@deksden-com/dd-flow-cli 0.9.0-beta.136 → 0.9.0-beta.137

package/dist/services/release-download.js

@@ -1,67 +0,0 @@
-import { AppError } from "../shared/errors.js";
-import { verifyReleaseArchive } from "./release-manifest.js";
-function refuse(reason) {
-    throw new AppError("release_download", "Release artifact download failed", 1, { reason, phase: "artifact_download", effect: "no_effect", help: "setup" });
-}
-/** No provider login, credentials or redirect forwarding. Activation is a separate operation. */
-export async function downloadReleaseArchive(identity, options) {
-    const maxBytes = options.maxBytes ?? 256 * 1024 * 1024;
-    const timeoutMs = options.timeoutMs ?? 60_000;
-    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 ||
-        !Number.isSafeInteger(identity.bytes) || identity.bytes < 1 || identity.bytes > maxBytes || !/^[a-f0-9]{64}$/.test(identity.sha256))
-        refuse("invalid_download_limits_or_identity");
-    let url;
-    try {
-        url = new URL(identity.url);
-    }
-    catch {
-        return refuse("invalid_artifact_url");
-    }
-    if (url.protocol !== "https:" || url.username || url.password || url.hash || (url.port && url.port !== "443") || !options.allowedHosts.has(url.hostname))
-        refuse("unapproved_artifact_origin");
-    const fetcher = options.fetch ?? globalThis.fetch;
-    let response;
-    const signal = AbortSignal.timeout(timeoutMs);
-    try {
-        response = await fetcher(url, { redirect: "error", signal, credentials: "omit" });
-    }
-    catch {
-        return refuse("network_unavailable_or_redirect");
-    }
-    if (!response.ok || !response.body) {
-        await response.body?.cancel();
-        return refuse("artifact_http_failure");
-    }
-    const length = response.headers.get("content-length");
-    if (length !== null && (!/^[0-9]+$/.test(length) || Number(length) !== identity.bytes)) {
-        await response.body.cancel();
-        return refuse("content_length_mismatch");
-    }
-    const reader = response.body.getReader(), chunks = [];
-    let received = 0;
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            received += value.byteLength;
-            if (received > identity.bytes || received > maxBytes) {
-                await reader.cancel();
-                return refuse("artifact_exceeds_declared_size");
-            }
-            chunks.push(Buffer.from(value));
-            options.onProgress?.({ received_bytes: received, expected_bytes: identity.bytes });
-        }
-    }
-    catch (error) {
-        if (error instanceof AppError)
-            throw error;
-        return refuse("artifact_stream_interrupted");
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const bytes = Buffer.concat(chunks, received);
-    verifyReleaseArchive(identity, bytes);
-    return bytes;
-}

package/dist/services/release-envelope.js

@@ -1,104 +0,0 @@
-import { createHash, createPublicKey, sign, verify } from "node:crypto";
-import { AppError } from "../shared/errors.js";
-import { admitReleaseManifest } from "./release-manifest.js";
-const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
-function refuse(reason) {
-    throw new AppError("release_authentication", "Release producer cannot be authenticated", 1, { reason, effect: "no_effect", phase: "release_authentication", help: "setup" });
-}
-function object(value, keys) {
-    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== keys.length ||
-        Object.keys(value).some(key => !keys.includes(key)))
-        refuse("invalid_envelope_shape");
-    return value;
-}
-function decoded(value, max = 16 * 1024 * 1024) {
-    if (typeof value !== "string" || value.length > Math.ceil(max / 3) * 4 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value))
-        refuse("invalid_encoded_bytes");
-    const bytes = Buffer.from(value, "base64");
-    if (bytes.length > max || bytes.toString("base64") !== value)
-        refuse("invalid_encoded_bytes");
-    return bytes;
-}
-function json(bytes) {
-    try {
-        return JSON.parse(bytes.toString("utf8"));
-    }
-    catch {
-        return refuse("invalid_signed_json");
-    }
-}
-export function releaseProducerKeyId(publicKey) {
-    if (publicKey.type !== "public" || publicKey.asymmetricKeyType !== "ed25519")
-        refuse("unsupported_signing_key");
-    return digest(publicKey.export({ type: "spki", format: "der" }));
-}
