@absolutejs/absolute 0.19.0-beta.1117 → 0.19.0-beta.1119

package/dist/angular/components/core/streamingSlotRegistrar.js

@@ -1,7 +1,7 @@
 // @bun
 var __require = import.meta.require;
 
-// .angular-partial-tmp-sa3gyt/src/core/streamingSlotRegistrar.ts
+// .angular-partial-tmp-dCpCal/src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
 var STREAMING_SLOT_WARNING_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotWarningController");
 var STREAMING_SLOT_COLLECTION_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotCollectionController");

package/dist/angular/components/core/streamingSlotRegistry.js

@@ -1,7 +1,7 @@
 // @bun
 var __require = import.meta.require;
 
-// .angular-partial-tmp-sa3gyt/src/core/streamingSlotRegistrar.ts
+// .angular-partial-tmp-dCpCal/src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
 var STREAMING_SLOT_WARNING_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotWarningController");
 var STREAMING_SLOT_COLLECTION_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotCollectionController");
@@ -48,7 +48,7 @@ var warnMissingStreamingSlotCollector = (primitiveName) => {
   getWarningController()?.maybeWarn(primitiveName);
 };
 
-// .angular-partial-tmp-sa3gyt/src/core/streamingSlotRegistry.ts
+// .angular-partial-tmp-dCpCal/src/core/streamingSlotRegistry.ts
 var STREAMING_SLOT_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotAsyncLocalStorage");
 var isObjectRecord2 = (value) => Boolean(value) && typeof value === "object";
 var isAsyncLocalStorage = (value) => isObjectRecord2(value) && ("getStore" in value) && typeof value.getStore === "function" && ("run" in value) && typeof value.run === "function";

