@aiwg/cli 2026.8.11 → 2026.8.13

package/dist/src/cli/services/deployment-verification.js

@@ -4,6 +4,7 @@ import { loadGraphIndexFile } from '../../artifacts/index-reader.js';
 import { readAiwgConfig } from '../../config/aiwg-config.js';
 import { readUserRegistry } from '../../config/user-registry.js';
 import { getProviderDefinition, normalizeProviderDefinitionId, resolveProviderPathValue, } from '../../providers/provider-definitions.js';
+import { diagnoseIntegratedProviderTransformationReceipt } from '../../providers/transformation-receipt-integration.js';
 import { diagnoseWorkspaceContext, providerContextContract, } from '../../smiths/context-pipeline/workspace-context.js';
 import { USER_SCOPE_PATHS } from '../scope-resolver.js';
 const RESTART_NOTICES = {
@@ -120,6 +121,56 @@ function classifyOutcome(findings, restartRequired) {
         return 'degraded';
     return restartRequired ? 'ready-restart-required' : 'ready';
 }
+const RECEIPT_DRIFT_POLICY = {
+    'source-verification-failure': {
+        severity: 'blocking',
+        remediation: 'Restore or reverify the canonical source before regenerating provider outputs.',
+    },
+    'transformation-mismatch': {
+        severity: 'blocking',
+        remediation: 'Review the active provider adapter change, then re-run the same aiwg use command.',
+    },
+    'user-modification': {
+        severity: 'blocking',
+        remediation: 'Back up the changed managed output if needed, then re-run the same aiwg use command.',
+    },
+    'stale-output': {
+        severity: 'blocking',
+        remediation: 'Re-run the same aiwg use command to complete a verified regeneration.',
+    },
+    'missing-receipt': {
+        severity: 'advisory',
+        remediation: 'Re-run the same aiwg use command to establish provider transformation evidence.',
+    },
+};
+async function collectProviderReceiptFindings(options, provider) {
+    try {
+        const diagnosis = await diagnoseIntegratedProviderTransformationReceipt({
+            projectRoot: options.projectRoot,
+            outputRoot: options.outputRoot,
+            frameworkRoot: options.frameworkRoot,
+            provider,
+            scope: options.scope,
+            requestedBundles: options.requestedBundles,
+        });
+        return diagnosis.findings
+            .filter((drift) => options.reportMissingReceipt !== false || drift.kind !== 'missing-receipt')
+            .map((drift, index) => {
+            const policy = RECEIPT_DRIFT_POLICY[drift.kind];
+            return finding(provider, `provider-drift:${drift.kind}:${index}`, policy.severity, drift.message, policy.remediation, {
+                driftClass: drift.kind,
+                receiptPath: diagnosis.receiptPath,
+                checkedOutputs: diagnosis.checkedOutputs,
+                ...(drift.path ? { path: drift.path } : {}),
+                ...(drift.expected ? { expected: drift.expected } : {}),
+                ...(drift.actual ? { actual: drift.actual } : {}),
+            });
+        });
+    }
+    catch (error) {
+        return [finding(provider, 'provider-drift:missing-receipt:0', 'advisory', `Provider transformation evidence could not be evaluated: ${error instanceof Error ? error.message : String(error)}`, RECEIPT_DRIFT_POLICY['missing-receipt'].remediation, { driftClass: 'missing-receipt' })];
+    }
+}
 function indexContainsRequestedBundles(index, requestedBundles) {
     if (requestedBundles.includes('all'))
         return Object.keys(index.entries).length > 0;
@@ -187,17 +238,18 @@ export async function verifyProviderDeployment(options) {
         findings.push(finding(normalized, 'project-root-missing', 'blocking', `Resolved project root does not exist: ${options.projectRoot}`, 'Select an existing project root and run aiwg use again.'));
     }
     if (definition) {
+        const deploymentRoot = options.outputRoot ?? options.projectRoot;