-function admission(payload, compatibility, producer) {
-    const data = object(payload, ["schema_id", "manifest_base64", "source", "qualifications", "evidence"]);
-    if (data.schema_id !== "dd-flow/release-payload@1" || !Array.isArray(data.qualifications) || !Array.isArray(data.evidence) || data.qualifications.length > 10_000 || data.evidence.length > 10_000)
-        refuse("invalid_payload_shape");
-    const source = object(data.source, ["kind", "repository", "commit", "tag"]);
-    if (source.repository !== producer.repository || typeof source.commit !== "string" || !/^[a-f0-9]{40}$/.test(source.commit) ||
-        !["published_release", "source_checkout"].includes(String(source.kind)))
-        refuse("source_outside_producer_scope");
-    if (!producer.channels.has(compatibility.channel))
-        refuse("channel_outside_producer_scope");
-    const receipts = new Map();
-    const qualifiedRoutes = new Map(), evidence = new Map();
-    for (const input of data.qualifications) {
-        const fact = object(input, ["route", "sha256", "request_id", "project_root", "workspace", "canon_sha256", "engine_sha256"]);
-        if (typeof fact.route !== "string" || !/^(darwin-arm64|darwin-x64|linux-arm64|linux-x64|win32-x64)\/(codex|zcode|agy|opencode|grok|droid)\/[a-z][a-z0-9-]{0,47}\/(external|native)$/.test(fact.route) ||
-            [fact.sha256, fact.canon_sha256, fact.engine_sha256].some(value => typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) ||
-            [fact.request_id, fact.project_root, fact.workspace].some(value => typeof value !== "string" || !value.trim()))
-            refuse("invalid_qualification_fact");
-        if (qualifiedRoutes.has(fact.route))
-            refuse("duplicate_qualification_fact");
-        qualifiedRoutes.set(fact.route, fact.sha256);
-        receipts.set(fact.sha256, { kind: "route-qualification", requestId: fact.request_id, projectRoot: fact.project_root, workspace: fact.workspace });
-    }
-    for (const input of data.evidence) {
-        const item = object(input, ["path", "bytes_base64"]);
-        if (typeof item.path !== "string" || !/^[a-zA-Z0-9_-][a-zA-Z0-9_.-]*(\/[a-zA-Z0-9_-][a-zA-Z0-9_.-]*)*$/.test(item.path) || evidence.has(item.path))
-            refuse("invalid_evidence_path");
-        evidence.set(item.path, decoded(item.bytes_base64));
-    }
-    const manifestBytes = decoded(data.manifest_base64, 1024 * 1024);
-    const authority = { ...compatibility, receipts, qualifiedRoutes, evidence };
-    const manifest = admitReleaseManifest(json(manifestBytes), authority);
-    for (const input of data.qualifications) {
-        if (input.canon_sha256 !== manifest.canon.archive.sha256 || input.engine_sha256 !== manifest.engine.archive.sha256)
-            refuse("qualification_artifact_mismatch");
-    }
-    if (source.commit !== manifest.canon.commit)
-        refuse("source_commit_mismatch");
-    if (source.kind === "source_checkout") {
-        if (manifest.channel !== "development" || source.tag !== null)
-            refuse("source_cannot_claim_published_release");
-    }
-    else if (source.tag !== `v${manifest.version}` || manifest.channel === "development")
-        refuse("published_release_identity_mismatch");
-    return { manifest, manifestBytes, authority, source: source };
-}
-/** Producer receives qualification facts from its owner ledger, never manufactures them from manifest references. */
-export function produceReleaseEnvelope(payload, privateKey, compatibility) {
-    if (privateKey.type !== "private" || privateKey.asymmetricKeyType !== "ed25519")
-        refuse("unsupported_signing_key");
-    admission(payload, compatibility, { repository: payload.source.repository, channels: new Set([compatibility.channel]) });
-    const bytes = Buffer.from(JSON.stringify(payload));
-    if (bytes.length > 16 * 1024 * 1024)
-        refuse("oversized_payload");
-    return { schema_id: "dd-flow/release-envelope@1", producer_key_id: releaseProducerKeyId(createPublicKey(privateKey)),
-        payload_base64: bytes.toString("base64"), signature_base64: sign(null, bytes, privateKey).toString("base64") };
-}
-/** Trust keys and scope are selected independently; an envelope cannot nominate its own authority. */
-export function authenticateReleaseEnvelope(input, trusted, compatibility) {
-    const envelope = object(input, ["schema_id", "producer_key_id", "payload_base64", "signature_base64"]);
