@aviaratech/ai-delivery 0.3.22 → 0.3.24

package/dist/releaseReconciliation.test.js

@@ -0,0 +1,314 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { Script } from 'node:vm';
+import { test } from 'vitest';
+const workflow = readFileSync(new URL('../.github/workflows/release.yml', import.meta.url), 'utf8');
+const scripts = [...workflow.matchAll(/node --input-type=module <<'JS'\n([\s\S]*?)\n\s+JS/gu)];
+const publishedScript = scripts.at(-1)?.[1];
+assert.ok(publishedScript, 'The actual release workflow must contain its publication script.');
+// Substitute only external imports; all publication decisions and guards execute unchanged.
+const program = publishedScript.replace(/^\s*import .+;\n/gmu, '');
+const archive = Buffer.from('independently reviewed synthetic archive');
+const digest = createHash('sha256').update(archive).digest('hex');
+const integrity = `sha512-${createHash('sha512').update(archive).digest('base64')}`;
+const source = 'a'.repeat(40);
+const registry = 'https://registry.npmjs.org';
+const packageUrl = `${registry}/@aviaratech%2fai-delivery`;
+const version = '0.8.1';
+const pkg = {
+    name: '@aviaratech/ai-delivery',
+    version,
+    private: false,
+    license: 'MIT',
+    repository: { url: 'git+https://github.com/aviaratech/ai-delivery.git' },
+};
+const manifest = {
+    name: pkg.name,
+    version,
+    dist: {
+        integrity,
+        tarball: `${registry}/@aviaratech/ai-delivery/-/ai-delivery-${version}.tgz`,
+        attestations: { provenance: { predicateType: 'https://slsa.dev/provenance/v1' } },
+    },
+};
+async function runRelease(fixture = {}) {
+    let publications = 0;
+    let reads = 0;
+    let elapsed = 0;
+    const requests = [];
+    const commands = [];
+    const waits = [];
+    const timeouts = [];
+    const messages = [];
+    const ready = (at = 1) => reads >= at;
+    const published = () => fixture.occupied || publications > 0;
+    const visibleManifest = (indexed = false) => {
+        const value = structuredClone(manifest);
+        if (!ready(fixture.provenanceReadyAt))
+            Reflect.deleteProperty(value.dist, 'attestations');
+        if (fixture.conflict === 'name')
+            value.name = '@someone/else';
+        if (fixture.conflict === 'version')
+            value.version = '0.8.0';
+        if (fixture.conflict === 'integrity' || (indexed && fixture.conflict === 'index'))
+            value.dist.integrity = 'sha512-conflicting';
+        if (fixture.conflict === 'provenance')
+            value.dist.attestations = { provenance: { predicateType: 'https://unexpected.example/predicate' } };
+        if (fixture.conflict === 'origin')
+            value.dist.tarball = 'https://unexpected.example/archive.tgz';
+        if (fixture.conflict === 'credentials') {
+            const tarball = new URL('/archive.tgz', registry);
+            tarball.username = 'user';
+            tarball.password = 'password';
+            value.dist.tarball = tarball.href;
+        }
+        return value;
+    };
+    const fetch = async (input, options = {}) => {
+        const url = String(input);
+        requests.push({ url, method: options.method ?? 'GET', at: elapsed });
+        assert.equal(options.redirect, 'error');
+        elapsed += fixture.fetchDurationMs ?? 100;
+        const phase = url.includes('api.github.com')
+            ? 'main'
+            : url === packageUrl
+                ? 'index'
+                : url === `${packageUrl}/${version}`
+                    ? 'version'
+                    : 'archive';
+        if (phase === fixture.errorPhase && (published() || phase === 'main')) {
+            if (fixture.networkFailure)
+                throw new Error('synthetic network failure');
+            return new Response(null, { status: fixture.errorStatus ?? 503 });
+        }
+        if (url === 'https://api.github.com/repos/aviaratech/ai-delivery/branches/main') {
+            return Response.json({
+                name: 'main',
+                protected: true,
+                commit: { sha: fixture.conflict === 'main' ? 'b'.repeat(40) : source },
+                protection: { required_status_checks: { enforcement_level: 'everyone', contexts: ['checks', 'secrets'] } },
+            });
+        }
+        if (url === `${packageUrl}/${version}`) {
+            if (published())
+                reads++;
+            return published() && ready(fixture.versionReadyAt)
+                ? fixture.oversizedManifest
+                    ? new Response('x'.repeat(4 * 1024 * 1024 + 1))
+                    : Response.json(visibleManifest())
+                : new Response(null, { status: 404 });
+        }
+        if (url === manifest.dist.tarball) {
+            if (fixture.bodyDeadlineExceeded) {
+                return new Response(new ReadableStream({
+                    start: (controller) => {
