@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/preset/workspace-files-ci-acceptance.js

@@ -0,0 +1,791 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderWorkspaceCiAcceptanceFiles = renderWorkspaceCiAcceptanceFiles;
+function renderWorkspaceCiAcceptanceFiles() {
+    return {
+        'tools/ci/workspace-acceptance.mjs': `import {
+  appendFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  writeFileSync,
+} from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { inflateRawSync } from 'node:zlib';
+
+const WORKFLOW = '.github/workflows/ci.yml';
+const KIND = 'ebk-workspace-protected-route-acceptance';
+const SCHEMA_VERSION = 2;
+const MAX_ARCHIVE_BYTES = 1024 * 1024;
+const MAX_MANIFEST_BYTES = 256 * 1024;
+const ROUTES = Object.freeze({
+  'protected-develop-promotion': Object.freeze({
+    base: 'main',
+    head: 'develop',
+    historyOnly: false,
+  }),
+  'protected-main-sync': Object.freeze({
+    base: 'develop',
+    head: 'main',
+    historyOnly: true,
+  }),
+});
+const INPUTS = Object.freeze([
+  WORKFLOW,
+  '.node-version',
+  'ebk.repository-policy.json',
+  'package.json',
+  'pnpm-lock.yaml',
+  'supply-chain/blueprint-trust-policy.json',
+  'supply-chain/blueprint-trust-snapshot.json',
+]);
+
+function sha256(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+function artifactDigest(value) {
+  if (typeof value !== 'string' || !/^sha256:[a-f0-9]{64}$/u.test(value)) {
+    throw new Error('Workspace acceptance artifact digest is invalid.');
+  }
+  return value;
+}
+
+function artifactSize(value) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > MAX_ARCHIVE_BYTES) {
+    throw new Error('Workspace acceptance artifact size is invalid.');
+  }
+  return value;
+}
+
+function artifactId(value) {
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new Error('Workspace acceptance artifact identity is invalid.');
+  }
+  return String(value);
+}
+
+function file(root, relative, limit = 16 * 1024 * 1024) {
+  const absolute = path.join(root, relative);
+  const entry = lstatSync(absolute);
+  if (
+    entry.isSymbolicLink() ||
+    !entry.isFile() ||
+    entry.size < 1 ||
+    entry.size > limit
+  ) {
+    throw new Error(\`Workspace acceptance input is invalid: \${relative}\`);
+  }
+  return readFileSync(absolute);
+}
+
+function git(root, args) {
+  const result = spawnSync('git', ['-C', root, ...args], {
+    encoding: 'utf8',
+    shell: false,
+    windowsHide: true,
+  });
+  if (result.error || result.status !== 0) {
+    throw new Error(
+      \`Workspace acceptance git failed: \${result.stderr || result.error?.message}\`,
+    );
+  }
+  return result.stdout.trim();
+}
+
+function rootIdentity(requested) {
+  const root = realpathSync(requested);
+  if (root !== path.resolve(requested) || !lstatSync(root).isDirectory()) {
+    throw new Error('Workspace acceptance root is not canonical.');
+  }
+  const commit = git(root, ['rev-parse', 'HEAD']);
+  const tree = git(root, ['rev-parse', 'HEAD^{tree}']);
+  if (
+    !/^[a-f0-9]{40}$/u.test(commit) ||
+    !/^[a-f0-9]{40}$/u.test(tree) ||
+    git(root, ['status', '--porcelain=v1', '--untracked-files=no'])
+  ) {
+    throw new Error('Workspace acceptance source is invalid or dirty.');
+  }
+  return { root, source: { commit, tree } };
+}
+
+function digests(root) {
+  return Object.fromEntries(
+    INPUTS.map((relative) => [relative, sha256(file(root, relative))]),
+  );
+}
+
+function integer(value, label) {
+  if (typeof value !== 'string' || !/^[1-9]\\d{0,19}$/u.test(value)) {
+    throw new Error(\`Workspace acceptance \${label} is invalid.\`);
+  }
+  return value;
+}
+
+function commit(value, label) {
+  if (typeof value !== 'string' || !/^[a-f0-9]{40}$/u.test(value)) {
+    throw new Error(\`Workspace acceptance \${label} commit is invalid.\`);
+  }
+  return value;
+}
+
+function repository(value) {
+  if (
+    typeof value !== 'string' ||
+    value.length > 200 ||
+    !/^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/u.test(value)
+  ) {
+    throw new Error('Workspace acceptance repository is invalid.');
+  }
+  return value;
+}
+
+// GitHub resolves pull_request workflows through an ephemeral merge ref. The
+// workflow bytes and exact source tree are bound independently in the sealed
+// manifest, while this check binds the observable GitHub route.
