@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/services/release-payload.js

@@ -0,0 +1,114 @@
+import { TextDecoder } from "node:util";
+import { valid } from "semver";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { AppError } from "../shared/errors.js";
+import { inspectReleaseArchive } from "./release-archive.js";
+const decoder = new TextDecoder("utf-8", { fatal: true });
+function refuse(reason) {
+    throw new AppError("release_integrity", "Release payload cannot be admitted", 1, { reason, phase: "payload_validation", effect: "no_effect", help: "setup" });
+}
+function root(entries, kind) {
+    const roots = new Set(entries.map(entry => entry.path.split("/")[0]));
+    if (roots.size !== 1)
+        refuse(`${kind}_payload_root_ambiguous`);
+    const selected = [...roots][0];
+    if (kind === "engine" && selected !== "package")
+        refuse("engine_payload_root_invalid");
+    if (entries.some(entry => entry.kind === "file" && entry.path === selected))
+        refuse(`${kind}_payload_root_invalid`);
+    return selected;
+}
+function text(entries, file) {
+    const entry = entries.find(candidate => candidate.path === file);
+    if (!entry || entry.kind !== "file")
+        refuse("payload_metadata_missing");
+    // Metadata is bounded separately from the expanded archive and never executed.
+    if (entry.bytes.length > 1024 * 1024)
+        refuse("payload_metadata_oversized");
+    try {
+        return decoder.decode(entry.bytes);
+    }
+    catch {
+        return refuse("payload_metadata_invalid_utf8");
+    }
+}
+function json(entries, file) {
+    let value;
+    try {
+        value = JSON.parse(text(entries, file));
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("engine_payload_package_invalid");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        refuse("engine_payload_package_invalid");
+    return value;
+}
+function validateCanonLayout(entries, archiveRoot) {
+    const markers = ["dd-flow/README.md", "mbb/index.md", "protocol/index.md"];
+    const candidates = [archiveRoot, `${archiveRoot}/.memory-bank`];
+    const present = (file) => entries.some(entry => entry.path === file && entry.kind === "file" && entry.bytes.length > 0);
+    const layouts = candidates.filter(candidate => markers.every(marker => present(`${candidate}/${marker}`)));
+    if (layouts.length !== 1)
+        refuse(layouts.length ? "canon_payload_layout_ambiguous" : "canon_payload_layout_incomplete");
+    const selected = layouts[0];
+    // Even an incomplete second layout can shadow files during later resolution.
+    if (candidates.some(candidate => candidate !== selected && markers.some(marker => present(`${candidate}/${marker}`))))
+        refuse("canon_payload_layout_ambiguous");
+}
+/** Check package identity from transferred bytes before creating the installation home.
+ * This is not catalog/schema or runtime qualification; those require their own evidence.
+ */
+export function validateReleasePayloadIdentity(manifest, canon, engine) {
+    const canonEntries = inspectReleaseArchive(manifest.canon.archive, canon);
+    const engineEntries = inspectReleaseArchive(manifest.engine.archive, engine);
+    const canonRoot = root(canonEntries, "canon"), engineRoot = root(engineEntries, "engine");
+    if (text(canonEntries, `${canonRoot}/VERSION`).trim() !== manifest.canon.version)
+        refuse("canon_payload_version_mismatch");
+    validateCanonLayout(canonEntries, canonRoot);
+    const metadata = json(engineEntries, `${engineRoot}/package.json`);
+    if (metadata.name !== manifest.engine.package)
+        refuse("engine_payload_package_mismatch");
+    if (metadata.version !== manifest.engine.version)
+        refuse("engine_payload_version_mismatch");
+    if (metadata.type !== "module")
+        refuse("engine_payload_module_type_invalid");
+    const bins = metadata.bin;
+    if (!bins || typeof bins !== "object" || Array.isArray(bins)
+        || bins["dd-flow"] !== "dist/cli.js")
+        refuse("engine_payload_bin_invalid");
+    for (const target of Object.values(bins)) {
+        if (typeof target !== "string" || !/^dist\/[A-Za-z0-9_./-]+$/.test(target)
+            || target.split("/").some(part => !part || part === "." || part === ".."))
