@agilno-tech/rivet 0.1.0-alpha.0

package/src/delivery/gitlab.js

@@ -0,0 +1,395 @@
+import { createProviderHttpClient } from '../adapters/http.js';
+import { captureRecord, createProviderWireBody } from '../adapters/contract.js';
+import { parseRepositoryRemote } from '../repositories/identity.js';
+import { createTrustedDeliveryExecutor } from './service.js';
+import {
+  ensure,
+  exact,
+  factsDigest,
+  hash,
+  plain,
+  ready,
+  sha,
+  timestamp,
+  validateCandidate,
+} from './contract.js';
+
+// GitLab conditions this operation on the source SHA. Target and policy are
+// rechecked, but concurrent administrator changes are not an atomic condition.
+export function createGitlabDeliveryExecutor(inputConfig) {
+  const input = captureRecord(
+    inputConfig,
+    new Set(['repository', 'transport', 'headers', 'clock', 'timeoutMs']),
+    ['repository', 'transport'],
+    'invalid-config',
+  );
+  const supplied = plain(input.repository),
+    repository = parseRepositoryRemote(supplied.url);
+  ensure(repository.provider === 'gitlab' && hash(repository) === hash(supplied));
+  const clock = input.clock ?? (() => new Date().toISOString());
+  ensure(typeof clock === 'function');
+  const http = createProviderHttpClient({
+    provider: 'gitlab',
+    baseUrl: 'https://gitlab.com/api/v4',
+    transport: input.transport,
+    ...(input.headers === undefined ? {} : { headers: input.headers }),
+    ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),
+    allowEncodedSlash: true,
+  });
+  const root = `/projects/${encodeURIComponent(repository.fullName)}`;
+  const get = async (path) => (await http.request({ method: 'GET', path: root + path })).data;
+  const pages = (path) => http.paginate({ path: root + path, identityKey: 'id' });
+  const number = (value) => {
+    ensure(Number.isSafeInteger(value) && value > 0 && value <= 1_000_000_000);
+    return value;
+  };
+  function target(value) {
+    validateCandidate(value);
+    ensure(hash(value.repository) === hash(repository), 'provider-mismatch');
+  }
+  function project(value) {
+    number(value?.id);
+    ensure(
+      value.path_with_namespace === repository.fullName && value.web_url === repository.url,
+      'changed-facts',
+    );
+    const fields = [
+      'id',
+      'archived',
+      'merge_method',
+      'squash_option',
+      'merge_pipelines_enabled',
+      'merge_trains_enabled',
+      'only_allow_merge_if_pipeline_succeeds',
+      'allow_merge_on_skipped_pipeline',
+      'only_allow_merge_if_all_discussions_are_resolved',
+      'only_allow_merge_if_all_status_checks_passed',
+      'prevent_merge_without_jira_issue',
+      'compliance_frameworks',
+    ];
+    return Object.fromEntries(fields.map((key) => [key, value[key] ?? null]));
+  }
+  function mergeRequest(value, candidate, expected, projectId) {
+    ensure(
+      value?.iid === expected &&
+        value.project_id === projectId &&
+        value.source_project_id === projectId &&
+        value.target_project_id === projectId &&
+        value.sha === candidate.headSha &&
+        value.source_branch === candidate.sourceBranch &&
+        value.target_branch === candidate.targetBranch &&
+        value.web_url === `${repository.url}/-/merge_requests/${expected}`,
+      'changed-facts',
+    );
+    ensure(
+      ['opened', 'closed', 'merged', 'locked'].includes(value.state) && typeof value.draft === 'boolean',
+      'invalid-provider-evidence',
+    );
+    // Merged results need only the recorded MR identity and merge commit; branches
+    // may already be deleted and mergeability/approval endpoints need not survive.