-    if (envelope.schema_id !== "dd-flow/release-envelope@1" || typeof envelope.producer_key_id !== "string")
-        refuse("invalid_envelope_identity");
-    const producer = trusted.get(envelope.producer_key_id);
-    if (!producer || releaseProducerKeyId(producer.publicKey) !== envelope.producer_key_id)
-        refuse("unknown_producer");
-    const bytes = decoded(envelope.payload_base64), signature = decoded(envelope.signature_base64, 64);
-    if (signature.length !== 64 || !verify(null, bytes, producer.publicKey, signature))
-        refuse("signature_mismatch");
-    return admission(json(bytes), compatibility, producer);
-}

package/dist/services/release-manifest.js

@@ -1,45 +0,0 @@
-import { createHash } from "node:crypto";
-import { AppError } from "../shared/errors.js";
-import { validateHybridContract } from "./hybrid-contracts.js";
-const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
-function refuse(reason) {
-    throw new AppError("release_integrity", "Release manifest cannot be admitted", 1, { reason, phase: "release_admission", effect: "no_effect", help: "setup" });
-}
-/** Pure admission: no download, activation, filesystem writes or qualification probes. */
-export function admitReleaseManifest(input, authority) {
-    const issues = validateHybridContract("release-manifest", input, { receipts: authority.receipts });
-    if (issues.length)
-        refuse(issues[0].code);
-    const manifest = input;
-    if (manifest.channel !== authority.channel)
-        refuse("channel_mismatch");
-    if (!authority.routerCompatible(manifest.min_router_version))
-        refuse("router_incompatible");
-    if (!authority.engineCompatible(manifest.engine.version, manifest.engine.compatible_range))
-        refuse("engine_incompatible");
-    for (const family of ["harness", "model", "flow"]) {
-        if (manifest.catalog_versions[family] !== authority.catalogVersions[family])
-            refuse("catalog_incompatible");
-    }
-    for (const route of manifest.qualified_routes) {
-        const key = [route.platform, route.harness, route.flow, route.delegation].join("/");
-        if (authority.qualifiedRoutes.get(key) !== route.evidence.sha256)
-            refuse("route_qualification_mismatch");
-    }
-    for (const reference of [manifest.impact, ...manifest.qualified_routes.map(route => route.evidence)]) {
-        const bytes = authority.evidence.get(reference.path);
-        if (!bytes || sha256(bytes) !== reference.sha256)
-            refuse("evidence_bytes_mismatch");
-    }
-    // Return a detached tuple: callers cannot mutate the submitted object after admission.
-    return structuredClone(manifest);
-}
-/** Verify the actual transferred bytes before any archive parser or cache publication. */
-export function verifyReleaseArchive(archive, bytes) {
-    if (!Number.isSafeInteger(archive.bytes) || archive.bytes < 1 || !/^[a-f0-9]{64}$/.test(archive.sha256))
-        refuse("invalid_archive_identity");
-    if (bytes.byteLength !== archive.bytes)
-        refuse("archive_size_mismatch");
-    if (sha256(bytes) !== archive.sha256)
-        refuse("archive_digest_mismatch");
-}

package/dist/services/release-payload.js

@@ -1,114 +0,0 @@
-import { TextDecoder } from "node:util";
-import { valid } from "semver";
-import { Ajv2020 } from "ajv/dist/2020.js";
-import { AppError } from "../shared/errors.js";
-import { inspectReleaseArchive } from "./release-archive.js";
-const decoder = new TextDecoder("utf-8", { fatal: true });
-function refuse(reason) {
-    throw new AppError("release_integrity", "Release payload cannot be admitted", 1, { reason, phase: "payload_validation", effect: "no_effect", help: "setup" });
-}
-function root(entries, kind) {
-    const roots = new Set(entries.map(entry => entry.path.split("/")[0]));
-    if (roots.size !== 1)
-        refuse(`${kind}_payload_root_ambiguous`);
-    const selected = [...roots][0];
-    if (kind === "engine" && selected !== "package")
-        refuse("engine_payload_root_invalid");
-    if (entries.some(entry => entry.kind === "file" && entry.path === selected))
-        refuse(`${kind}_payload_root_invalid`);
-    return selected;
-}
-function text(entries, file) {
-    const entry = entries.find(candidate => candidate.path === file);
-    if (!entry || entry.kind !== "file")
-        refuse("payload_metadata_missing");
-    // Metadata is bounded separately from the expanded archive and never executed.