+            refuse("engine_payload_bin_invalid");
+        const executable = engineEntries.find(entry => entry.path === `${engineRoot}/${target}`);
+        if (!executable || executable.kind !== "file" || executable.bytes.length === 0 || !(executable.mode & 0o111))
+            refuse("engine_payload_bin_missing");
+    }
+    const build = json(engineEntries, `${engineRoot}/dist/build-info.json`);
+    if (build.cli_package !== manifest.engine.package || build.cli_version !== manifest.engine.version
+        || typeof build.cli_commit !== "string" || !/^[a-f0-9]{40}$/.test(build.cli_commit))
+        refuse("engine_payload_build_identity_mismatch");
+    const canonBuild = build.built_with_canon;
+    // Build provenance is not the installed canon selection. One immutable engine
+    // can serve multiple independently qualified canon tuples without being rebuilt.
+    if (!canonBuild || typeof canonBuild !== "object" || Array.isArray(canonBuild)
+        || typeof canonBuild.version !== "string" || !valid(canonBuild.version)
+        || typeof canonBuild.commit !== "string" || !/^[a-f0-9]{40}$/.test(canonBuild.commit))
+        refuse("engine_payload_canon_provenance_invalid");
+    const schemaFiles = { descriptor: "flow-descriptor", execution: "execution-settings", bundle: "execution-bundle" };
+    for (const family of ["descriptor", "execution", "bundle"]) {
+        const schema = json(engineEntries, `${engineRoot}/dist/schemas/${schemaFiles[family]}.schema.json`);
+        if (schema.$id !== manifest.schema_versions[family]
+            || schema.$schema !== "https://json-schema.org/draft/2020-12/schema")
+            refuse("engine_payload_schema_identity_mismatch");
+        try {
+            new Ajv2020({ strict: true, validateFormats: false }).compile(schema);
+        }
+        catch {
+            return refuse("engine_payload_schema_invalid");
+        }
+    }
+}

package/dist/services/release-producer.js

@@ -0,0 +1,63 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createPublicKey, randomUUID } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { acquireInstallationLock } from "./installation-lock.js";
+import { authenticateReleaseEnvelope, produceReleaseEnvelope, releaseProducerKeyId } from "./release-envelope.js";
+import { readLocalReleaseBundle } from "./release-source.js";
+import { validateReleasePayloadIdentity } from "./release-payload.js";
+function refuse(reason) {
+    throw new AppError("release_producer", "Release bundle cannot be published", 1, { reason, phase: "release_production", effect: "no_effect" });
+}
+/** Local immutable delivery only. Qualification facts must already come from their
+ * owner ledger; this producer never performs, synthesizes or upgrades qualification.
+ */
+export function publishReleaseBundle(destination, input) {
+    if (!input.payload || typeof input.payload !== "object" || !input.payload.source
+        || typeof input.payload.source.repository !== "string")
+        refuse("invalid_producer_payload");
+    const envelope = produceReleaseEnvelope(input.payload, input.privateKey, input.compatibility);
+    const publicKey = createPublicKey(input.privateKey), producers = new Map([[releaseProducerKeyId(publicKey), {
+                publicKey, repository: input.payload.source.repository, channels: new Set([input.compatibility.channel])
+            }]]);
+    const admitted = authenticateReleaseEnvelope(envelope, producers, input.compatibility);
+    validateReleasePayloadIdentity(admitted.manifest, input.canonArchive, input.engineArchive);
+    const root = path.resolve(destination), parent = path.dirname(root);
+    if (root === parent || !fs.existsSync(parent) || !fs.lstatSync(parent).isDirectory())
+        refuse("invalid_output_parent");
+    const envelopeBytes = Buffer.from(JSON.stringify(envelope));
+    const lease = acquireInstallationLock(`${root}.lock`, hybridDigest({ envelope, canon: admitted.manifest.canon.archive, engine: admitted.manifest.engine.archive }));
+    let staging = null;
+    try {
+        if (fs.existsSync(root)) {
+            const retained = readLocalReleaseBundle(root, producers, input.compatibility);
+            if (fs.readdirSync(root).sort().join("/") !== "canon.tgz/engine.tgz/release-envelope.json"
+                || !fs.readFileSync(path.join(root, "release-envelope.json")).equals(envelopeBytes)
