: metadata.keyVersion,
+        recipientKeyId: envelope.recipientKeyId,
+        recipientKeyFingerprint: envelope.recipientKeyFingerprint,
+        ephemeralPublicKey: envelope.ephemeralPublicKey,
+        algorithm: envelope.algorithm
+    });
+}
+async function deriveWrappingKey(subtle, shared, contextDigest) {
+    const material = await subtle.importKey("raw", ownedBuffer(shared), "HKDF", false, [
+        "deriveKey"
+    ]);
+    return subtle.deriveKey({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: ownedBuffer(digestBytes(contextDigest)),
+        info: ownedBuffer(KEY_WRAP_INFO)
+    }, material, { name: "AES-GCM", length: 256 }, false, ["decrypt"]);
+}
+async function verifyDigest(expected, bytes, label) {
+    const actual = new Uint8Array(await cryptoApi().digest("SHA-256", ownedBuffer(bytes)));
+    const expectedBytes = digestBytes(expected);
+    let difference = actual.byteLength ^ expectedBytes.byteLength;
+    for (let index = 0; index < actual.byteLength; index += 1) {
+        difference |= actual[index] ^ (expectedBytes[index] ?? 0);
+    }
+    if (difference !== 0) {
+        throw new Error(`private artifact ${label} digest is invalid`);
+    }
+}
+function digestBytes(value) {
+    const match = /^sha256:([0-9a-f]{64})$/.exec(value);
+    if (!match)
+        throw new Error("private artifact digest is invalid");
+    const hex = match[1];
+    return Uint8Array.from({ length: 32 }, (_, index) => Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16));
+}
+function decodeBase64Url(value, expectedLength) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value) || value.includes("=")) {
+        throw new Error("private artifact base64url value is invalid");
+    }
+    const padded = value.replaceAll("-", "+").replaceAll("_", "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+    const decoded = Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+    if (decoded.byteLength !== expectedLength) {
+        throw new Error("private artifact base64url value has an invalid length");
+    }
+    return decoded;
+}
+function jsonBytes(value) {
+    return new TextEncoder().encode(JSON.stringify(value));
+}
+function ownedBuffer(bytes) {
+    return bytes.slice().buffer;
+}
+function cryptoApi() {
+    if (!globalThis.crypto?.subtle) {
+        throw new Error("Web Crypto is required for private registry packages");
+    }
+    return globalThis.crypto.subtle;
+}
+//# sourceMappingURL=private-artifact.js.map

package/dist/package-cache/private-artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-artifact.js","sourceRoot":"","sources":["../../src/package-cache/private-artifact.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAmD7E,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,YAAqB,EACrB,UAAsB,EACtB,IAAsC;IAEtC,MAAM,OAAO,GAAG,YAA8B,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC;YAClD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,YAAY,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,EAC7D,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EACrC,KAAK,EACL,EAAE,CACH,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAC9E,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YACpF,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,OAAO,CAClB;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACpD,cAAc,EAAE,WAAW,CAAC,OAAO,CAAC;gBACpC,SAAS,EAAE,GAAG;aACf,EACD,WAAW,EACX,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CACtD,CACF,CAAC;YACF,IAAI,CAAC;gBACH,IAAI,eAAe,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;oBACtC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC/D,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,WAAW,CAAC,eAAe,CAAC,EAC5B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;gBACF,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,MAAM,MAAM,CAAC,OAAO,CAClB;oBACE,IAAI,EAAE,SAAS;oBACf,EAAE,EAAE,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpD,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC;oBAChC,SAAS,EAAE,GAAG;iBACf,EACD,UAAU,EACV,WAAW,CAAC,UAAU,CAAC,CACxB,CACF,CAAC;gBACF,IAAI,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;oBACvD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,YAAY,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;oBAAS,CAAC;gBACT,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAC;QAC9E,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB,EAAE,KAAyB;IAC1E,IACE,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,KAAK,CAAC,aAAa,KAAK,YAAY;QACpC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,KAAK,CAAC,UAAU,IAAI,CAAC;QACrB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC7C,KAAK,CAAC,gBAAgB,IAAI,CAAC;QAC3B,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACpC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;QACrC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAChC,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACnC,OAAO,OAAO,CAAC,QAAQ,EAAE,UAAU,KAAK,QAAQ,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAkB;IAC1C,IACE,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,KAAK,CAAC,SAAS,KAAK,6BAA6B;QACjD,CAAC,KAAK,CAAC,cAAc,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,eAAe,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC9C,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgB;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,SAA2B,CAAC;IACpD,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,KAAK,CAAC,WAAW;QACjB,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,UAAU,KAAK,OAAO;QAChC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAuB,EACvB,QAA4B;IAE5B,OAAO,SAAS,CAAC;QACf,MAAM,EAAE,gCAAgC;QACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU;QACvC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAA4B,EAC5B,QAAqB;IAErB,OAAO,SAAS,CAAC;QACf,MAAM,EAAE,wCAAwC;QAChD,iBAAiB,EAAE,QAAQ,CAAC,SAAS;QACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;QACzD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAoB,EACpB,MAAkB,EAClB,aAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjF,WAAW;KACZ,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,SAAS,CACrB;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,EAAE,WAAW,CAAC,aAAa,CAAC;KACjC,EACD,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,KAAiB,EACjB,KAAa;IAEb,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC;IACF,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;IAC9D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,UAAU,IAAI,MAAM,CAAC,KAAK,CAAE,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACtB,OAAO,UAAU,CAAC,IAAI,CACpB,EAAE,MAAM,EAAE,EAAE,EAAE,EACd,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,cAAsB;IAC5D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CACnE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAC/B,GAAG,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,MAAqB,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;AAClC,CAAC"}