-    if (entry.bytes.length > 1024 * 1024)
-        refuse("payload_metadata_oversized");
-    try {
-        return decoder.decode(entry.bytes);
-    }
-    catch {
-        return refuse("payload_metadata_invalid_utf8");
-    }
-}
-function json(entries, file) {
-    let value;
-    try {
-        value = JSON.parse(text(entries, file));
-    }
-    catch (error) {
-        if (error instanceof AppError)
-            throw error;
-        return refuse("engine_payload_package_invalid");
-    }
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        refuse("engine_payload_package_invalid");
-    return value;
-}
-function validateCanonLayout(entries, archiveRoot) {
-    const markers = ["dd-flow/README.md", "mbb/index.md", "protocol/index.md"];
-    const candidates = [archiveRoot, `${archiveRoot}/.memory-bank`];
-    const present = (file) => entries.some(entry => entry.path === file && entry.kind === "file" && entry.bytes.length > 0);
-    const layouts = candidates.filter(candidate => markers.every(marker => present(`${candidate}/${marker}`)));
-    if (layouts.length !== 1)
-        refuse(layouts.length ? "canon_payload_layout_ambiguous" : "canon_payload_layout_incomplete");
-    const selected = layouts[0];
-    // Even an incomplete second layout can shadow files during later resolution.
-    if (candidates.some(candidate => candidate !== selected && markers.some(marker => present(`${candidate}/${marker}`))))
-        refuse("canon_payload_layout_ambiguous");
-}
-/** Check package identity from transferred bytes before creating the installation home.
- * This is not catalog/schema or runtime qualification; those require their own evidence.
- */
-export function validateReleasePayloadIdentity(manifest, canon, engine) {
-    const canonEntries = inspectReleaseArchive(manifest.canon.archive, canon);
-    const engineEntries = inspectReleaseArchive(manifest.engine.archive, engine);
-    const canonRoot = root(canonEntries, "canon"), engineRoot = root(engineEntries, "engine");
-    if (text(canonEntries, `${canonRoot}/VERSION`).trim() !== manifest.canon.version)
-        refuse("canon_payload_version_mismatch");
-    validateCanonLayout(canonEntries, canonRoot);
-    const metadata = json(engineEntries, `${engineRoot}/package.json`);
-    if (metadata.name !== manifest.engine.package)
-        refuse("engine_payload_package_mismatch");
-    if (metadata.version !== manifest.engine.version)
-        refuse("engine_payload_version_mismatch");
-    if (metadata.type !== "module")
-        refuse("engine_payload_module_type_invalid");
-    const bins = metadata.bin;
-    if (!bins || typeof bins !== "object" || Array.isArray(bins)
-        || bins["dd-flow"] !== "dist/cli.js")
-        refuse("engine_payload_bin_invalid");
-    for (const target of Object.values(bins)) {
-        if (typeof target !== "string" || !/^dist\/[A-Za-z0-9_./-]+$/.test(target)
-            || target.split("/").some(part => !part || part === "." || part === ".."))
-            refuse("engine_payload_bin_invalid");
-        const executable = engineEntries.find(entry => entry.path === `${engineRoot}/${target}`);
-        if (!executable || executable.kind !== "file" || executable.bytes.length === 0 || !(executable.mode & 0o111))
-            refuse("engine_payload_bin_missing");
-    }
-    const build = json(engineEntries, `${engineRoot}/dist/build-info.json`);
-    if (build.cli_package !== manifest.engine.package || build.cli_version !== manifest.engine.version
-        || typeof build.cli_commit !== "string" || !/^[a-f0-9]{40}$/.test(build.cli_commit))
-        refuse("engine_payload_build_identity_mismatch");
-    const canonBuild = build.built_with_canon;
-    // Build provenance is not the installed canon selection. One immutable engine
-    // can serve multiple independently qualified canon tuples without being rebuilt.
