@codyswann/lisa 4.71.1 → 4.71.3

package/all/copy-overwrite/scripts/lisa-npm-updater.mjs

@@ -11,11 +11,11 @@ import { join, resolve } from "node:path";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 import {
   required,
-  UpdaterError,
   keys,
   validatePolicy,
   validateProposal,
 } from "./lib/npm-update-contract.mjs";
+import { publicFailure, withStage } from "./lib/npm-update-invariants.mjs";
 import {
   readJson,
   writeJson,
@@ -33,6 +33,62 @@ import {
 import { gateProposal } from "./lib/npm-update-gate.mjs";
 import { readGateProof } from "./lib/npm-update-gate-proof.mjs";
 import { sha256 } from "./lib/github-attestation-verifier.mjs";
+import {
+  prepareCancellation,
+  finalizeCancellation,
+} from "./lib/npm-update-cancellation.mjs";
+const CANCEL_PREPARE = "cancel-prepare";
+const PHASES = [
+  "prepare",
+  "allocate",
+  "checkpoint",
+  "gate",
+  "publish",
+  CANCEL_PREPARE,
+  "cancel-checkpoint",
+];
+
+/** Three complete literal fields identify one old leaf and the exact expected current main. */
+export function cancellationRequest(env = process.env) {
+  required(
+    typeof env.CANCEL_ISSUE === "string" && /^[1-9]\d*$/.test(env.CANCEL_ISSUE),
+    "exact cancellation issue number required"
+  );
+  const number = Number(env.CANCEL_ISSUE);
+  required(
+    Number.isSafeInteger(number) &&
+      String(number) === env.CANCEL_ISSUE &&
+      typeof env.CANCEL_PROPOSAL_KEY === "string" &&
+      /^[a-f0-9]{64}$/.test(env.CANCEL_PROPOSAL_KEY) &&
+      typeof env.CANCEL_EXPECTED_MAIN === "string" &&
+      /^[a-f0-9]{40}$/.test(env.CANCEL_EXPECTED_MAIN),
+    "complete exact cancellation identity required"
+  );
+  return {
+    number,
+    proposalKey: env.CANCEL_PROPOSAL_KEY,
+    parent: env.CANCEL_EXPECTED_MAIN,
+  };
+}
+
+/** Cancellation stays inside the same trusted issuer job and never consumes ordinary publication slots. */
+async function cancellationPhase(cwd, output, proposal, config, phase) {
+  const api = new GitHub(config.automationProvenance, process.env.GH_TOKEN);
+  const context = {
+    api,
+    cwd,
+    output,
+    proposal,
+    config,
+    request: cancellationRequest(),
+  };
+  const result = await (
+    phase === CANCEL_PREPARE ? prepareCancellation : finalizeCancellation
+  )(context);
+  process.stdout.write(
+    `${phase === CANCEL_PREPARE ? result.mode : result.status}\n`
+  );
+}
 
 /** Only committed policy grants authority; ignored/local config cannot activate Actions. */
 async function configuration(cwd) {
@@ -119,19 +175,44 @@ async function publishPhase(
   process.stdout.write(`${result.status} ${result.url}\n`);
 }
 