+                || !retained.canonArchive.equals(input.canonArchive) || !retained.engineArchive.equals(input.engineArchive))
+                refuse("immutable_bundle_conflict");
+            return { root, replayed: true, producer_key_id: envelope.producer_key_id };
+        }
+        staging = path.join(parent, `.release-staging-${randomUUID()}`);
+        fs.mkdirSync(staging, { mode: 0o700 });
+        for (const [name, bytes] of [["release-envelope.json", envelopeBytes], ["canon.tgz", input.canonArchive], ["engine.tgz", input.engineArchive]]) {
+            const fd = fs.openSync(path.join(staging, name), "wx", 0o600);
+            try {
+                fs.writeFileSync(fd, bytes);
+                fs.fsyncSync(fd);
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+        readLocalReleaseBundle(staging, producers, input.compatibility);
+        fs.renameSync(staging, root);
+        staging = null;
+        return { root, replayed: false, producer_key_id: envelope.producer_key_id };
+    }
+    finally {
+        if (staging)
+            fs.rmSync(staging, { recursive: true, force: true });
+        lease.release();
+    }
+}

package/dist/services/release-provenance.js

@@ -0,0 +1,160 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+import { inspectReleaseArchive } from "./release-archive.js";
+import { produceReleaseArchive } from "./release-archive-producer.js";
+function refuse(reason) {
+    throw new AppError("release_provenance", "Producer source provenance cannot be verified", 1, { reason, phase: "release_production", effect: "no_effect" });
+}
+function gitBytes(directory, args, maxBuffer = 1024 * 1024, input) {
+    const env = { ...process.env, GIT_OPTIONAL_LOCKS: "0", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null" };
+    for (const name of Object.keys(env))
+        if (name.startsWith("GIT_") && !["GIT_OPTIONAL_LOCKS", "GIT_CONFIG_NOSYSTEM", "GIT_CONFIG_GLOBAL"].includes(name))
+            delete env[name];
+    const result = spawnSync("git", ["-c", "core.fsmonitor=false", "-c", "core.untrackedCache=false", ...args], {
+        cwd: directory, env, timeout: 10_000, maxBuffer, input
+    });
+    if (result.status !== 0 || result.error)
+        refuse("git_source_unavailable");
+    return result.stdout;
+}
+/** Read-only source/tag verification. No fetch, tag creation, commit or cleanup. */
+export function verifyProducerSource(root, source, version) {
+    if (!source || !/^[a-f0-9]{40}$/.test(source.commit) || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(source.repository)
+        || !/^[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?$/.test(version)
+        || (source.kind !== "source_checkout" && source.kind !== "published_release")
+        || (source.kind === "source_checkout" ? source.tag !== null : source.tag !== `v${version}`))
+        refuse("invalid_source_identity");
+    let directory;
+    try {
+        directory = fs.realpathSync(root);
+    }
+    catch {
+        return refuse("source_unavailable");
+    }
+    const git = (args) => gitBytes(directory, args).toString("utf8").trim();
+    const top = git(["rev-parse", "--show-toplevel"]);
+    try {
+        if (fs.realpathSync(top) !== directory)
+            refuse("source_root_mismatch");
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("source_root_mismatch");
+    }
+    const origin = git(["remote", "get-url", "origin"]);
+    if (![`https://github.com/${source.repository}`, `https://github.com/${source.repository}.git`, `git@github.com:${source.repository}.git`, `ssh://git@github.com/${source.repository}.git`].includes(origin))
+        refuse("source_repository_mismatch");
+    if (git(["status", "--porcelain", "--untracked-files=all"]))
+        refuse("source_not_clean");
+    const commit = git(["rev-parse", "HEAD"]), tree = git(["rev-parse", "HEAD^{tree}"]);
+    if (commit !== source.commit)
+        refuse("source_commit_mismatch");
+    if (readBoundedReleaseFile(path.join(directory, "VERSION"), 1024).toString("utf8").trim() !== version)
+        refuse("source_version_mismatch");
+    if (source.tag && git(["rev-parse", "--verify", `refs/tags/${source.tag}^{commit}`]) !== commit)
+        refuse("source_tag_mismatch");
+    return { commit, tree, version };
+}
+/** Exact committed release tree, with only the four canon directory aliases
+ * materialized as regular files. No mutable worktree reads or export filters.