         const artifactPaths = options.scope === 'user'
             ? USER_SCOPE_PATHS[normalized] ?? definition.paths.artifacts
             : definition.paths.artifacts;
         for (const type of ['agents', 'commands', 'skills', 'rules', 'behaviors']) {
-            const resolved = resolveProviderPathValue(artifactPaths[type], options.projectRoot);
+            const resolved = resolveProviderPathValue(artifactPaths[type], deploymentRoot);
             counts[type] = await countEntries(resolved);
         }
-        const resolvedSkillsPath = resolveProviderPathValue(artifactPaths.skills, options.projectRoot);
+        const resolvedSkillsPath = resolveProviderPathValue(artifactPaths.skills, deploymentRoot);
         const kernelPath = options.scope === 'user'
             ? ''
-            : resolveProviderPathValue(definition.paths.kernelSkills, options.projectRoot);
+            : resolveProviderPathValue(definition.paths.kernelSkills, deploymentRoot);
         const kernelCount = await countEntries(kernelPath);
         if (kernelPath && kernelPath !== resolvedSkillsPath)
             counts.skills += kernelCount;
@@ -207,6 +259,7 @@ export async function verifyProviderDeployment(options) {
         }
     }
     findings.push(...await collectRegistryFindings(options, normalized, counts));
+    findings.push(...await collectProviderReceiptFindings(options, normalized));
     const projectConfig = await readAiwgConfig(options.projectRoot);
     const scopedRegistry = options.scope === 'user'
         ? await readUserRegistry()
@@ -300,7 +353,7 @@ export async function verifyProviderDeployment(options) {
     const indexFailed = findings.some((item) => item.id.startsWith('index-'));
     const contextFailed = findings.some((item) => item.id.startsWith('context-') && item.severity === 'blocking');
     const deployFailed = findings.some((item) => item.severity === 'blocking'
-        && (item.id.startsWith('deployment-') || item.id.startsWith('provider-') || item.id.startsWith('registry-')));
+        && (item.id.startsWith('deployment-') || item.id === 'provider-unknown' || item.id === 'provider-artifacts-missing' || item.id.startsWith('registry-')));
     const phases = [
         phase('resolve', 'passed', true, `Resolved ${options.projectRoot}, ${normalized}, ${options.scope} scope.`),
         phase('deploy', deployFailed ? 'failed' : 'passed', true, deployFailed ? 'Deployment invariants failed.' : 'Provider artifacts and installed state verified.', { counts }),
@@ -406,13 +459,18 @@ export function aggregateUseDeploymentResult(options) {
 }
 export async function verifyConfiguredDeployments(projectRoot, filters = {}, frameworkRoot = process.env.AIWG_ROOT || projectRoot) {
     const config = await readAiwgConfig(projectRoot);
+    const userRegistry = filters.scope === 'user' ? await readUserRegistry() : null;
+    const installed = userRegistry?.installed ?? config?.installed ?? {};
+    const registeredProviders = [...new Set(Object.values(installed).flatMap((entry) => Object.keys(entry.deployedTo ?? {})))];
     const providers = filters.provider
         ? [filters.provider]
-        : config?.providers?.length ? config.providers : [];
-    const bundles = filters.bundle ? [filters.bundle] : Object.keys(config?.installed ?? {});
+        : filters.scope === 'user'
+            ? registeredProviders
+            : config?.providers?.length ? config.providers : registeredProviders;
+    const bundles = filters.bundle ? [filters.bundle] : Object.keys(installed);
     const results = [];
     for (const provider of providers) {
-        const providerBundles = bundles.filter((bundle) => Boolean(config?.installed[bundle]?.deployedTo[provider]));
+        const providerBundles = bundles.filter((bundle) => Boolean(installed[bundle]?.deployedTo[provider]));
         if (providerBundles.length === 0)
             continue;
         results.push(await verifyProviderDeployment({

