@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.37 → 0.1.47

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/version_release/fixtures/aligned/VERSION

@@ -1 +0,0 @@
-1.2.3

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/version_release/fixtures/mismatched/.workflows/changesets/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "changesets-fixture",
-  "version": "1.2.3",
-  "private": true
-}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/version_release/fixtures/mismatched/.workflows/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "workflows-fixture",
-  "version": "1.2.2",
-  "private": true
-}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/version_release/fixtures/mismatched/CHANGELOG.md

@@ -1,5 +0,0 @@
-# Changelog
-
-## 1.2.0
-
-- fixture: stale release notes, one minor behind VERSION

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/version_release/fixtures/mismatched/VERSION

@@ -1 +0,0 @@
-1.2.3

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/version_release/test_check.py

@@ -1,162 +0,0 @@
-"""REL-004 — VERSION, CHANGELOG.md, and the two workflow manifests, aligned.
-
-Not driven through `verdict_for`/`runner.run`: this wave's checks are ported in
-parallel and none may touch `checks/__init__.py`'s shared `CHECKS` tuple, so
-`lookup(row.id)` cannot find this class yet. `Context`/`FileSet` are built
-directly and `VersionRelease().run(...)` is called on them instead — the same
-pattern `tests/core/test_check.py` already uses to test a `Check` subclass in
-isolation — and `decide()` turns the resulting findings into a `Verdict` for
-readable assertions. `REL-004`'s row already exists in
-`policy/gate-registry.yaml` (with `grants: 0`), so `load().resolve("REL-004")`
-resolves it fine; only the class-lookup step is bypassed.
-
-`test_an_aligned_checkout_is_silent` and `test_a_drifted_checkout_reports_
-both_mismatches` are `test.sh`'s own two corpora (`fixtures/aligned`,
-`fixtures/mismatched`, ported byte-for-byte) and assert exactly what its `rg`
-checks assert: the same rule id (`VER-001`), the same two finding paths and
-messages, and that the corpus's one already-aligned manifest
-(`.workflows/changesets/package.json`) is never named.
-
-The remaining tests exercise `VERREL-INPUT`, the tier `check.sh`'s own bare
-`fail()` calls became (see `check.py`'s module docstring) — untested by
-`test.sh`, which never drives a corpus missing VERSION or CHANGELOG.md, the
-same way `COV-003`'s and `PIP-001`'s invented `*-INPUT` tiers are proven by
-fixtures the shell suite never had either.
-"""
-
-from __future__ import annotations
-
-from collections.abc import Iterable
-from contextlib import ExitStack
-from pathlib import Path
-
-from helpers import corpus
-
-from adl_compliance import runner
-from adl_compliance.checks.release.version_release import VersionRelease
-from adl_compliance.core.context import Context, FileSet
-from adl_compliance.core.verdict import Outcome, Verdict, decide
