@clossys/launcher 0.3.1 → 0.5.0

package/dist/plan-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-rules.js","sourceRoot":"","sources":["../src/plan-rules.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,+EAA+E;AAC/E,2EAA2E;AAC3E,qEAAqE;AACrE,4EAA4E;AAC5E,4EAA4E;AAC5E,0CAA0C;AAC1C,8EAA8E;AAC9E,oEAAoE;AACpE,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,sBAAsB;AAEtB,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAMzE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE;IACrD,MAAM,WAAW,GAAG,cAAc,CAAC,mBAAmB,CAAC,EAAE,WAA8D,CAAC;IACxH,MAAM,KAAK,GAAG,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACrK,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAI,KAAkB,CAAC,CAAC,CAAC;AACjD,CAAC,CAAC,EAAE,CAAC;AAUL,sHAAsH;AACtH,SAAS,UAAU,CAAI,KAAmB,EAAE,GAAwB,EAAE,QAAqD;IACzH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;;YAC9C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,GAAG,CAAsC,QAAW,EAAE,IAAO;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,IAAiB;IAClD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,IAAoB,EAAE,IAAY,EAAE,OAAe,EAAQ,EAAE;QACxE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IAExC,0EAA0E;IAC1E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,UAAU,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/E,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc,EAAE,yCAAyC,KAAK,0DAA0D,CAAC,CAAC;QACvJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kHAAkH;IAClH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC;YACrC,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAC9D,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC;oBAAE,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,WAAW,QAAQ,GAAG,EAAE,6BAA6B,CAAC,CAAC;YAC1H,CAAC;QACH,CAAC;QACD,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAE,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,QAAQ,GAAG,EAAE,sCAAsC,CAAC,CAAC;QACvL,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACnF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAE,CAAC,UAAU,CAAC;gBAAE,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc,EAAE,qDAAqD,CAAC,CAAC;QACnJ,CAAC;QACD,+BAA+B;QAC/B,UAAU,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3D,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,YAAY,EAAE,oBAAoB,KAAK,YAAY,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,gFAAgF;QAChF,UAAU,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjG,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,QAAQ,EAAE,+CAA+C,KAAK,6CAA6C,CAAC,CAAC;QAC1I,CAAC,CAAC,CAAC;QACH,sGAAsG;QACtG,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAE,CAAC;YAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,EAAE;gBAAE,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,YAAY,EAAE,6EAA6E,CAAC,CAAC;QACjL,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACxD,IAAI,WAAW,IAAI,CAAC,aAAa;QAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,sCAAsC,CAAC,CAAC;IACnG,IAAI,CAAC,WAAW,IAAI,aAAa;QAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,2CAA2C,CAAC,CAAC;IAExG,0BAA0B;IAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjD,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,EAAE,gBAAgB,KAAK,MAAM,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,+CAA+C;IAC/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAE,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;gBACrE,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,WAAW,QAAQ,GAAG,EAAE,oBAAoB,KAAK,WAAW,KAAK,GAAG,CAAC,CAAC;YACnG,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,UAAU,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC3D,GAAG,CAAC,IAAI,EAAE,iBAAiB,QAAQ,GAAG,EAAE,yBAAyB,KAAK,GAAG,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,4GAA4G;IAC5G,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;YAAE,IAAI,QAAQ,CAAC,KAAK,CAAE,CAAC,GAAG,KAAK,aAAa;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtH,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YACzF,GAAG,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,+DAA+D,IAAI,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACzK,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,QAAQ,CAAC,KAAK,CAAE,CAAC,SAAS,KAAK,iBAAiB;gBAAE,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,aAAa,EAAE,+CAA+C,CAAC,CAAC;QACpJ,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC;YACrC,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAC9D,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC;oBAAE,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,WAAW,QAAQ,GAAG,EAAE,mFAAmF,CAAC,CAAC;YAC1L,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,IAAoB,EAAE,IAAY,EAAE,OAAe,EAAQ,EAAE;QACxE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAC1C,+CAA+C;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAE,CAAC;YAAE,GAAG,CAAC,IAAI,EAAE,eAAe,KAAK,GAAG,EAAE,4BAA4B,CAAC,CAAC;IACxG,CAAC;IACD,wBAAwB;IACxB,UAAU,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvD,GAAG,CAAC,IAAI,EAAE,eAAe,KAAK,GAAG,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/planned-bundle.d.ts