package/dist/src/config/aiwg-config.js

@@ -448,8 +448,8 @@ export async function readIndexConfig(projectDir) {
  *   - any host containing 'gitea' (or matching the typical Gitea path shape) → 'gitea'
  *
  * Returns 'unknown' for self-hosted instances we can't classify by host alone —
- * callers should then prompt the operator or fall back to the configured
- * AIWG provider list.
+ * callers should then prompt the operator or use `remotes.issue_provider`
+ * when the project has declared one.
  *
  * @implements #997
  */
@@ -466,7 +466,7 @@ export function resolveRemoteProvider(remoteUrl) {
     // gitea — identified by hostname token. Self-hosted Gitea instances often
     // don't include 'gitea' in their hostname (e.g. corporate git servers), so
     // 'unknown' is the honest answer there — callers should consult the
-    // configured AIWG provider list rather than guess.
+    // explicit remotes.issue_provider hint rather than guess.
     if (lower.includes('gitea'))
         return 'gitea';
     return 'unknown';
@@ -487,6 +487,7 @@ export function resolveRemotes(remotes) {
     return {
         primary,
         issue_tracker: remotes?.issue_tracker ?? primary,
+        issue_provider: remotes?.issue_provider,
         ci: remotes?.ci ?? primary,
         tracker_actor: remotes?.tracker_actor,
         transport: remotes?.transport,

package/dist/src/config/cli.js

@@ -140,7 +140,8 @@ async function handleSet(config, args) {
 //   aiwg config get --project remotes.primary
 //
 // Set validates enum membership for known fields (delivery.mode,
-// delivery.merge_style, delivery.force_push_policy) before writing.
+// delivery.merge_style, delivery.force_push_policy, remotes.issue_provider)
+// before writing.
 const ENUM_RULES = {
     'delivery.mode': ['direct', 'feature-branch', 'pr-required'],
     'delivery.merge_style': ['rebase-merge', 'squash', 'merge', 'fast-forward-only'],
@@ -149,6 +150,7 @@ const ENUM_RULES = {
     'delivery.signing.enforce': ['commits', 'tags', 'all'],
     'delivery.release_signing.format': ['openpgp', 'ssh', 'x509'],
     'delivery.release_signing.enforce': ['commits', 'tags', 'all'],
+    'remotes.issue_provider': ['gitea', 'github', 'local'],
     'remotes.tracker_actor.via': ['tea', 'gh', 'mcp', 'api'],
     'remotes.transport.protocol': ['ssh', 'https'],
     'repo_maintainer.tiers.local': ['collaborator', 'maintainer', 'admin'],