-from adl_compliance.policy.registry import load
-
-CORPORA = corpus("release", "version-release")
-ALIGNED = CORPORA / "aligned"
-MISMATCHED = CORPORA / "mismatched"
-
-ROW = load().resolve("REL-004")
-
-
-def _verdict(root: Path, given: Iterable[str] = (), trees: dict[str, str] | None = None) -> Verdict:
-    with ExitStack() as stack:
-        inputs = runner.resolve_inputs(VersionRelease, root, None, stack, trees)
-        ctx = Context(root=root, row=ROW, inputs=inputs)
-        findings = tuple(VersionRelease().run(ctx, FileSet(paths=tuple(given))))
-    return decide(ROW, findings, granted=0)
-
-
-def test_an_aligned_checkout_is_silent() -> None:
-    verdict = _verdict(ALIGNED)
-    assert verdict.outcome is Outcome.CLEAN, verdict.render()
-
-
-def test_a_drifted_checkout_reports_both_mismatches() -> None:
-    verdict = _verdict(MISMATCHED)
-    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
-    assert verdict.rules == ["VER-001", "VER-001"], verdict.render()
-
-    by_path = {f.path: f.message for f in verdict.findings}
-    assert by_path[".workflows/package.json"] == (
-        ".workflows/package.json has version 1.2.2, expected 1.2.3 (from VERSION)"
-    )
-    assert by_path["CHANGELOG.md"] == (
-        "CHANGELOG.md's latest release heading is 1.2.0, expected 1.2.3 (from VERSION)"
-    )
-    # .workflows/changesets/package.json is aligned (1.2.3) in this fixture and
-    # must not be reported.
-    assert ".workflows/changesets/package.json" not in verdict.render()
-
-
-def test_a_missing_version_file_is_an_input_finding(tmp_path: Path) -> None:
-    (tmp_path / "CHANGELOG.md").write_text("# Changelog\n\n## 1.2.3\n")
-    verdict = _verdict(tmp_path)
-    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
-    assert verdict.rules == ["VERREL-INPUT"]
-    assert verdict.findings[0].path == "VERSION"
-    assert "VERSION is missing" in verdict.findings[0].message
-
-
-def test_an_empty_version_file_is_an_input_finding(tmp_path: Path) -> None:
-    (tmp_path / "VERSION").write_text("   \n")
-    (tmp_path / "CHANGELOG.md").write_text("# Changelog\n\n## 1.2.3\n")
-    verdict = _verdict(tmp_path)
-    assert verdict.rules == ["VERREL-INPUT"], verdict.render()
-    assert "VERSION is empty" in verdict.findings[0].message
-
-
-def test_a_non_semantic_version_is_an_input_finding(tmp_path: Path) -> None:
-    (tmp_path / "VERSION").write_text("v1.2\n")
-    (tmp_path / "CHANGELOG.md").write_text("# Changelog\n\n## 1.2.3\n")
-    verdict = _verdict(tmp_path)
-    assert verdict.rules == ["VERREL-INPUT"], verdict.render()
-    assert "not semantic x.y.z" in verdict.findings[0].message
-
-
-def test_a_missing_changelog_is_an_input_finding(tmp_path: Path) -> None:
-    (tmp_path / "VERSION").write_text("1.2.3\n")
-    verdict = _verdict(tmp_path)
-    assert verdict.rules == ["VERREL-INPUT"], verdict.render()
-    assert verdict.findings[0].path == "CHANGELOG.md"