+                        elapsed += 5 * 60_000;
+                        controller.error(new DOMException('Readback body timed out', 'TimeoutError'));
+                    },
+                }));
+            }
+            return ready(fixture.archiveReadyAt)
+                ? new Response(fixture.corruptArchive ? Buffer.from('conflicting registry bytes') : archive)
+                : new Response(null, { status: 404 });
+        }
+        if (url === packageUrl) {
+            return Response.json({
+                name: pkg.name,
+                'dist-tags': {
+                    latest: published() && fixture.conflict === 'latest'
+                        ? '0.8.2'
+                        : published() && ready(fixture.latestReadyAt)
+                            ? version
+                            : '0.8.0',
+                },
+                versions: published() && ready(fixture.indexReadyAt) ? { [version]: visibleManifest(true) } : {},
+            });
+        }
+        throw new Error(`Unexpected external request: ${url}`);
+    };
+    const context = {
+        createHash,
+        readFileSync: (path) => {
+            assert.equal(path, `../../aviaratech-ai-delivery-${version}.tgz`);
+            return archive;
+        },
+        spawnSync: (command, args) => {
+            commands.push({ command, args: [...args] });
+            assert.equal(command, 'npm');
+            assert.equal(args[0], 'publish');
+            publications++;
+            return { status: fixture.publishStatus === undefined ? 0 : fixture.publishStatus };
+        },
+        pkg,
+        process: {
+            env: {
+                GITHUB_SHA: source,
+                REVIEWED_SOURCE_SHA: source,
+                RELEASE_VERSION: version,
+                REVIEWED_ARCHIVE_SHA256: digest,
+                GH_TOKEN: 'synthetic',
+            },
+        },
+        fetch,
+        AbortSignal: {
+            timeout: (ms) => {
+                timeouts.push(ms);
+                return new AbortController().signal;
+            },
+        },
+        URL,
+        Buffer,
+        performance: { now: () => elapsed },
+        console: {
+            log: (message) => {
+                messages.push(String(message));
+            },
+        },
+        setTimeout: (callback, ms) => {
+            waits.push(ms);
+            elapsed += ms;
+            queueMicrotask(callback);
+            return 0;
+        },
+    };
+    let error = null;
+    try {
+        await new Script(`(async () => {${program}\n})()`).runInNewContext(context);
+    }
+    catch (failure) {
+        error = String(failure);
+    }
+    return { error, publications, requests, commands, waits, timeouts, messages, elapsed, reads };
+}
+test('successful publication reconciles staggered registry visibility without another npm invocation', async () => {
+    const result = await runRelease({
+        versionReadyAt: 2,
+        archiveReadyAt: 3,
+        provenanceReadyAt: 4,
+        indexReadyAt: 5,
+        latestReadyAt: 6,
+    });
+    assert.equal(result.error, null);
+    assert.equal(result.publications, 1);
+    assert.equal(result.commands.length, 1);
+    assert.deepEqual(result.commands[0]?.args, [
+        'publish',
+        '.',
+        '--ignore-scripts',
+        '--access',
+        'public',
+        '--tag',
+        'latest',
+        '--registry',
+        registry,
+        '--provenance',
+    ]);
+    assert.ok(result.waits.length > 0, 'Stale reads must be paced.');
+    assert.ok(result.waits.every((ms) => ms > 0));
+    assert.ok(result.requests.every((request) => request.method === 'GET'));
+    assert.ok(result.timeouts.every((ms) => ms > 0 && ms <= 30_000));
+    assert.ok(result.messages.some((message) => /exact reviewed registry/iu.test(message)));
+});
+test('matching occupied release reconciles latest without publication or retag', async () => {
+    const result = await runRelease({ occupied: true, latestReadyAt: 3 });
+    assert.equal(result.error, null);
+    assert.equal(result.publications, 0);
+    assert.deepEqual(result.commands, []);
+    assert.ok(result.messages.some((message) => /no publication repeated/iu.test(message)));
+});
+test('conflicting archive bytes fail immediately after one publication', async () => {
+    const result = await runRelease({ corruptArchive: true });
+    assert.match(result.error ?? '', /archive differs/iu);
+    assert.equal(result.publications, 1);
+    assert.deepEqual(result.waits, []);
+});
+test('unresolved visibility reports the external reconciliation bound without republishing', async () => {
+    const result = await runRelease({ versionReadyAt: Infinity });
+    assert.match(result.error ?? '', /reconciliation unresolved/iu);
+    assert.equal(result.publications, 1);