package/dist/src/config/gitignore.js

@@ -9,6 +9,10 @@
  */
 import * as fs from 'fs/promises';
 import * as path from 'path';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+const execFileAsync = promisify(execFile);
+const GITIGNORE_PROBE_BASENAME = '.aiwg-ignore-probe';
 // ===========================
 // Recommended Patterns
 // ===========================
@@ -62,6 +66,63 @@ export const ALL_RECOMMENDED_PATTERNS = [
 // ===========================
 // Core Functions
 // ===========================
+function isTextuallyCovered(pattern, lines) {
+    if (lines.includes(pattern))
+        return true;
+    if (lines.includes(pattern.replace(/\/$/, '')))
+        return true;
+    const parts = pattern.split('/').filter(Boolean);
+    for (let i = 1; i < parts.length; i++) {
+        const parent = parts.slice(0, i).join('/') + '/';
+        if (lines.includes(parent) || lines.includes(parent.replace(/\/$/, ''))) {
+            return true;
+        }
+    }
+    return false;
+}
+function probePath(pattern) {
+    return pattern.endsWith('/') ? `${pattern}${GITIGNORE_PROBE_BASENAME}` : pattern;
+}
+async function isGitWorktree(projectRoot) {
+    try {
+        const { stdout } = await execFileAsync('git', ['rev-parse', '--is-inside-work-tree'], {
+            cwd: projectRoot,
+            windowsHide: true,
+        });
+        return stdout.trim() === 'true';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Resolve effective ignore coverage through Git when possible. This honors
+ * negations, .git/info/exclude, and core.excludesFile. A textual fallback keeps
+ * the helper deterministic outside Git worktrees or when Git is unavailable.
+ *
+ * @implements #2106
+ */
+async function resolveCoveredPatterns(projectRoot, patterns, lines) {
+    if (!(await isGitWorktree(projectRoot))) {
+        return new Set(patterns.filter(pattern => isTextuallyCovered(pattern, lines)));
+    }
+    const covered = await Promise.all(patterns.map(async (pattern) => {
+        try {
+            await execFileAsync('git', ['check-ignore', '--quiet', '--', probePath(pattern)], {
+                cwd: projectRoot,
+                windowsHide: true,
+            });
+            return true;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 1)
+                return false;
+            return isTextuallyCovered(pattern, lines);
+        }
+    }));
+    return new Set(patterns.filter((_, index) => covered[index]));
+}
 /**
  * Check which recommended patterns are missing from the project's .gitignore.
  */
@@ -77,26 +138,10 @@ export async function checkGitignore(projectRoot) {
         // File doesn't exist — all patterns are missing
     }
     const lines = content.split('\n').map(l => l.trim());
-    const isCovered = (pattern) => {
-        // Exact match
-        if (lines.includes(pattern))
-            return true;
-        // Pattern without trailing slash is also sufficient
-        if (lines.includes(pattern.replace(/\/$/, '')))
-            return true;
-        // Parent directory is ignored (covers all children)
-        const parts = pattern.split('/').filter(Boolean);
-        for (let i = 1; i < parts.length; i++) {
-            const parent = parts.slice(0, i).join('/') + '/';
-            if (lines.includes(parent) || lines.includes(parent.replace(/\/$/, ''))) {
-                return true;
-            }
-        }
-        return false;
-    };
-    const missingRuntime = AIWG_RUNTIME_PATTERNS.filter(p => !isCovered(p));
-    const missingSession = CLAUDE_SESSION_PATTERNS.filter(p => !isCovered(p));
-    const missingProvider = PROVIDER_CONVENTIONAL_PATTERNS.filter(p => !isCovered(p));
+    const covered = await resolveCoveredPatterns(projectRoot, ALL_RECOMMENDED_PATTERNS, lines);
+    const missingRuntime = AIWG_RUNTIME_PATTERNS.filter(p => !covered.has(p));
+    const missingSession = CLAUDE_SESSION_PATTERNS.filter(p => !covered.has(p));
+    const missingProvider = PROVIDER_CONVENTIONAL_PATTERNS.filter(p => !covered.has(p));
     const missing = [...missingRuntime, ...missingSession, ...missingProvider];
     return { exists, missing, missingRuntime, missingSession, missingProvider };
 }
@@ -116,10 +161,11 @@ export async function appendGitignore(projectRoot, patterns) {
         // File doesn't exist, will create
     }
     const existingLines = existing.split('\n').map(l => l.trim());
+    const covered = await resolveCoveredPatterns(projectRoot, patterns, existingLines);
     const toAdd = [];
     const alreadyPresent = [];
     for (const pattern of patterns) {
-        if (existingLines.includes(pattern) || existingLines.includes(pattern.replace(/\/$/, ''))) {
+        if (covered.has(pattern)) {
             alreadyPresent.push(pattern);
         }
         else {

package/dist/src/config/workspace.js

@@ -119,14 +119,21 @@ async function resolveEndpoint(repoPath, remote, providerHint) {
                 : 'unknown',
     };
 }
+function trackerProviderHint(remotes, fallback) {
+    const configured = remotes.issue_provider;
+    if (configured === 'gitea' || configured === 'github')
+        return configured;
+    return fallback;
+}
 async function resolveMember(entry, workspaceRoot) {
     const memberPath = resolveFrom(workspaceRoot, entry.path);
     const configPath = getConfigPath(memberPath);
     const config = await readAiwgConfig(memberPath);
     const remotes = resolveRemotes(config?.remotes);
+    const issueProviderHint = trackerProviderHint(remotes, entry.provider);
     const [primary, issueTracker, ci] = await Promise.all([
         resolveEndpoint(memberPath, remotes.primary, entry.provider),
-        resolveEndpoint(memberPath, remotes.issue_tracker, entry.provider),
+        resolveEndpoint(memberPath, remotes.issue_tracker, issueProviderHint),
         resolveEndpoint(memberPath, remotes.ci, entry.provider),
     ]);
     const drift = [];