package/dist/cli/index.js

@@ -171648,20 +171648,27 @@ __export(exports_lintProof, {
   createLintSourceTree: () => createLintSourceTree,
   createLintProof: () => createLintProof
 });
-import { createHash as createHash2 } from "crypto";
+import {
+  createHash as createHash2,
+  createPrivateKey,
+  createPublicKey,
+  sign,
+  verify
+} from "crypto";
 import {
   existsSync as existsSync11,
   lstatSync,
   mkdirSync as mkdirSync8,
   mkdtempSync,
   readFileSync as readFileSync14,
+  realpathSync,
   renameSync as renameSync2,
   rmSync as rmSync5,
   writeFileSync as writeFileSync7
 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname5, relative as relative2, resolve as resolve11 } from "path";
-var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSION = 1, runGit = (args, options) => {
+import { delimiter, dirname as dirname5, relative as relative2, resolve as resolve11 } from "path";
+var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSION = 1, FLAG_NOT_FOUND = -1, runGit = (args, options) => {
   const proc = Bun.spawnSync(["git", ...args], {
     cwd: options.cwd,
     env: { ...process.env, ...options.env },
@@ -171673,7 +171680,43 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
     throw new Error(detail || `git ${args.join(" ")} failed`);
   }
   return proc.stdout.toString().trim();
-}, gitRoot = (cwd) => resolve11(runGit(["rev-parse", "--show-toplevel"], { cwd })), createLintSourceTree = (cwd = process.cwd(), proofLocation = DEFAULT_PROOF_LOCATION) => {
+}, gitRoot = (cwd) => resolve11(runGit(["rev-parse", "--show-toplevel"], { cwd })), isInside = (parent, candidate) => {
+  const path = relative2(parent, candidate);
+  return path === "" || !path.startsWith("../") && path !== "..";
+}, attestationPayload = (proof) => Buffer.from([
+  "absolute-lint-proof-attestation:1",
+  JSON.stringify({
+    command: proof.command,
+    contractVersion: proof.contractVersion,
+    createdAt: proof.createdAt,
+    lintFingerprint: proof.lintFingerprint,
+    sourceTree: proof.sourceTree
+  })
+].join("\x00")), publicKeyId = (key) => createHash2("sha256").update(key.export({ format: "der", type: "spki" })).digest("hex"), readEd25519PrivateKey = (cwd, location) => {
+  const path = resolve11(cwd, location);
+  if (isInside(realpathSync(gitRoot(cwd)), realpathSync(path))) {
+    throw new Error("lint proof signing key must live outside the Git working tree");
+  }
+  const key = createPrivateKey(readFileSync14(path));
+  if (key.asymmetricKeyType !== "ed25519") {
+    throw new Error("lint proof signing key must be an Ed25519 private key");
+  }
+  return key;
+}, readEd25519PublicKey = (cwd, location) => {
+  const key = createPublicKey(readFileSync14(resolve11(cwd, location)));
+  if (key.asymmetricKeyType !== "ed25519") {
+    throw new Error("trusted lint proof key must be an Ed25519 public key");
+  }
+  return key;
+}, stageFiles = (files, root, env3) => {
+  const batchSize = 200;
+  for (let index = 0;index < files.length; index += batchSize) {
+    runGit(["add", "-f", "--", ...files.slice(index, index + batchSize)], {
+      cwd: root,
+      env: env3
+    });
+  }
+}, createLintSourceTree = (cwd = process.cwd(), proofLocation = DEFAULT_PROOF_LOCATION) => {
   const root = gitRoot(cwd);
   const proofPath = resolve11(cwd, proofLocation);
   const proofRelative = relative2(root, proofPath).replaceAll("\\", "/");
@@ -171682,7 +171725,19 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
   }
   const temporaryDirectory = mkdtempSync(resolve11(tmpdir2(), "absolute-lint-proof-"));
   const temporaryIndex = resolve11(temporaryDirectory, "index");
-  const env3 = { GIT_INDEX_FILE: temporaryIndex };
+  const temporaryObjects = resolve11(temporaryDirectory, "objects");
+  mkdirSync8(temporaryObjects, { recursive: true });
+  const repositoryObjectsPath = runGit(["rev-parse", "--git-path", "objects"], { cwd: root });
+  const repositoryObjects = resolve11(root, repositoryObjectsPath);
+  const existingAlternates = process.env.GIT_ALTERNATE_OBJECT_DIRECTORIES?.trim();
+  const env3 = {
+    GIT_ALTERNATE_OBJECT_DIRECTORIES: [
+      repositoryObjects,