-    if (!canonBuild || typeof canonBuild !== "object" || Array.isArray(canonBuild)
-        || typeof canonBuild.version !== "string" || !valid(canonBuild.version)
-        || typeof canonBuild.commit !== "string" || !/^[a-f0-9]{40}$/.test(canonBuild.commit))
-        refuse("engine_payload_canon_provenance_invalid");
-    const schemaFiles = { descriptor: "flow-descriptor", execution: "execution-settings", bundle: "execution-bundle" };
-    for (const family of ["descriptor", "execution", "bundle"]) {
-        const schema = json(engineEntries, `${engineRoot}/dist/schemas/${schemaFiles[family]}.schema.json`);
-        if (schema.$id !== manifest.schema_versions[family]
-            || schema.$schema !== "https://json-schema.org/draft/2020-12/schema")
-            refuse("engine_payload_schema_identity_mismatch");
-        try {
-            new Ajv2020({ strict: true, validateFormats: false }).compile(schema);
-        }
-        catch {
-            return refuse("engine_payload_schema_invalid");
-        }
-    }
-}

package/dist/services/release-producer.js

@@ -1,63 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { createPublicKey, randomUUID } from "node:crypto";
-import { AppError } from "../shared/errors.js";
-import { hybridDigest } from "./hybrid-contracts.js";
-import { acquireInstallationLock } from "./installation-lock.js";
-import { authenticateReleaseEnvelope, produceReleaseEnvelope, releaseProducerKeyId } from "./release-envelope.js";
-import { readLocalReleaseBundle } from "./release-source.js";
-import { validateReleasePayloadIdentity } from "./release-payload.js";
-function refuse(reason) {
-    throw new AppError("release_producer", "Release bundle cannot be published", 1, { reason, phase: "release_production", effect: "no_effect" });
-}
-/** Local immutable delivery only. Qualification facts must already come from their
- * owner ledger; this producer never performs, synthesizes or upgrades qualification.
- */
-export function publishReleaseBundle(destination, input) {
-    if (!input.payload || typeof input.payload !== "object" || !input.payload.source
-        || typeof input.payload.source.repository !== "string")
-        refuse("invalid_producer_payload");
-    const envelope = produceReleaseEnvelope(input.payload, input.privateKey, input.compatibility);
-    const publicKey = createPublicKey(input.privateKey), producers = new Map([[releaseProducerKeyId(publicKey), {
-                publicKey, repository: input.payload.source.repository, channels: new Set([input.compatibility.channel])
-            }]]);
-    const admitted = authenticateReleaseEnvelope(envelope, producers, input.compatibility);
-    validateReleasePayloadIdentity(admitted.manifest, input.canonArchive, input.engineArchive);
-    const root = path.resolve(destination), parent = path.dirname(root);
-    if (root === parent || !fs.existsSync(parent) || !fs.lstatSync(parent).isDirectory())
-        refuse("invalid_output_parent");
-    const envelopeBytes = Buffer.from(JSON.stringify(envelope));
-    const lease = acquireInstallationLock(`${root}.lock`, hybridDigest({ envelope, canon: admitted.manifest.canon.archive, engine: admitted.manifest.engine.archive }));
-    let staging = null;
-    try {
-        if (fs.existsSync(root)) {
-            const retained = readLocalReleaseBundle(root, producers, input.compatibility);
-            if (fs.readdirSync(root).sort().join("/") !== "canon.tgz/engine.tgz/release-envelope.json"
-                || !fs.readFileSync(path.join(root, "release-envelope.json")).equals(envelopeBytes)
-                || !retained.canonArchive.equals(input.canonArchive) || !retained.engineArchive.equals(input.engineArchive))
-                refuse("immutable_bundle_conflict");
-            return { root, replayed: true, producer_key_id: envelope.producer_key_id };
-        }
-        staging = path.join(parent, `.release-staging-${randomUUID()}`);
-        fs.mkdirSync(staging, { mode: 0o700 });
-        for (const [name, bytes] of [["release-envelope.json", envelopeBytes], ["canon.tgz", input.canonArchive], ["engine.tgz", input.engineArchive]]) {
