@deksden-com/dd-flow-cli 0.9.0-beta.15 → 0.9.0-beta.151

package/dist/services/release-archive-producer.js

@@ -0,0 +1,52 @@
+import { gzipSync } from "node:zlib";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { inspectReleaseArchive } from "./release-archive.js";
+/** Deterministic regular-file-only tar/gzip. Extraction admission is also applied
+ * to producer output; producing bytes never grants them installation authority.
+ */
+export function produceReleaseArchive(files) {
+    const refuse = () => { throw new AppError("release_producer", "Archive production refused", 1, { reason: "invalid_archive_input", effect: "no_effect" }); };
+    if (!files.length || files.length > 100_000)
+        refuse();
+    const chunks = [];
+    let expanded = 1024;
+    const append = (name, bytes, mode, type) => {
+        expanded += 512 + Math.ceil(bytes.length / 512) * 512;
+        if (expanded > 512 * 1024 * 1024)
+            refuse();
+        const header = Buffer.alloc(512);
+        header.write(name);
+        header.write(mode.toString(8).padStart(7, "0") + "\0", 100);
+        header.write("0000000\0", 108);
+        header.write("0000000\0", 116);
+        header.write(bytes.length.toString(8).padStart(11, "0") + "\0", 124);
+        header.write("00000000000\0", 136);
+        header.fill(32, 148, 156);
+        header[156] = type;
+        header.write("ustar\0", 257);
+        header.write("00", 263);
+        header.write(header.reduce((sum, byte) => sum + byte, 0).toString(8).padStart(6, "0") + "\0 ", 148);
+        chunks.push(header, bytes, Buffer.alloc((512 - bytes.length % 512) % 512));
+    };
+    let index = 0;
+    for (const file of [...files].sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)))) {
+        const length = Buffer.byteLength(file.path);
+        if (!length || length > 4096 || !Buffer.isBuffer(file.bytes) || typeof file.executable !== "boolean")
+            refuse();
+        let name = file.path;
+        if (length > 100) {
+            const record = `path=${file.path}\n`;
+            let size = Buffer.byteLength(record) + 2;
+            while (size !== Buffer.byteLength(record) + String(size).length + 1)
+                size = Buffer.byteLength(record) + String(size).length + 1;
+            append(`PaxHeaders/${index}`, Buffer.from(`${size} ${record}`), 0o644, 120);
+            name = `entries/${index}`;
+        }
+        append(name, file.bytes, file.executable ? 0o755 : 0o644, 48);
+        index++;
+    }
+    const bytes = gzipSync(Buffer.concat([...chunks, Buffer.alloc(1024)]), { level: 9 });
+    inspectReleaseArchive({ url: "https://producer.invalid/archive", bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") }, bytes);
+    return bytes;
+}