package/dist/package-cache/project-session.d.ts

@@ -0,0 +1,61 @@
+import type { RunMatFilesystemProvider } from "../fs/provider-types.js";
+import { type BrowserProjectResolveRequest, type BrowserProjectResolverConfig, type BrowserProjectResolverNative, type BrowserResolvedProject } from "./browser-resolver.js";
+import type { PackageCacheGcPlan, PackageCacheStatus, RunMatPackageCacheProvider } from "./provider-types.js";
+export interface BrowserProjectSessionHandle {
+    setFsProvider?(provider: RunMatFilesystemProvider): Promise<void> | void;
+    installProjectHandoff(handoff: unknown): Promise<unknown>;
+    clearProjectHandoff(): Promise<void>;
+    projectRevision(): Promise<unknown | null>;
+}
+export interface BrowserProjectSessionNative extends BrowserProjectResolverNative {
+    decodePackageLock(input: string): unknown;
+    encodePackageLock(lock: unknown): string;
+    handoffFromFrozenProject(project: unknown): unknown;
+    packageCacheStatus(provider: RunMatPackageCacheProvider): Promise<PackageCacheStatus>;
+    packageCacheGc(provider: RunMatPackageCacheProvider, targetBytes: bigint, retainRecentMs: bigint): Promise<PackageCacheGcPlan>;
+}
+export interface BrowserProjectSessionConfig extends Omit<BrowserProjectResolverConfig, "native"> {
+    native: BrowserProjectSessionNative;
+    session: BrowserProjectSessionHandle;
+}
+export interface BrowserProjectSessionResolveRequest extends BrowserProjectResolveRequest {
+    /**
+     * Defaults to `runmat.lock` beside the manifest. Set to `null` only for an
+     * intentionally ephemeral embedding that must neither read nor write a lock.
+     */
+    lockPath?: string | null;
+}
+export interface BrowserProjectSessionResolution {
+    project: BrowserResolvedProject;
+    handoff: unknown;
+    revision: unknown;
+    lockPath: string | null;
+    lockWritten: boolean;
+}
+/**
+ * Owns one resolved browser project and its immutable cache lease/mount table.
+ *
+ * Rust remains authoritative for lock parsing, solving, graph construction,
+ * handoff validation, and cache policy. This class only coordinates host ports
+ * and makes teardown explicit.
+ */
+export declare class BrowserProjectSession {
+    private readonly config;
+    private readonly resolver;
+    private active;
+    private disposed;
+    constructor(config: BrowserProjectSessionConfig);
+    get resolution(): BrowserProjectSessionResolution | null;
+    get filesystem(): RunMatFilesystemProvider;
+    get cacheLeaseError(): unknown;
+    resolve(request: BrowserProjectSessionResolveRequest): Promise<BrowserProjectSessionResolution>;
+    sourceRevision(): Promise<unknown | null>;
+    cacheStatus(): Promise<PackageCacheStatus>;
+    collectCache(targetBytes: bigint, retainRecentMs?: bigint): Promise<PackageCacheGcPlan>;
+    dispose(): Promise<void>;
+    private readExistingLock;
+    private writeLock;
+    private pathExists;
+    private rollback;
+}
+//# sourceMappingURL=project-session.d.ts.map