+    assert.ok(result.waits.length > 0);
+    assert.ok(result.elapsed < 10 * 60_000, 'Reconciliation must fit the existing external publish job.');
+    assert.ok(result.timeouts.some((ms) => ms < 30_000), 'Requests must respect the remaining reconciliation allowance.');
+});
+test('an occupied version visible only in the index never enters publication', async () => {
+    const result = await runRelease({ occupied: true, versionReadyAt: 3, latestReadyAt: 4 });
+    assert.equal(result.error, null);
+    assert.deepEqual(result.commands, []);
+    assert.ok(result.waits.length > 0);
+});
+for (const conflict of [
+    'name',
+    'version',
+    'integrity',
+    'provenance',
+    'origin',
+    'credentials',
+    'index',
+    'latest',
+]) {
+    test(`present ${conflict} conflict is refused without another publication`, async () => {
+        const result = await runRelease({ conflict });
+        assert.match(result.error ?? '', /differs|unexpected|advanced/iu);
+        assert.equal(result.publications, 1);
+        // The package index is initially absent; its conflict is observed on the second read.
+        if (conflict !== 'index')
+            assert.deepEqual(result.waits, []);
+        else
+            assert.equal(result.waits.length, 1);
+    });
+}
+for (const errorPhase of ['version', 'index', 'archive']) {
+    for (const errorStatus of [401, 403, 429, 503]) {
+        test(`${errorPhase} HTTP ${errorStatus} remains a permanent failure`, async () => {
+            const result = await runRelease({ errorPhase, errorStatus });
+            assert.match(result.error ?? '', new RegExp(`readback failed: ${errorStatus}`, 'u'));
+            assert.equal(result.publications, 1);
+            assert.deepEqual(result.waits, []);
+        });
+    }
+}
+test('network failure is not retried as propagation', async () => {
+    const result = await runRelease({ errorPhase: 'version', networkFailure: true });
+    assert.match(result.error ?? '', /synthetic network failure/u);
+    assert.equal(result.publications, 1);
+    assert.deepEqual(result.waits, []);
+});
+for (const publishStatus of [1, null]) {
+    test(`publish status ${publishStatus} remains ambiguous after matching readback`, async () => {
+        const result = await runRelease({ publishStatus, versionReadyAt: 3 });
+        assert.match(result.error ?? '', /failed or was ambiguous/iu);
+        assert.equal(result.publications, 1);
+        assert.ok(result.messages.some((message) => message.includes(`"status":${publishStatus}`)));
+        assert.ok(result.messages.some((message) => /exact reviewed registry/iu.test(message)));
+    });
+}
+test('an occupied conflicting release is never republished', async () => {
+    const result = await runRelease({ occupied: true, conflict: 'integrity' });
+    assert.match(result.error ?? '', /integrity differs/iu);
+    assert.deepEqual(result.commands, []);
+});
+test('protected source drift refuses publication', async () => {
+    const result = await runRelease({ conflict: 'main' });
+    assert.match(result.error ?? '', /protected main.*drifted/iu);
+    assert.deepEqual(result.commands, []);
+});
+test('oversized registry metadata fails within the readback output bound', async () => {
+    const result = await runRelease({ oversizedManifest: true });
+    assert.match(result.error ?? '', /readback bound/iu);
+    assert.equal(result.publications, 1);
+    assert.deepEqual(result.waits, []);
+});
+test('a body timeout at the reconciliation bound retains an explicit unresolved result', async () => {
+    const result = await runRelease({ bodyDeadlineExceeded: true });
+    assert.match(result.error ?? '', /reconciliation unresolved/iu);
+    assert.equal(result.publications, 1);
+});
+for (const phase of ['archiveReadyAt', 'provenanceReadyAt', 'indexReadyAt', 'latestReadyAt']) {
+    test(`unresolved ${phase} cannot be accepted as a completed release`, async () => {
+        const result = await runRelease({ [phase]: Infinity });
+        assert.match(result.error ?? '', /reconciliation unresolved/iu);
+        assert.equal(result.publications, 1);
+    });
+}
+//# sourceMappingURL=releaseReconciliation.test.js.map