package/dist/src/extensions/commands/definitions.js

@@ -2478,6 +2478,24 @@ export const evidenceCommand = {
         },
     },
 };
+export const artifactVerifyCommand = {
+    id: 'verify',
+    type: 'command',
+    name: 'Artifact Verification',
+    description: 'Verify cross-asset DSSE provenance and manage versioned trust roots',
+    version: '1.0.0',
+    capabilities: ['cli', 'security', 'dsse', 'sigstore', 'provenance', 'trust-policy'],
+    keywords: ['verify', 'artifact', 'attestation', 'dsse', 'sigstore', 'trust-root', 'revocation'],
+    category: 'utility',
+    platforms: { claude: 'full', generic: 'full' },
+    deployment: { pathTemplate: '.{platform}/commands/{id}.md', core: true },
+    metadata: {
+        type: 'command',
+        template: 'utility',
+        argumentHint: '<artifact> --attestation <path> --policy <root.json> [--offline] [--json] | trust <bootstrap|update|status>',
+        allowedTools: ['Read', 'Bash'],
+    },
+};
 export const costReportCommand = {
     id: 'cost-report',
     type: 'skill',
@@ -3614,6 +3632,7 @@ export const commandDefinitions = [
     teamCommand,
     // Metrics (4)
     evidenceCommand,
+    artifactVerifyCommand,
     costReportCommand,
     costHistoryCommand,
     metricsTokensCommand,

package/dist/src/extensions/project-quickref.js

@@ -11,6 +11,7 @@ import { basename, dirname, isAbsolute, join, resolve } from 'path';
 import { homedir } from 'os';
 import { z } from 'zod';
 import { getProviderDefinition, normalizeProviderDefinitionId, } from '../providers/provider-definitions.js';
+import { resolveHermesHome } from '../providers/hermes-home.js';
 import { OPERATIONAL_SHOW_TYPES } from '../artifacts/types.js';
 import { projectAiwgPath } from '../config/project-artifacts.js';
 import { appendAiwgSourceTrackBlock } from './project-local-gitignore.js';
@@ -339,6 +340,14 @@ function resolveProviderSkillsRoot(provider, projectDir, homeDir) {
     const definition = getProviderDefinition(normalized);
     if (!definition)
         throw new Error(`Provider definition unavailable for '${provider}'`);
+    if (normalized === 'hermes') {
+        return {
+            provider: normalized,
+            root: resolve(resolveHermesHome(homeDir), 'skills'),
+            emulated: false,
+            global: true,
+        };
+    }
     const configured = definition.paths.kernelSkills ?? definition.paths.artifacts.skills;
     if (!configured)
         throw new Error(`Provider '${normalized}' has no supported skill or aggregation target`);