package/dist/services/release-archive.js

@@ -0,0 +1,143 @@
+import { gunzipSync } from "node:zlib";
+import { TextDecoder } from "node:util";
+import { AppError } from "../shared/errors.js";
+import { verifyReleaseArchive } from "./release-manifest.js";
+const defaultLimits = { expandedBytes: 512 * 1024 * 1024, entries: 100_000 };
+const decoder = new TextDecoder("utf-8", { fatal: true });
+function refuse(reason) {
+    throw new AppError("archive_integrity", "Release archive cannot be extracted", 1, { reason, phase: "archive_validation", effect: "no_effect", help: "setup" });
+}
+function text(bytes) {
+    try {
+        return decoder.decode(bytes);
+    }
+    catch {
+        return refuse("invalid_utf8");
+    }
+}
+function field(bytes) {
+    const zero = bytes.indexOf(0);
+    if (zero >= 0 && bytes.subarray(zero).some(byte => byte !== 0))
+        refuse("invalid_header_string");
+    return text(zero < 0 ? bytes : bytes.subarray(0, zero));
+}
+function octal(bytes) {
+    const value = text(bytes).replace(/\0.*$/, "").trim();
+    if (!/^[0-7]+$/.test(value))
+        refuse("invalid_numeric_header");
+    const result = Number.parseInt(value, 8);
+    if (!Number.isSafeInteger(result))
+        refuse("oversized_numeric_header");
+    return result;
+}
+function containedPath(input, directory) {
+    const value = directory && input.endsWith("/") ? input.slice(0, -1) : input;
+    if (!value || value !== value.normalize("NFC") || /[\\:]/.test(value) ||
+        [...value].some(character => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127))
+        refuse("unsafe_path");
+    for (const part of value.split("/")) {
+        if (!part || part === "." || part === ".." || /[. ]$/.test(part) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part))
+            refuse("unsafe_path");
+    }
+    return value;
+}
+function pax(bytes) {
+    const result = {};
+    let offset = 0;
+    while (offset < bytes.length) {
+        const space = bytes.indexOf(32, offset);
+        if (space < 0)
+            refuse("invalid_pax");
+        const lengthText = text(bytes.subarray(offset, space));
+        if (!/^[1-9][0-9]*$/.test(lengthText))
+            refuse("invalid_pax");
+        const length = Number(lengthText), end = offset + length;
+        if (!Number.isSafeInteger(length) || end > bytes.length || end <= space + 1 || bytes[end - 1] !== 10)
+            refuse("invalid_pax");
+        const record = text(bytes.subarray(space + 1, end - 1)), equal = record.indexOf("=");
+        if (equal < 1)
+            refuse("invalid_pax");
+        const key = record.slice(0, equal), value = record.slice(equal + 1);
+        if (Object.hasOwn(result, key))
+            refuse("duplicate_pax_key");
+        // Do not allow sparse files, links, custom extraction attributes or size overrides.
+        if (!["path", "mtime", "atime", "ctime", "uid", "gid", "uname", "gname"].includes(key))
+            refuse("unsupported_pax_key");
+        result[key] = value;
+        offset = end;
+    }
+    return result;
+}
+/** Validate the entire archive before writing any entry. Links and special files never enter staging. */
+export function inspectReleaseArchive(identity, compressed, limits = defaultLimits) {
+    verifyReleaseArchive(identity, compressed);