+      ...existingAlternates ? [existingAlternates] : []
+    ].join(delimiter),
+    GIT_INDEX_FILE: temporaryIndex,
+    GIT_OBJECT_DIRECTORY: temporaryObjects
+  };
   try {
     runGit(["read-tree", "--empty"], { cwd: root, env: env3 });
     const files = runGit(["ls-files", "--cached", "--others", "--exclude-standard", "-z"], { cwd: root }).split("\x00").filter((path) => {
@@ -171695,12 +171750,7 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
         return false;
       }
     });
-    for (let index = 0;index < files.length; index += 200) {
-      runGit(["add", "-f", "--", ...files.slice(index, index + 200)], {
-        cwd: root,
-        env: env3
-      });
-    }
+    stageFiles(files, root, env3);
     return runGit(["write-tree"], { cwd: root, env: env3 });
   } finally {
     rmSync5(temporaryDirectory, { force: true, recursive: true });
@@ -171721,16 +171771,56 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
   const path = resolve11(cwd, proofLocation);
   const temporary = `${path}.${process.pid}.tmp`;
   const proof = createLintProof(command, { cwd, proofLocation });
+  if (options.signingKeyLocation) {
+    const privateKey = readEd25519PrivateKey(cwd, options.signingKeyLocation);
+    const publicKey = createPublicKey(privateKey);
+    proof.attestation = {
+      algorithm: "ed25519",
+      keyId: publicKeyId(publicKey),
+      signature: sign(null, attestationPayload(proof), privateKey).toString("base64")
+    };
+  }
   mkdirSync8(dirname5(path), { recursive: true });
   writeFileSync7(temporary, `${JSON.stringify(proof, null, 2)}
 `);
   renameSync2(temporary, path);
   return proof;
+}, isRecord3 = (value) => value !== null && typeof value === "object", isLintProofAttestation = (value) => {
+  if (!isRecord3(value))
+    return false;
+  return Reflect.get(value, "algorithm") === "ed25519" && typeof Reflect.get(value, "keyId") === "string" && typeof Reflect.get(value, "signature") === "string";
 }, isLintProof = (value) => {
   if (value === null || typeof value !== "object")
     return false;
-  const proof = value;
-  return proof.contractVersion === PROOF_CONTRACT_VERSION && Array.isArray(proof.command) && proof.command.every((part) => typeof part === "string") && typeof proof.createdAt === "string" && typeof proof.lintFingerprint === "string" && typeof proof.sourceTree === "string";
+  const command = Reflect.get(value, "command");
+  const attestation = Reflect.get(value, "attestation");
+  return Reflect.get(value, "contractVersion") === PROOF_CONTRACT_VERSION && Array.isArray(command) && command.every((part) => typeof part === "string") && typeof Reflect.get(value, "createdAt") === "string" && typeof Reflect.get(value, "lintFingerprint") === "string" && typeof Reflect.get(value, "sourceTree") === "string" && (attestation === undefined || isLintProofAttestation(attestation));
+}, verifyAttestation = (proof, cwd, trustedKeyLocation) => {
+  if (!proof.attestation)
+    return {
+      reason: "lint proof is not signed",
+      valid: false
+    };
+  let trustedKey;
+  try {
+    trustedKey = readEd25519PublicKey(cwd, trustedKeyLocation);
+  } catch (error) {
+    return {
+      reason: error instanceof Error ? error.message : "trusted lint proof key is invalid",
+      valid: false
+    };
+  }
+  if (proof.attestation.keyId !== publicKeyId(trustedKey))
+    return {
+      reason: "lint proof was signed by an untrusted key",
+      valid: false
+    };
+  if (!verify(null, attestationPayload(proof), trustedKey, Buffer.from(proof.attestation.signature, "base64")))
+    return {
+      reason: "lint proof signature is invalid",
+      valid: false
+    };
+  return { valid: true };
 }, verifyLintProof = (command, options = {}) => {
   const cwd = options.cwd ?? process.cwd();
   const proofLocation = options.proofLocation ?? DEFAULT_PROOF_LOCATION;
@@ -171760,20 +171850,49 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
       reason: "source tree changed since lint passed",
       valid: false
     };
+  if (options.trustedKeyLocation) {
+    const result = verifyAttestation(proof, cwd, options.trustedKeyLocation);