-    assert "CHANGELOG.md is missing" in verdict.findings[0].message
-
-
-def test_a_changelog_with_no_release_heading_is_an_input_finding(tmp_path: Path) -> None:
-    (tmp_path / "VERSION").write_text("1.2.3\n")
-    (tmp_path / "CHANGELOG.md").write_text("# Changelog\n\n## [Unreleased]\n\n- wip\n")
-    verdict = _verdict(tmp_path)
-    assert verdict.rules == ["VERREL-INPUT"], verdict.render()
-    assert "unable to read latest CHANGELOG.md release version" in verdict.findings[0].message
-
-
-def test_a_missing_versioned_manifest_is_an_input_finding(tmp_path: Path) -> None:
-    (tmp_path / "VERSION").write_text("1.2.3\n")
-    (tmp_path / "CHANGELOG.md").write_text("# Changelog\n\n## 1.2.3\n")
-    verdict = _verdict(tmp_path)
-    assert verdict.rules == ["VERREL-INPUT"], verdict.render()
-    assert verdict.findings[0].path == ".workflows/changesets/package.json"
-    assert "is missing" in verdict.findings[0].message
-
-
-def test_a_redeclared_workflows_tree_is_honoured(tmp_path: Path) -> None:
-    """FIXED 2026-09-15 (K-42 sweep): `VERSIONED_FILES` used to be hardcoded
-    `.workflows/...` literals read directly via `self.text(ctx, relative)`,
-    bypassing `ctx.inputs`/tree resolution entirely. A repository declaring
-    `workflows = "my-workflows"` (with its two manifests actually living
-    there) got both reported as flatly missing — LOUD, but against a path
-    that was never real, never the redeclared one. Drives a real `<workflows>`
-    redeclaration via `effective_trees`, not the packaged-default `trees=None`
-    every other test in this file uses."""
-    from adl_compliance.policy.registry import effective_trees
-
-    (tmp_path / "VERSION").write_text("1.2.3\n")
-    (tmp_path / "CHANGELOG.md").write_text("# Changelog\n\n## 1.2.3\n")
-    workflows = tmp_path / "my-workflows"
-    (workflows / "changesets").mkdir(parents=True)
-    manifest = '{\n  "name": "fixture",\n  "version": "1.2.3"\n}\n'
-    (workflows / "package.json").write_text(manifest)
-    (workflows / "changesets" / "package.json").write_text(manifest)
-    verdict = _verdict(tmp_path, trees=effective_trees({"workflows": "my-workflows"}))
-    assert verdict.outcome is Outcome.CLEAN, verdict.render()
-
-
-def test_a_bracketed_changelog_heading_is_read_the_same_as_a_bare_one(tmp_path: Path) -> None:
-    """`## [1.2.3] - 2024-01-01` and `## 1.2.3` both resolve to `1.2.3`."""
-    (tmp_path / "VERSION").write_text("1.2.3\n")
-    (tmp_path / "CHANGELOG.md").write_text(
-        "# Changelog\n\n## [1.2.3] - 2024-01-01\n\n- release\n"
-    )
-    workflows = tmp_path / ".workflows"
-    (workflows / "changesets").mkdir(parents=True)
-    manifest = '{\n  "name": "fixture",\n  "version": "1.2.3"\n}\n'
-    (workflows / "package.json").write_text(manifest)
-    (workflows / "changesets" / "package.json").write_text(manifest)
-    verdict = _verdict(tmp_path)
-    assert verdict.outcome is Outcome.CLEAN, verdict.render()