@@ -0,0 +1,20 @@
+import type { ReadinessRunner } from "./admission.js";
+import type { RepositoryChangeSet } from "./change-set-contract.js";
+import type { PlanApplyBundleResult } from "./plan-bundle.js";
+export interface PlannedBundleOptions {
+    /** The hub's real path. */
+    readonly hub: string;
+    /** The local clone of a repository id. */
+    readonly cloneFor: (id: string) => string;
+    /** Every change set the hub holds: the ledger's history is trusted only against these. */
+    readonly heldChangeSets: readonly RepositoryChangeSet[];
+    readonly now: () => Date;
+    /** Runs advisor-execution-readiness; the hub's own bin by default. Not reachable from a CLI. */
+    readonly runReadiness?: ReadinessRunner;
+}
+/**
+ * The result as a planned bundle, or the same result when nothing approves it (P1). A repository with no change set keeps
+ * its entry. Throws when the planned bundle does not validate; nothing is written here.
+ */
+export declare function plannedBundle(result: PlanApplyBundleResult, options: PlannedBundleOptions): Promise<PlanApplyBundleResult>;
+//# sourceMappingURL=planned-bundle.d.ts.map

package/dist/planned-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planned-bundle.d.ts","sourceRoot":"","sources":["../src/planned-bundle.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAkC,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAStF,OAAO,KAAK,EAAkD,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAIpH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,2BAA2B;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1C,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC;CACzC;AAwHD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiChI"}