package/dist/package-cache/project-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-session.d.ts","sourceRoot":"","sources":["../../src/package-cache/project-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAC;AAI7B,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CAAC,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzE,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,eAAe,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,2BAA4B,SAAQ,4BAA4B;IAC/E,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1C,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACzC,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IACpD,kBAAkB,CAAC,QAAQ,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtF,cAAc,CACZ,QAAQ,EAAE,0BAA0B,EACpC,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,2BACf,SAAQ,IAAI,CAAC,4BAA4B,EAAE,QAAQ,CAAC;IACpD,MAAM,EAAE,2BAA2B,CAAC;IACpC,OAAO,EAAE,2BAA2B,CAAC;CACtC;AAED,MAAM,WAAW,mCACf,SAAQ,4BAA4B;IACpC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,sBAAsB,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAKpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,QAAQ,CAAS;gBAEI,MAAM,EAAE,2BAA2B;IAIhE,IAAI,UAAU,IAAI,+BAA+B,GAAG,IAAI,CAEvD;IAED,IAAI,UAAU,IAAI,wBAAwB,CAEzC;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAEK,OAAO,CACX,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,+BAA+B,CAAC;IA4CrC,cAAc,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAIzC,WAAW,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAI1C,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,cAAc,SAAK,GAClB,OAAO,CAAC,kBAAkB,CAAC;IAWxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAQhB,gBAAgB;YAkBhB,SAAS;YA4BT,UAAU;YAYV,QAAQ;CAMvB"}

package/dist/package-cache/project-session.js

@@ -0,0 +1,160 @@
+import { dirname, normalizePath } from "../fs/path.js";
+import { BrowserProjectResolver } from "./browser-resolver.js";
+const LOCK_FILE_NAME = "runmat.lock";
+/**
+ * Owns one resolved browser project and its immutable cache lease/mount table.
+ *
+ * Rust remains authoritative for lock parsing, solving, graph construction,
+ * handoff validation, and cache policy. This class only coordinates host ports
+ * and makes teardown explicit.
+ */
+export class BrowserProjectSession {
+    config;
+    resolver;
+    active = null;
+    disposed = false;
+    constructor(config) {
+        this.config = config;
+        this.resolver = new BrowserProjectResolver(config);
+    }
+    get resolution() {
+        return this.active;
+    }
+    get filesystem() {
+        return this.resolver.filesystem;
+    }
+    get cacheLeaseError() {
+        return this.resolver.cacheLeaseError;
+    }
+    async resolve(request) {
+        if (this.disposed) {
+            throw new Error("Browser project session has been disposed");
+        }
+        if (this.active) {
+            throw new Error("Dispose the active browser project before resolving another project");
+        }
+        const lockPath = request.lockPath === undefined
+            ? normalizePath(`${dirname(request.manifestPath)}/${LOCK_FILE_NAME}`)
+            : request.lockPath;
+        const existingLock = request.existingLock ??
+            (lockPath === null ? undefined : await this.readExistingLock(lockPath));
+        const project = await this.resolver.resolve({
+            manifestPath: request.manifestPath,
+            existingLock,
+            options: request.options
+        });
+        try {
+            const handoff = await this.config.native.handoffFromFrozenProject(project.frozen);
+            await this.config.session.setFsProvider?.(this.resolver.filesystem);
+            const revision = await this.config.session.installProjectHandoff(handoff);
+            const lockWritten = lockPath !== null && project.lock_decision === "write-generated"
+                ? await this.writeLock(lockPath, project.lock)
+                : false;
+            this.active = {
+                project,
+                handoff,
+                revision,
+                lockPath,
+                lockWritten
+            };
+            return this.active;
+        }
+        catch (error) {
+            this.disposed = true;
+            await this.rollback().catch(() => { });
+            throw error;
+        }
+    }
+    async sourceRevision() {
+        return this.config.session.projectRevision();
+    }
+    async cacheStatus() {
+        return this.config.native.packageCacheStatus(this.config.packageCache);
+    }
+    async collectCache(targetBytes, retainRecentMs = 0n) {
+        if (targetBytes < 0n || retainRecentMs < 0n) {
+            throw new Error("Browser package cache GC values must be non-negative");
+        }
+        return this.config.native.packageCacheGc(this.config.packageCache, targetBytes, retainRecentMs);
+    }
+    async dispose() {
+        if (this.disposed) {
+            return;
+        }
+        this.disposed = true;
+        await this.rollback();
+    }
+    async readExistingLock(lockPath) {
+        try {
+            const metadata = await this.config.filesystem.metadata(lockPath);
+            if (metadata.fileType !== "file") {
+                throw new Error(`Project lock path is not a file: ${lockPath}`);
+            }
+        }
+        catch (error) {
+            if (isNotFound(error)) {
+                return undefined;
+            }
+            throw error;
+        }
+        const bytes = await this.config.filesystem.readFile(lockPath);
+        return this.config.native.decodePackageLock(new TextDecoder("utf-8", { fatal: true }).decode(normalizeBytes(bytes)));
+    }
+    async writeLock(lockPath, lock) {
+        const bytes = new TextEncoder().encode(await this.config.native.encodePackageLock(lock));
+        const exists = await this.pathExists(lockPath);
+        if (exists || !this.config.filesystem.rename) {
+            await this.config.filesystem.writeFile(lockPath, bytes);
+            return true;
+        }
+        const suffix = globalThis.crypto?.randomUUID?.() ??
+            `${Date.now()}-${Math.floor(Math.random() * Number.MAX_SAFE_INTEGER)}`;
+        const temporaryPath = `${lockPath}.runmat-${suffix}.tmp`;
+        await this.config.filesystem.writeFile(temporaryPath, bytes);
+        try {
+            await this.config.filesystem.rename(temporaryPath, lockPath);
+        }
+        catch (error) {
+            try {
+                await this.config.filesystem.removeFile(temporaryPath);
+            }
+            catch {
+                // Preserve the atomic rename failure; a best-effort temp cleanup is secondary.
+            }
+            throw error;
+        }
+        return true;
+    }
+    async pathExists(path) {
+        try {
+            await this.config.filesystem.metadata(path);
+            return true;
+        }
+        catch (error) {
+            if (isNotFound(error)) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    async rollback() {
+        this.active = null;
+        await this.config.session.clearProjectHandoff().catch(() => { });
+        await this.config.session.setFsProvider?.(this.config.filesystem);
+        await this.resolver.dispose();
+    }
+}
+function normalizeBytes(value) {
+    return value instanceof Uint8Array ? value : new Uint8Array(value);
+}
+function isNotFound(error) {
+    if (typeof error === "object" && error !== null && "code" in error) {
+        if (error.code === "ENOENT") {
+            return true;
+        }
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    const normalized = message.toLowerCase();
+    return normalized.includes("not found") || normalized.includes("(404)");
+}
+//# sourceMappingURL=project-session.js.map