+    if (!result.valid)
+      return result;
+  }
   return { proof, valid: true };
 }, parseArgs = (args) => {
   const separator = args.indexOf("--");
-  const controlArgs = separator === -1 ? args : args.slice(0, separator);
-  const command = separator === -1 ? [] : args.slice(separator + 1);
+  const controlArgs = separator === FLAG_NOT_FOUND ? args : args.slice(0, separator);
+  const command = separator === FLAG_NOT_FOUND ? [] : args.slice(separator + 1);
   const proofFlag = controlArgs.indexOf("--proof");
-  const proofLocation = proofFlag === -1 ? DEFAULT_PROOF_LOCATION : controlArgs[proofFlag + 1];
+  const proofLocation = proofFlag === FLAG_NOT_FOUND ? DEFAULT_PROOF_LOCATION : controlArgs[proofFlag + 1];
+  const signingKeyFlag = controlArgs.indexOf("--signing-key");
+  const signingKeyLocation = signingKeyFlag === FLAG_NOT_FOUND ? undefined : controlArgs[signingKeyFlag + 1];
+  const trustedKeyFlag = controlArgs.indexOf("--trusted-key");
+  const trustedKeyLocation = trustedKeyFlag === FLAG_NOT_FOUND ? undefined : controlArgs[trustedKeyFlag + 1];
   if (!proofLocation)
     throw new Error("--proof requires a path");
-  return { command, proofLocation };
+  if (signingKeyFlag !== FLAG_NOT_FOUND && !signingKeyLocation)
+    throw new Error("--signing-key requires a path");
+  if (trustedKeyFlag !== FLAG_NOT_FOUND && !trustedKeyLocation)
+    throw new Error("--trusted-key requires a path");
+  return {
+    command,
+    proofLocation,
+    signingKeyLocation,
+    trustedKeyLocation
+  };
+}, runVerification = (parsed) => {
+  const result = verifyLintProof(parsed.command, {
+    proofLocation: parsed.proofLocation,
+    trustedKeyLocation: parsed.trustedKeyLocation
+  });
+  if (!result.valid) {
+    console.error(`\x1B[31m\u2717\x1B[0m ${result.reason}`);
+    return 1;
+  }
+  console.log(`\x1B[32m\u2713\x1B[0m Lint proof matches the source tree, command, and lint toolchain${parsed.trustedKeyLocation ? ", with a trusted signature" : ""}`);
+  return 0;
 }, runLintProof = async (args) => {
   const [operation] = args;
   if (operation !== "run" && operation !== "verify") {
-    console.error("Usage: absolute lint-proof <run|verify> [--proof path] -- <lint command>");
+    console.error("Usage: absolute lint-proof <run|verify> [--proof path] [--signing-key path | --trusted-key path] -- <lint command>");
     return 2;
   }
   let parsed;
@@ -171787,17 +171906,16 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
     console.error("A lint command is required after --");
     return 2;
   }
-  if (operation === "verify") {
-    const result = verifyLintProof(parsed.command, {
-      proofLocation: parsed.proofLocation
-    });
-    if (!result.valid) {
-      console.error(`\x1B[31m\u2717\x1B[0m ${result.reason}`);
-      return 1;
-    }
-    console.log(`\x1B[32m\u2713\x1B[0m Lint proof matches the source tree, command, and lint toolchain`);
-    return 0;
+  if (operation === "run" && parsed.trustedKeyLocation) {
+    console.error("--trusted-key is only valid with lint-proof verify");
+    return 2;
+  }
+  if (operation === "verify" && parsed.signingKeyLocation) {
+    console.error("--signing-key is only valid with lint-proof run");
+    return 2;
   }
+  if (operation === "verify")
+    return runVerification(parsed);
   const proc = Bun.spawn(parsed.command, {
     stderr: "inherit",
     stdout: "inherit"
@@ -171807,8 +171925,11 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
     console.error("\x1B[31m\u2717\x1B[0m Lint failed; proof was not updated");
     return exitCode;
   }
-  writeLintProof(parsed.command, { proofLocation: parsed.proofLocation });
-  console.log(`\x1B[32m\u2713\x1B[0m Wrote exact-source lint proof: ${parsed.proofLocation}`);
+  writeLintProof(parsed.command, {
+    proofLocation: parsed.proofLocation,
+    signingKeyLocation: parsed.signingKeyLocation
+  });
+  console.log(`\x1B[32m\u2713\x1B[0m Wrote exact-source lint proof${parsed.signingKeyLocation ? " with an Ed25519 attestation" : ""}: ${parsed.proofLocation}`);
   return 0;
 };
 var init_lintProof = __esm(() => {
@@ -173057,7 +173178,7 @@ var init_mem = __esm(() => {
 });
 