+    if (!Number.isSafeInteger(limits.expandedBytes) || limits.expandedBytes < 1024 || !Number.isSafeInteger(limits.entries) || limits.entries < 1)
+        refuse("invalid_limits");
+    let tar;
+    try {
+        tar = gunzipSync(compressed, { maxOutputLength: limits.expandedBytes });
+    }
+    catch {
+        return refuse("invalid_or_oversized_gzip");
+    }
+    if (tar.length % 512 !== 0)
+        refuse("truncated_tar");
+    const entries = [], paths = new Map(), kinds = new Map();
+    let offset = 0, headers = 0, pending = null;
+    while (offset + 512 <= tar.length) {
+        const header = tar.subarray(offset, offset + 512);
+        if (header.every(byte => byte === 0)) {
+            if (pending || offset + 1024 > tar.length || tar.subarray(offset).some(byte => byte !== 0))
+                refuse("invalid_tar_trailer");
+            return entries;
+        }
+        if (++headers > limits.entries * 2)
+            refuse("too_many_headers");
+        const checksum = header.reduce((sum, byte, index) => sum + (index >= 148 && index < 156 ? 32 : byte), 0);
+        if (octal(header.subarray(148, 156)) !== checksum)
+            refuse("header_checksum_mismatch");
+        const size = octal(header.subarray(124, 136)), mode = octal(header.subarray(100, 108));
+        const next = offset + 512 + Math.ceil(size / 512) * 512;
+        if (!Number.isSafeInteger(next) || next > tar.length)
+            refuse("truncated_entry");
+        const bytes = tar.subarray(offset + 512, offset + 512 + size);
+        const type = header[156];
+        if (type === 120) {
+            if (pending)
+                refuse("stacked_pax_headers");
+            pending = pax(bytes);
+            offset = next;
+            continue;
+        }
+        if (type !== 0 && type !== 48 && type !== 53)
+            refuse("unsupported_entry_type");
+        const directory = type === 53;
+        if (directory && size !== 0)
+            refuse("directory_has_data");
+        const prefix = field(header.subarray(345, 500));
+        const name = field(header.subarray(0, 100));
+        const entryPath = containedPath(pending?.path ?? (prefix ? `${prefix}/${name}` : name), directory);
+        pending = null;
+        const parts = entryPath.split("/");
+        for (let index = 1; index <= parts.length; index++) {
+            const partial = parts.slice(0, index).join("/"), folded = partial.toLowerCase();
+            const previous = paths.get(folded);
+            if (previous && previous !== partial)
+                refuse("case_collision");
+            paths.set(folded, partial);
+            if (index < parts.length && kinds.get(partial) === "file")
+                refuse("file_directory_collision");
+            if (index < parts.length && !kinds.has(partial))
+                kinds.set(partial, "implicit_directory");
+        }
+        const previous = kinds.get(entryPath);
+        if (previous && !(directory && previous === "implicit_directory"))
+            refuse("duplicate_or_conflicting_entry");
+        kinds.set(entryPath, directory ? "directory" : "file");
+        if (entries.length >= limits.entries)
+            refuse("too_many_entries");
+        entries.push({ path: entryPath, kind: directory ? "directory" : "file", mode: mode & 0o111 ? 0o755 : 0o644, bytes: Buffer.from(bytes) });
+        offset = next;
+    }
+    return refuse("missing_tar_trailer");
+}