package/dist/package-cache/project-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-session.js","sourceRoot":"","sources":["../../src/package-cache/project-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EACL,sBAAsB,EAKvB,MAAM,uBAAuB,CAAC;AAO/B,MAAM,cAAc,GAAG,aAAa,CAAC;AA4CrC;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAKH;IAJZ,QAAQ,CAAyB;IAC1C,MAAM,GAA2C,IAAI,CAAC;IACtD,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAA6B,MAAmC;QAAnC,WAAM,GAAN,MAAM,CAA6B;QAC9D,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IAClC,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAA4C;QAE5C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,KAAK,SAAS;YAC5B,CAAC,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,cAAc,EAAE,CAAC;YACrE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvB,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;YACpB,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1C,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,YAAY;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC1E,MAAM,WAAW,GACf,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,aAAa,KAAK,iBAAiB;gBAC9D,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC;gBAC9C,CAAC,CAAC,KAAK,CAAC;YACZ,IAAI,CAAC,MAAM,GAAG;gBACZ,OAAO;gBACP,OAAO;gBACP,QAAQ;gBACR,QAAQ;gBACR,WAAW;aACZ,CAAC;YACF,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,cAAc,GAAG,EAAE;QAEnB,IAAI,WAAW,GAAG,EAAE,IAAI,cAAc,GAAG,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CACtC,IAAI,CAAC,MAAM,CAAC,YAAY,EACxB,WAAW,EACX,cAAc,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QAC7C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjE,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CACzC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,IAAa;QACrD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CACjD,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GACV,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;YACjC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,aAAa,GAAG,GAAG,QAAQ,WAAW,MAAM,MAAM,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,+EAA+E;YACjF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;CACF;AAED,SAAS,cAAc,CAAC,KAA+B;IACrD,OAAO,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}