+function isPullRequestWorkflowRef(value, expectedRepository) {
+  const prefix = \`\${expectedRepository}/\${WORKFLOW}@refs/pull/\`;
+  return (
+    typeof value === 'string' &&
+    value.startsWith(prefix) &&
+    /^[1-9]\\d{0,9}\\/merge$/u.test(value.slice(prefix.length))
+  );
+}
+
+function routeDefinition(value) {
+  if (typeof value !== 'string' || !Object.hasOwn(ROUTES, value)) {
+    throw new Error('Workspace acceptance route is invalid.');
+  }
+  return ROUTES[value];
+}
+
+function routeForBranches(base, head) {
+  const matches = Object.entries(ROUTES).filter(
+    ([, route]) => route.base === base && route.head === head,
+  );
+  if (matches.length !== 1) {
+    throw new Error('Workspace acceptance branch route is invalid.');
+  }
+  return { name: matches[0][0], ...matches[0][1] };
+}
+
+function routeForProtectedPush(ref) {
+  if (ref === 'refs/heads/main') {
+    return {
+      name: 'protected-develop-promotion',
+      ...ROUTES['protected-develop-promotion'],
+    };
+  }
+  if (ref === 'refs/heads/develop') {
+    return {
+      name: 'protected-main-sync',
+      ...ROUTES['protected-main-sync'],
+    };
+  }
+  throw new Error('Workspace merge lookup lacks protected branch authority.');
+}
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value !== null && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.keys(value)
+        .sort()
+        .map((key) => [key, canonical(value[key])]),
+    );
+  }
+  return value;
+}
+
+export function sealWorkspaceAcceptance({
+  environment,
+  output,
+  root: requested,
+}) {
+  const { root, source } = rootIdentity(requested);
+  const expectedRepository = repository(environment.GITHUB_REPOSITORY);
+  const runId = integer(environment.GITHUB_RUN_ID, 'run id');
+  const runAttempt = integer(environment.GITHUB_RUN_ATTEMPT, 'run attempt');
+  const route = routeForBranches(
+    environment.GITHUB_BASE_REF,
+    environment.GITHUB_HEAD_REF,
+  );
+  const baseCommit = commit(environment.EBK_BASE_COMMIT, 'base');
+  const baseTree = git(root, ['rev-parse', \`\${baseCommit}^{tree}\`]);
+  if (
+    environment.GITHUB_EVENT_NAME !== 'pull_request' ||
+    environment.EBK_HEAD_REPOSITORY !== expectedRepository ||
+    !isPullRequestWorkflowRef(
+      environment.GITHUB_WORKFLOW_REF,
+      expectedRepository,
+    ) ||
+    environment.EBK_CI_CANDIDATE_SHA !== source.commit
+  ) {
+    throw new Error('Workspace acceptance is not an exact protected route.');
+  }
+  if (existsSync(output)) {
+    throw new Error('Workspace acceptance output already exists.');
+  }
+  if (route.historyOnly && baseTree !== source.tree) {
+    return Object.freeze({
+      base: route.base,
+      head: route.head,
+      historyOnly: true,
+      reason: 'protected main sync changes protected source',
+      route: route.name,
+      sealed: false,
+    });
+  }
+  const manifest = {
+    base: route.base,
+    baseSource: { commit: baseCommit, tree: baseTree },
+    eventName: 'pull_request',
+    head: route.head,
+    headRepository: expectedRepository,
+    historyOnly: route.historyOnly,
+    inputs: digests(root),
+    kind: KIND,
+    repository: expectedRepository,
+    route: route.name,
+    runAttempt,
+    runId,
+    schemaVersion: SCHEMA_VERSION,
+    source,
+    workflow: WORKFLOW,
+  };
+  mkdirSync(path.dirname(output), { recursive: true, mode: 0o700 });
+  writeFileSync(output, \`\${JSON.stringify(manifest, null, 2)}\\n\`, {
+    encoding: 'utf8',
+    mode: 0o600,
+  });
+  return manifest;
+}
+
+export function verifyWorkspaceAcceptance({
+  baseCommit: requestedBaseCommit,
+  headCommit,
+  manifestPath,
+  repository: requestedRepository,
+  root: requested,
+  route: requestedRoute,