package/dist/releaseReconciliation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"releaseReconciliation.test.js","sourceRoot":"","sources":["../src/releaseReconciliation.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAE9B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AACpG,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC,CAAC;AAC/F,MAAM,eAAe,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5C,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,kEAAkE,CAAC,CAAC;AAC/F,4FAA4F;AAC5F,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;AACnE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;AACxE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,MAAM,SAAS,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AACpF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC9B,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAC9C,MAAM,UAAU,GAAG,GAAG,QAAQ,4BAA4B,CAAC;AAC3D,MAAM,OAAO,GAAG,OAAO,CAAC;AACxB,MAAM,GAAG,GAAG;IACV,IAAI,EAAE,yBAAyB;IAC/B,OAAO;IACP,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,EAAE,GAAG,EAAE,mDAAmD,EAAE;CACzE,CAAC;AACF,MAAM,QAAQ,GAAG;IACf,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,OAAO;IACP,IAAI,EAAE;QACJ,SAAS;QACT,OAAO,EAAE,GAAG,QAAQ,0CAA0C,OAAO,MAAM;QAC3E,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,gCAAgC,EAAE,EAAE;KAClF;CACF,CAAC;AAoBF,KAAK,UAAU,UAAU,CAAC,UAAmB,EAAE;IAC7C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,QAAQ,GAAkD,EAAE,CAAC;IACnE,MAAM,QAAQ,GAA0C,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,YAAY,GAAG,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,CAAC,OAAO,GAAG,KAAK,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAAE,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,GAAG,eAAe,CAAC;QAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC5D,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;YAC/E,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,oBAAoB,CAAC;QAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,YAAY;YACnC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,sCAAsC,EAAE,EAAE,CAAC;QACtG,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,wCAAwC,CAAC;QACjG,IAAI,OAAO,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC;YAC1B,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,EAAE,KAAmB,EAAE,UAAuB,EAAE,EAAE,EAAE;QACrE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC1C,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,GAAG,KAAK,UAAU;gBAClB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,GAAG,KAAK,GAAG,UAAU,IAAI,OAAO,EAAE;oBAClC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,KAAK,KAAK,OAAO,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;YACtE,IAAI,OAAO,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACzE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,GAAG,KAAK,mEAAmE,EAAE,CAAC;YAChF,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;gBACtE,UAAU,EAAE,EAAE,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE;aAC3G,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,KAAK,GAAG,UAAU,IAAI,OAAO,EAAE,EAAE,CAAC;YACvC,IAAI,SAAS,EAAE;gBAAE,KAAK,EAAE,CAAC;YACzB,OAAO,SAAS,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;gBACjD,CAAC,CAAC,OAAO,CAAC,iBAAiB;oBACzB,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;oBAC/C,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACpC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;gBACjC,OAAO,IAAI,QAAQ,CACjB,IAAI,cAAc,CAAC;oBACjB,KAAK,EAAE,CAAC,UAAU,EAAE,EAAE;wBACpB,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC;wBACtB,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC,CAAC;oBAChF,CAAC;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;gBAClC,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC5F,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE;oBACX,MAAM,EACJ,SAAS,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;wBAC1C,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,SAAS,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;4BAC3C,CAAC,CAAC,OAAO;4BACT,CAAC,CAAC,OAAO;iBAChB;gBACD,QAAQ,EAAE,SAAS,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;aACjG,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC;IACF,MAAM,OAAO,GAAG;QACd,UAAU;QACV,YAAY,EAAE,CAAC,IAAY,EAAE,EAAE;YAC7B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,gCAAgC,OAAO,MAAM,CAAC,CAAC;YAClE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,EAAE,CAAC,OAAe,EAAE,IAAc,EAAE,EAAE;YAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACjC,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACrF,CAAC;QACD,GAAG;QACH,OAAO,EAAE;YACP,GAAG,EAAE;gBACH,UAAU,EAAE,MAAM;gBAClB,mBAAmB,EAAE,MAAM;gBAC3B,eAAe,EAAE,OAAO;gBACxB,uBAAuB,EAAE,MAAM;gBAC/B,QAAQ,EAAE,WAAW;aACtB;SACF;QACD,KAAK;QACL,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,EAAU,EAAE,EAAE;gBACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClB,OAAO,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;YACtC,CAAC;SACF;QACD,GAAG;QACH,MAAM;QACN,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE;QACnC,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,OAAgB,EAAE,EAAE;gBACxB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,CAAC;SACF;QACD,UAAU,EAAE,CAAC,QAAoB,EAAE,EAAU,EAAE,EAAE;YAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,OAAO,IAAI,EAAE,CAAC;YACd,cAAc,CAAC,QAAQ,CAAC,CAAC;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;KACF,CAAC;IACF,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAO,IAAI,MAAM,CAAC,iBAAiB,OAAO,QAAQ,CAAC,CAAC,eAAe,CAAC,OAAO,CAAmB,CAAC;IACjG,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