package/dist/planned-bundle.js

@@ -0,0 +1,191 @@
+// Planned mode for `launcher-apply-plan plan` (issue #1708, RFC apply-approved-plan sections 4.2, 4.4 and 7).
+//
+// The planner and the dry tree produce a report: it claims no repository state and records no approval. This module turns
+// that report into a planned bundle, but only when an approval binds exactly what was planned. Every ambiguity leaves the
+// report as it is, or refuses; a rule is one of a fixed set of tokens and never carries tool output, a path, an id or a file
+// name.
+//
+//   P1. The result is planned only when the bundle says the plan is the committed one AND the hub's committed plan, read as a
+//       git object at an attached HEAD, is approved (readHubAuthority) for this very plan digest AND the bundle that approval
+//       names is one the hub holds, stored and verifying, for that plan digest (the same K2 read admission makes). An approval
+//       that names nothing the hub holds approves nothing this run could be bound by. Otherwise the result is returned
+//       untouched, so its bytes are what they were before this module existed.
+//   P2. A binding comes only from decideSetBinding, over the ledger this module reads at the set's base commit and trusts
+//       against the committed plan's acts (never the acts of the set being judged). Nothing here builds a binding by hand.
+//   P3. A repository that already carries a violated V3 (the planner's A4 flags: an authorization for another plan, or none)
+//       is not admitted, and no readiness check runs for it.
+//   P4. V3 is satisfied exactly when the set is bound. A refusal is V3 violated (exit 1) or indeterminate (exit 2), the rule is
+//       the refusal's fixed token, and the repository has no binding.
+//   P5. Planned mode reports V1, V2, V4, V5 and V7 as satisfied on every computed repository (a set that exists and validated
+//       has met them), and V9 as satisfied only for a set that changes no lockfile; the dry tree's V6 and V9 are kept.
+//   P6. A repository is `planned` when its verdict is satisfied and it has a binding (code rule A6). The bundle is validated
+//       again before it is returned. No set, digest or set byte moves: the bundle digest does not cover mode, state, binding
+//       or checks.
+import { spawnSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { decideSetBinding, planPackagesFor, readHubAuthority } from "./admission.js";
+import { readStoredApplyBundle } from "./apply-store.js";
+import { AUTHORIZATION_ABSENT, AUTHORIZATION_PLAN_MISMATCH, LEDGER_PATH, canonicalOrder, validateApplyBundle, worstVerdict, } from "./change-set-contract.js";
+import { trustInstalledLedger } from "./ledger-trust.js";
+import { derivedLockfile } from "./materialize.js";
+const TOKEN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+/** The V3 rule of a refusal whose token is not a fixed one, or is one the bundle may carry only for its own authorization condition. */
+const AUTHORIZATION_NOT_CURRENT = "authorization-not-current";
+/** The V3 rule of a base ledger that cannot be read as a regular file. */
+const LEDGER_UNREADABLE = "ledger-unreadable";
+/** The V3 rule of a base ledger whose generation is not the one the set was computed over. */
+const LEDGER_MISMATCH = "ledger-mismatch";
+/** The V9 rule of a set that changes a lockfile and whose dry tree left no provenance check. */
+const PROVENANCE_NOT_RUN = "provenance-not-run";
+/** Rules only the bundle's own authorization condition may name (code rule A4). */
+const RESERVED_RULES = new Set([AUTHORIZATION_PLAN_MISMATCH, AUTHORIZATION_ABSENT]);
+const sortChecks = (checks) => canonicalOrder(checks, (check) => [check.check, check.rule ?? ""]);
+const satisfied = (check) => ({ check, verdict: "satisfied" });
+// ---------------------------------------------------------------------------
+// the base ledger, from git objects only
+const DROPPED_GIT_ENV = ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_COMMON_DIR", "GIT_NAMESPACE", "GIT_PREFIX", "GIT_SHALLOW_FILE", "GIT_GRAFT_FILE"];
+const OBJECT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+/** Runs git with no repository named by the environment, no replace refs and literal pathspecs. Never throws. */
+function runGit(cwd, args) {
+    const env = { ...process.env };
+    for (const name of DROPPED_GIT_ENV)
+        delete env[name];
+    env.GIT_LITERAL_PATHSPECS = "1";
+    env.GIT_TERMINAL_PROMPT = "0";
+    env.GIT_OPTIONAL_LOCKS = "0";
+    const run = spawnSync("git", ["--no-replace-objects", ...args], { cwd, env, stdio: ["ignore", "pipe", "ignore"], maxBuffer: 256 * 1024 * 1024 });
+    if (run.error !== undefined || run.stdout === null || run.stdout === undefined)
+        return { status: null, stdout: Buffer.alloc(0) };
+    return { status: run.status, stdout: run.stdout };
+}
+/**
+ * The base ledger's exact bytes at the set's base commit: null when the commit holds none, or when the commit cannot be
+ * read (materialize reads it the same way, and admission reads the base tree itself for every set that depends on it);
+ * "unreadable" when the path is there but is not one regular, non-executable blob, or the blob cannot be read.
+ */
+function readBaseLedger(clone, baseCommit) {
+    if (!OBJECT_ID.test(baseCommit))
+        return null;
+    const listed = runGit(clone, ["ls-tree", "-z", "--full-tree", baseCommit, "--", LEDGER_PATH]);
+    if (listed.status !== 0)
+        return null;
+    const records = listed.stdout.toString("utf8").split("\0").filter((record) => record !== "");
+    if (records.length === 0)
+        return null;
+    if (records.length !== 1)
+        return "unreadable";
+    const record = records[0];
+    const tab = record.indexOf("\t");
+    if (tab === -1)
+        return "unreadable";
+    const [mode, type, oid, ...rest] = record.slice(0, tab).split(" ");
+    if (mode !== "100644" || type !== "blob" || oid === undefined || rest.length > 0 || !OBJECT_ID.test(oid) || record.slice(tab + 1) !== LEDGER_PATH)
+        return "unreadable";
+    const blob = runGit(clone, ["cat-file", "blob", oid]);