+ */
+function committedBlobs(root, commit) {
+    if (!/^[a-f0-9]{40}$/.test(commit))
+        refuse("invalid_source_identity");
+    const blobs = new Map();
+    const links = [];
+    const listing = gitBytes(root, ["ls-tree", "-rz", "--full-tree", commit], 16 * 1024 * 1024).toString("utf8");
+    for (const record of listing.split("\0").filter(Boolean)) {
+        const match = /^(100644|100755|120000) blob ([a-f0-9]{40})\t(.+)$/.exec(record);
+        if (!match)
+            refuse("unsupported_committed_tree_entry");
+        const mode = match[1], hash = match[2], name = match[3];
+        if (mode === "120000")
+            links.push({ name, hash });
+        else
+            blobs.set(name, { hash, executable: mode === "100755" });
+    }
+    const aliases = { code: "mb-sdlc/code", plan: "mb-sdlc/plan", merge: "mb-sdlc/merge", specify: "mb-sdlc/specify" };
+    for (const link of links) {
+        const match = /^(\.memory-bank\/)?dd-flow\/(code|plan|merge|specify)$/.exec(link.name);
+        if (!match)
+            refuse("unreviewed_committed_alias");
+        const target = gitBytes(root, ["cat-file", "blob", link.hash]).toString("utf8");
+        if (target !== aliases[match[2]])
+            refuse("unreviewed_committed_alias");
+        const targetPrefix = `${path.posix.dirname(link.name)}/${target}/`;
+        const children = [...blobs].filter(([name]) => name.startsWith(targetPrefix));
+        if (!children.length)
+            refuse("empty_committed_alias");
+        for (const [name, blob] of children) {
+            const alias = `${link.name}/${name.slice(targetPrefix.length)}`;
+            if (blobs.has(alias))
+                refuse("committed_alias_collision");
+            blobs.set(alias, blob);
+        }
+    }
+    return blobs;
+}
+export function verifyCanonArchiveSource(root, commit, identity, compressed) {
+    const blobs = committedBlobs(root, commit), entries = inspectReleaseArchive(identity, compressed);
+    const roots = new Set(entries.map(entry => entry.path.split("/")[0]));
+    if (roots.size !== 1)
+        refuse("canon_archive_root_ambiguous");
+    const prefix = `${[...roots][0]}/`;
+    const directories = new Set();
+    for (const name of blobs.keys()) {
+        const parts = name.split("/");
+        for (let index = 1; index < parts.length; index++)
+            directories.add(parts.slice(0, index).join("/"));
+    }
+    const seen = new Set();
+    for (const entry of entries) {
+        if (entry.path === prefix.slice(0, -1) && entry.kind === "directory")
+            continue;
+        const name = entry.path.slice(prefix.length);
+        if (entry.kind === "directory") {
+            if (!directories.has(name))
+                refuse("canon_archive_extra_entry");
+            continue;
+        }
+        const blob = blobs.get(name);
+        if (!blob)
+            refuse("canon_archive_extra_entry");
+        const hash = createHash("sha1").update(`blob ${entry.bytes.length}\0`).update(entry.bytes).digest("hex");
+        if (hash !== blob.hash || Boolean(entry.mode & 0o111) !== blob.executable)
+            refuse("canon_archive_blob_mismatch");
+        seen.add(name);
+    }
+    if (seen.size !== blobs.size)
+        refuse("canon_archive_missing_entry");
+}
+/** Produce from immutable Git objects in one bounded batch, not worktree files. */
+export function produceCanonArchive(root, commit) {
+    const blobs = committedBlobs(root, commit), hashes = [...new Set([...blobs.values()].map(blob => blob.hash))];
+    const batch = gitBytes(root, ["cat-file", "--batch"], 512 * 1024 * 1024, Buffer.from(hashes.join("\n") + "\n"));
+    const contents = new Map();
+    let offset = 0;
+    for (const hash of hashes) {
+        const newline = batch.indexOf(10, offset);
+        if (newline < 0)
+            refuse("invalid_git_blob_batch");
+        const match = /^([a-f0-9]{40}) blob ([0-9]+)$/.exec(batch.subarray(offset, newline).toString("ascii"));
+        if (!match || match[1] !== hash)
+            refuse("invalid_git_blob_batch");