package/dist/services/release-cache.js

@@ -0,0 +1,150 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { inspectReleaseArchive } from "./release-archive.js";
+import { verifyReleaseArchive } from "./release-manifest.js";
+import { acquireInstallationLock } from "./installation-lock.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { publishSetup } from "../harness-runtime/lib/setup-progress.mjs";
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+let cacheVerificationPass = 0;
+function refuse(reason) {
+    throw new AppError("cache_integrity", "Release cache cannot be published", 1, { reason, phase: "cache_publication", effect: "no_effect", help: "setup" });
+}
+function directory(target) {
+    if (fs.existsSync(target)) {
+        if (!fs.lstatSync(target).isDirectory())
+            refuse("unsafe_cache_directory");
+        return;
+    }
+    const parent = path.dirname(target);
+    if (parent !== target)
+        directory(parent);
+    fs.mkdirSync(target, { mode: 0o700 });
+}
+function write(target, bytes, mode) {
+    const fd = fs.openSync(target, "wx", mode);
+    try {
+        fs.writeFileSync(fd, bytes);
+        fs.fchmodSync(fd, mode);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function retained(target, archive, entries) {
+    const observation = `release-cache:${++cacheVerificationPass}:${target}`;
+    publishSetup("probe_started", observation);
+    if (!fs.lstatSync(target).isDirectory())
+        refuse("unsafe_retained_cache");
+    const archiveFile = path.join(target, "archive.tgz");
+    if (!fs.lstatSync(archiveFile).isFile())
+        refuse("unsafe_retained_cache");
+    if (fs.readdirSync(target).sort().join("/") !== "archive.tgz/payload/receipt.json")
+        refuse("retained_cache_changed");
+    const marker = path.join(target, "receipt.json"), payload = path.join(target, "payload");
+    if (!fs.lstatSync(marker).isFile() || fs.readFileSync(marker, "utf8") !== JSON.stringify({ sha256: archive.sha256, bytes: archive.bytes }))
+        refuse("same_version_different_bytes");
+    verifyReleaseArchive(archive, fs.readFileSync(archiveFile));
+    const expected = new Map();
+    const directories = new Set();
+    for (const entry of entries) {
+        expected.set(entry.path, entry);
+        const parts = entry.path.split("/");
+        for (let index = 1; index < parts.length; index++)
+            directories.add(parts.slice(0, index).join("/"));
+    }
+    const seen = new Set();
+    let checked = 0;
+    const visit = (root, relative) => {
+        if (!fs.lstatSync(root).isDirectory())
+            refuse("unsafe_retained_cache");
+        for (const name of fs.readdirSync(root)) {
+            const logical = relative ? `${relative}/${name}` : name, full = path.join(root, name), stat = fs.lstatSync(full);
+            const entry = expected.get(logical);
+            if (stat.isDirectory()) {
+                if (entry?.kind === "file" || (!entry && !directories.has(logical)))
+                    refuse("retained_cache_changed");
+                if (entry)
+                    seen.add(logical);
+                visit(full, logical);
+            }
+            else {
+                if (!stat.isFile() || entry?.kind !== "file" || stat.size !== entry.bytes.length || digest(fs.readFileSync(full)) !== digest(entry.bytes) || (stat.mode & 0o111) !== (entry.mode & 0o111))
+                    refuse("retained_cache_changed");
+                seen.add(logical);
+                if (++checked % 64 === 0)
+                    publishSetup("identity_digest_progress", `${observation}:${checked}`);
+            }
+        }
+    };
+    visit(payload, "");
+    if (seen.size !== entries.length)
+        refuse("retained_cache_changed");
+    publishSetup("identity_digest_completed", observation);
+}
+/** Verify retained compressed and expanded bytes without executing or activating them. */
+export function verifyPublishedReleaseCache(target, archive) {
+    if (!fs.lstatSync(target).isDirectory())
+        refuse("unsafe_retained_cache");
+    const archiveFile = path.join(target, "archive.tgz");
+    if (!fs.lstatSync(archiveFile).isFile())
+        refuse("unsafe_retained_cache");
+    retained(target, archive, inspectReleaseArchive(archive, fs.readFileSync(archiveFile)));
+}
+/** Home-only immutable publication. It never activates a version or changes RUN bindings. */
+export function publishReleaseCache(home, kind, version, archive, compressed) {
+    if (kind !== "canon" && kind !== "engine")
+        refuse("invalid_artifact_kind");
+    if (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?$/.test(version))
+        refuse("invalid_version");
+    const entries = inspectReleaseArchive(archive, compressed);
+    const parent = path.join(path.resolve(home), "release-cache", kind), target = path.join(parent, version);
+    for (const candidate of [path.resolve(home), path.join(path.resolve(home), "release-cache"), parent]) {
+        if (fs.existsSync(candidate) && !fs.lstatSync(candidate).isDirectory())
+            refuse("unsafe_cache_directory");
+    }
+    // Validate before creating even the home, including on replay.
+    if (fs.existsSync(target)) {
+        directory(parent);
+        retained(target, archive, entries);
+        return { root: target, replayed: true };
+    }
+    directory(parent);
+    const lock = `${target}.lock`;
+    const lease = acquireInstallationLock(lock, hybridDigest({ kind, version, archive }));
+    let staging = null;
+    try {
+        if (fs.existsSync(target)) {
+            retained(target, archive, entries);
+            return { root: target, replayed: true };
+        }
+        staging = path.join(parent, `.staging-${lease.token}`);
+        fs.mkdirSync(staging, { mode: 0o700 });
+        const payload = path.join(staging, "payload");
+        fs.mkdirSync(payload, { mode: 0o700 });
+        for (const entry of entries) {
+            const destination = path.join(payload, entry.path);
+            if (entry.kind === "directory")
+                directory(destination);
+            else {
+                directory(path.dirname(destination));
+                write(destination, entry.bytes, entry.mode);
+            }
+        }
+        write(path.join(staging, "receipt.json"), Buffer.from(JSON.stringify({ sha256: archive.sha256, bytes: archive.bytes })), 0o600);
+        write(path.join(staging, "archive.tgz"), compressed, 0o600);
+        retained(staging, archive, entries);
+        fs.renameSync(staging, target);
+        staging = null;
+        return { root: target, replayed: false };
+    }
+    finally {
+        // Only the unique staging directory and lock acquired by this call are owned here.
+        if (staging)
+            fs.rmSync(staging, { recursive: true, force: true });
+        lease.release();
+    }
+}