+    return blob.status === 0 ? blob.stdout : "unreadable";
+}
+/** The base ledger, trusted over the committed plan's acts (T9), and held to the generation the set was computed over. */
+function trustedBaseLedger(clone, set, held, authority) {
+    const bytes = readBaseLedger(clone, set.repository.baseCommit);
+    if (bytes === "unreadable")
+        return { refused: { check: "V3", verdict: "indeterminate", rule: LEDGER_UNREADABLE } };
+    const trust = trustInstalledLedger(bytes === null || bytes.length === 0 ? null : bytes, { id: set.repository.id, nodeId: set.repository.nodeId }, held, {
+        planPackageActs: [{ planDigest: authority.planDigest, packages: planPackagesFor(authority, set.repository.id) }],
+    });
+    if (trust.state === "refused")
+        return { refused: { check: "V3", verdict: "indeterminate", rule: TOKEN.test(trust.rule) ? trust.rule : LEDGER_UNREADABLE } };
+    if ((trust.ledger?.generation ?? 0) !== set.ledger.generation)
+        return { refused: { check: "V3", verdict: "violated", rule: LEDGER_MISMATCH } };
+    return { ledger: trust.ledger, bytes: bytes === null || bytes.length === 0 ? null : bytes };
+}
+// ---------------------------------------------------------------------------
+// V3 for one set
+/** The V3 check of a refusal: exit 1 is violated, anything else indeterminate; the rule is its fixed detail, or its reason. */
+function refusalCheck(refusal) {
+    const token = refusal.detail ?? refusal.reason;
+    const rule = TOKEN.test(token) && !RESERVED_RULES.has(token) ? token : AUTHORIZATION_NOT_CURRENT;
+    return { check: "V3", verdict: refusal.exitCode === 1 ? "violated" : "indeterminate", rule };
+}
+async function decideV3(entry, set, authority, options) {
+    let clone;
+    try {
+        clone = realpathSync(options.cloneFor(set.repository.id));
+    }
+    catch {
+        return { check: { check: "V3", verdict: "indeterminate", rule: "clone-unreadable" } };
+    }
+    const base = trustedBaseLedger(clone, set, options.heldChangeSets, authority);
+    if ("refused" in base)
+        return { check: base.refused };
+    const decided = await decideSetBinding({
+        hub: options.hub,
+        clone,
+        set,
+        authority,
+        baseLedger: base.ledger,
+        baseLedgerBytes: base.bytes,
+        now: options.now,
+        runReadiness: options.runReadiness,
+    });
+    if (decided.state !== "bound")
+        return { check: refusalCheck(decided) };
+    return { check: satisfied("V3"), binding: decided.binding };
+}
+// ---------------------------------------------------------------------------
+// the bundle
+/** Whether the hub stores, verified, the bundle the approval names, and it is for the approved plan's digest. A store that cannot be read holds nothing. */
+function holdsApprovedBundle(hub, authority) {
+    try {
+        const approved = readStoredApplyBundle(hub, authority.subject);
+        return approved !== null && approved.bundleDigest === authority.subject && approved.plan.digest === authority.planDigest;
+    }
+    catch {
+        return false;
+    }
+}
+const PRE_APPLY = ["V1", "V2", "V3", "V4", "V5", "V6", "V7", "V8", "V9"];
+/**
+ * The result as a planned bundle, or the same result when nothing approves it (P1). A repository with no change set keeps
+ * its entry. Throws when the planned bundle does not validate; nothing is written here.
+ */
+export async function plannedBundle(result, options) {
+    if (!result.bundle.plan.committed)
+        return result;
+    const authority = readHubAuthority(options.hub);
+    if ("state" in authority || authority.planDigest !== result.bundle.plan.digest)
+        return result;
+    if (!holdsApprovedBundle(options.hub, authority))
+        return result;
+    const repositories = [];
+    for (const entry of result.bundle.repositories) {
+        if (!("changeSet" in entry)) {
+            repositories.push(entry);
+            continue;
+        }
+        const set = result.changeSets.find((candidate) => candidate.changeSetDigest === entry.changeSet);
+        if (set === undefined)
+            throw new Error("a repository names a change set the result does not hold");
+        const { state: _state, binding: _binding, ...rest } = entry;
+        // P3: the planner already refused this repository's authorization; no readiness runs and nothing is bound.
+        const flagged = rest.checks.some((check) => check.check === "V3");
+        const decided = flagged ? undefined : await decideV3(rest, set, authority, options);
+        const others = rest.checks.filter((check) => !(decided !== undefined && check.check === "V3"));
+        const added = [satisfied("V1"), satisfied("V2"), satisfied("V4"), satisfied("V5"), satisfied("V7")];
+        // P5: V9 is satisfied only for a set with no lockfile to regenerate; for any other set it stands as the dry tree left it, and is
+        // indeterminate when the dry tree ran no provenance check at all.
+        if (derivedLockfile(set) === null)
+            added.push(satisfied("V9"));
+        else
+            added.push({ check: "V9", verdict: "indeterminate", rule: PROVENANCE_NOT_RUN });
+        const checks = sortChecks([...others, ...(decided === undefined ? [] : [decided.check]), ...added.filter((check) => !others.some((existing) => existing.check === check.check))]);
+        const verdict = worstVerdict(checks.map((check) => check.verdict));
+        const binding = decided?.binding;
+        const planned = verdict === "satisfied" && binding !== undefined && PRE_APPLY.every((id) => checks.some((check) => check.check === id && check.verdict === "satisfied"));
+        repositories.push({ ...rest, verdict, checks, ...(binding === undefined ? {} : { binding }), ...(planned ? { state: "planned" } : {}) });
+    }
+    const bundle = { ...result.bundle, mode: "planned", repositories };
+    if (!validateApplyBundle(bundle).valid)
+        throw new Error("the planned bundle does not validate");
+    return { bundle, changeSets: result.changeSets };
+}
+//# sourceMappingURL=planned-bundle.js.map