+/** Gate input/output classification preserves the original orchestration and authority order. */
+async function gatePhase(
+  cwd,
+  output,
+  proposal,
+  policy,
+  config,
+  allocation,
+  preview
+) {
+  const result = await gateProposal({
+    cwd,
+    proposal,
+    policy,
+    allocation,
+    preview,
+    ...(await withStage("gate-input", () => readGateProof(output))),
+    token: process.env.GH_TOKEN,
+    config,
+  });
+  await withStage("gate-output", () =>
+    writeJson(join(output, "gated.json"), result)
+  );
+  process.stdout.write(`gated ${result.receipt.commit}\n`);
+}
+
 /** Strict phase and fixed directory arguments are data, never a caller recipe. */
 export async function main(argv = process.argv.slice(2)) {
   required(
-    argv.length === 3 &&
-      ["prepare", "allocate", "checkpoint", "gate", "publish"].includes(
-        argv[0]
-      ),
-    "usage: lisa-npm-updater.mjs <prepare|allocate|checkpoint|gate|publish> <owned-checkout> <private-phase-directory>"
+    argv.length === 3 && PHASES.includes(argv[0]),
+    "usage: lisa-npm-updater.mjs <prepare|allocate|checkpoint|gate|publish|cancel-prepare|cancel-checkpoint> <owned-checkout> <private-phase-directory>"
   );
   const [phase, checkout, directory] = argv;
   const cwd = resolve(checkout);
   const output = resolve(directory);
-  const { config, policy } = await configuration(cwd);
+  const { config, policy } = await withStage("configuration", () =>
+    configuration(cwd)
+  );
   phaseDirectory(output);
   if (phase === "prepare") {
     const result = await prepareUpdate({ cwd, policy, config });
@@ -145,6 +226,9 @@ export async function main(argv = process.argv.slice(2)) {
     readJson(join(output, "proposal.json")),
     policy
   );
+  if (phase === CANCEL_PREPARE || phase === "cancel-checkpoint") {
+    return cancellationPhase(cwd, output, proposal, config, phase);
+  }
   if (phase === "allocate")
     return allocatePhase(cwd, output, proposal, policy, config);
   const allocation = readJson(join(output, "allocation.json"));
@@ -168,21 +252,16 @@ export async function main(argv = process.argv.slice(2)) {
     process.stdout.write(`${result.mode} checkpoint complete\n`);
     return;
   }
-  if (phase === "gate") {
-    const result = await gateProposal({
+  if (phase === "gate")
+    return gatePhase(
       cwd,
+      output,
       proposal,
       policy,
-      allocation,
-      preview,
-      ...readGateProof(output),
-      token: process.env.GH_TOKEN,
       config,
-    });
-    writeJson(join(output, "gated.json"), result);
-    process.stdout.write(`gated ${result.receipt.commit}\n`);
-    return;
-  }
+      allocation,
+      preview
+    );
   return publishPhase(
     cwd,
     output,
@@ -197,8 +276,6 @@ export async function main(argv = process.argv.slice(2)) {
 if (invokedAsScript(import.meta.url))
   main().catch(error => {
     // Never print candidate/provider payloads or child output that may contain credentials.
-    process.stderr.write(
-      `${error instanceof UpdaterError ? error.message : "npm updater failed: required policy, authorization, installation, gate or exact publication evidence was unavailable"}\n`
-    );
+    process.stderr.write(`${publicFailure(error)}\n`);
     process.exitCode = 1;
   });