+        const size = Number(match[2]), end = newline + 1 + size;
+        if (!Number.isSafeInteger(size) || end >= batch.length || batch[end] !== 10)
+            refuse("invalid_git_blob_batch");
+        contents.set(hash, batch.subarray(newline + 1, end));
+        offset = end + 1;
+    }
+    if (offset !== batch.length)
+        refuse("invalid_git_blob_batch");
+    const bytes = produceReleaseArchive([...blobs].map(([name, blob]) => ({ path: `canon/${name}`, bytes: contents.get(blob.hash), executable: blob.executable })));
+    verifyCanonArchiveSource(root, commit, { url: "https://producer.invalid/canon.tgz", bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") }, bytes);
+    return bytes;
+}

package/dist/services/release-registry.js

@@ -0,0 +1,66 @@
+import { valid, prerelease } from "semver";
+import { AppError } from "../shared/errors.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+function refuse(reason) {
+    throw new AppError("release_registry", "Release selection cannot be resolved", 1, { reason, phase: "release_selection", effect: "no_effect", help: "setup" });
+}
+function object(value, keys, required = keys) {
+    if (!value || typeof value !== "object" || Array.isArray(value)
+        || required.some(key => !Object.hasOwn(value, key))
+        || Object.keys(value).some(key => !keys.includes(key)))
+        refuse("invalid_registry_shape");
+    return value;
+}
+/** Operator registry is a selector, not signing authority or qualification evidence. */
+export function selectRegistryRelease(input, channel, version) {
+    if (!["stable", "preview", "development"].includes(channel))
+        refuse("invalid_selected_channel");
+    const registry = object(input, ["schema_id", "releases", "defaults"]);
+    if (registry.schema_id !== "dd-flow/release-registry@1" || !Array.isArray(registry.releases)
+        || registry.releases.length < 1 || registry.releases.length > 10_000)
+        refuse("invalid_registry_shape");
+    const defaults = object(registry.defaults, ["stable", "preview", "development"], []);
+    const entries = new Map();
+    for (const value of registry.releases) {
+        const entry = object(value, ["channel", "version", "envelope_url"]);
+        if (!["stable", "preview", "development"].includes(String(entry.channel))
+            || typeof entry.version !== "string" || valid(entry.version) !== entry.version
+            || (entry.channel === "stable" && prerelease(entry.version)) || typeof entry.envelope_url !== "string")
+            refuse("invalid_registry_entry");
+        let url;
+        try {
+            url = new URL(entry.envelope_url);
+        }
+        catch {
+            return refuse("invalid_registry_url");
+        }
+        if (url.protocol !== "https:" || url.username || url.password || url.hash || (url.port && url.port !== "443"))
+            refuse("invalid_registry_url");
+        const key = `${entry.channel}/${entry.version}`;
+        if (entries.has(key))
+            refuse("duplicate_registry_selection");
+        entries.set(key, { channel: entry.channel, version: entry.version, envelope_url: entry.envelope_url });
+    }
+    for (const [key, selected] of Object.entries(defaults)) {
+        if (typeof selected !== "string" || !entries.has(`${key}/${selected}`))
+            refuse("invalid_registry_default");
+    }
+    const selected = version ?? defaults[channel];
+    if (typeof selected !== "string" || valid(selected) !== selected)
+        refuse("missing_or_invalid_release_version");
+    const entry = entries.get(`${channel}/${selected}`);
+    if (!entry)
+        refuse("release_not_in_selected_channel");
+    return { ...entry };
+}
+export function readRegistryRelease(file, channel, version) {
+    const bytes = readBoundedReleaseFile(file, 4 * 1024 * 1024);
+    let input;
+    try {
+        input = JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return refuse("invalid_registry_json");
+    }
+    return selectRegistryRelease(input, channel, version);
+}

package/dist/services/release-source.js