package/dist/planned-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planned-bundle.js","sourceRoot":"","sources":["../src/planned-bundle.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,EAAE;AACF,0HAA0H;AAC1H,0HAA0H;AAC1H,6HAA6H;AAC7H,QAAQ;AACR,EAAE;AACF,8HAA8H;AAC9H,8HAA8H;AAC9H,+HAA+H;AAC/H,uHAAuH;AACvH,+EAA+E;AAC/E,0HAA0H;AAC1H,2HAA2H;AAC3H,6HAA6H;AAC7H,6DAA6D;AAC7D,gIAAgI;AAChI,sEAAsE;AACtE,8HAA8H;AAC9H,uHAAuH;AACvH,6HAA6H;AAC7H,6HAA6H;AAC7H,mBAAmB;AAEnB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAenD,MAAM,KAAK,GAAG,6BAA6B,CAAC;AAC5C,wIAAwI;AACxI,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAC9D,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,8FAA8F;AAC9F,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAE1C,gGAAgG;AAChG,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEhD,mFAAmF;AACnF,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEzG,MAAM,UAAU,GAAG,CAAC,MAA6B,EAAgB,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AACvI,MAAM,SAAS,GAAG,CAAC,KAA0B,EAAc,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AAEhG,8EAA8E;AAC9E,yCAAyC;AAEzC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AAC1N,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD,iHAAiH;AACjH,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,eAAe;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,GAAG,CAAC,qBAAqB,GAAG,GAAG,CAAC;IAChC,GAAG,CAAC,mBAAmB,GAAG,GAAG,CAAC;IAC9B,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC;IAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACjJ,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACjI,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAa,EAAE,UAAkB;IACvD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,YAAY,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,WAAW;QAAE,OAAO,YAAY,CAAC;IACvK,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;AACxD,CAAC;AAID,0HAA0H;AAC1H,SAAS,iBAAiB,CAAC,KAAa,EAAE,GAAwB,EAAE,IAAoC,EAAE,SAAuB;IAC/H,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC;IACnH,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE;QACtJ,eAAe,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;KACjH,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAC5J,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC;IAC/I,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AAC9F,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AAEjB,+HAA+H;AAC/H,SAAS,YAAY,CAAC,OAAyB;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACjG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAA4D,EAAE,GAAwB,EAAE,SAAuB,EAAE,OAA6B;IACpK,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAC9E,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;QACrC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK;QACL,GAAG;QACH,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,eAAe,EAAE,IAAI,CAAC,KAAK;QAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,aAAa;AAEb,4JAA4J;AAC5J,SAAS,mBAAmB,CAAC,GAAW,EAAE,SAAuB;IAC/D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/D,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,UAAU,CAAC;IAC3H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAmC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAA6B,EAAE,OAA6B;IAC9F,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC;IACjD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC9F,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC;IAEhE,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/C,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;QACjG,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACnG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC5D,2GAA2G;QAC3G,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAClH,iIAAiI;QACjI,kEAAkE;QAClE,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;;YAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClL,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC;QACzK,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,MAAM,MAAM,GAAgB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IAChF,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAChG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AACnD,CAAC"}