+    if (value.state === 'merged')
+      return {
+        number: expected,
+        state: 'merged',
+        url: value.web_url,
+        headSha: value.sha,
+        commitSha: sha(value.merge_commit_sha),
+      };
+    ensure(value.diff_refs?.head_sha === candidate.headSha, 'changed-facts');
+    return {
+      number: expected,
+      state: value.state === 'opened' ? 'open' : 'closed',
+      url: value.web_url,
+      headSha: value.sha,
+      commitSha: null,
+      draft: value.draft,
+      canMerge: value.user?.can_merge === true,
+      status: value.detailed_merge_status ?? null,
+      pipeline: value.head_pipeline ?? null,
+      autoMerge: value.merge_when_pipeline_succeeds ?? null,
+      mergeAfter: value.merge_after ?? null,
+      squash: value.squash ?? null,
+      forceRemoveSourceBranch: value.force_remove_source_branch ?? null,
+    };
+  }
+  async function locate(candidate, projectId, selected) {
+    let n = selected ?? candidate.reviewNumber;
+    if (n === null || n === undefined) {
+      const matches = await pages(
+        `/merge_requests?scope=all&state=opened&source_branch=${encodeURIComponent(candidate.sourceBranch)}&target_branch=${encodeURIComponent(candidate.targetBranch)}&per_page=100`,
+      );
+      ensure(matches.length === 1, 'ambiguous-review');
+      n = number(matches[0].iid);
+    }
+    number(n);
+    if (candidate.reviewNumber !== null) ensure(candidate.reviewNumber === n, 'changed-facts');
+    return mergeRequest(await get(`/merge_requests/${n}`), candidate, n, projectId);
+  }
+  async function policy(p, n) {
+    return {
+      project: p,
+      protections: await pages('/protected_branches?per_page=100'),
+      config: await get('/approvals'),
+      settings: await get('/merge_request_approval_setting'),
+      approvals: await get(`/merge_requests/${n}/approval_state`),
+    };
+  }
+  function supported(policies, candidate) {
+    const { project: p, protections, config: c, settings: s, approvals: a } = policies;
+    if (
+      p.archived !== false ||
+      p.merge_method !== 'merge' ||
+      !['never', 'default_off'].includes(p.squash_option) ||
+      p.only_allow_merge_if_pipeline_succeeds !== true ||
+      ![
+        'merge_pipelines_enabled',
+        'merge_trains_enabled',
+        'allow_merge_on_skipped_pipeline',
+        'only_allow_merge_if_all_discussions_are_resolved',
+        'only_allow_merge_if_all_status_checks_passed',
+        'prevent_merge_without_jira_issue',
+      ].every((key) => p[key] === false) ||
+      !Array.isArray(p.compliance_frameworks) ||
+      p.compliance_frameworks.length !== 0
+    )
+      return false;
+    // Wildcard and inherited overlapping protection resolution is a separate lane.
+    if (
+      !Array.isArray(protections) ||
+      protections.some((rule) => typeof rule.name !== 'string' || rule.name.includes('*'))
+    )
+      return false;
+    const matching = protections.filter((rule) => rule.name === candidate.targetBranch);
+    if (matching.length !== 1) return false;
+    const protection = matching[0];
+    if (
+      protection.allow_force_push !== false ||
+      protection.code_owner_approval_required !== false ||
+      !Array.isArray(protection.merge_access_levels) ||
+      !protection.merge_access_levels.length ||
+      !Array.isArray(protection.push_access_levels) ||
+      !protection.push_access_levels.length
+    )
+      return false;
+    // Direct pushes could bypass this review lane. Unknown/custom access is blocked.