-            const fd = fs.openSync(path.join(staging, name), "wx", 0o600);
-            try {
-                fs.writeFileSync(fd, bytes);
-                fs.fsyncSync(fd);
-            }
-            finally {
-                fs.closeSync(fd);
-            }
-        }
-        readLocalReleaseBundle(staging, producers, input.compatibility);
-        fs.renameSync(staging, root);
-        staging = null;
-        return { root, replayed: false, producer_key_id: envelope.producer_key_id };
-    }
-    finally {
-        if (staging)
-            fs.rmSync(staging, { recursive: true, force: true });
-        lease.release();
-    }
-}

package/dist/services/release-provenance.js

@@ -1,160 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { AppError } from "../shared/errors.js";
-import { readBoundedReleaseFile } from "./release-source.js";
-import { inspectReleaseArchive } from "./release-archive.js";
-import { produceReleaseArchive } from "./release-archive-producer.js";
-function refuse(reason) {
-    throw new AppError("release_provenance", "Producer source provenance cannot be verified", 1, { reason, phase: "release_production", effect: "no_effect" });
-}
-function gitBytes(directory, args, maxBuffer = 1024 * 1024, input) {
-    const env = { ...process.env, GIT_OPTIONAL_LOCKS: "0", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null" };
-    for (const name of Object.keys(env))
-        if (name.startsWith("GIT_") && !["GIT_OPTIONAL_LOCKS", "GIT_CONFIG_NOSYSTEM", "GIT_CONFIG_GLOBAL"].includes(name))
-            delete env[name];
-    const result = spawnSync("git", ["-c", "core.fsmonitor=false", "-c", "core.untrackedCache=false", ...args], {
-        cwd: directory, env, timeout: 10_000, maxBuffer, input
-    });
-    if (result.status !== 0 || result.error)
-        refuse("git_source_unavailable");
-    return result.stdout;
-}
-/** Read-only source/tag verification. No fetch, tag creation, commit or cleanup. */
-export function verifyProducerSource(root, source, version) {
-    if (!source || !/^[a-f0-9]{40}$/.test(source.commit) || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(source.repository)
-        || !/^[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?$/.test(version)
-        || (source.kind !== "source_checkout" && source.kind !== "published_release")
-        || (source.kind === "source_checkout" ? source.tag !== null : source.tag !== `v${version}`))
-        refuse("invalid_source_identity");
-    let directory;
-    try {
-        directory = fs.realpathSync(root);
-    }
-    catch {
-        return refuse("source_unavailable");
-    }
-    const git = (args) => gitBytes(directory, args).toString("utf8").trim();
-    const top = git(["rev-parse", "--show-toplevel"]);
-    try {
-        if (fs.realpathSync(top) !== directory)
-            refuse("source_root_mismatch");
-    }
-    catch (error) {
-        if (error instanceof AppError)
-            throw error;
-        return refuse("source_root_mismatch");
-    }
-    const origin = git(["remote", "get-url", "origin"]);
-    if (![`https://github.com/${source.repository}`, `https://github.com/${source.repository}.git`, `git@github.com:${source.repository}.git`, `ssh://git@github.com/${source.repository}.git`].includes(origin))
-        refuse("source_repository_mismatch");
-    if (git(["status", "--porcelain", "--untracked-files=all"]))
-        refuse("source_not_clean");
-    const commit = git(["rev-parse", "HEAD"]), tree = git(["rev-parse", "HEAD^{tree}"]);
-    if (commit !== source.commit)
-        refuse("source_commit_mismatch");
-    if (readBoundedReleaseFile(path.join(directory, "VERSION"), 1024).toString("utf8").trim() !== version)
-        refuse("source_version_mismatch");
-    if (source.tag && git(["rev-parse", "--verify", `refs/tags/${source.tag}^{commit}`]) !== commit)
-        refuse("source_tag_mismatch");
-    return { commit, tree, version };
-}
-/** Exact committed release tree, with only the four canon directory aliases
- * materialized as regular files. No mutable worktree reads or export filters.