package/dist/product-repository.d.ts

@@ -21,6 +21,10 @@ export interface CloudBootstrapReport {
  * against `directory`. Never mutates anything, never runs `npm ci` itself
  * -- it checks that the manifest and lockfile are BOTH present, which is
  * the precondition a real `npm ci` needs, not a substitute for running it.
+ * An unsatisfied check is a readiness report, not a failure: a launcher run
+ * in the hub writes nothing into a product repository, whose `AGENTS.md`
+ * arrives only once it is staffed in an approved plan, with that plan's
+ * setup pull request.
  */
 export declare function checkCloudSessionBootstrap(host: WorkspaceHost, directory: string): CloudBootstrapReport;
 //# sourceMappingURL=product-repository.d.ts.map

package/dist/product-repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"product-repository.d.ts","sourceRoot":"","sources":["../src/product-repository.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,YAAY,CAAC;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAOD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,oBAAoB,CAuCvG"}
+{"version":3,"file":"product-repository.d.ts","sourceRoot":"","sources":["../src/product-repository.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,YAAY,CAAC;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAOD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,oBAAoB,CA4CvG"}

package/dist/product-repository.js

@@ -8,6 +8,10 @@ const HUB_MARKER_REL = join("clossys", ".state", "workspace.json");
  * against `directory`. Never mutates anything, never runs `npm ci` itself
  * -- it checks that the manifest and lockfile are BOTH present, which is
  * the precondition a real `npm ci` needs, not a substitute for running it.
+ * An unsatisfied check is a readiness report, not a failure: a launcher run
+ * in the hub writes nothing into a product repository, whose `AGENTS.md`
+ * arrives only once it is staffed in an approved plan, with that plan's
+ * setup pull request.
  */
 export function checkCloudSessionBootstrap(host, directory) {
     const hasManifest = host.exists(join(directory, PACKAGE_JSON_REL));
@@ -34,7 +38,11 @@ export function checkCloudSessionBootstrap(host, directory) {
         satisfied: agentsPointsAtClossys,
         ...(agentsPointsAtClossys
             ? {}
-            : { note: agentsRaw === null ? "AGENTS.md does not exist at the repository root." : "AGENTS.md exists but does not mention clossys/." }),
+            : {
+                note: agentsRaw === null
+                    ? "AGENTS.md does not exist at the repository root yet; a launcher run in the hub writes nothing here, and once this repository is staffed in an approved plan, AGENTS.md arrives with that plan's setup pull request."
+                    : "AGENTS.md exists but does not mention clossys/.",
+            }),
     };
     const hasHubMarker = host.exists(join(directory, HUB_MARKER_REL));
     const markerCheck = {

package/dist/product-repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"product-repository.js","sourceRoot":"","sources":["../src/product-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsBjC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAmB,EAAE,SAAiB;IAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAwB;QACzC,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,qDAAqD;QAC5D,SAAS,EAAE,WAAW,IAAI,OAAO;QACjC,GAAG,CAAC,WAAW,IAAI,OAAO;YACxB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,IAAI,EAAE,CAAC,WAAW,IAAI,CAAC,OAAO;oBAC5B,CAAC,CAAC,wDAAwD;oBAC1D,CAAC,CAAC,CAAC,WAAW;wBACZ,CAAC,CAAC,qDAAqD;wBACvD,CAAC,CAAC,0EAA0E;aACjF,CAAC;KACP,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,MAAM,qBAAqB,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACnF,MAAM,WAAW,GAAwB;QACvC,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,gEAAgE;QACvE,SAAS,EAAE,qBAAqB;QAChC,GAAG,CAAC,qBAAqB;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,iDAAiD,EAAE,CAAC;KAC3I,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IAClE,MAAM,WAAW,GAAwB;QACvC,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,2DAA2D;QAClE,SAAS,EAAE,YAAY;QACvB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAAC;KACvF,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACzD,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;AACvF,CAAC"}
+{"version":3,"file":"product-repository.js","sourceRoot":"","sources":["../src/product-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsBjC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAEnE;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAmB,EAAE,SAAiB;IAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAwB;QACzC,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,qDAAqD;QAC5D,SAAS,EAAE,WAAW,IAAI,OAAO;QACjC,GAAG,CAAC,WAAW,IAAI,OAAO;YACxB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,IAAI,EAAE,CAAC,WAAW,IAAI,CAAC,OAAO;oBAC5B,CAAC,CAAC,wDAAwD;oBAC1D,CAAC,CAAC,CAAC,WAAW;wBACZ,CAAC,CAAC,qDAAqD;wBACvD,CAAC,CAAC,0EAA0E;aACjF,CAAC;KACP,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,MAAM,qBAAqB,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACnF,MAAM,WAAW,GAAwB;QACvC,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,gEAAgE;QACvE,SAAS,EAAE,qBAAqB;QAChC,GAAG,CAAC,qBAAqB;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,IAAI,EACF,SAAS,KAAK,IAAI;oBAChB,CAAC,CAAC,qNAAqN;oBACvN,CAAC,CAAC,iDAAiD;aACxD,CAAC;KACP,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IAClE,MAAM,WAAW,GAAwB;QACvC,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,2DAA2D;QAClE,SAAS,EAAE,YAAY;QACvB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAAC;KACvF,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACzD,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;AACvF,CAAC"}