+    if (
+      !protection.push_access_levels.every(
+        (v) => v.access_level === 0 && !v.user_id && !v.group_id && !v.deploy_key_id && !v.member_role_id,
+      ) ||
+      !protection.merge_access_levels.every((v) => [30, 40].includes(v.access_level) && !v.member_role_id)
+    )
+      return false;
+    if (
+      c?.reset_approvals_on_push !== true ||
+      c.selective_code_owner_removals !== false ||
+      ![
+        'retain_approvals_on_push',
+        'selective_code_owner_removals',
+        'allow_overrides_to_approver_list_per_merge_request',
+      ].every((key) => s?.[key]?.value === false) ||
+      c.disable_overriding_approvers_per_merge_request !== true ||
+      a?.approval_rules_overwritten !== false ||
+      !Array.isArray(a.rules)
+    )
+      return false;
+    const ids = new Set();
+    return a.rules.every((r) => {
+      if (!Number.isSafeInteger(r.id) || r.id <= 0 || ids.has(r.id)) return false;
+      ids.add(r.id);
+      return (
+        r.rule_type === 'regular' &&
+        r.contains_hidden_groups === false &&
+        r.overridden === false &&
+        Number.isSafeInteger(r.approvals_required) &&
+        r.approvals_required >= 0 &&
+        typeof r.approved === 'boolean' &&
+        Array.isArray(r.eligible_approvers) &&
+        Array.isArray(r.approved_by) &&
+        [...r.eligible_approvers, ...r.approved_by].every((u) => Number.isSafeInteger(u.id) && u.id > 0)
+      );
+    });
+  }
+  async function observe(candidate) {
+    target(candidate);
+    const p = project(await get('')),
+      first = await locate(candidate, p.id);
+    const source = await get(`/repository/branches/${encodeURIComponent(candidate.sourceBranch)}`),
+      base = await get(`/repository/branches/${encodeURIComponent(candidate.targetBranch)}`);
+    ensure(
+      source.name === candidate.sourceBranch &&
+        source.commit?.id === candidate.headSha &&
+        base.name === candidate.targetBranch,
+      'changed-facts',
+    );
+    const baseSha = sha(base.commit?.id);
+    let policies = null,
+      checks = { policy: 'unknown', satisfied: null, evidenceDigest: hash({ unavailable: true }) },
+      reviews = { ...checks };
+    try {
+      policies = await policy(p, first.number);
+    } catch {
+      policies = null;
+    }
+    if (policies && supported(policies, candidate)) {
+      const ancestor = await get(`/repository/merge_base?refs[]=${baseSha}&refs[]=${candidate.headSha}`);
+      const pipeline = first.pipeline;
+      const canMerge =
+        first.state === 'open' &&
+        !first.draft &&
+        first.canMerge &&
+        first.status === 'mergeable' &&
+        first.autoMerge === false &&
+        first.mergeAfter === null &&
+        first.squash === false &&
+        first.forceRemoveSourceBranch === false;
+      checks = {
+        policy: 'known',
+        satisfied: Boolean(
+          canMerge &&
+            base.protected === true &&
+            ancestor.id === baseSha &&
+            pipeline &&
+            Number.isSafeInteger(pipeline.id) &&
+            pipeline.id > 0 &&
+            pipeline.project_id === p.id &&
+            pipeline.sha === candidate.headSha &&
+            pipeline.status === 'success',
+        ),
+        evidenceDigest: hash({ policies, first, ancestor, protected: base.protected ?? null }),
+      };
+      reviews = {
+        policy: 'known',
+        satisfied: policies.approvals.rules.every(
+          (r) =>
+            r.approved &&
+            new Set(
+              r.approved_by.filter((u) => r.eligible_approvers.some((e) => e.id === u.id)).map((u) => u.id),
+            ).size >= r.approvals_required,
+        ),
+        evidenceDigest: hash({ policies, first }),
+      };
+    }
+    const final = await locate(candidate, p.id, first.number),
+      finalSource = await get(`/repository/branches/${encodeURIComponent(candidate.sourceBranch)}`),
+      finalBase = await get(`/repository/branches/${encodeURIComponent(candidate.targetBranch)}`),
+      finalProject = project(await get(''));
+    ensure(
+      hash(first) === hash(final) &&
+        hash(p) === hash(finalProject) &&
+        finalSource.name === candidate.sourceBranch &&
+        finalSource.commit?.id === candidate.headSha &&
+        finalBase.name === candidate.targetBranch &&
+        finalBase.commit?.id === baseSha &&
+        finalBase.protected === base.protected,
+      'changed-facts',
+    );
+    if (policies) ensure(hash(await policy(finalProject, first.number)) === hash(policies), 'changed-facts');
+    return plain({
+      repositoryUrl: repository.url,