@@ -0,0 +1,194 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createPublicKey } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { authenticateReleaseEnvelope, releaseProducerKeyId } from "./release-envelope.js";
+import { verifyReleaseArchive } from "./release-manifest.js";
+import { downloadReleaseArchive } from "./release-download.js";
+function refuse(reason) {
+    throw new AppError("release_source", "Release source cannot be read", 1, { reason, phase: "release_source", effect: "no_effect", help: "setup" });
+}
+/** Bounded regular-file reads; paths, parser excerpts and key material never enter diagnostics. */
+export function readBoundedReleaseFile(file, maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1)
+        refuse("invalid_source_limit");
+    let fd;
+    try {
+        if (!fs.lstatSync(file).isFile())
+            refuse("source_not_regular_file");
+        fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("source_unavailable");
+    }
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size < 1 || stat.size > maxBytes)
+            refuse("source_size_outside_limit");
+        const bytes = Buffer.alloc(stat.size);
+        let offset = 0;
+        while (offset < bytes.length) {
+            const received = fs.readSync(fd, bytes, offset, bytes.length - offset, offset);
+            if (!received)
+                refuse("source_changed_during_read");
+            offset += received;
+        }
+        if (fs.readSync(fd, Buffer.alloc(1), 0, 1, offset) !== 0)
+            refuse("source_changed_during_read");
+        return bytes;
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("source_unavailable");
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function json(bytes) {
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return refuse("invalid_source_json");
+    }
+}
+/** Explicit operator trust input is separate from the release bundle. No implicit key enrollment. */
+export function readTrustedReleaseProducers(file) {
+    const input = json(readBoundedReleaseFile(file, 1024 * 1024));
+    if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).length !== 2 || Object.keys(input).some(key => !["producers", "schema_id"].includes(key)))
+        refuse("invalid_trust_shape");
+    const settings = input;
+    if (settings.schema_id !== "dd-flow/release-trust@1" || !Array.isArray(settings.producers) || settings.producers.length < 1 || settings.producers.length > 100)
+        refuse("invalid_trust_shape");
+    const result = new Map();
+    for (const input of settings.producers) {
+        if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).length !== 3 || Object.keys(input).some(key => !["channels", "public_key_pem", "repository"].includes(key)))
+            refuse("invalid_producer_shape");
+        const producer = input;
+        if (typeof producer.public_key_pem !== "string" || !/^-----BEGIN PUBLIC KEY-----\r?\n[A-Za-z0-9+/=\r\n]+-----END PUBLIC KEY-----\r?\n?$/.test(producer.public_key_pem) ||
+            typeof producer.repository !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(producer.repository) ||
+            !Array.isArray(producer.channels) || producer.channels.length < 1 || producer.channels.length > 3 ||
+            producer.channels.some(channel => !["stable", "preview", "development"].includes(channel)) || new Set(producer.channels).size !== producer.channels.length)
+            refuse("invalid_producer_scope");
+        try {
+            const publicKey = createPublicKey(producer.public_key_pem), id = releaseProducerKeyId(publicKey);
+            if (result.has(id))
+                refuse("duplicate_producer_key");
+            result.set(id, { publicKey, repository: producer.repository, channels: new Set(producer.channels) });
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return refuse("invalid_producer_key");
+        }
+    }
+    return result;
+}
+/** Authenticate metadata before reading archives; all integrity checks precede installation writes. */
+export function readLocalReleaseBundle(root, producers, compatibility) {
+    try {