+  runAttempt,
+  runId,
+}) {
+  const { root, source } = rootIdentity(requested);
+  const expectedRepository = repository(requestedRepository);
+  const route = {
+    name: requestedRoute,
+    ...routeDefinition(requestedRoute),
+  };
+  runId = integer(runId, 'run id');
+  runAttempt = integer(runAttempt, 'run attempt');
+  const baseCommit = commit(requestedBaseCommit, 'base');
+  headCommit = commit(headCommit, 'head');
+  const baseTree = git(root, ['rev-parse', \`\${baseCommit}^{tree}\`]);
+  const headTree = git(root, ['rev-parse', \`\${headCommit}^{tree}\`]);
+  if (headTree !== source.tree) {
+    throw new Error(
+      'Workspace acceptance head tree differs from the merged tree.',
+    );
+  }
+  if (route.historyOnly && baseTree !== headTree) {
+    throw new Error('Workspace acceptance sync changes protected source.');
+  }
+  const manifest = JSON.parse(
+    file(
+      path.dirname(manifestPath),
+      path.basename(manifestPath),
+      256 * 1024,
+    ).toString('utf8'),
+  );
+  if (manifest?.kind !== KIND) {
+    throw new Error('Workspace acceptance kind is unsupported.');
+  }
+  if (manifest.schemaVersion !== SCHEMA_VERSION) {
+    throw new Error(
+      \`Workspace acceptance schema is unsupported; expected schema v\${SCHEMA_VERSION}.\`,
+    );
+  }
+  if (manifest.route !== route.name) {
+    throw new Error('Workspace acceptance route differs from the merged route.');
+  }
+  const expected = {
+    base: route.base,
+    baseSource: { commit: baseCommit, tree: baseTree },
+    eventName: 'pull_request',
+    head: route.head,
+    headRepository: expectedRepository,
+    historyOnly: route.historyOnly,
+    inputs: digests(root),
+    kind: KIND,
+    repository: expectedRepository,
+    route: route.name,
+    runAttempt,
+    runId,
+    schemaVersion: SCHEMA_VERSION,
+    source: { commit: headCommit, tree: headTree },
+    workflow: WORKFLOW,
+  };
+  if (
+    JSON.stringify(canonical(manifest)) !== JSON.stringify(canonical(expected))
+  ) {
+    throw new Error('Workspace acceptance differs from the merged tree.');
+  }
+  return manifest;
+}
+
+async function json(url, token, fetchImpl) {
+  const response = await fetchImpl(url, {
+    headers: {
+      Accept: 'application/vnd.github+json',
+      Authorization: \`Bearer \${token}\`,
+      'X-GitHub-Api-Version': '2022-11-28',
+    },
+  });
+  const text = await response.text();
+  if (!response.ok || text.length > 2 * 1024 * 1024) {
+    throw new Error(\`GitHub acceptance lookup failed (\${response.status}).\`);
+  }
+  return JSON.parse(text);
+}
+
+async function boundedResponseBytes(response, limit) {
+  if (!response.ok || !response.body) {
+    throw new Error(
+      \`Workspace acceptance artifact download failed (\${response.status}).\`,
+    );
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!(value instanceof Uint8Array)) {
+      throw new Error('Workspace acceptance artifact stream is invalid.');
+    }
+    total += value.byteLength;
+    if (total > limit) {
+      await reader.cancel();
+      throw new Error('Workspace acceptance artifact exceeds its byte bound.');
+    }
+    chunks.push(Buffer.from(value));
+  }
+  if (total < 1) {
+    throw new Error('Workspace acceptance artifact is empty.');
+  }
+  return Buffer.concat(chunks, total);
+}
+
+function crc32(value) {
+  let crc = 0xffffffff;
+  for (const byte of value) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) {
+      crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
+    }
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+// The acceptance upload contains exactly one manifest. Parse that bounded ZIP
+// directly so no unverified archive bytes reach a filesystem extractor.