+      sourceBranch: candidate.sourceBranch,
+      targetBranch: candidate.targetBranch,
+      headSha: candidate.headSha,
+      baseSha,
+      review: {
+        number: first.number,
+        state: first.state,
+        url: first.url,
+        headSha: candidate.headSha,
+      },
+      checks: { headSha: candidate.headSha, ...checks },
+      reviews: { headSha: candidate.headSha, ...reviews },
+      observedAt: timestamp(clock()),
+    });
+  }
+  function operation(input) {
+    const op = plain(input);
+    target(op.candidate);
+    ensure(op.action === 'merge');
+    exact(op.payload, ['reviewNumber', 'mergeMethod']);
+    number(op.payload.reviewNumber);
+    ensure(op.payload.mergeMethod === 'merge');
+    return op;
+  }
+  function receipt(op, result) {
+    return plain({
+      status: 'succeeded',
+      operationDigest: op.digest,
+      headSha: op.candidate.headSha,
+      evidenceDigest: hash(result),
+      resourceUrl: result.url,
+      commitSha: result.commitSha,
+    });
+  }
+  async function dispatch(input, context) {
+    const op = operation(input),
+      deadlineContext = plain(context);
+    exact(deadlineContext, ['deadline']);
+    const deadline = Date.parse(timestamp(deadlineContext.deadline));
+    const timely = () => ensure(Date.parse(timestamp(clock())) < deadline, 'dispatch-expired');
+    timely();
+    const facts = await observe(op.candidate);
+    ensure(
+      ready(facts) &&
+        facts.review.number === op.payload.reviewNumber &&
+        factsDigest(facts) === op.factsDigest,
+      'changed-facts',
+    );
+    const wireBody = createProviderWireBody({
+      provider: 'gitlab',
+      action: 'merge',
+      resourceId: `${repository.fullName}#${op.payload.reviewNumber}`,
+      expectedState: 'open',
+      expectedVersion: op.candidate.headSha,
+      idempotencyKey: op.digest,
+      payload: {
+        sha: op.candidate.headSha,
+        squash: false,
+        auto_merge: false,
+        should_remove_source_branch: false,
+      },
+    });
+    timely();
+    const controller = new AbortController(),
+      remaining = deadline - Date.parse(timestamp(clock()));
+    ensure(remaining > 0, 'dispatch-expired');
+    const timer = setTimeout(() => controller.abort(), remaining);
+    let response;
+    try {
+      response = (
+        await http.request({
+          method: 'PUT',
+          path: `${root}/merge_requests/${op.payload.reviewNumber}/merge`,
+          wireBody,
+          signal: controller.signal,
+        })
+      ).data;
+    } finally {
+      clearTimeout(timer);
+    }
+    const p = project(await get('')),
+      sent = mergeRequest(response, op.candidate, op.payload.reviewNumber, p.id);
+    ensure(sent.state === 'merged', 'unverified-effect');
+    const result = await locate(op.candidate, p.id, op.payload.reviewNumber);
+    ensure(result.state === 'merged' && result.commitSha === sent.commitSha, 'unverified-effect');
+    return receipt(op, result);
+  }
+  async function reconcile(input) {
+    try {
+      const op = operation(input),
+        p = project(await get('')),
+        result = await locate(op.candidate, p.id, op.payload.reviewNumber);
+      return result.state === 'merged'
+        ? { status: 'succeeded', receipt: receipt(op, result) }
+        : { status: 'unknown' };
+    } catch {
+      return { status: 'unknown' };
+    }
+  }
+  return createTrustedDeliveryExecutor({
+    provider: 'gitlab',
+    capabilities: [{ action: 'merge', conditionalHead: true, reconcile: true }],
+    observe,
+    dispatch,
+    reconcile,
+  });
+}

package/src/delivery/prepare.js

@@ -0,0 +1,90 @@
+import { createHash } from 'node:crypto';
+import { createHostExecution } from '../feature/host-execution.js';
+import { acquireHostRunLock } from '../feature/host-run-lock.js';
+import { resolveExistingFeatureRunPaths } from '../state/paths.js';
+import { loadProjectConfig } from '../config/load.js';
+import { discoverRepositoryRemotes, selectConfiguredRepositoryRemote } from '../repositories/index.js';
+import { immutableJson } from '../clients/contract.js';
+
+export class DeliveryPreparationError extends Error {
+  constructor(message = 'Delivery requires a verified run and unchanged integration checkout. Inspect work status and verification results.') {
+    super(message);
+    this.name = 'DeliveryPreparationError';
+    this.code = 'ERR_DELIVERY_PREPARATION';
+    this.safeMessage = this.message;
+  }
+}
+function fail() {
+  throw new DeliveryPreparationError();
+}
+
+// Only the application reads local verification. CLI inputs never stand in for evidence.