 // src/cli/config/guards.ts
-var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 
 // src/cli/config/schema/fromType.ts
 import {
@@ -173119,7 +173240,7 @@ var import_typescript3, VIRTUAL_NAME = "__absolute_type_introspect__.ts", MAX_DE
 }, readDiskCache = (cwd, typeName, signature, specifier) => {
   try {
     const cached = JSON.parse(readFileSync17(cacheFile(cwd, typeName, specifier), "utf-8"));
-    if (isRecord3(cached) && cached.signature === signature && Array.isArray(cached.fields)) {
+    if (isRecord4(cached) && cached.signature === signature && Array.isArray(cached.fields)) {
       return cached.fields;
     }
   } catch {}
@@ -173527,11 +173648,11 @@ var init_frameworks = __esm(() => {
 
 // src/cli/generate/context.ts
 import { dirname as dirname6, isAbsolute, join as join14, relative as relative4, resolve as resolve14 } from "path";
-var asString = (value) => typeof value === "string" ? value : undefined, isRecord4 = (value) => typeof value === "object" && value !== null, resolveDir = (cwd, value) => isAbsolute(value) ? value : resolve14(cwd, value), resolveStylesDir = (cwd, config) => {
+var asString = (value) => typeof value === "string" ? value : undefined, isRecord5 = (value) => typeof value === "object" && value !== null, resolveDir = (cwd, value) => isAbsolute(value) ? value : resolve14(cwd, value), resolveStylesDir = (cwd, config) => {
   const styles = config.stylesConfig;
   if (typeof styles === "string")
     return resolveDir(cwd, styles);
-  if (isRecord4(styles)) {
+  if (isRecord5(styles)) {
     const indexes = asString(styles.indexes);
     if (indexes)
       return resolveDir(cwd, indexes);
@@ -173542,7 +173663,7 @@ var asString = (value) => typeof value === "string" ? value : undefined, isRecor
   return dir ? dirname6(dir) : resolve14(project.cwd, "src/frontend");
 }, resolveProject = async (cwd, configOverride) => {
   const loaded = await loadConfig(configOverride);
-  const config = isRecord4(loaded) ? loaded : {};
+  const config = isRecord5(loaded) ? loaded : {};
   const frameworkDirs = {};
   for (const key of FRAMEWORK_KEYS2) {
     const dir = asString(config[frameworks2[key].configDirKey]);
@@ -174524,7 +174645,7 @@ ${value.map((item) => `${pad}${serializeValue(item, level + 1, indent)}`).join(`
 `)}
 ${indent.repeat(level)}]`;
   }
-  if (isRecord3(value)) {
+  if (isRecord4(value)) {
     const keys = Object.keys(value);
     if (keys.length === 0)
       return "{}";
@@ -174737,18 +174858,18 @@ var init_catalog = __esm(() => {
 // src/cli/integrations/addPlugin.ts
 import { existsSync as existsSync23, readFileSync as readFileSync23 } from "fs";
 import { join as join20 } from "path";
-var isRecord5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), readPackageJson = (cwd) => {
+var isRecord6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), readPackageJson = (cwd) => {
   const path = join20(cwd, "package.json");
   if (!existsSync23(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync23(path, "utf-8"));
-    return isRecord5(parsed) ? parsed : null;
+    return isRecord6(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }, addGroupKeys = (group, names) => {
-  if (!isRecord5(group))
+  if (!isRecord6(group))
     return;
   for (const name of Object.keys(group))
     names.add(name);
@@ -175340,12 +175461,12 @@ var init_resolveAuthSettings = __esm(() => {
 // src/cli/config/auth/resolveAuthState.ts
 import { existsSync as existsSync25, readdirSync as readdirSync6, readFileSync as readFileSync25 } from "fs";
 import { join as join21, relative as relative7, resolve as resolve16 } from "path";
-var import_typescript10, AUTH_PACKAGE2 = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs/absolute-auth", NPM_URL = "https://www.npmjs.com/package/@absolutejs/auth", SKIP_DIRS, MAX_FILES = 4000, SETUP_EXPORTS, isRecord6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), readJson = (path) => {
+var import_typescript10, AUTH_PACKAGE2 = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs/absolute-auth", NPM_URL = "https://www.npmjs.com/package/@absolutejs/auth", SKIP_DIRS, MAX_FILES = 4000, SETUP_EXPORTS, isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), readJson = (path) => {
   if (!existsSync25(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync25(path, "utf-8"));
-    return isRecord6(parsed) ? parsed : null;
+    return isRecord7(parsed) ? parsed : null;
   } catch {
     return null;