+function acceptanceManifestFromArchive(archive) {
+  const minimumEocd = 22;
+  const minimumOffset = Math.max(0, archive.length - 65_557);
+  let eocd = -1;
+  for (
+    let offset = archive.length - minimumEocd;
+    offset >= minimumOffset;
+    offset -= 1
+  ) {
+    if (
+      archive.readUInt32LE(offset) === 0x06054b50 &&
+      offset + minimumEocd + archive.readUInt16LE(offset + 20) ===
+        archive.length
+    ) {
+      eocd = offset;
+      break;
+    }
+  }
+  if (
+    eocd < 0 ||
+    archive.readUInt16LE(eocd + 4) !== 0 ||
+    archive.readUInt16LE(eocd + 6) !== 0 ||
+    archive.readUInt16LE(eocd + 8) !== 1 ||
+    archive.readUInt16LE(eocd + 10) !== 1
+  ) {
+    throw new Error('Workspace acceptance archive shape is invalid.');
+  }
+  const centralSize = archive.readUInt32LE(eocd + 12);
+  const centralOffset = archive.readUInt32LE(eocd + 16);
+  if (
+    centralOffset + centralSize !== eocd ||
+    centralSize < 46 ||
+    archive.readUInt32LE(centralOffset) !== 0x02014b50
+  ) {
+    throw new Error('Workspace acceptance central directory is invalid.');
+  }
+  const flags = archive.readUInt16LE(centralOffset + 8);
+  const method = archive.readUInt16LE(centralOffset + 10);
+  const expectedCrc = archive.readUInt32LE(centralOffset + 16);
+  const compressedSize = archive.readUInt32LE(centralOffset + 20);
+  const manifestSize = archive.readUInt32LE(centralOffset + 24);
+  const nameSize = archive.readUInt16LE(centralOffset + 28);
+  const extraSize = archive.readUInt16LE(centralOffset + 30);
+  const commentSize = archive.readUInt16LE(centralOffset + 32);
+  const disk = archive.readUInt16LE(centralOffset + 34);
+  const madeBy = archive.readUInt16LE(centralOffset + 4);
+  const externalAttributes = archive.readUInt32LE(centralOffset + 38);
+  const localOffset = archive.readUInt32LE(centralOffset + 42);
+  const centralEnd = centralOffset + 46 + nameSize + extraSize + commentSize;
+  const name = archive
+    .subarray(centralOffset + 46, centralOffset + 46 + nameSize)
+    .toString('utf8');
+  const unixMode = madeBy >>> 8 === 3 ? externalAttributes >>> 16 : 0;
+  if (
+    centralEnd !== eocd ||
+    name !== 'manifest.json' ||
+    disk !== 0 ||
+    (flags & ~0x0808) !== 0 ||
+    (method !== 0 && method !== 8) ||
+    compressedSize < 1 ||
+    manifestSize < 1 ||
+    manifestSize > MAX_MANIFEST_BYTES ||
+    (unixMode !== 0 && (unixMode & 0o170000) !== 0o100000) ||
+    localOffset + 30 > centralOffset ||
+    archive.readUInt32LE(localOffset) !== 0x04034b50 ||
+    archive.readUInt16LE(localOffset + 6) !== flags ||
+    archive.readUInt16LE(localOffset + 8) !== method
+  ) {
+    throw new Error('Workspace acceptance archive entry is invalid.');
+  }
+  const localNameSize = archive.readUInt16LE(localOffset + 26);