package/dist/provenance-gate.d.ts

@@ -0,0 +1,48 @@
+import type { ApplyCheck, ChangeSetItem } from "./change-set-contract.js";
+import type { LockfileSpawn } from "./lockfile-regen.js";
+import type { RegistrySnapshot } from "./registry-snapshot.js";
+/** The bin Integrator installs, found under the hub's node_modules/.bin. */
+export declare const PROVENANCE_CHECK_BIN = "integrator-provenance-check";
+/** How long one run of the bin may take. */
+export declare const PROVENANCE_CHECK_TIMEOUT_MS = 120000;
+/** Bytes kept of the bin's stdout; a report at or past this is treated as truncated. */
+export declare const PROVENANCE_CHECK_MAX_BUFFER = 1000000;
+export interface ProvenanceGateInput {
+    /** Absolute, real (realpath-equal) directory holding the set's materialized tree. */
+    readonly tree: string;
+    /** Absolute, real (realpath-equal) hub root, whose node_modules holds Integrator. */
+    readonly hubRoot: string;
+    /** The change set's items. */
+    readonly items: readonly ChangeSetItem[];
+}
+/** Ports. Not reachable from a CLI. */
+export interface ProvenanceGatePorts {
+    readonly spawn?: LockfileSpawn;
+}
+/**
+ * The snapshot's digest, as docs/contracts/registry-snapshot.json defines it
+ * (in the public repository, not shipped in this package): `sha256:` and the
+ * SHA-256 of the canonical JSON of `{registry, packages}`, packages sorted by
+ * name, each reduced to name, status, latest and versions, versions sorted by
+ * version and kept whole. fetchedAt, fetchedBy, responseSha256, schemaVersion
+ * and kind are left out. Throws TypeError for a snapshot that does not validate
+ * against the contract: an invalid snapshot has no digest. The gate itself
+ * does not read a snapshot; this is exported for the plan binding that a later
+ * change wires in.
+ */
+export declare function registrySnapshotDigest(snapshot: RegistrySnapshot): string;
+/**
+ * V9 for one change set. Satisfied without touching anything when the set
+ * installs or pins nothing its base lacks. Otherwise runs the hub's
+ * `integrator-provenance-check` against `tree` and judges each gated package
+ * by exact name and exact version: satisfied only when every one is verified
+ * at that version, with no exception for an unverified one. Other `@clossys`
+ * packages in the report never gate: an unrelated violated legacy pin passes
+ * when every gated package is verified. Indeterminate wins over violated; the
+ * result lists each distinct rule once, in code-unit order, and never mixes a
+ * satisfied entry with a refusal. Never throws for a bad input; everything it
+ * cannot rely on is an indeterminate entry. The input carries no ledger or
+ * snapshot: nothing here reads one.
+ */
+export declare function checkSetProvenance(input: ProvenanceGateInput, ports?: ProvenanceGatePorts): Promise<readonly ApplyCheck[]>;
+//# sourceMappingURL=provenance-gate.d.ts.map

package/dist/provenance-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance-gate.d.ts","sourceRoot":"","sources":["../src/provenance-gate.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAI1E,OAAO,KAAK,EAAE,aAAa,EAAuB,MAAM,qBAAqB,CAAC;AAK9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,4CAA4C;AAC5C,eAAO,MAAM,2BAA2B,SAAU,CAAC;AACnD,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,UAAY,CAAC;AAErD,MAAM,WAAW,mBAAmB;IAClC,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED,uCAAuC;AACvC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;CAChC;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAOzE;AA4KD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,GAAE,mBAAwB,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CA6EpI"}