   }
@@ -175358,7 +175479,7 @@ var import_typescript10, AUTH_PACKAGE2 = "@absolutejs/auth", REPO_URL = "https:/
     return null;
   for (const field of ["dependencies", "devDependencies"]) {
     const group = pkg[field];
-    if (!isRecord6(group))
+    if (!isRecord7(group))
       continue;
     const version2 = group[AUTH_PACKAGE2];
     if (typeof version2 === "string")
@@ -176643,7 +176764,7 @@ var init_logs = __esm(() => {
 import {
   existsSync as existsSync33,
   readFileSync as readFileSync31,
-  realpathSync,
+  realpathSync as realpathSync2,
   rmSync as rmSync6,
   writeFileSync as writeFileSync19
 } from "fs";
@@ -176652,13 +176773,13 @@ import { dirname as dirname14, join as join28, resolve as resolve19, sep } from
 var DEPENDENCY_FIELDS, TYPE_GRAPH_PACKAGES, readManifest = (path) => {
   try {
     const parsed = JSON.parse(readFileSync31(path, "utf-8"));
-    return isRecord3(parsed) ? parsed : null;
+    return isRecord4(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }, dependencyRecord = (manifest, field) => {
   const value = Reflect.get(manifest, field);
-  return isRecord3(value) ? value : {};
+  return isRecord4(value) ? value : {};
 }, dependencyNames = (manifest) => [
   ...new Set(DEPENDENCY_FIELDS.flatMap((field) => Object.keys(dependencyRecord(manifest, field))))
 ], declaresPackage = (manifest, name) => DEPENDENCY_FIELDS.some((field) => Object.hasOwn(dependencyRecord(manifest, field), name)), manifestName = (manifest, fallback) => {
@@ -176714,7 +176835,7 @@ var DEPENDENCY_FIELDS, TYPE_GRAPH_PACKAGES, readManifest = (path) => {
     directory = parent;
   }
 }, appendConsumer = (consumers, consumerPaths, path, manifest) => {
-  const physicalPath = realpathSync(path);
+  const physicalPath = realpathSync2(path);
   if (!manifest || consumerPaths.has(physicalPath))
     return;
   consumerPaths.add(physicalPath);
@@ -176734,7 +176855,7 @@ var DEPENDENCY_FIELDS, TYPE_GRAPH_PACKAGES, readManifest = (path) => {
     identity: {
       consumer: consumerName,
       packageName: target,
-      packagePath: realpathSync(path),
+      packagePath: realpathSync2(path),
       version: manifestVersion(manifest)
     }
   };
@@ -176753,7 +176874,7 @@ var DEPENDENCY_FIELDS, TYPE_GRAPH_PACKAGES, readManifest = (path) => {
   const consumers = [
     { manifest: rootManifest, path: rootManifestPath }
   ];
-  const consumerPaths = new Set([realpathSync(rootManifestPath)]);
+  const consumerPaths = new Set([realpathSync2(rootManifestPath)]);
   const projectManifestPath = findProjectManifest(cwd, installRoot);
   appendConsumer(consumers, consumerPaths, projectManifestPath, readManifest(projectManifestPath));
   const projectConsumers = [...consumers];
@@ -176789,7 +176910,7 @@ var DEPENDENCY_FIELDS, TYPE_GRAPH_PACKAGES, readManifest = (path) => {
   if (!manifest)
     return [];
   const existing = Reflect.get(manifest, "overrides");
-  const overrides = isRecord3(existing) ? existing : {};
+  const overrides = isRecord4(existing) ? existing : {};
   const changes = [];
   const rootName = manifestName(manifest, "<workspace>");
   for (const duplicate of duplicates) {
@@ -176808,7 +176929,7 @@ var DEPENDENCY_FIELDS, TYPE_GRAPH_PACKAGES, readManifest = (path) => {
 }, removeDuplicateTypeGraphPackages = (report) => {
   const manifest = readManifest(join28(report.installRoot, "package.json")) ?? {};
   const rootName = manifestName(manifest, "<workspace>");
-  const installPrefix = `${realpathSync(report.installRoot)}${sep}`;
+  const installPrefix = `${realpathSync2(report.installRoot)}${sep}`;
   const nodeModulesSegment = `${sep}node_modules${sep}`;
   const removed = [];
   const stalePaths = duplicateTypeGraphPackages(report).flatMap((duplicate) => {
@@ -177736,7 +177857,7 @@ var cliTag4 = (color, message) => `\x1B[2m${formatTimestamp()}\x1B[0m ${color}[c
   if (!encoded)
     return;
   const map = JSON.parse(Buffer.from(encoded, "base64").toString("utf-8"));
-  if (!isRecord3(map))
+  if (!isRecord4(map))
     return;
   if (!Array.isArray(map.sources))
     return;
@@ -177987,7 +178108,7 @@ var cliTag4 = (color, message) => `\x1B[2m${formatTimestamp()}\x1B[0m ${color}[c
 }, pickExportEntry = (value) => {
   if (typeof value === "string")
     return value;
-  if (!isRecord3(value))
+  if (!isRecord4(value))
     return;
   for (const key of ["bun", "node", "import", "module", "default"]) {
     const entry = pickExportEntry(value[key]);