+  const localExtraSize = archive.readUInt16LE(localOffset + 28);
+  const localNameStart = localOffset + 30;
+  const localNameEnd = localNameStart + localNameSize;
+  const dataStart = localNameEnd + localExtraSize;
+  const dataEnd = dataStart + compressedSize;
+  if (
+    localNameSize !== nameSize ||
+    archive.subarray(localNameStart, localNameEnd).toString('utf8') !== name ||
+    dataEnd > centralOffset
+  ) {
+    throw new Error('Workspace acceptance local archive entry is invalid.');
+  }
+  const compressed = archive.subarray(dataStart, dataEnd);
+  const manifest =
+    method === 0
+      ? Buffer.from(compressed)
+      : inflateRawSync(compressed, {
+          maxOutputLength: MAX_MANIFEST_BYTES,
+        });
+  if (manifest.length !== manifestSize || crc32(manifest) !== expectedCrc) {
+    throw new Error('Workspace acceptance manifest archive authority differs.');
+  }
+  return manifest;
+}
+
+export async function downloadWorkspaceAcceptance({
+  artifactDigest: requestedDigest,
+  artifactId: requestedId,
+  artifactSize: requestedSize,
+  environment,
+  fetchImpl = fetch,
+  output,
+}) {
+  const expectedRepository = repository(environment.GITHUB_REPOSITORY);
+  const token = environment.GH_TOKEN;
+  const id = integer(requestedId, 'artifact id');
+  const digest = artifactDigest(requestedDigest);
+  const size = Number(integer(requestedSize, 'artifact size'));
+  artifactSize(size);
+  if (typeof token !== 'string' || token.length < 1) {
+    throw new Error('Workspace acceptance download token is missing.');
+  }
+  const api = environment.GITHUB_API_URL ?? 'https://api.github.com';
+  const response = await fetchImpl(
+    \`\${api}/repos/\${expectedRepository}/actions/artifacts/\${id}/zip\`,
+    {
+      headers: {
+        Accept: 'application/vnd.github+json',
+        Authorization: \`Bearer \${token}\`,
+        'X-GitHub-Api-Version': '2022-11-28',
+      },
+      redirect: 'follow',
+    },
+  );
+  const archive = await boundedResponseBytes(response, MAX_ARCHIVE_BYTES);
+  if (archive.length !== size || \`sha256:\${sha256(archive)}\` !== digest) {
+    throw new Error(
+      'Workspace acceptance archive differs from GitHub authority.',
+    );
+  }
+  const manifest = acceptanceManifestFromArchive(archive);
+  if (existsSync(output)) {
+    throw new Error('Workspace acceptance restore output already exists.');
+  }
+  mkdirSync(output, { recursive: true, mode: 0o700 });
+  writeFileSync(path.join(output, 'manifest.json'), manifest, {
+    mode: 0o600,
+  });
+  return { digest, id, size };
+}
+
+// Declining reuse is always safe: the complete verification lane runs. Reuse
+// is claimed only when one exact protected route, the identical reviewed tree,
+// one successful workflow run, and one retained artifact all agree.