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/banned_commands/check.py

@@ -1,103 +0,0 @@
-"""REP-004 — no executable invocation of a banned command inside this package.
-
-  GIT-001  a standalone version-control command.
-  GRP-001  a standalone legacy search command.
-
-Two rules, one table, because they differed only in the forbidden word.
-
-**This gate would report itself if written naively** (K-15). A check that
-forbids a string necessarily contains it, so both words are ASSEMBLED from
-fragments below and appear nowhere in this file as a single token — the shell
-version was flagged at its own line 85 before it did the same.
-
-The extension test is SUBJECT MATTER, not scope. It asks what KIND of file this
-is — the rule is about shell, and a `.md` file naming a command is prose. A path
-PREFIX would be a different question, "where is this file", and that is the row's
-`engine.scope` to answer; an earlier draft filtered `compliance/**` inside the
-script and that is the hand-rolled path list AGENTS.md forbids.
-
-What the port deletes is everything the shell needed to REACH the search: a
-`command -v rg` prologue, `mktemp` with a NUL-delimited list because the tree has
-paths with spaces, an `xargs -0 sh -c` batch wrapper, and the exit-status
-translation inside it — GNU `xargs` collapses every utility exit in 1..125 to
-123, so rg's "no matches" and "real error" arrived identically. `re` has no exit
-status to translate.
-"""
-
-from __future__ import annotations
-
-import re
-from collections.abc import Iterable
-from typing import ClassVar, NamedTuple
-
-from ....core.check import Check
-from ....core.context import Context, FileSet
-from ....core.finding import Report
-
-
-class Banned(NamedTuple):
-    rule: str
-    word: str
-    message: str
-    fix: str
-
-
-class BannedCommands(Check):
-    id: ClassVar[str] = "REP-004"
-
-    SHELL_SUFFIXES: ClassVar[tuple[str, ...]] = (".sh", ".bash", ".zsh")
-    JUSTFILE: ClassVar[str] = "justfile"
-
-    # Assembled, never spelled. Written as one token, this file becomes a
-    # violation of the rule it enforces -- and a true one, by the rule's own
-    # definition.
-    VCS_WORD: ClassVar[str] = "gi" + "t"
-    SEARCH_WORD: ClassVar[str] = "gr" + "ep"
-
-    BOUNDARY: ClassVar[str] = r"(?:^|[;&|()`\s'\"])"
-    """A command START. The backtick is in the class so a command substitution
-    opening with one is still recognised; the original GRP-001 pattern omitted
-    it and the original GIT-001 pattern is the one kept."""
-
-    TRAILING: ClassVar[str] = r"(?:\s|$)"
-
-    COMMENT: ClassVar[re.Pattern[str]] = re.compile(r"^\s*#")
-    """A WHOLE-LINE comment only. Deliberately conservative: a trailing comment
-    on a real command line stays flagged, because deciding whether a mid-line
-    '#' opens a comment or sits inside a quoted string needs a shell parser, and
-    over-reporting is the safe direction."""
-
-    def banned(self) -> tuple[Banned, ...]:
-        return (
-            Banned(
-                rule="GIT-001",
-                word=self.VCS_WORD,
-                message="version-control invocation is forbidden inside the compliance package",
-                fix="read the set the runner hands you, or drop the call if it only built "
-                    "a repository the assertion never needed",
-            ),
-            Banned(
-                rule="GRP-001",
-                word=self.SEARCH_WORD,
-                message="standalone legacy search command is forbidden; use rg",
-                fix="replace this invocation with an equivalent rg call",
-            ),
-        )
-
-    def graded(self, ctx: Context, files: FileSet) -> Iterable[Report]:
-        targets = sorted(p for p in files if self._is_shell(p))
-        for relative in FileSet(paths=tuple(targets)).existing(ctx.root):
-            for entry in self.banned():
-                pattern = re.compile(f"{self.BOUNDARY}{re.escape(entry.word)}{self.TRAILING}")
-                for line, found in self.scan(ctx, relative, pattern):
-                    # `found.string` is the line: `scan` matches line by line.
-                    if self.COMMENT.match(found.string):
-                        continue
-                    yield self.report(
-                        relative, f"{entry.message} ({found.string.strip()})",
-                        entry.fix, rule=entry.rule, line=line,
-                    )
-
-    def _is_shell(self, relative: str) -> bool:
-        name = relative.rsplit("/", 1)[-1]
-        return name == self.JUSTFILE or relative.endswith(self.SHELL_SUFFIXES)

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/backend/Cargo.lock

@@ -1,7 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "fixture"
-version = "0.1.0"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/backend/Cargo.toml

@@ -1,4 +0,0 @@
-[package]
-name = "fixture"
-version = "0.1.0"
-edition = "2021"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/backend/rust-toolchain.toml

@@ -1,3 +0,0 @@
-[toolchain]
-channel = "1.96.1"
-components = ["rustfmt", "clippy", "rust-analyzer", "llvm-tools-preview"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/backend/src/main.rs

@@ -1 +0,0 @@
-fn main() {}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/frontend/bun.lock

@@ -1 +0,0 @@
-# fixture lock

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/backend/Cargo.lock

@@ -1,7 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "fixture"
-version = "0.1.0"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/backend/Cargo.toml

@@ -1,4 +0,0 @@
-[package]
-name = "fixture"
-version = "0.1.0"
-edition = "2021"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/backend/rust-toolchain.toml

@@ -1,3 +0,0 @@
-[toolchain]
-channel = "1.96.1"
-components = ["rustfmt", "clippy", "rust-analyzer", "llvm-tools-preview"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/backend/src/main.rs

@@ -1 +0,0 @@
-fn main() {}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/policy/grants-registry.yaml