package/all/copy-overwrite/scripts/npm-updater-helper-graph.json

@@ -72,7 +72,7 @@
       "children": []
     },
     "lib/github-attestation-provider.mjs": {
-      "sha256": "43be8987bd5af04130eedcc256f8a3c5667d3648dfdf37b0fb7d3ce28f417c08",
+      "sha256": "98dbe0326546a1d10e148ed9036d5696159dee38068beddff321f1b2d47fcdc7",
       "staticImports": [
         "lib/bounded-spawn.mjs",
         "lib/github-attestation-verifier.mjs"
@@ -142,7 +142,7 @@
       "children": []
     },
     "lib/history-secret-scanner.mjs": {
-      "sha256": "d77fc82db53ffbfef6bd714b600ed9f8b711cf52bbf630020efa4841ae5f083c",
+      "sha256": "07b639188c44ed5db817fc47bcdedfdd58e700024af19d464d78497b1ee236b3",
       "staticImports": [
         "lib/history-secret-evidence.mjs",
         "lib/history-secret-git.mjs",
@@ -176,7 +176,7 @@
       "children": []
     },
     "lib/npm-update-allocate.mjs": {
-      "sha256": "f28cd52c08836bd7cf18a14e18e1f69293bbb2c84e2da77ddbcd267d71f6c11e",
+      "sha256": "c35a8c44bf67e4afb2849f2ea41948e190f1b108b35db25b38418478a3227e36",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
@@ -184,7 +184,9 @@
         "lib/npm-update-npm.mjs",
         "lib/npm-update-prepare.mjs",
         "lib/npm-update-process.mjs",
-        "lib/npm-update-recovery.mjs"
+        "lib/npm-update-recovery.mjs",
+        "lib/npm-update-supersession.mjs",
+        "lisa-automation-provenance.mjs"
       ],
       "dynamicImports": [],
       "children": []
@@ -219,6 +221,54 @@
       "dynamicImports": [],
       "children": []
     },
+    "lib/npm-update-cancel-origin.mjs": {
+      "sha256": "331554c8d2201fb6fe6934d158f5f60d7da11bbb1d4aa938ef9437afe724b5ff",
+      "staticImports": [
+        "lib/automation-provenance-contract.mjs",
+        "lib/github-attestation-provider.mjs",
+        "lib/github-attestation-recovery.mjs",
+        "lib/github-attestation-verifier.mjs",
+        "lib/npm-update-checkpoint.mjs",
+        "lib/npm-update-contract.mjs",
+        "lib/npm-update-leaf.mjs",
+        "lib/npm-update-process.mjs",
+        "lisa-automation-provenance.mjs",
+        "node:fs",
+        "node:path"
+      ],
+      "dynamicImports": [],
+      "children": []
+    },
+    "lib/npm-update-cancellation-proof.mjs": {
+      "sha256": "56365dbe20ef540b8a3d59a3ce9e0fa33c9c4efdfb27c2b69e27cbe60b2ba204",
+      "staticImports": [
+        "lib/github-attestation-verifier.mjs",
+        "lib/npm-update-contract.mjs",
+        "lisa-automation-provenance.mjs"
+      ],
+      "dynamicImports": [],
+      "children": []
+    },
+    "lib/npm-update-cancellation.mjs": {
+      "sha256": "529122fd37117526d97277de116fe0080bce85557062585bd73ce7d8be2f88b9",
+      "staticImports": [
+        "lib/github-attestation-verifier.mjs",
+        "lib/npm-update-allocate.mjs",
+        "lib/npm-update-cancel-origin.mjs",
+        "lib/npm-update-cancellation-proof.mjs",
+        "lib/npm-update-checkpoint.mjs",
+        "lib/npm-update-contract.mjs",
+        "lib/npm-update-hosted-gate.mjs",
+        "lib/npm-update-invariants.mjs",
+        "lib/npm-update-process.mjs",
+        "lib/npm-update-supersession.mjs",
+        "lisa-automation-provenance.mjs",
+        "node:fs",
+        "node:path"
+      ],
+      "dynamicImports": [],
+      "children": []
+    },
     "lib/npm-update-checkpoint.mjs": {
       "sha256": "1c0c9d1442d65cc848a80bce010fc0d7d9f3792b9080df03ce3286177b4d37a0",
       "staticImports": [
@@ -353,7 +403,7 @@
       "children": []
     },
     "lib/npm-update-gate.mjs": {
-      "sha256": "86b3b29736b5abee8d3f53844084805f4e5d85ad6537488f7d2da284d2146207",
+      "sha256": "bb6b6b8ea1e3620ee0b1b620e50331788bc99b44f431057e12a60cd138e56bc4",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
@@ -362,6 +412,7 @@
         "lib/npm-update-gate-proof.mjs",
         "lib/npm-update-github.mjs",
         "lib/npm-update-hosted-gate.mjs",
+        "lib/npm-update-invariants.mjs",
         "lib/npm-update-prepare.mjs",
         "lib/npm-update-process.mjs",
         "lib/npm-update-publication.mjs",
@@ -421,7 +472,7 @@
       "children": []