QACjB,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAChG,CAAC;AAED,IAAI,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;IAChH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;QAC9B,cAAc,EAAE,CAAC;QACjB,cAAc,EAAE,CAAC;QACjB,iBAAiB,EAAE,CAAC;QACpB,YAAY,EAAE,CAAC;QACf,aAAa,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACzC,SAAS;QACT,GAAG;QACH,kBAAkB;QAClB,UAAU;QACV,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,QAAQ;QACR,cAAc;KACf,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,4BAA4B,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;IAClF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACtG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,6BAA6B,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,4DAA4D,CAAC,CAAC;IACtG,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,EACzC,+DAA+D,CAChE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACzF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,KAAK,MAAM,QAAQ,IAAI;IACrB,MAAM;IACN,SAAS;IACT,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,aAAa;IACb,OAAO;IACP,QAAQ;CACA,EAAE,CAAC;IACX,IAAI,CAAC,WAAW,QAAQ,kDAAkD,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACrC,sFAAsF;QACtF,IAAI,QAAQ,KAAK,OAAO;YAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;;YACxD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,MAAM,UAAU,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;IAClE,KAAK,MAAM,WAAW,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,GAAG,UAAU,SAAS,WAAW,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC/E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,MAAM,CAAC,oBAAoB,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YACrF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;IAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,KAAK,MAAM,aAAa,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACtC,IAAI,CAAC,kBAAkB,aAAa,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACxD,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;IAC5D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAC9D,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;IACpF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAClG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,6BAA6B,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,KAAK,MAAM,KAAK,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,CAAU,EAAE,CAAC;IACtG,IAAI,CAAC,cAAc,KAAK,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,6BAA6B,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/review.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import type { DeliveryConfig } from './config/deliveryConfig.js';
-import { type RepositoryApprovalBinding, type RepositoryClassificationReceipt } from './delivery/index.js';
+import { type RepositoryApprovalBinding, type RepositoryClassificationReceipt } from './delivery/legacy.js';
 import type { DeliveryContext } from './issue.js';
 export declare const ReviewArtifactSchema: z.ZodObject<{
     artifactId: z.ZodString;
@@ -88,28 +88,58 @@ export declare function readRequiredReviewState(context: DeliveryContext, prNumb
     login: string;
 }): Promise<RequiredReviewState>;
 export declare function parseReviewArtifact(raw: unknown): ReviewArtifact;
+/** Preserve the original binding: GitHub can remap a review's commit_id after a rebase. */
+export declare function parseGitHubReviewArtifact(body: string | null | undefined): ReviewArtifact;
+export declare function readGitHubPrScopeHash(context: DeliveryContext, prNumber: number, changedFiles: number): Promise<string>;
 export declare function reviewArtifactApproval(input: {
     artifact: ReviewArtifact;
     classification: RepositoryClassificationReceipt;
-    config: DeliveryConfig;
+    config: Pick<DeliveryConfig, 'roles'>;
     issueNumber: number;
     prNumber?: number;
 }): RepositoryApprovalBinding;
 export declare function savePrepublicationArtifact(input: {
     artifact: ReviewArtifact;
     classification: RepositoryClassificationReceipt;
-    config: DeliveryConfig;
+    config: Pick<DeliveryConfig, 'roles'>;
     issueNumber: number;
     repoRoot: string;
 }): void;
 export declare function loadPrepublicationArtifact(repoRoot: string, issueNumber: number, headSha: string): ReviewArtifact | null;
-export declare function submitReview(input: {
+interface ReviewSubmissionInput {
     artifact: ReviewArtifact;
     context: DeliveryContext;
     issueNumber: number;
     prNumber: number;
-    publicationEvidenceId: string;
-    classification: RepositoryClassificationReceipt;
-}): Promise<SubmittedReviewReceipt>;
+    dryRun?: boolean;
+    publicationEvidenceId?: string;
+    classification?: RepositoryClassificationReceipt;
+}
+export interface GitHubReviewReceipt {
+    artifact: ReviewArtifact;
+    repository: string;
+    baseSha: string;
+    headSha: string;