package/dist/services/release-compatibility.js

@@ -0,0 +1,18 @@
+import semver from "semver";
+import { AppError } from "../shared/errors.js";
+/** Registered catalog format revisions; these do not establish harness/model availability. */
+export const installedCatalogVersions = Object.freeze({ harness: "1.0.0", model: "1.0.0", flow: "1.0.0" });
+/** Compatibility comes from the installed consumer/catalog policy, never from release claims. */
+export function createReleaseCompatibility(policy) {
+    if (!["stable", "preview", "development"].includes(policy.channel) || !semver.valid(policy.routerVersion) ||
+        ["harness", "model", "flow"].some(family => !semver.valid(policy.catalogVersions[family]))) {
+        throw new AppError("release_compatibility", "Installed release compatibility policy is invalid", 1, { phase: "release_admission", effect: "no_effect", help: "setup" });
+    }
+    const routerVersion = policy.routerVersion;
+    return {
+        channel: policy.channel,
+        catalogVersions: { ...policy.catalogVersions },
+        routerCompatible: minimum => Boolean(semver.valid(minimum)) && semver.gte(routerVersion, minimum),
+        engineCompatible: (version, range) => Boolean(semver.valid(version) && semver.validRange(range)) && semver.satisfies(version, range)
+    };
+}

package/dist/services/release-download.js

@@ -0,0 +1,67 @@
+import { AppError } from "../shared/errors.js";
+import { verifyReleaseArchive } from "./release-manifest.js";
+function refuse(reason) {
+    throw new AppError("release_download", "Release artifact download failed", 1, { reason, phase: "artifact_download", effect: "no_effect", help: "setup" });
+}
+/** No provider login, credentials or redirect forwarding. Activation is a separate operation. */
+export async function downloadReleaseArchive(identity, options) {
+    const maxBytes = options.maxBytes ?? 256 * 1024 * 1024;
+    const timeoutMs = options.timeoutMs ?? 60_000;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 ||
+        !Number.isSafeInteger(identity.bytes) || identity.bytes < 1 || identity.bytes > maxBytes || !/^[a-f0-9]{64}$/.test(identity.sha256))
+        refuse("invalid_download_limits_or_identity");
+    let url;
+    try {
+        url = new URL(identity.url);
+    }
+    catch {
+        return refuse("invalid_artifact_url");
+    }
+    if (url.protocol !== "https:" || url.username || url.password || url.hash || (url.port && url.port !== "443") || !options.allowedHosts.has(url.hostname))
+        refuse("unapproved_artifact_origin");
+    const fetcher = options.fetch ?? globalThis.fetch;
+    let response;
+    const signal = AbortSignal.timeout(timeoutMs);
+    try {
+        response = await fetcher(url, { redirect: "error", signal, credentials: "omit" });
+    }
+    catch {
+        return refuse("network_unavailable_or_redirect");
+    }
+    if (!response.ok || !response.body) {
+        await response.body?.cancel();
+        return refuse("artifact_http_failure");
+    }
+    const length = response.headers.get("content-length");
+    if (length !== null && (!/^[0-9]+$/.test(length) || Number(length) !== identity.bytes)) {
+        await response.body.cancel();
+        return refuse("content_length_mismatch");
+    }
+    const reader = response.body.getReader(), chunks = [];
+    let received = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            received += value.byteLength;
+            if (received > identity.bytes || received > maxBytes) {
+                await reader.cancel();
+                return refuse("artifact_exceeds_declared_size");
+            }
+            chunks.push(Buffer.from(value));
+            options.onProgress?.({ received_bytes: received, expected_bytes: identity.bytes });
+        }
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("artifact_stream_interrupted");
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = Buffer.concat(chunks, received);
+    verifyReleaseArchive(identity, bytes);
+    return bytes;
+}