+export async function resolveWorkspaceAcceptance({
+  environment,
+  fetchImpl = fetch,
+  root: requested,
+}) {
+  const { root, source } = rootIdentity(requested);
+  const expectedRepository = repository(environment.GITHUB_REPOSITORY);
+  const token = environment.GH_TOKEN;
+  const route = routeForProtectedPush(environment.GITHUB_REF);
+  if (
+    typeof token !== 'string' ||
+    token.length < 1 ||
+    environment.GITHUB_EVENT_NAME !== 'push' ||
+    environment.GITHUB_SHA !== source.commit
+  ) {
+    throw new Error('Workspace merge lookup lacks protected-push authority.');
+  }
+  const api = environment.GITHUB_API_URL ?? 'https://api.github.com';
+  try {
+    const pulls = await json(
+      \`\${api}/repos/\${expectedRepository}/commits/\${source.commit}/pulls\`,
+      token,
+      fetchImpl,
+    );
+    const eligible = pulls.filter(
+      (pull) =>
+        pull?.merged_at &&
+        pull?.merge_commit_sha === source.commit &&
+        pull?.base?.ref === route.base &&
+        pull?.head?.ref === route.head &&
+        pull?.head?.repo?.full_name === expectedRepository,
+    );
+    if (eligible.length !== 1) {
+      return {
+        reason: \`eligible \${route.name} merges: \${eligible.length}\`,
+        reused: false,
+      };
+    }
+    const pull = eligible[0];
+    const headCommit = pull.head?.sha;
+    if (
+      typeof headCommit !== 'string' ||
+      !/^[a-f0-9]{40}$/u.test(headCommit)
+    ) {
+      return {
+        reason: 'protected-route head commit is not exact',
+        reused: false,
+      };
+    }
+    const mergeParents = git(root, [
+      'rev-list',
+      '--parents',
+      '-n',
+      '1',
+      source.commit,
+    ]).split(' ');
+    if (
+      mergeParents.length !== 3 ||
+      mergeParents[0] !== source.commit ||
+      mergeParents[2] !== headCommit
+    ) {
+      return {
+        reason: 'protected-route merge parents are not exact',
+        reused: false,
+      };
+    }
+    const baseCommit = mergeParents[1];
+    const baseTree = git(root, ['rev-parse', \`\${baseCommit}^{tree}\`]);
+    const headTree = git(root, ['rev-parse', \`\${headCommit}^{tree}\`]);
+    if (headTree !== source.tree) {
+      return {
+        reason: 'merged tree differs from the reviewed protected-route tree',
+        reused: false,
+      };
+    }
+    if (route.historyOnly && baseTree !== headTree) {
+      return {
+        reason: 'protected-main-sync changes protected source',
+        reused: false,
+      };
+    }
+    const query = new URL(
+      \`\${api}/repos/\${expectedRepository}/actions/workflows/ci.yml/runs\`,
+    );
+    query.searchParams.set('event', 'pull_request');
+    query.searchParams.set('head_sha', headCommit);
+    query.searchParams.set('status', 'success');
+    query.searchParams.set('per_page', '100');
+    const observed = await json(query.href, token, fetchImpl);
+    // GitHub may clear a completed run's associated pull_requests array after
+    // the pull request merges. The exact merged PR was already established by
+    // the commit lookup above; bind its reviewed head to the protected workflow
+    // run directly instead of relying on that unstable, redundant association.
+    const runs = observed.workflow_runs.filter(
+      (run) =>
+        run?.conclusion === 'success' &&
+        run?.event === 'pull_request' &&
+        run?.head_sha === headCommit &&
+        run?.head_branch === route.head &&
+        run?.head_repository?.full_name === expectedRepository &&
+        run?.path === WORKFLOW &&
+        Number.isSafeInteger(run.id) &&
+        Number.isSafeInteger(run.run_attempt),
+    );
+    runs.sort(
+      (left, right) =>
+        right.run_attempt - left.run_attempt || right.id - left.id,
+    );
+    for (const run of runs) {
+      const artifactName = \`workspace-acceptance-\${headCommit}-\${run.id}-\${run.run_attempt}\`;
+      const retained = await json(
+        \`\${api}/repos/\${expectedRepository}/actions/runs/\${run.id}/artifacts?per_page=100\`,
+        token,
+        fetchImpl,
+      );
+      const artifacts = Array.isArray(retained?.artifacts)
+        ? retained.artifacts.filter(
+            (artifact) =>
+              artifact?.name === artifactName && artifact?.expired === false,