+    githubReviewId: number;
+    githubReviewUrl: string;
+    login: string;
+    prNumber: number;
+    schemaVersion: 'ai-delivery.github-review@1';
+    state: 'APPROVED';
+    receiptId: string;
+}
+export interface ReviewDryRun {
+    dryRun: true;
+    artifactId: string;
+    headSha: string;
+}
+export declare function submitReview(input: ReviewSubmissionInput & {
+    dryRun: true;
+}): Promise<ReviewDryRun>;
+export declare function submitReview(input: ReviewSubmissionInput & {
+    dryRun?: false;
+}): Promise<GitHubReviewReceipt>;
+export declare function submitReview(input: ReviewSubmissionInput): Promise<GitHubReviewReceipt | ReviewDryRun>;
 export declare function loadSubmittedReview(repoRoot: string, issueNumber: number, headSha: string): SubmittedReviewReceipt | null;
 export declare function assertSubmittedReviewCurrent(context: DeliveryContext, receipt: SubmittedReviewReceipt): Promise<void>;
+export {};

package/dist/review.js

@@ -1,7 +1,7 @@
 import { join } from 'node:path';
 import { z } from 'zod';
 import { assertPrivateFile } from './delivery/common.js';
-import { digestValue, RepositoryApprovalBindingSchema, } from './delivery/index.js';
+import { digestValue, RepositoryApprovalBindingSchema, } from './delivery/legacy.js';
 import { DeliveryError } from './errors.js';
 import { gitCommonDir } from './git.js';
 import { writePrivateJsonFileAtomically } from './utils/atomicJson.js';
@@ -144,6 +144,50 @@ export function parseReviewArtifact(raw) {
     const value = typeof raw === 'string' ? JSON.parse(raw) : raw;
     return ReviewArtifactSchema.parse(value);
 }
+/** Preserve the original binding: GitHub can remap a review's commit_id after a rebase. */
+export function parseGitHubReviewArtifact(body) {
+    try {
+        if (typeof body !== 'string' || Buffer.byteLength(body, 'utf8') > 64 * 1024)
+            throw new Error('Invalid size.');
+        const markers = body.match(/<!-- ai-delivery-review-artifact:[\s\S]*?-->/gu) ?? [];
+        const payloads = body.match(/<!-- ai-delivery-review-artifact-data:[\s\S]*?-->/gu) ?? [];
+        if (markers.length !== 1 || payloads.length !== 1)
+            throw new Error('Ambiguous binding.');
+        const id = markers[0].match(/^<!-- ai-delivery-review-artifact: (sha256:[a-f0-9]{64}) -->$/u)?.[1];
+        const encoded = payloads[0].match(/^<!-- ai-delivery-review-artifact-data: ([A-Za-z0-9_-]+) -->$/u)?.[1];
+        if (!id || !encoded)
+            throw new Error('Invalid binding.');
+        const bytes = Buffer.from(encoded, 'base64url');
+        const json = bytes.toString('utf8');
+        if (bytes.toString('base64url') !== encoded || !Buffer.from(json, 'utf8').equals(bytes))
+            throw new Error('Invalid encoding.');
+        const artifact = parseReviewArtifact(json);
+        if (artifact.artifactId !== id)
+            throw new Error('Artifact identity differs.');
+        return artifact;
+    }
+    catch {
+        throw new DeliveryError('GitHub review artifact binding is missing, invalid or ambiguous; obtain a fresh review.');
+    }
+}
+function githubReviewBody(artifact) {
+    ReviewArtifactSchema.parse(artifact);
+    const body = `${artifact.summary}\n\n<!-- ai-delivery-review-artifact: ${artifact.artifactId} -->\n<!-- ai-delivery-review-artifact-data: ${Buffer.from(JSON.stringify(artifact)).toString('base64url')} -->`;
+    parseGitHubReviewArtifact(body);
+    return body;
+}
+export async function readGitHubPrScopeHash(context, prNumber, changedFiles) {
+    const files = [];
+    for (let page = 1; page <= 30; page++) {
+        const batch = (await context.clients.rest.pulls.listFiles({ ...context.repo, pull_number: prNumber, page, per_page: 100 })).data;
+        files.push(...batch.map((file) => file.filename));
+        if (batch.length < 100)
+            break;
+    }
+    if (!Number.isSafeInteger(changedFiles) || files.length !== changedFiles || new Set(files).size !== files.length)
+        throw new DeliveryError('Independent review scope is incomplete or differs from the remote PR diff.');
+    return digestValue(files.sort());
+}
 export function reviewArtifactApproval(input) {
     const { artifact, classification, config } = input;
     ReviewArtifactSchema.parse(artifact);
@@ -207,76 +251,93 @@ async function listAllReviews(context, prNumber) {
 }
 export async function submitReview(input) {
     const { artifact, context, issueNumber, prNumber } = input;
-    reviewArtifactApproval({
-        artifact,
-        classification: input.classification,
-        config: context.config,
-        issueNumber,
-        prNumber,
-    });
-    if (context.clients.authSource !== 'app' || context.clients.role !== 'reviewer' || !context.clients.appActorLogin) {
-        throw new DeliveryError('Formal review requires the reviewer GitHub App role.');
-    }