+export async function loadDeliveryCandidate({ project, runId, remoteName, gitClient, runner }) {
+  const paths = await resolveExistingFeatureRunPaths(project, runId, runner ? { runner } : {});
+  if (paths === null) fail();
+  const lock = await acquireHostRunLock(paths);
+  try {
+    const execution = createHostExecution({ gitClient });
+    const observed = await execution.status({ project, runId });
+    const config = await loadProjectConfig(project);
+    const { run, verification, checkout } = observed;
+    const source = await gitClient.inspectRepository(project);
+    if (
+      source.dirty ||
+      source.detached ||
+      source.headSha !== run.featurePlan.baselineCommit ||
+      source.branch !== config.project.repository.defaultBranch
+    )
+      fail();
+    if (
+      !observed.deliveryReady ||
+      verification.failure !== null ||
+      verification.checks.some(
+        (check) =>
+          check.required &&
+          (check.status !== 'passed' || check.exitCode !== 0 || check.executionStatus !== 'success')
+      ) ||
+      !config.quality.commandGates
+        .filter((gate) => gate.required)
+        .every((gate) =>
+          verification.checks.some(
+            (check) => check.id === gate.id && check.required && check.status === 'passed'
+          )
+        ) ||
+      !run.evidenceRefs.includes(`commit:${checkout.acceptedCommit}`)
+    )
+      fail();
+    const remotes = await discoverRepositoryRemotes(project, runner ? { runner } : {});
+    let selected;
+    try { selected = selectConfiguredRepositoryRemote(remotes, config.project.repository.remote, remoteName); }
+    catch { throw new DeliveryPreparationError('Repository remote is missing, ambiguous or changed. Review setup --remote=<name> or select --remote=<name> for this delivery operation.'); }
+    const { remoteName: _remote, ...repository } = selected;
+    const final = await gitClient.inspectRepository(checkout.path);
+    if (final.dirty || final.headSha !== checkout.acceptedCommit || final.branch !== checkout.branch) fail();
+    return immutableJson({
+      runId,
+      repository,
+      sourceBranch: checkout.branch,
+      targetBranch: config.project.repository.defaultBranch,
+      localVerification: {
+        runId,
+        status: 'passed',
+        headSha: checkout.acceptedCommit,
+        evidenceDigest: createHash('sha256')
+          .update(
+            JSON.stringify({
+              proposalDigest: run.proposalDigest,
+              verification,
+            })
+          )
+          .digest('hex'),
+        verifiedAt: verification.checkedAt,
+      },
+    });
+  } catch (error) {
+    if (error instanceof DeliveryPreparationError) throw error;
+    fail();
+  } finally {
+    await lock.release();
+  }
+}

package/src/delivery/publication-process.js

@@ -0,0 +1,33 @@
+import { spawn } from 'node:child_process';
+import { ensure } from './contract.js';
+
+// Internal argv runner: publication supplies the executable, argv and environment.
+// A killed process group does not prove escaped descendants stopped. Release pipes
+// after a bounded grace and report uncertainty instead of waiting on close forever.