+        if (!fs.lstatSync(root).isDirectory())
+            refuse("source_not_directory");
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("source_unavailable");
+    }
+    const envelope = json(readBoundedReleaseFile(path.join(root, "release-envelope.json"), 24 * 1024 * 1024));
+    const authenticated = authenticateReleaseEnvelope(envelope, producers, compatibility);
+    const canonArchive = readBoundedReleaseFile(path.join(root, "canon.tgz"), Math.min(authenticated.manifest.canon.archive.bytes, 256 * 1024 * 1024));
+    const engineArchive = readBoundedReleaseFile(path.join(root, "engine.tgz"), Math.min(authenticated.manifest.engine.archive.bytes, 256 * 1024 * 1024));
+    verifyReleaseArchive(authenticated.manifest.canon.archive, canonArchive);
+    verifyReleaseArchive(authenticated.manifest.engine.archive, engineArchive);
+    return { envelope, authenticated, canonArchive, engineArchive };
+}
+function remoteUrl(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        return refuse("invalid_remote_source");
+    }
+    // The explicit source selects a transport origin, never a signing key.
+    if (url.protocol !== "https:" || url.username || url.password || url.hash || (url.port && url.port !== "443"))
+        refuse("unsafe_remote_source");
+    return url;
+}
+/** Remote metadata is untrusted until signature verification; archives are fetched only afterward.
+ * Redirects, cross-origin artifacts and implicit credential forwarding are never admitted.
+ */
+export async function readRemoteReleaseBundle(source, producers, compatibility, options = {}) {
+    const url = remoteUrl(source), timeoutMs = options.timeoutMs ?? 60_000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60_000)
+        refuse("invalid_source_timeout");
+    const fetcher = options.fetch ?? globalThis.fetch;
+    let response;
+    try {
+        response = await fetcher(url, { redirect: "error", signal: AbortSignal.timeout(timeoutMs), credentials: "omit" });
+    }
+    catch {
+        return refuse("remote_source_unavailable_or_redirect");
+    }
+    if (!response.ok || !response.body) {
+        await response.body?.cancel();
+        return refuse("remote_source_http_failure");
+    }
+    const maxBytes = 24 * 1024 * 1024, length = response.headers.get("content-length");
+    if (length !== null && (!/^[0-9]+$/.test(length) || Number(length) < 1 || Number(length) > maxBytes)) {
+        await response.body.cancel();
+        return refuse("remote_source_size_outside_limit");
+    }
+    const reader = response.body.getReader(), chunks = [];
+    let received = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            received += value.byteLength;
+            if (received > maxBytes) {
+                await reader.cancel();
+                return refuse("remote_source_size_outside_limit");
+            }
+            chunks.push(Buffer.from(value));
+        }
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("remote_source_interrupted");
+    }
+    finally {
+        reader.releaseLock();
+    }
+    if (!received || (length !== null && Number(length) !== received))
+        refuse("remote_source_length_mismatch");
+    const envelope = json(Buffer.concat(chunks, received));
+    const authenticated = authenticateReleaseEnvelope(envelope, producers, compatibility);
+    if (options.expectedVersion !== undefined && authenticated.manifest.version !== options.expectedVersion)
+        refuse("selected_version_mismatch");
+    for (const artifact of [authenticated.manifest.canon.archive, authenticated.manifest.engine.archive]) {
+        if (remoteUrl(artifact.url).origin !== url.origin)
+            refuse("cross_origin_artifact_refused");
+    }
+    const archives = [];
+    for (const artifact of ["canon", "engine"]) {
+        archives.push(await downloadReleaseArchive(authenticated.manifest[artifact].archive, {
+            allowedHosts: new Set([url.hostname]), timeoutMs, fetch: fetcher,
+            ...(options.onProgress ? { onProgress: progress => options.onProgress({ artifact, ...progress }) } : {})
+        }));