+    ReviewArtifactSchema.parse(artifact);
+    if (artifact.verdict !== 'approve' ||
+        artifact.issueNumber !== issueNumber ||
+        artifact.authorIdentity !== context.config.roles.author.identity ||
+        artifact.reviewerIdentity !== context.config.roles.reviewer.identity ||
+        (artifact.prNumber !== null && artifact.prNumber !== prNumber))
+        throw new DeliveryError('Independent review artifact is foreign or rejected.');
+    if (context.clients.authSource !== 'app' || context.clients.role !== 'reviewer' || !context.clients.appActorLogin)
+        throw new DeliveryError('Formal review requires the independent reviewer GitHub App role.');
     const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: prNumber })).data;
-    if (pr.head.sha !== artifact.head.sha || pr.state !== 'open')
-        throw new DeliveryError('PR head changed before formal review.');
+    if (pr.number !== prNumber ||
+        pr.head.sha !== artifact.head.sha ||
+        pr.state !== 'open' ||
+        pr.base.repo?.full_name.toLowerCase() !== context.config.repository.toLowerCase() ||
+        pr.head.repo?.full_name.toLowerCase() !== context.config.repository.toLowerCase())
+        throw new DeliveryError('PR identity or head changed before formal review.');
     const actor = await context.clients.appActorLogin();
-    if (!actor || !pr.user?.login || actor.toLowerCase() === pr.user.login.toLowerCase()) {
+    if (!actor || !pr.user?.login || actor.toLowerCase() === pr.user.login.toLowerCase())
         throw new DeliveryError('Reviewer GitHub actor must differ from PR author.');
-    }
-    const existing = loadSubmittedReview(context.root, issueNumber, artifact.head.sha);
-    if (existing) {
-        if (existing.artifact.artifactId !== artifact.artifactId ||
-            existing.prNumber !== prNumber ||
-            existing.publicationEvidenceId !== input.publicationEvidenceId ||
-            existing.login.toLowerCase() !== actor.toLowerCase()) {
-            throw new DeliveryError('An exact-head review receipt already binds different review evidence.');
-        }
-        await assertSubmittedReviewCurrent(context, existing);
-        return existing;
-    }
+    const commit = (await context.clients.rest.git.getCommit({ ...context.repo, commit_sha: artifact.head.sha })).data;
+    if (commit.sha !== artifact.head.sha || commit.tree.sha !== artifact.head.tree)
+        throw new DeliveryError('Independent review tree differs from the remote commit.');
+    if (artifact.diffScopeHash !== (await readGitHubPrScopeHash(context, prNumber, pr.changed_files)))
+        throw new DeliveryError('Independent review scope is incomplete or differs from the remote PR diff.');
+    const body = githubReviewBody(artifact);
     const marker = `<!-- ai-delivery-review-artifact: ${artifact.artifactId} -->`;
-    const matches = (await listAllReviews(context, prNumber)).filter((review) => review.body?.includes(marker));
+    const history = await listAllReviews(context, prNumber);
+    if (history.some((review) => review.user?.login.toLowerCase() === actor.toLowerCase() &&
+        review.commit_id === artifact.head.sha &&
+        review.state === 'APPROVED' &&
+        /<!-- ai-delivery-review-artifact: sha256:[a-f0-9]{64} -->/u.test(review.body ?? '') &&
+        !review.body?.includes(marker)))
+        throw new DeliveryError('Another independent artifact conflicts with the existing exact-head App approval.');
+    const matches = history.filter((review) => review.body?.includes(marker));
     if (matches.length > 1)
-        throw new DeliveryError('Multiple GitHub reviews claim the same artifact identity.');
+        throw new DeliveryError('Conflicting GitHub reviews claim the same artifact identity.');
     const prior = matches[0];
     if (prior &&
         (prior.state !== 'APPROVED' ||
             prior.commit_id !== artifact.head.sha ||
-            prior.user?.login?.toLowerCase() !== actor.toLowerCase() ||
-            !prior.html_url)) {
-        throw new DeliveryError('Prior GitHub review marker does not match exact approval.');
-    }
+            prior.user?.login.toLowerCase() !== actor.toLowerCase() ||
+            !prior.html_url ||
+            parseGitHubReviewArtifact(prior.body).artifactId !== artifact.artifactId))
+        throw new DeliveryError('Prior GitHub review marker conflicts with exact-head approval.');
+    const fresh = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: prNumber })).data;
+    if (fresh.head.sha !== artifact.head.sha || fresh.base.sha !== pr.base.sha || fresh.state !== 'open')
+        throw new DeliveryError('PR moved during independent review validation.');
+    if (input.dryRun)
+        return { dryRun: true, artifactId: artifact.artifactId, headSha: artifact.head.sha };
     const submitted = prior ??