+export async function runPublicationProcess(executable, args, {cwd, env, timeoutMs = 10000, signal, maxOutputBytes = 65536} = {}) {
+  ensure(['darwin','linux'].includes(process.platform), 'unsupported-platform');
+  ensure(Number.isSafeInteger(timeoutMs) && timeoutMs > 0 && timeoutMs <= 120000);
+  ensure(Number.isSafeInteger(maxOutputBytes) && maxOutputBytes > 0 && maxOutputBytes <= 1048576);
+  return new Promise(resolve => {
+    let child, timer, grace, settled = false, reason = null, stdout = '', size = 0;
+    const finish = code => {
+      if (settled) return; settled = true;
+      clearTimeout(timer); clearTimeout(grace); signal?.removeEventListener('abort', abort);
+      resolve({code: code ?? null, reason, cleanup: reason ? 'uncertain' : 'not-required', stdout: reason ? '' : stdout});
+    };
+    const stop = why => {
+      if (reason || settled) return; reason = why;
+      try { process.kill(-child.pid, 'SIGKILL'); } catch {}
+      grace = setTimeout(() => {child.stdout.destroy(); child.stderr.destroy(); child.unref(); finish(null);},100);
+    };
+    const abort = () => stop('cancelled');
+    if (signal?.aborted) {reason='cancelled';finish(null);return;}
+    try {child=spawn(executable,args,{cwd,env,shell:false,detached:true,stdio:['ignore','pipe','pipe']});}
+    catch {reason='launch-failed';finish(null);return;}
+    timer=setTimeout(()=>stop('timeout'),timeoutMs);signal?.addEventListener('abort',abort,{once:true});
+    for (const [stream,capture] of [[child.stdout,true],[child.stderr,false]]) stream.on('data',data=>{
+      if(reason) return;size+=data.length;if(size>maxOutputBytes) stop('output-limit');else if(capture) stdout+=data.toString('utf8');
+    });
+    child.on('error',()=>{reason='launch-failed';finish(null);});child.on('close',finish);
+  });
+}

package/src/delivery/publication-transport.js

@@ -0,0 +1,112 @@
+import { lstat, realpath, open, readdir, mkdtemp, mkdir, rm } from 'node:fs/promises';
+import { join, dirname, relative, resolve, isAbsolute } from 'node:path';
+import { tmpdir } from 'node:os';
+import { ensure, hash, sha } from './contract.js';
+import { parseRepositoryRemote } from '../repositories/identity.js';
+import { runPublicationProcess } from './publication-process.js';
+
+export function publicationAuthorization(provider, token) {
+  const username={github:'x-access-token',gitlab:'oauth2',bitbucket:'x-token-auth'}[provider];
+  ensure(username && typeof token==='string' && token.length>0 && token.length<=8192 && !/[\s\u0000-\u001f\u007f]/.test(token),'invalid-credentials');
+  return `Authorization: Basic ${Buffer.from(`${username}:${token}`).toString('base64')}`;
+}
+function outside(root,path) {const rel=relative(root,path);return rel==='..'||rel.startsWith('../')||isAbsolute(rel);}
+function identity(stat) {return `${stat.dev}:${stat.ino}`;}
+async function directory(path) {
+  ensure(typeof path==='string' && isAbsolute(path) && !/[\u0000-\u001f\u007f:]/.test(path),'unsafe-object-store');
+  ensure(await realpath(path)===path,'unsafe-object-store');
+  const stat=await lstat(path);ensure(stat.isDirectory()&&!stat.isSymbolicLink(),'unsafe-object-store');return identity(stat);
+}
+async function native(path,project) {
+  ensure(isAbsolute(path) && await realpath(path)===path && outside(project,path),'unsafe-git-executable');
+  const stat=await lstat(path);ensure(stat.isFile()&&!stat.isSymbolicLink()&&(stat.mode&0o111)!==0,'unsafe-git-executable');
+  const handle=await open(path,'r');let magic;