package/dist/src/marketplace/artifact-attestation.js

@@ -0,0 +1,195 @@
+import { createArtifactAttestation, serializeArtifactAttestation, } from '../security/artifact-attestation.js';
+import { verifyArtifact, } from '../security/artifact-verifier.js';
+import { canonicalJson as artifactCanonicalJson, parseTrustRoot, sha256 as artifactSha256, } from '../security/artifact-trust.js';
+import { canonicalJson, createPackageLock, verifyProvenanceEnvelope, } from './provenance.js';
+export const MARKETPLACE_ENVELOPE_SUBJECT = 'aiwg-marketplace-envelope.json';
+export function serializeMarketplaceEnvelope(envelope) {
+    return Buffer.from(`${canonicalJson(envelope)}\n`, 'utf8');
+}
+export function marketplaceArtifactScope(envelope) {
+    return {
+        assetType: 'marketplace-envelope',
+        namespace: envelope.package.namespace,
+        channel: `marketplace:${envelope.package.name}`,
+    };
+}
+function requiredMaterialNames(materials) {
+    const names = new Set(materials.map(material => material.name));
+    for (const required of ['lock', 'inventory', 'git-tree', 'fortemi-shard', 'receipt', 'sbom', 'license']) {
+        if (!names.has(required))
+            throw new Error(`Marketplace attestation requires '${required}' material`);
+    }
+}
+export function createMarketplaceArtifactAttestation(options) {
+    requiredMaterialNames(options.materials);
+    const scope = marketplaceArtifactScope(options.envelope);
+    const envelopeBytes = serializeMarketplaceEnvelope(options.envelope);
+    const provenanceBytes = Buffer.from(artifactCanonicalJson(options.envelope.provenance), 'utf8');
+    const dependencies = options.envelope.package.dependencies
+        .filter(dependency => !dependency.optional)
+        .map(dependency => {
+        if (!dependency.lockId)
+            throw new Error(`Required dependency '${dependency.identity}' has no immutable lockId`);
+        return {
+            name: dependency.identity,
+            uri: `aiwg:marketplace-lock:${dependency.lockId}`,
+            mediaType: 'application/vnd.aiwg.marketplace-lock.v1+json',
+            digest: { sha256: dependency.lockId.replace(/^sha256:/, '') },
+        };
+    });
+    const attestation = createArtifactAttestation({
+        artifact: {
+            name: MARKETPLACE_ENVELOPE_SUBJECT,
+            bytes: envelopeBytes,
+            mediaType: 'application/vnd.aiwg.marketplace-envelope.v1+json',
+        },
+        assetType: scope.assetType,
+        publisher: {
+            id: options.publisherIdentity ?? options.envelope.publisher.id,
+            namespace: scope.namespace,
+            role: 'marketplace-publisher',
+        },
+        publication: {
+            version: options.envelope.package.version,
+            channel: scope.channel,
+            sequence: options.envelope.publication.sequence,
+            sourceUri: options.envelope.source.canonicalRemote,
+        },
+        issuedAt: options.issuedAt ?? options.envelope.publication.publishedAt,
+        expiresAt: options.expiresAt,
+        derivation: {
+            builder: options.builder,
+            materials: options.materials.map(material => ({
+                name: material.name,
+                uri: material.uri,
+                ...(material.mediaType ? { mediaType: material.mediaType } : {}),
+                digest: { sha256: artifactSha256(material.bytes) },
+            })),
+            reproducible: true,
+        },
+        provenanceGraph: {
+            standard: 'W3C-PROV',
+            uri: 'aiwg:marketplace-provenance:w3c-prov',
+            sha256: artifactSha256(provenanceBytes),
+        },
+        dependencies,
+        privateKey: options.privateKey,
+    });
+    return { attestation, materials: options.materials };
+}
+export function serializeMarketplaceAttestation(evidence) {
+    return serializeArtifactAttestation(evidence.attestation);
+}
+function signedMarketplacePolicy(root) {
+    return root.signed.policy.marketplace ?? {
+        evidenceMode: 'marketplace-only',
+        legacySignatureMigrationGate: false,
+        recursiveDependencies: 'if-present',
+    };
+}
+export async function verifyMarketplaceEvidence(options) {
+    const authenticatedRoot = options.artifact ? parseTrustRoot(options.artifact.rootBytes) : undefined;
+    const signedPolicy = authenticatedRoot ? signedMarketplacePolicy(authenticatedRoot) : {
+        evidenceMode: 'marketplace-only',
+        legacySignatureMigrationGate: false,
+        recursiveDependencies: 'if-present',
+    };
+    const legacyRequired = signedPolicy.evidenceMode !== 'cross-asset-required'