         (await context.clients.rest.pulls.createReview({
             ...context.repo,
             pull_number: prNumber,
             commit_id: artifact.head.sha,
-            body: `${artifact.summary}\n\n${marker}`,
+            body,
             event: 'APPROVE',
         })).data;
     if (!submitted.id ||
         submitted.state !== 'APPROVED' ||
         submitted.commit_id !== artifact.head.sha ||
-        submitted.user?.login?.toLowerCase() !== actor.toLowerCase() ||
-        !submitted.html_url) {
-        throw new DeliveryError('GitHub did not return complete exact-head approval readback.');
-    }
+        submitted.user?.login.toLowerCase() !== actor.toLowerCase() ||
+        !submitted.html_url)
+        throw new DeliveryError('GitHub did not return complete exact-head independent approval.');
     const content = {
         artifact,
-        completedAt: new Date().toISOString(),
+        repository: context.config.repository,
+        baseSha: pr.base.sha,
+        headSha: artifact.head.sha,
         githubReviewId: submitted.id,
         githubReviewUrl: submitted.html_url,
-        headSha: artifact.head.sha,
         login: submitted.user.login,
         prNumber,
-        publicationEvidenceId: input.publicationEvidenceId,
-        schemaVersion: 'ai-delivery.review-receipt@1',
+        schemaVersion: 'ai-delivery.github-review@1',
         state: 'APPROVED',
     };
-    const receipt = SubmittedReviewReceiptSchema.parse({ ...content, receiptId: digestValue(content) });
-    await assertSubmittedReviewCurrent(context, receipt);
-    writePrivateJsonFileAtomically(receiptPath(context.root, issueNumber, artifact.head.sha), receipt);
+    const receipt = { ...content, receiptId: digestValue(content) };
+    const readback = (await context.clients.rest.pulls.getReview({ ...context.repo, pull_number: prNumber, review_id: submitted.id })).data;
+    if (readback.id !== receipt.githubReviewId ||
+        readback.html_url !== receipt.githubReviewUrl ||
+        readback.state !== 'APPROVED' ||
+        readback.commit_id !== receipt.headSha ||
+        readback.user?.login !== receipt.login ||
+        parseGitHubReviewArtifact(readback.body).artifactId !== artifact.artifactId)
+        throw new DeliveryError('GitHub exact-head App review readback disagrees.');
+    const current = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: prNumber })).data;
+    if (current.head.sha !== artifact.head.sha || current.base.sha !== pr.base.sha || current.state !== 'open')
+        throw new DeliveryError('PR moved during independent review submission; approval is not current.');
     return receipt;
 }
 export function loadSubmittedReview(repoRoot, issueNumber, headSha) {
@@ -299,7 +360,7 @@ export async function assertSubmittedReviewCurrent(context, receipt) {
         review.commit_id !== receipt.headSha ||
         review.user?.login !== receipt.login ||
         review.html_url !== receipt.githubReviewUrl ||
-        !review.body?.includes(`<!-- ai-delivery-review-artifact: ${receipt.artifact.artifactId} -->`)) {
+        parseGitHubReviewArtifact(review.body).artifactId !== receipt.artifact.artifactId) {
         throw new DeliveryError('GitHub exact-head review no longer matches the stored receipt.');
     }
 }