+  try {const opened=await handle.stat();ensure(identity(opened)===identity(stat),'unsafe-git-executable');const data=Buffer.alloc(4);ensure((await handle.read(data,0,4,0)).bytesRead===4,'unsafe-git-executable');magic=data.toString('hex');}
+  finally {await handle.close();}
+  ensure(['7f454c46','cffaedfe','cefaedfe','feedfacf','feedface','cafebabe','bebafeca','cafebabf','bfbafeca'].includes(magic),'unsafe-git-executable');
+  return `${identity(stat)}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;
+}
+async function inspectObjects(root) {
+  const rootId=await directory(root);let count=0;
+  async function visit(path,depth) {
+    ensure(depth<=3,'unsafe-object-store');
+    for(const entry of await readdir(path,{withFileTypes:true})) {
+      ensure(++count<=200000 && !entry.isSymbolicLink(),'unsafe-object-store');
+      const child=join(path,entry.name);const stat=await lstat(child);
+      ensure(!stat.isSymbolicLink()&&(stat.isFile()||stat.isDirectory()),'unsafe-object-store');
+      if(path===join(root,'info')) ensure(!['alternates','http-alternates'].includes(entry.name),'unsafe-object-store');
+      if(stat.isDirectory()) await visit(child,depth+1);
+    }
+  }
+  await visit(root,0);ensure(await directory(root)===rootId,'unsafe-object-store');return rootId;
+}
+export function publicationRef(branch) {
+  ensure(typeof branch==='string'&&/^[A-Za-z0-9_][A-Za-z0-9._/-]{0,254}$/.test(branch)&&!branch.includes('..')&&!branch.includes('//')&&!branch.includes('@{')&&!branch.endsWith('/')&&!branch.endsWith('.')&&!branch.split('/').some(p=>p.startsWith('.')||p.endsWith('.lock')),'invalid-branch');
+  return `refs/heads/${branch}`;
+}
+export async function createGitPublicationTransport({gitExecutable,sourceObjects,project,repository,token,runner=runPublicationProcess,signal}) {
+  ensure(hash(parseRepositoryRemote(repository.url))===hash(repository),'invalid-destination');
+  const destination=repository.url+'.git';const projectRoot=await realpath(project);
+  const executableId=await native(gitExecutable,projectRoot);
+  const objectsId=await inspectObjects(sourceObjects);
+  const authorization=publicationAuthorization(repository.provider,token);
+  const cleanBase={PATH:'/usr/bin:/bin',LANG:'C',LC_ALL:'C',GIT_CONFIG_NOSYSTEM:'1',GIT_TERMINAL_PROMPT:'0',GIT_ASKPASS:'/usr/bin/false',SSH_ASKPASS:'/usr/bin/false',GIT_ALLOW_PROTOCOL:'https',GIT_PROTOCOL_FROM_USER:'0'};
+  const probe=await runner(gitExecutable,['--exec-path'],{cwd:'/',env:{...cleanBase,HOME:'/nonexistent',GIT_CONFIG_GLOBAL:'/dev/null'},timeoutMs:3000,signal});
+  ensure(probe.code===0&&!probe.reason&&typeof probe.stdout==='string','unsafe-git-executable');
+  const execPath=probe.stdout.trim();const execPathId=await directory(execPath);
+  ensure(outside(projectRoot,execPath),'unsafe-git-executable');
+  const helpers=[];
+  for (const name of ['git','git-send-pack','git-pack-objects','git-remote-http','git-remote-https']) {
+    const path=await realpath(join(execPath,name));helpers.push({name,path,identity:await native(path,projectRoot)});
+  }
+  async function validateTools() {
+    ensure(await native(gitExecutable,projectRoot)===executableId && await directory(execPath)===execPathId,'changed-git-executable');
+    for(const helper of helpers) ensure(await realpath(join(execPath,helper.name))===helper.path && await native(helper.path,projectRoot)===helper.identity,'changed-git-executable');
+  }
+  async function withRepository(operation) {
+    await validateTools();
+    ensure(await inspectObjects(sourceObjects)===objectsId,'changed-object-store');
+    const scratch=await realpath(await mkdtemp(join(tmpdir(),'rivet-publish-')));
+    try {