+          )
+        : [];
+      if (artifacts.length === 1) {
+        const [artifact] = artifacts;
+        const id = artifactId(artifact.id);
+        const digest = artifactDigest(artifact.digest);
+        const size = String(artifactSize(artifact.size_in_bytes));
+        if (
+          artifact.archive_download_url !==
+            \`\${api}/repos/\${expectedRepository}/actions/artifacts/\${id}/zip\` ||
+          artifact.workflow_run?.id !== run.id ||
+          artifact.workflow_run?.head_sha !== headCommit
+        ) {
+          continue;
+        }
+        return {
+          artifactDigest: digest,
+          artifactId: id,
+          artifactName,
+          artifactSize: size,
+          baseCommit,
+          headCommit,
+          historyOnly: route.historyOnly,
+          reused: true,
+          route: route.name,
+          runAttempt: String(run.run_attempt),
+          runId: String(run.id),
+        };
+      }
+    }
+    return {
+      reason:
+        'no successful protected-route run retains the acceptance artifact',
+      reused: false,
+    };
+  } catch (error) {
+    return {
+      reason: \`acceptance resolution failed: \${error?.message ?? error}\`,
+      reused: false,
+    };
+  }
+}
+
+async function main(argv) {
+  const [operation, ...args] = argv;
+  if (operation === 'seal' && args.length === 1) {
+    const result = sealWorkspaceAcceptance({
+      environment: process.env,
+      output: path.resolve(args[0]),
+      root: process.cwd(),
+    });
+    const output = process.env.GITHUB_OUTPUT;
+    if (typeof output !== 'string' || !path.isAbsolute(output)) {
+      throw new Error('Workspace acceptance output authority is missing.');
+    }
+    appendFileSync(output, \`sealed=\${String(result.sealed !== false)}\\n\`, 'utf8');
+    if (result.sealed === false) {
+      console.log(
+        \`::warning title=Protected sync evidence declined::\${result.reason}; no reusable acceptance artifact was sealed.\`,
+      );
+    }
+    return;
+  }
+  if (operation === 'verify' && args.length === 6) {
+    verifyWorkspaceAcceptance({
+      baseCommit: args[2],
+      headCommit: args[1],
+      manifestPath: path.resolve(args[0]),
+      repository: process.env.GITHUB_REPOSITORY,
+      root: process.cwd(),
+      route: args[3],
+      runAttempt: args[5],
+      runId: args[4],
+    });
+    return;
+  }
+  if (operation === 'download' && args.length === 4) {
+    await downloadWorkspaceAcceptance({
+      artifactDigest: args[2],
+      artifactId: args[1],
+      artifactSize: args[3],
+      environment: process.env,
+      output: path.resolve(args[0]),
+    });
+    return;
+  }
+  if (operation === 'resolve' && args.length === 0) {
+    const result = await resolveWorkspaceAcceptance({
+      environment: process.env,
+      root: process.cwd(),
+    });
+    const output = process.env.GITHUB_OUTPUT;
+    if (typeof output !== 'string' || !path.isAbsolute(output)) {
+      throw new Error('Workspace acceptance output authority is missing.');
+    }
+    if (result.reused !== true && result.reason) {
+      console.warn(
+        \`Workspace acceptance reuse declined (\${result.reason}); the complete verification lane runs instead.\`,
+      );
+    }
+    for (const [name, value] of Object.entries({
+      artifact_digest: result.artifactDigest ?? '',
+      artifact_id: result.artifactId ?? '',
+      artifact_name: result.artifactName ?? '',
+      artifact_size: result.artifactSize ?? '',
+      base_commit: result.baseCommit ?? '',
+      head_commit: result.headCommit ?? '',
+      history_only: String(result.historyOnly === true),
+      reused: String(result.reused),
+      route: result.route ?? '',
+      run_attempt: result.runAttempt ?? '',
+      run_id: result.runId ?? '',
+    })) {
+      appendFileSync(output, \`\${name}=\${value}\\n\`, 'utf8');
+    }
+    return;
+  }
+  throw new Error(
+    'Usage: workspace-acceptance.mjs seal <manifest> | download <output> <artifact-id> <artifact-digest> <artifact-size> | verify <manifest> <head> <base> <route> <run> <attempt> | resolve',
+  );
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  await main(process.argv.slice(2));
+}
+`,
+    };
+}
+//# sourceMappingURL=workspace-files-ci-acceptance.js.map