     },
     "lib/npm-update-helper-inventory.mjs": {
-      "sha256": "da1bd212a20406c060d26c52bc8e67dac3fef51afafb604042b9c6e26b07bdb6",
+      "sha256": "33ab2fcba24552a378a75314fe021b25ae6862a6e3c7c4f6b83250f9749264bb",
       "staticImports": [],
       "dynamicImports": [],
       "children": []
@@ -499,7 +550,7 @@
       "children": []
     },
     "lib/npm-update-hosted-gate.mjs": {
-      "sha256": "787e9424114d52f6a6c8a09a67033d69b20d66ee22e1735f856f2c2d9f20aa69",
+      "sha256": "b6adf8af72067f883c83e11b7465a3f4c219a6e78d98b029b1af489967ccbaa8",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
@@ -507,6 +558,7 @@
         "lib/npm-update-helper.mjs",
         "lib/npm-update-hook-installation.mjs",
         "lib/npm-update-hook-provider.mjs",
+        "lib/npm-update-invariants.mjs",
         "lib/npm-update-process.mjs",
         "node:fs",
         "node:path",
@@ -534,7 +586,7 @@
       ]
     },
     "lib/npm-update-invariants.mjs": {
-      "sha256": "866525d6b23523dc5d45cd1ed7794e31f84be5cc636288cc05d0e54d0cee63a6",
+      "sha256": "136cb22396d33252494c4df1e35d13ff58c58a0ca34fbe5c68954b077cb3f30b",
       "staticImports": [],
       "dynamicImports": [],
       "children": []
@@ -550,7 +602,7 @@
       "children": []
     },
     "lib/npm-update-leaf-contract.mjs": {
-      "sha256": "8e7bcfb1d604f2d49cd86c1964330a84d4f8a4945feb5e5a9d4f72e2aa03dc07",
+      "sha256": "1686c41dd54accb8e52595cbe66b0780878c2dc9eba3436b574d869bcfe93110",
       "staticImports": [
         "lib/npm-update-contract.mjs",
         "lisa-automation-provenance.mjs",
@@ -560,7 +612,7 @@
       "children": []
     },
     "lib/npm-update-leaf.mjs": {
-      "sha256": "0cc4210470edf0042a61a74799d570b2a1a3e524dca03faca78e49ad88a4dfb9",
+      "sha256": "6638fa03bb9bb44bd84fc9b4a91d8a334030c108e2759a2a673000dcbfbfe637",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
@@ -573,9 +625,10 @@
       "children": []
     },
     "lib/npm-update-native-process.mjs": {
-      "sha256": "29dc444ecb1736be991faffc7439865bcecc2cf19a81f8cefd574f9bb5a40917",
+      "sha256": "295d69d90f32aad9d757060ea6d3f66787a00e24c19e01e5beaf2ba752fec8da",
       "staticImports": [
         "lib/npm-update-contract.mjs",
+        "lib/npm-update-invariants.mjs",
         "node:child_process",
         "node:url"
       ],
@@ -776,6 +829,21 @@
       "dynamicImports": [],
       "children": []
     },
+    "lib/npm-update-supersession.mjs": {
+      "sha256": "d336e2c611f43ec2c576ddba19cad6533c1bc50e100f291e4c2cffd82bad3cde",
+      "staticImports": [
+        "lib/github-attestation-verifier.mjs",
+        "lib/npm-update-cancel-origin.mjs",
+        "lib/npm-update-cancellation-proof.mjs",
+        "lib/npm-update-contract.mjs",
+        "lib/npm-update-process.mjs",
+        "lisa-automation-provenance.mjs",
+        "node:fs",
+        "node:path"
+      ],
+      "dynamicImports": [],
+      "children": []
+    },
     "lib/npm-update-tool-launcher.mjs": {
       "sha256": "03e58c15ceee04a80a2c2a597454132ab742fc13c878eb1cb742a6ee0e045045",
       "staticImports": [
@@ -950,16 +1018,18 @@
       "children": []
     },
     "lisa-npm-updater.mjs": {
-      "sha256": "43b4eb085bede37441c36fa30af3c65f397bd5862a15d4bce6d05068b7497bac",
+      "sha256": "3ee8529f74396b06b1189db9dd37bc002d1e17d9abd9fbd9da6c20c212db7898",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/invoked-as-script.mjs",
         "lib/npm-update-allocate.mjs",
         "lib/npm-update-authorization.mjs",
+        "lib/npm-update-cancellation.mjs",
         "lib/npm-update-contract.mjs",
         "lib/npm-update-gate-proof.mjs",
         "lib/npm-update-gate.mjs",
         "lib/npm-update-github.mjs",
+        "lib/npm-update-invariants.mjs",
         "lib/npm-update-prepare.mjs",
         "lib/npm-update-process.mjs",
         "lib/npm-update-publish.mjs",

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAkvDjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAqpDjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA6xDjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAgsDjC,CAAC"}