package/dist/services/release-envelope.js

@@ -0,0 +1,104 @@
+import { createHash, createPublicKey, sign, verify } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { admitReleaseManifest } from "./release-manifest.js";
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function refuse(reason) {
+    throw new AppError("release_authentication", "Release producer cannot be authenticated", 1, { reason, effect: "no_effect", phase: "release_authentication", help: "setup" });
+}
+function object(value, keys) {
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== keys.length ||
+        Object.keys(value).some(key => !keys.includes(key)))
+        refuse("invalid_envelope_shape");
+    return value;
+}
+function decoded(value, max = 16 * 1024 * 1024) {
+    if (typeof value !== "string" || value.length > Math.ceil(max / 3) * 4 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value))
+        refuse("invalid_encoded_bytes");
+    const bytes = Buffer.from(value, "base64");
+    if (bytes.length > max || bytes.toString("base64") !== value)
+        refuse("invalid_encoded_bytes");
+    return bytes;
+}
+function json(bytes) {
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return refuse("invalid_signed_json");
+    }
+}
+export function releaseProducerKeyId(publicKey) {
+    if (publicKey.type !== "public" || publicKey.asymmetricKeyType !== "ed25519")
+        refuse("unsupported_signing_key");
+    return digest(publicKey.export({ type: "spki", format: "der" }));
+}
+function admission(payload, compatibility, producer) {
+    const data = object(payload, ["schema_id", "manifest_base64", "source", "qualifications", "evidence"]);
+    if (data.schema_id !== "dd-flow/release-payload@1" || !Array.isArray(data.qualifications) || !Array.isArray(data.evidence) || data.qualifications.length > 10_000 || data.evidence.length > 10_000)
+        refuse("invalid_payload_shape");
+    const source = object(data.source, ["kind", "repository", "commit", "tag"]);
+    if (source.repository !== producer.repository || typeof source.commit !== "string" || !/^[a-f0-9]{40}$/.test(source.commit) ||
+        !["published_release", "source_checkout"].includes(String(source.kind)))
+        refuse("source_outside_producer_scope");
+    if (!producer.channels.has(compatibility.channel))
+        refuse("channel_outside_producer_scope");
+    const receipts = new Map();
+    const qualifiedRoutes = new Map(), evidence = new Map();
+    for (const input of data.qualifications) {
+        const fact = object(input, ["route", "sha256", "request_id", "project_root", "workspace", "canon_sha256", "engine_sha256"]);
+        if (typeof fact.route !== "string" || !/^(darwin-arm64|darwin-x64|linux-arm64|linux-x64|win32-x64)\/(codex|zcode|agy|opencode|grok|droid)\/[a-z][a-z0-9-]{0,47}\/(external|native)$/.test(fact.route) ||
+            [fact.sha256, fact.canon_sha256, fact.engine_sha256].some(value => typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) ||
+            [fact.request_id, fact.project_root, fact.workspace].some(value => typeof value !== "string" || !value.trim()))
+            refuse("invalid_qualification_fact");
+        if (qualifiedRoutes.has(fact.route))
+            refuse("duplicate_qualification_fact");
+        qualifiedRoutes.set(fact.route, fact.sha256);
+        receipts.set(fact.sha256, { kind: "route-qualification", requestId: fact.request_id, projectRoot: fact.project_root, workspace: fact.workspace });
+    }
+    for (const input of data.evidence) {
+        const item = object(input, ["path", "bytes_base64"]);
+        if (typeof item.path !== "string" || !/^[a-zA-Z0-9_-][a-zA-Z0-9_.-]*(\/[a-zA-Z0-9_-][a-zA-Z0-9_.-]*)*$/.test(item.path) || evidence.has(item.path))
+            refuse("invalid_evidence_path");
+        evidence.set(item.path, decoded(item.bytes_base64));
+    }
+    const manifestBytes = decoded(data.manifest_base64, 1024 * 1024);
+    const authority = { ...compatibility, receipts, qualifiedRoutes, evidence };
+    const manifest = admitReleaseManifest(json(manifestBytes), authority);
+    for (const input of data.qualifications) {
+        if (input.canon_sha256 !== manifest.canon.archive.sha256 || input.engine_sha256 !== manifest.engine.archive.sha256)
+            refuse("qualification_artifact_mismatch");
+    }
+    if (source.commit !== manifest.canon.commit)
+        refuse("source_commit_mismatch");
+    if (source.kind === "source_checkout") {
+        if (manifest.channel !== "development" || source.tag !== null)
+            refuse("source_cannot_claim_published_release");
+    }
+    else if (source.tag !== `v${manifest.version}` || manifest.channel === "development")
+        refuse("published_release_identity_mismatch");
+    return { manifest, manifestBytes, authority, source: source };
+}
+/** Producer receives qualification facts from its owner ledger, never manufactures them from manifest references. */
+export function produceReleaseEnvelope(payload, privateKey, compatibility) {
+    if (privateKey.type !== "private" || privateKey.asymmetricKeyType !== "ed25519")
+        refuse("unsupported_signing_key");
+    admission(payload, compatibility, { repository: payload.source.repository, channels: new Set([compatibility.channel]) });
+    const bytes = Buffer.from(JSON.stringify(payload));
+    if (bytes.length > 16 * 1024 * 1024)
+        refuse("oversized_payload");
+    return { schema_id: "dd-flow/release-envelope@1", producer_key_id: releaseProducerKeyId(createPublicKey(privateKey)),
+        payload_base64: bytes.toString("base64"), signature_base64: sign(null, bytes, privateKey).toString("base64") };
+}
+/** Trust keys and scope are selected independently; an envelope cannot nominate its own authority. */
+export function authenticateReleaseEnvelope(input, trusted, compatibility) {
+    const envelope = object(input, ["schema_id", "producer_key_id", "payload_base64", "signature_base64"]);
+    if (envelope.schema_id !== "dd-flow/release-envelope@1" || typeof envelope.producer_key_id !== "string")
+        refuse("invalid_envelope_identity");
+    const producer = trusted.get(envelope.producer_key_id);
+    if (!producer || releaseProducerKeyId(producer.publicKey) !== envelope.producer_key_id)
+        refuse("unknown_producer");
+    const bytes = decoded(envelope.payload_base64), signature = decoded(envelope.signature_base64, 64);
+    if (signature.length !== 64 || !verify(null, bytes, producer.publicKey, signature))
+        refuse("signature_mismatch");
+    return admission(json(bytes), compatibility, producer);
+}