@@ -1,112 +0,0 @@
-schema: adl.exception-register/v1
-created: '2026-08-22'
-catalogs:
-  - path: compliance/policy/grants/typescript.audit.yaml
-    source: retired 2026-08-23 (frontend-bun-audit-exceptions.json deleted; catalog is now the sole record)
-    source_count: 0
-  - path: compliance/policy/grants/rust.audit.yaml
-    source: retired 2026-08-23 (backend-cargo-audit-exceptions.json deleted; catalog is now the sole record)
-    source_count: 0
-  # backend-parity.yaml removed 2026-08-23. Parity with the legacy
-  # check-rust-policy.py was reached, the catalog held zero entries, and no
-  # `.py` remains under .workflows/ for it to be parity WITH. The register
-  # outlived the file by a day and blocked gate-profile-report until now.
-  - path: compliance/policy/grants/rust.run-001-command-boundary.yaml
-    source: .workflows/config/profiles/rule-profiles.yaml (rust.run-001-command-boundary)
-    source_count: 2
-  - path: compliance/policy/grants/rust.todo-unimplemented-in-test.yaml
-    source: .workflows/config/profiles/rule-profiles.yaml (rust.todo-unimplemented-in-test)
-    source_count: 1
-  - path: compliance/policy/grants/rust.no-ignore-in-tests.yaml
-    source: .workflows/config/profiles/rule-profiles.yaml (rust.no-ignore-in-tests)
-    source_count: 0
-    # emptied 2026-08-24: all 19 inherited #[ignore] uses migrated to Cargo
-    # feature gating the same day (rust.no-ignore-in-tests report now clean
-    # with zero exceptions). File kept as entries: [] -- deletion is blocked
-    # by the sandbox for this tree; the profile row's `exceptions:` reference
-    # stays valid rather than pointing at a removed file.
-  - path: compliance/policy/grants/typescript.no-test-skip.yaml
-    source: .workflows/config/profiles/rule-profiles.yaml (typescript.no-test-skip)
-    source_count: 71
-    # 2743 -> 6045 on 2026-08-23: the old backlog measures 0 and the count is now
-    # entirely ultracite/biome/type-aware's eight project-scanner rules.
-  - path: compliance/policy/grants/framework.inline-suppressions.yaml
-    source: tracked repository inline markers at 8094e112 excluding plan examples
-    baseline_source_count: 145
-    source_count: 186
-  - path: compliance/policy/grants/typescript.bundle-size.yaml
-    source: compliance/policy/grants/typescript.bundle-size.yaml
-    source_count: 1
-  - path: compliance/policy/grants/rust.verified-exception.yaml
-    source: compliance/policy/grants/rust.verified-exception-entry.yaml
-    source_count: 0
-  - path: compliance/policy/grants/rust.crate-edges.yaml
-    source: compliance/policy/inputs/rust-crate-register.yaml
-    source_count: 0
-  # frontend-symbols.yaml removed 2026-08-23 together with its source register
-  # .workflows/config/frontend/frontend-symbol-register.yaml (DEF-0029): the
-  # catalog held zero entries and the register's documented consumers did not
-  # exist, so it granted nothing to nobody.
-  - path: compliance/policy/grants/framework.no-python.yaml
-    source: .workflows/scripts/gates/meta/check-no-python.sh (PY-01)
-    source_count: 2
-  - path: compliance/policy/grants/framework.no-silent-degrade.yaml
-    source: .workflows/scripts/gates/meta/check-no-silent-degrade.sh (SD-01, SD-02)
-    source_count: 1
-  # Registered 2026-08-23. All three suppressed real frontend findings while
-  # appearing in no register, in no profile row's `exceptions:` field, and in no
-  # column of the debt report. An allowance nobody can enumerate is not a
-  # reviewed exception, it is an unrecorded one.
-  - path: compliance/policy/baselines/typescript.dead-code-accounting.yaml