package/dist/package-cache/provider-types.d.ts

@@ -0,0 +1,58 @@
+export type PackageCacheRevision = number | bigint;
+export interface PackageCacheSnapshot {
+    revision: PackageCacheRevision;
+    state: unknown;
+}
+export interface PackageCacheObjectWrite {
+    object: unknown;
+    bytes?: number[] | Uint8Array | null;
+}
+export interface PackageCacheTransaction {
+    expected_revision: PackageCacheRevision;
+    next_state: unknown;
+    writes: Record<string, PackageCacheObjectWrite> | Map<string, PackageCacheObjectWrite>;
+    deletes: string[] | Set<string>;
+}
+export type PackageCacheCommitOutcome = {
+    outcome: "committed";
+    revision: PackageCacheRevision;
+} | {
+    outcome: "conflict";
+    actual_revision: PackageCacheRevision;
+};
+/**
+ * Storage-only port consumed by RunMat's portable Rust cache policy.
+ *
+ * Implementations atomically compare the revision and publish state plus payload changes.
+ * They do not interpret package objects, leases, pins, materialization, or GC policy.
+ */
+export interface RunMatPackageCacheProvider {
+    snapshot(): Promise<PackageCacheSnapshot | null>;
+    initialize(initial: PackageCacheSnapshot): Promise<PackageCacheSnapshot>;
+    commit(transaction: PackageCacheTransaction): Promise<PackageCacheCommitOutcome>;
+    readObjectBytes(digest: string): Promise<Uint8Array | null>;
+}
+export interface PackageCacheStatus {
+    schema_version: number;
+    object_count: number | bigint;
+    objects_by_kind: Record<"blob" | "tree" | "source-index", number | bigint>;
+    logical_bytes: number | bigint;
+    stored_payload_bytes: number | bigint;
+    pin_count: number | bigint;
+    lease_count: number | bigint;
+    corruption_count: number | bigint;
+    materialization_count: number | bigint;
+}
+export interface PackageCacheGcPlan {
+    delete: string[];
+    reclaim_bytes: number | bigint;
+}
+export interface PackageCacheLease {
+    id: string;
+    owner: string;
+    objects: string[];
+    acquired_at_ms: number | bigint;
+    expires_at_ms: number | bigint;
+    generation: number | bigint;
+}
+//# sourceMappingURL=provider-types.d.ts.map

package/dist/package-cache/provider-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-types.d.ts","sourceRoot":"","sources":["../../src/package-cache/provider-types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACvF,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,oBAAoB,CAAA;CAAE,GACxD;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACjD,UAAU,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzE,MAAM,CAAC,WAAW,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACjF,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,GAAG,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAC3E,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,qBAAqB,EAAE,MAAM,GAAG,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7B"}

package/dist/package-cache/provider-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider-types.js.map

package/dist/package-cache/provider-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-types.js","sourceRoot":"","sources":["../../src/package-cache/provider-types.ts"],"names":[],"mappings":""}

package/dist/package-cache/registry.d.ts

@@ -0,0 +1,30 @@
+import { type BrowserPrivatePackageKeyProvider } from "./private-artifact.js";
+export interface RegistryCandidatePlan {
+    source_registry: string;
+    index: string;
+    package: string;
+    allow_network: boolean;
+}
+export interface RegistryAcquisitionPlan extends RegistryCandidatePlan {
+    requirement: string;
+    expected?: {
+        release: string;
+    };
+    lock_action: "preserve" | "write" | "replace";
+}
+export interface BrowserRegistryOptions {
+    authenticatedOrigin?: string;
+    authToken?: string | (() => string | null | Promise<string | null>);
+    fetch?: typeof globalThis.fetch;
+    signal?: AbortSignal;
+    maxArtifactBytes?: number;
+    privatePackageKeys?: BrowserPrivatePackageKeyProvider;
+}
+export interface RegistryReleaseTransfer {
+    release: unknown;
+    artifactBytes: Uint8Array;
+    privateArtifact?: boolean;
+}
+export declare function fetchRegistryCandidates(plan: RegistryCandidatePlan, options?: BrowserRegistryOptions): Promise<unknown>;
+export declare function fetchRegistryRelease(plan: RegistryAcquisitionPlan, options?: BrowserRegistryOptions): Promise<RegistryReleaseTransfer>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/package-cache/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/package-cache/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,uBAAuB,CAAC;AAK/B,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,WAAW,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IACpE,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,gCAAgC,CAAC;CACvD;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,UAAU,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,qBAAqB,EAC3B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,uBAAuB,EAC7B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,uBAAuB,CAAC,CA6DlC"}