+      const bare=join(scratch,'repository.git');const empty=join(scratch,'empty');await mkdir(empty);
+      const settings=[['credential.helper',''],['core.hooksPath',empty],['http.sslVerify','true'],['http.followRedirects','false'],['http.proxy',''],['http.cookieFile',''],['http.saveCookies','false'],['http.extraHeader',authorization],['protocol.allow','never'],['protocol.https.allow','always'],['push.followTags','false'],['push.gpgSign','false'],['push.recurseSubmodules','no'],['core.sshCommand','/usr/bin/false'],['core.useReplaceRefs','false'],['core.commitGraph','false'],['gc.auto','0'],['maintenance.auto','false']];
+      const env={...cleanBase,HOME:scratch,XDG_CONFIG_HOME:empty,GIT_CONFIG_GLOBAL:'/dev/null',GIT_CONFIG_SYSTEM:'/dev/null',GIT_EXEC_PATH:execPath,GIT_TEMPLATE_DIR:empty,GIT_NO_REPLACE_OBJECTS:'1',GIT_NO_LAZY_FETCH:'1',GIT_CONFIG_COUNT:String(settings.length),GIT_ALTERNATE_OBJECT_DIRECTORIES:sourceObjects};
+      settings.forEach(([key,value],i)=>{env[`GIT_CONFIG_KEY_${i}`]=key;env[`GIT_CONFIG_VALUE_${i}`]=value;});
+      const run=async(args,timeoutMs=10000,deadline)=>{
+        await validateTools();
+        const boundedTimeout=deadline===undefined?timeoutMs:Math.min(timeoutMs,Date.parse(deadline)-Date.now());
+        ensure(boundedTimeout>0,'expired-proposal');
+        const result=await runner(gitExecutable,args,{cwd:scratch,env,timeoutMs:boundedTimeout,signal,maxOutputBytes:65536});
+        ensure(result.code===0&&!result.reason,'publication-outcome-uncertain');return result.stdout;
+      };
+      await run(['init','--bare','--template=',bare]);
+      return await operation((args,timeout,deadline)=>run(['--git-dir='+bare,...args],timeout,deadline));
+    } finally {await rm(scratch,{recursive:true,force:true});}
+  }
+  async function readRefs(target) {
+    ensure(hash(target.repository)===hash(repository),'invalid-destination');
+    const source=publicationRef(target.sourceBranch),base=publicationRef(target.targetBranch);ensure(source!==base,'invalid-branch');
+    return withRepository(async run=>{
+      const output=await run(['ls-remote','--refs','--exit-code',destination,source,base]);
+      const refs=new Map();for(const line of output.trim().split('\n').filter(Boolean)) {
+        const match=/^([a-f0-9]{40})\t(refs\/heads\/[^\s]+)$/.exec(line);
+        ensure(match&&[source,base].includes(match[2])&&!refs.has(match[2]),'invalid-remote-observation');refs.set(match[2],match[1]);
+      }
+      ensure(refs.has(base),'missing-target-branch');return {sourceSha:refs.get(source)??null,baseSha:refs.get(base)};
+    });
+  }
+  async function push(target,{deadline}) {
+    ensure(hash(target.repository)===hash(repository),'invalid-destination');sha(target.headSha);
+    const ref=publicationRef(target.sourceBranch);ensure(ref!==publicationRef(target.targetBranch),'invalid-branch');
+    const remaining=()=>Math.min(60000,Date.parse(deadline)-Date.now());ensure(remaining()>0,'expired-proposal');
+    return withRepository(async run=>{
+      ensure((await run(['cat-file','-t',target.headSha])).trim()==='commit','invalid-source-commit');
+      ensure(await directory(sourceObjects)===objectsId,'changed-object-store');
+      ensure(remaining()>0,'expired-proposal');
+      await run(['push','--porcelain','--no-verify','--no-follow-tags','--recurse-submodules=no','--signed=false',`--force-with-lease=${ref}:`,destination,`${target.headSha}:${ref}`],60000,deadline);
+    });
+  }
+  return Object.freeze({readRefs,push});
+}
+
+export async function validatePublicationExecutable(executable,project) {return native(executable,await realpath(project));}