package/dist/services/release-manifest.js

@@ -0,0 +1,45 @@
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { validateHybridContract } from "./hybrid-contracts.js";
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function refuse(reason) {
+    throw new AppError("release_integrity", "Release manifest cannot be admitted", 1, { reason, phase: "release_admission", effect: "no_effect", help: "setup" });
+}
+/** Pure admission: no download, activation, filesystem writes or qualification probes. */
+export function admitReleaseManifest(input, authority) {
+    const issues = validateHybridContract("release-manifest", input, { receipts: authority.receipts });
+    if (issues.length)
+        refuse(issues[0].code);
+    const manifest = input;
+    if (manifest.channel !== authority.channel)
+        refuse("channel_mismatch");
+    if (!authority.routerCompatible(manifest.min_router_version))
+        refuse("router_incompatible");
+    if (!authority.engineCompatible(manifest.engine.version, manifest.engine.compatible_range))
+        refuse("engine_incompatible");
+    for (const family of ["harness", "model", "flow"]) {
+        if (manifest.catalog_versions[family] !== authority.catalogVersions[family])
+            refuse("catalog_incompatible");
+    }
+    for (const route of manifest.qualified_routes) {
+        const key = [route.platform, route.harness, route.flow, route.delegation].join("/");
+        if (authority.qualifiedRoutes.get(key) !== route.evidence.sha256)
+            refuse("route_qualification_mismatch");
+    }
+    for (const reference of [manifest.impact, ...manifest.qualified_routes.map(route => route.evidence)]) {
+        const bytes = authority.evidence.get(reference.path);
+        if (!bytes || sha256(bytes) !== reference.sha256)
+            refuse("evidence_bytes_mismatch");
+    }
+    // Return a detached tuple: callers cannot mutate the submitted object after admission.
+    return structuredClone(manifest);
+}
+/** Verify the actual transferred bytes before any archive parser or cache publication. */
+export function verifyReleaseArchive(archive, bytes) {
+    if (!Number.isSafeInteger(archive.bytes) || archive.bytes < 1 || !/^[a-f0-9]{64}$/.test(archive.sha256))
+        refuse("invalid_archive_identity");
+    if (bytes.byteLength !== archive.bytes)
+        refuse("archive_size_mismatch");
+    if (sha256(bytes) !== archive.sha256)
+        refuse("archive_digest_mismatch");
+}