+    }
+    return { envelope, authenticated, canonArchive: archives[0], engineArchive: archives[1] };
+}
+/** One source selector for setup/update; local bundles remain fully offline. */
+export async function readReleaseBundle(source, producers, compatibility, options = {}) {
+    if (/^https?:\/\//i.test(source))
+        return readRemoteReleaseBundle(source, producers, compatibility, options);
+    return readLocalReleaseBundle(source, producers, compatibility);
+}

package/dist/services/repair-intents.js

@@ -0,0 +1,29 @@
+import crypto from "node:crypto";
+import { stageAttempt, stageCycle, bindStageWork } from "./stage-work-graph.js";
+import { assertRunMutationAllowed } from "./run-recovery.js";
+import { AppError } from "../shared/errors.js";
+import { assertCheckDiagnosisEligible } from "./code-checks.js";
+/** Checks finish before entering this synchronous registration transaction. */
+export function ensureAggregateRepair(context, input, create) {
+    assertCheckDiagnosisEligible(input.failures);
+    const causes = input.failures.map(receipt => ({ id: receipt.id, epoch: receipt.verification_epoch, fingerprint: receipt.fingerprint_scope === "check_inputs" ? receipt.before_fingerprint : receipt.workspace_fingerprint })).sort((a, b) => a.id.localeCompare(b.id));
+    return ensureRepairIntent(context, { ...input, causes: { receipts: causes, origins: [...(input.origins ?? [])].sort() } }, create);
+}
+export function ensureRepairIntent(context, input, create) {
+    return context.db.writeTransaction(() => {
+        assertRunMutationAllowed(context, input.projectId, input.runId, input.generation);
+        const attempt = stageAttempt(context, input.projectId, input.runId, input.stage);
+        const payload = JSON.stringify({ project_id: input.projectId, run_id: input.runId, stage: input.stage, attempt, cycle: stageCycle(context, input.projectId, input.runId, input.stage), causes: input.causes });
+        const identity = crypto.createHash("sha256").update(payload).digest("hex");
+        const prior = context.db.get("SELECT work_id, payload_json FROM repair_intents WHERE identity = ?", [identity]);
+        if (prior && prior.payload_json !== payload)
+            throw new AppError("repair_intent_conflict", "Repair identity has different causes", 1);
+        const workId = prior?.work_id ?? create();
+        if (!prior) {
+            bindStageWork(context, { projectId: input.projectId, runId: input.runId, workId, stage: input.stage, attempt });
+            context.db.run("INSERT INTO repair_intents (identity, project_id, run_id, stage, attempt, payload_hash, payload_json, work_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", [identity, input.projectId, input.runId, input.stage, attempt, identity, payload, workId, context.now()]);
+        }
+        return { schema_id: "dd-flow/continuation@1", kind: "repair_required", project_id: input.projectId, run_id: input.runId, stage: input.stage, attempt, identity, work_id: workId };
+    });
+}
+export { isRegisteredRepair } from "./repair-receipt.js";

package/dist/services/repair-receipt.js

@@ -0,0 +1,13 @@
+/** Read-only receipt validation must not load repair execution on hook admission. */
+export function isRegisteredRepair(context, value, scope) {
+    if (!value || typeof value !== "object")
+        return false;
+    const receipt = value;
+    if (receipt.schema_id !== "dd-flow/continuation@1" || receipt.kind !== "repair_required")
+        return false;
+    if (scope && (receipt.project_id !== scope.projectId || receipt.run_id !== scope.runId))
+        return false;
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'repair_intents'"))
+        return false;
+    return Boolean(context.db.get("SELECT 1 FROM repair_intents i JOIN works w ON w.work_id = i.work_id AND w.project_id = i.project_id AND w.run_id = i.run_id WHERE i.identity = ? AND i.project_id = ? AND i.run_id = ? AND i.stage = ? AND i.attempt = ? AND i.work_id = ?", [receipt.identity, receipt.project_id, receipt.run_id, receipt.stage, receipt.attempt, receipt.work_id]));
+}