-    source: compliance/policy/grants/typescript.dead-code.yaml
-    source_count: 669
-  # frontend-english-only.yaml retired 2026-08-27, per DEF-0050's own
-  # requirement ("Retire frontend-english-only.yaml and its index entry with
-  # it"). 40 -> 0: the docs.english-only row no longer declares an
-  # `exceptions:` field at all, so this catalog grants nothing regardless of
-  # its contents. Its last 40 findings resolved two ways, not one: the 7
-  # officecli-pitch-deck untranslated-donor-jargon findings were FIXED in
-  # place (Englishized, with dev/seed/capabilities/skill.csv's
-  # content_sha256 recomputed per backend/crates/enact-db/src/repository/skill.rs:81);
-  # the other 33 were reclassified as SCOPE, not an exception -- CJK-handling
-  # code and test fixtures (frontend) or byte-exact/matcher CJK technical
-  # content (dev/seed/capabilities/skill.csv), never prose to translate.
-  # Scope now lives in .workflows/config/docs/english-only-scope.yaml,
-  # resolved via gate_path docs.english_only_scope and read directly by the
-  # gate -- the same reason layout.directory-ratchet's own
-  # excluded_paths/excluded_single_files hold no index entry either: a scope
-  # exclusion is never a grant this register holds.
-  #
-  # The entry itself is now gone too. It was kept as `entries: []` only so
-  # `source_count` would match a file that still existed; the restructure
-  # deleted .workflows/config/exceptions/ entirely, and an index row naming an
-  # absent catalog is a hard failure in gate-profile-report, not a harmless
-  # leftover -- it took framework.violation-baseline down to "could not run".
-  # 224 -> 92 on 2026-08-27. Three owner decisions in one change: every
-  # max_children ceiling raised to 20, `.workflows` dropped as a scanned tree,
-  # and two SCOPE mechanisms added to the baseline (excluded_paths,
-  # excluded_single_files) for shapes the rule should never have judged --
-  # locale directories, vendored skill and harness assets, per-domain seed
-  # CSVs, and any directory whose only file is a Cargo.toml or a main.tf.
-  # 124 entries were deleted as dead rather than granted away.
-  - path: compliance/policy/baselines/layout.directory-ratchet-accounting.yaml
-    source: compliance/policy/grants/layout.directory-ratchet.yaml
-    source_count: 92
-  # frontend-size-ratchet.yaml and its baseline removed 2026-08-24 with the
-  # frontend.file-function-ratchet gate they served. The gate graded files and
-  # functions by LINE COUNT as a proxy for bundle size, and line count does not
-  # determine shipped bytes -- frontend.bundle-size measures those directly,
-  # including the singleChunkMb ceiling. 218 overrides for a proxy metric with
-  # no evidence it achieved its stated purpose. Owner decision.
-  # The shared empty catalog, added 2026-08-27. Every row in the profile
-  # registry now names a grants catalog, so `granted` is a signed number rather
-  # than an absent key. This changes nothing about enforcement -- absence
-  # already meant zero, per the mechanism in AGENTS.md -- it only makes the
-  # zero explicit and reviewable. 128 of the 142 gates grant nothing and all
-  # point here rather than each carrying an identical zero-entry file: 128 empty
-  # catalogs would breach the .workflows directory-ratchet ceiling and add 128
-  # register rows describing nothing. A gate leaves this catalog the moment it
-  # needs its first grant, which makes that switch visible in review.
-  - path: compliance/policy/grants/zero.yaml
-    source: compliance/policy/gate-registry.yaml (every gate granting nothing)
-    source_count: 0