+        || !signedPolicy.legacySignatureMigrationGate;
+    const marketplace = await verifyProvenanceEnvelope({
+        envelope: options.envelope,
+        contentRoot: options.contentRoot,
+        checkoutPath: options.checkoutPath,
+        trustStore: options.trustStore,
+        installedLocks: options.installedLocks,
+        at: options.artifact?.now ? new Date(options.artifact.now) : undefined,
+        policy: legacyRequired
+            ? {
+                requireSignature: true,
+                allowIntegrityOnly: false,
+                requireDependencyLocks: signedPolicy.recursiveDependencies === 'required',
+                ...options.marketplacePolicy,
+            }
+            : {
+                requireDependencyLocks: signedPolicy.recursiveDependencies === 'required',
+                ...options.marketplacePolicy,
+            },
+    });
+    const errors = marketplace.ok ? [] : marketplace.errors.map(error => `marketplace: ${error}`);
+    let crossAsset;
+    const crossRequired = signedPolicy.evidenceMode !== 'marketplace-only';
+    if (options.artifact) {
+        const scope = marketplaceArtifactScope(options.envelope);
+        crossAsset = await verifyArtifact({
+            artifactBytes: serializeMarketplaceEnvelope(options.envelope),
+            artifactName: MARKETPLACE_ENVELOPE_SUBJECT,
+            attestation: options.artifact.evidence.attestation,
+            rootBytes: options.artifact.rootBytes,
+            state: options.artifact.state,
+            materials: new Map(options.artifact.evidence.materials.map(material => [material.uri, material.bytes])),
+            expectedScope: scope,
+            offline: options.artifact.offline,
+            now: options.artifact.now,
+        });
+        if (crossAsset.status !== 'verified')
+            errors.push(`cross-asset: ${crossAsset.status}`);
+    }
+    else if (crossRequired) {
+        errors.push('cross-asset: required evidence is unavailable');
+    }
+    if (legacyRequired && marketplace.status !== 'verified')
+        errors.push('marketplace: a trusted legacy publisher signature remains mandatory');
+    if (crossAsset?.status === 'verified' && marketplace.signer && options.trustStore) {
+        const legacyKey = options.trustStore.keys.find(key => key.keyId === marketplace.signer);
+        if (!legacyKey?.artifactIdentityId || !crossAsset.identities.includes(legacyKey.artifactIdentityId)) {
+            errors.push('trust-parity: marketplace and cross-asset verification resolved different publisher authorities');
+        }
+    }
+    return {
+        ok: errors.length === 0,
+        status: errors.length === 0 ? 'verified' : 'failed',
+        marketplace,
+        ...(crossAsset ? { crossAsset } : {}),
+        errors: [...new Set(errors)],
+    };
+}
+export async function verifyMarketplaceDependencyClosure(options) {
+    const errors = [];
+    const verified = new Set();
+    const active = new Set();
+    const visit = async (envelope) => {
+        const lock = createPackageLock(envelope, envelope.publication.publishedAt);
+        if (verified.has(lock.lockId))
+            return;
+        if (active.has(lock.lockId)) {
+            errors.push(`dependency cycle detected at ${lock.lockId}`);
+            return;
+        }
+        active.add(lock.lockId);
+        if (!await options.verify(envelope))
+            errors.push(`dependency evidence failed for ${lock.lockId}`);
+        for (const dependency of envelope.package.dependencies.filter(item => !item.optional)) {
+            if (!dependency.lockId) {
+                if (options.required)
+                    errors.push(`required dependency '${dependency.identity}' has no immutable lockId`);
+                continue;
+            }
+            const child = options.packages.get(dependency.lockId);
+            if (!child) {
+                errors.push(`required dependency '${dependency.identity}' is unavailable at ${dependency.lockId}`);
+                continue;
+            }
+            const actual = createPackageLock(child, child.publication.publishedAt).lockId;
+            if (actual !== dependency.lockId) {
+                errors.push(`dependency substitution for '${dependency.identity}': expected ${dependency.lockId}, got ${actual}`);
+                continue;
+            }
+            await visit(child);
+        }
+        active.delete(lock.lockId);
+        verified.add(lock.lockId);
+    };
+    await visit(options.root);
+    return { ok: errors.length === 0, errors, verifiedLocks: [...verified].sort() };
+}
+//# sourceMappingURL=artifact-attestation.js.map