- */
-function committedBlobs(root, commit) {
-    if (!/^[a-f0-9]{40}$/.test(commit))
-        refuse("invalid_source_identity");
-    const blobs = new Map();
-    const links = [];
-    const listing = gitBytes(root, ["ls-tree", "-rz", "--full-tree", commit], 16 * 1024 * 1024).toString("utf8");
-    for (const record of listing.split("\0").filter(Boolean)) {
-        const match = /^(100644|100755|120000) blob ([a-f0-9]{40})\t(.+)$/.exec(record);
-        if (!match)
-            refuse("unsupported_committed_tree_entry");
-        const mode = match[1], hash = match[2], name = match[3];
-        if (mode === "120000")
-            links.push({ name, hash });
-        else
-            blobs.set(name, { hash, executable: mode === "100755" });
-    }
-    const aliases = { code: "mb-sdlc/code", plan: "mb-sdlc/plan", merge: "mb-sdlc/merge", specify: "mb-sdlc/specify" };
-    for (const link of links) {
-        const match = /^(\.memory-bank\/)?dd-flow\/(code|plan|merge|specify)$/.exec(link.name);
-        if (!match)
-            refuse("unreviewed_committed_alias");
-        const target = gitBytes(root, ["cat-file", "blob", link.hash]).toString("utf8");
-        if (target !== aliases[match[2]])
-            refuse("unreviewed_committed_alias");
-        const targetPrefix = `${path.posix.dirname(link.name)}/${target}/`;
-        const children = [...blobs].filter(([name]) => name.startsWith(targetPrefix));
-        if (!children.length)
-            refuse("empty_committed_alias");
-        for (const [name, blob] of children) {
-            const alias = `${link.name}/${name.slice(targetPrefix.length)}`;
-            if (blobs.has(alias))
-                refuse("committed_alias_collision");
-            blobs.set(alias, blob);
-        }
-    }
-    return blobs;
-}
-export function verifyCanonArchiveSource(root, commit, identity, compressed) {
-    const blobs = committedBlobs(root, commit), entries = inspectReleaseArchive(identity, compressed);
-    const roots = new Set(entries.map(entry => entry.path.split("/")[0]));
-    if (roots.size !== 1)
-        refuse("canon_archive_root_ambiguous");
-    const prefix = `${[...roots][0]}/`;
-    const directories = new Set();
-    for (const name of blobs.keys()) {
-        const parts = name.split("/");
-        for (let index = 1; index < parts.length; index++)
-            directories.add(parts.slice(0, index).join("/"));
-    }
-    const seen = new Set();
-    for (const entry of entries) {
-        if (entry.path === prefix.slice(0, -1) && entry.kind === "directory")
-            continue;
-        const name = entry.path.slice(prefix.length);
-        if (entry.kind === "directory") {
-            if (!directories.has(name))
-                refuse("canon_archive_extra_entry");
-            continue;
-        }
-        const blob = blobs.get(name);
-        if (!blob)
-            refuse("canon_archive_extra_entry");
-        const hash = createHash("sha1").update(`blob ${entry.bytes.length}\0`).update(entry.bytes).digest("hex");
-        if (hash !== blob.hash || Boolean(entry.mode & 0o111) !== blob.executable)
-            refuse("canon_archive_blob_mismatch");
-        seen.add(name);
-    }
-    if (seen.size !== blobs.size)
-        refuse("canon_archive_missing_entry");
-}
-/** Produce from immutable Git objects in one bounded batch, not worktree files. */
-export function produceCanonArchive(root, commit) {
-    const blobs = committedBlobs(root, commit), hashes = [...new Set([...blobs.values()].map(blob => blob.hash))];
-    const batch = gitBytes(root, ["cat-file", "--batch"], 512 * 1024 * 1024, Buffer.from(hashes.join("\n") + "\n"));
-    const contents = new Map();
-    let offset = 0;
-    for (const hash of hashes) {
-        const newline = batch.indexOf(10, offset);
-        if (newline < 0)
-            refuse("invalid_git_blob_batch");
-        const match = /^([a-f0-9]{40}) blob ([0-9]+)$/.exec(batch.subarray(offset, newline).toString("ascii"));
-        if (!match || match[1] !== hash)
-            refuse("invalid_git_blob_batch");