package/dist/src/cli/scripts/lintProof.d.ts

@@ -1,4 +1,10 @@
+type LintProofAttestation = {
+    algorithm: 'ed25519';
+    keyId: string;
+    signature: string;
+};
 type LintProof = {
+    attestation?: LintProofAttestation;
     command: string[];
     contractVersion: number;
     createdAt: string;
@@ -12,23 +18,24 @@ type ProofResult = {
     reason: string;
     valid: false;
 };
+type CreateLintProofOptions = {
+    cwd?: string;
+    proofLocation?: string;
+};
+type WriteLintProofOptions = CreateLintProofOptions & {
+    signingKeyLocation?: string;
+};
+type VerifyLintProofOptions = CreateLintProofOptions & {
+    trustedKeyLocation?: string;
+};
 /**
  * Build a Git tree from the complete working copy without modifying the real
  * index. Ignored files and the proof itself are excluded. Git performs its
  * normal clean filters, so the digest is stable across checkout platforms.
  */
 export declare const createLintSourceTree: (cwd?: string, proofLocation?: string) => string;
-export declare const createLintProof: (command: string[], options?: {
-    cwd?: string;
-    proofLocation?: string;
-}) => LintProof;
-export declare const writeLintProof: (command: string[], options?: {
-    cwd?: string;
-    proofLocation?: string;
-}) => LintProof;
-export declare const verifyLintProof: (command: string[], options?: {
-    cwd?: string;
-    proofLocation?: string;
-}) => ProofResult;
+export declare const createLintProof: (command: string[], options?: CreateLintProofOptions) => LintProof;
+export declare const writeLintProof: (command: string[], options?: WriteLintProofOptions) => LintProof;
+export declare const verifyLintProof: (command: string[], options?: VerifyLintProofOptions) => ProofResult;
 export declare const runLintProof: (args: string[]) => Promise<number>;
 export {};

package/package.json

@@ -693,7 +693,7 @@
 			]
 		}
 	},
-	"version": "0.19.0-beta.1117",
+	"version": "0.19.0-beta.1119",
 	"workspaces": [
 		"tests/fixtures/*",
 		"tests/fixtures/_packages/*"