package/packages/repo-controls/workflows/scripts/release/verify-npm-artifact.ts

@@ -1,119 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Proves that an immutable npm version is the artifact built from this exact
- * commit. A matching semantic version is not enough: npm never replaces a
- * published version, so a prior publication from another commit must stop the
- * release rather than make a later pipeline run look green.
- */
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
-import { isAbsolute, join, normalize, resolve } from 'node:path'
-
-interface Metadata {
-  version?: unknown
-  gitHead?: unknown
-  'dist.tarball'?: unknown
-}
-
-interface Arguments {
-  packageName: string
-  version: string
-  gitHead: string
-  source: string
-}
-
-const usage =
-  'usage: bun workflows/scripts/release/verify-npm-artifact.ts --package <npm-package> --version <version> --git-head <build-source-version> --source <repo-relative-source-path>'
-
-const fail = (message: string): never => {
-  throw new Error(message)
-}
-
-function parseArguments(argv: string[]): Arguments {
-  const values = new Map<string, string>()
-  for (let index = 0; index < argv.length; index += 2) {
-    const flag = argv[index]
-    const value = argv[index + 1]
-    if (flag === undefined || value === undefined || !['--package', '--version', '--git-head', '--source'].includes(flag) || values.has(flag)) {
-      fail(usage)
-    }
-    values.set(flag, value)
-  }
-  const packageName = values.get('--package')
-  const version = values.get('--version')
-  const gitHead = values.get('--git-head')
-  const source = values.get('--source')
-  if (packageName === undefined || version === undefined || gitHead === undefined || source === undefined || values.size !== 4) fail(usage)
-  return { packageName, version, gitHead, source }
-}
-
-function command(commandName: string, args: string[]): { stdout: string; stderr: string } {
-  const result = Bun.spawnSync([commandName, ...args], { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' })
-  const stdout = result.stdout.toString()
-  const stderr = result.stderr.toString()
-  if ((result.exitCode ?? 1) !== 0) {
-    fail(`${commandName} failed while verifying the published artifact${stderr.trim() === '' ? '' : `: ${stderr.trim()}`}`)
-  }
-  return { stdout, stderr }
-}
-
-function metadataFor(packageName: string, version: string): Metadata {
-  const { stdout } = command('npm', ['view', `${packageName}@${version}`, 'version', 'gitHead', 'dist.tarball', '--json'])
-  try {
-    return JSON.parse(stdout) as Metadata
-  } catch {
-    fail('npm returned malformed package metadata while verifying the published artifact')
-  }
-}
-
-function sourcePath(source: string): string {
-  if (isAbsolute(source) || source === '' || source.split(/[\\/]/).some((segment) => segment === '..' || segment === '')) {
-    fail(`source must be a non-empty repository-relative path: ${source}`)
-  }
-  const root = resolve(process.cwd())
-  const path = resolve(root, normalize(source))
-  if (!path.startsWith(`${root}/`) || !existsSync(path)) fail(`source file does not exist: ${source}`)
-  return path
-}
-
-function httpsTarball(value: string): string {
-  try {
-    if (new URL(value).protocol !== 'https:') fail('published dist.tarball must be an HTTPS URL')
-  } catch (error) {
-    if (error instanceof Error && error.message === 'published dist.tarball must be an HTTPS URL') throw error
-    fail('published dist.tarball must be an HTTPS URL')
-  }
-  return value
-}
-
-function main(): void {
-  const args = parseArguments(process.argv.slice(2))
-  const localSource = sourcePath(args.source)
-  const metadata = metadataFor(args.packageName, args.version)
-  if (metadata.version !== args.version) fail(`published version mismatch: expected ${args.version}, received ${String(metadata.version)}`)
-  if (metadata.gitHead !== args.gitHead) fail(`published gitHead mismatch: expected ${args.gitHead}, received ${String(metadata.gitHead)}`)
-  const tarball = metadata['dist.tarball']
-  if (typeof tarball !== 'string' || tarball === '') fail('published package metadata has no dist.tarball')
-  const verifiedTarball = httpsTarball(tarball)
-
-  const scratchRoot = join(process.cwd(), '.scratchpad')
-  mkdirSync(scratchRoot, { recursive: true })
-  const temporary = mkdtempSync(join(scratchRoot, 'release-artifact-'))
-  const archive = join(temporary, 'package.tgz')
-  try {
-    command('curl', ['--fail', '--location', '--silent', '--show-error', '--output', archive, '--', verifiedTarball])
-    const packed = command('tar', ['-xOzf', archive, `package/${args.source}`]).stdout
-    const local = readFileSync(localSource)
-    if (!Buffer.from(packed).equals(local)) fail(`published packed source mismatch: package/${args.source} does not match this checkout`)
-  } finally {
-    rmSync(temporary, { recursive: true, force: true })
-  }
-
-  console.log(`verified ${args.packageName}@${args.version}: gitHead and package/${args.source} match this checkout`)
-}
-
-try {
-  main()
-} catch (error) {
-  console.error(`release artifact verification failed: ${error instanceof Error ? error.message : String(error)}`)
-  process.exitCode = 1
-}