-        const size = Number(match[2]), end = newline + 1 + size;
-        if (!Number.isSafeInteger(size) || end >= batch.length || batch[end] !== 10)
-            refuse("invalid_git_blob_batch");
-        contents.set(hash, batch.subarray(newline + 1, end));
-        offset = end + 1;
-    }
-    if (offset !== batch.length)
-        refuse("invalid_git_blob_batch");
-    const bytes = produceReleaseArchive([...blobs].map(([name, blob]) => ({ path: `canon/${name}`, bytes: contents.get(blob.hash), executable: blob.executable })));
-    verifyCanonArchiveSource(root, commit, { url: "https://producer.invalid/canon.tgz", bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") }, bytes);
-    return bytes;
-}

package/dist/services/release-registry.js

@@ -1,66 +0,0 @@
-import { valid, prerelease } from "semver";
-import { AppError } from "../shared/errors.js";
-import { readBoundedReleaseFile } from "./release-source.js";
-function refuse(reason) {
-    throw new AppError("release_registry", "Release selection cannot be resolved", 1, { reason, phase: "release_selection", effect: "no_effect", help: "setup" });
-}
-function object(value, keys, required = keys) {
-    if (!value || typeof value !== "object" || Array.isArray(value)
-        || required.some(key => !Object.hasOwn(value, key))
-        || Object.keys(value).some(key => !keys.includes(key)))
-        refuse("invalid_registry_shape");
-    return value;
-}
-/** Operator registry is a selector, not signing authority or qualification evidence. */
-export function selectRegistryRelease(input, channel, version) {
-    if (!["stable", "preview", "development"].includes(channel))
-        refuse("invalid_selected_channel");
-    const registry = object(input, ["schema_id", "releases", "defaults"]);
-    if (registry.schema_id !== "dd-flow/release-registry@1" || !Array.isArray(registry.releases)
-        || registry.releases.length < 1 || registry.releases.length > 10_000)
-        refuse("invalid_registry_shape");
-    const defaults = object(registry.defaults, ["stable", "preview", "development"], []);
-    const entries = new Map();
-    for (const value of registry.releases) {
-        const entry = object(value, ["channel", "version", "envelope_url"]);
-        if (!["stable", "preview", "development"].includes(String(entry.channel))
-            || typeof entry.version !== "string" || valid(entry.version) !== entry.version
-            || (entry.channel === "stable" && prerelease(entry.version)) || typeof entry.envelope_url !== "string")
-            refuse("invalid_registry_entry");
-        let url;
-        try {
-            url = new URL(entry.envelope_url);
-        }
-        catch {
-            return refuse("invalid_registry_url");
-        }
-        if (url.protocol !== "https:" || url.username || url.password || url.hash || (url.port && url.port !== "443"))
-            refuse("invalid_registry_url");
-        const key = `${entry.channel}/${entry.version}`;
-        if (entries.has(key))
-            refuse("duplicate_registry_selection");
-        entries.set(key, { channel: entry.channel, version: entry.version, envelope_url: entry.envelope_url });
-    }
-    for (const [key, selected] of Object.entries(defaults)) {
-        if (typeof selected !== "string" || !entries.has(`${key}/${selected}`))
-            refuse("invalid_registry_default");
-    }
-    const selected = version ?? defaults[channel];
-    if (typeof selected !== "string" || valid(selected) !== selected)
-        refuse("missing_or_invalid_release_version");
-    const entry = entries.get(`${channel}/${selected}`);
-    if (!entry)
-        refuse("release_not_in_selected_channel");
-    return { ...entry };
-}
-export function readRegistryRelease(file, channel, version) {
-    const bytes = readBoundedReleaseFile(file, 4 * 1024 * 1024);
-    let input;
-    try {
-        input = JSON.parse(bytes.toString("utf8"));
-    }
-    catch {
-        return refuse("invalid_registry_json");
-    }
-    return selectRegistryRelease(input, channel, version);
-}