@evomap/evolver-core 2.0.0-beta.1 → 2.0.0-beta.3

package/dist/material/materialArchive.js

@@ -0,0 +1,466 @@
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeSync, } from 'node:fs';
+import { basename, dirname, extname, join } from 'node:path';
+import { material } from '../schema/material.js';
+import { acquireLock, releaseLock } from '../util/fileLock.js';
+export const MATERIAL_ARCHIVE_DEFAULT_KEEP_RECORDS = 1_000;
+const SEGMENT_PATTERN = /^material-(\d{16})-(\d{16})\.jsonl$/;
+export class InvalidMaterialLogError extends Error {
+    line;
+    code = 'MATERIAL_ARCHIVE_INVALID_LOG';
+    constructor(line, reason) {
+        super(`material archive refused invalid active log at line ${line}: ${reason}`);
+        this.line = line;
+        this.name = 'InvalidMaterialLogError';
+    }
+}
+export class InvalidMaterialArchiveError extends Error {
+    segment;
+    line;
+    code = 'MATERIAL_ARCHIVE_INVALID_ARCHIVE';
+    constructor(segment, line, reason) {
+        super(`material archive segment ${segment} is invalid at line ${line}: ${reason}`);
+        this.segment = segment;
+        this.line = line;
+        this.name = 'InvalidMaterialArchiveError';
+    }
+}
+export class MaterialArchiveRangeError extends Error {
+    code = 'MATERIAL_ARCHIVE_RANGE_INVALID';
+    constructor(reason) {
+        super(`material archive range is invalid: ${reason}`);
+        this.name = 'MaterialArchiveRangeError';
+    }
+}
+export class MaterialArchiveSegmentConflictError extends Error {
+    archiveId;
+    code = 'MATERIAL_ARCHIVE_SEGMENT_CONFLICT';
+    constructor(archiveId) {
+        super(`material archive segment ${archiveId} already exists with different content`);
+        this.archiveId = archiveId;
+        this.name = 'MaterialArchiveSegmentConflictError';
+    }
+}
+export class InvalidMaterialArchiveCursorError extends Error {
+    code = 'MATERIAL_ARCHIVE_CURSOR_INVALID';
+    constructor(reason) {
+        super(`material archive cursor is invalid: ${reason}`);
+        this.name = 'InvalidMaterialArchiveCursorError';
+    }
+}
+export function materialArchiveDir(path) {
+    const ext = extname(path);
+    const stem = ext.length > 0 ? basename(path, ext) : basename(path);
+    return join(dirname(path), `${stem}.archive`);
+}
+export function materialArchiveSegmentName(start, end) {
+    return `material-${String(start).padStart(16, '0')}-${String(end).padStart(16, '0')}.jsonl`;
+}
+export function planMaterialArchive(opts) {
+    const keepRecords = normalizeKeepRecords(opts.keepRecords);
+    const state = readStrictHistory(opts.path);
+    const historyRecords = state.archive.length + state.logicalActive.length;
+    const cursors = readCursorsStrict(opts.cursorPaths ?? [], historyRecords);
+    const minCursor = minimumCursor(cursors, state.archive.length);
+    const wouldArchive = archiveableCount(state, minCursor, keepRecords);
+    const start = state.archive.length;
+    const end = start + wouldArchive - 1;
+    return {
+        mode: 'preview',
+        activeRecords: state.logicalActive.length,
+        physicalActiveRecords: state.active.length,
+        archiveRecords: state.archive.length,
+        historyRecords,
+        keepRecords,
+        minCursor,
+        cursors,
+        overlapRecords: state.overlap,
+        wouldArchive,
+        retainedRecords: state.logicalActive.length - wouldArchive,
+        archiveId: wouldArchive === 0 ? null : `${start}-${end}`,
+    };
+}
+export function archiveMaterialStore(opts) {
+    const keepRecords = normalizeKeepRecords(opts.keepRecords);
+    const lockPath = `${opts.path}.lock`;
+    mkdirSync(dirname(opts.path), { recursive: true });
+    acquireLock(lockPath);
+    try {
+        const state = readStrictHistory(opts.path);
+        const historyRecords = state.archive.length + state.logicalActive.length;
+        const cursors = readCursorsStrict(opts.cursorPaths ?? [], historyRecords);
+        const minCursor = minimumCursor(cursors, state.archive.length);
+        const archivedRecords = archiveableCount(state, minCursor, keepRecords);
+        const start = state.archive.length;
+        const end = start + archivedRecords - 1;
+        const archiveId = archivedRecords === 0 ? null : `${start}-${end}`;
+        if (archivedRecords > 0) {
+            const prefix = state.logicalActive.slice(0, archivedRecords);
+            const archiveDir = materialArchiveDir(opts.path);
+            mkdirSync(archiveDir, { recursive: true });
+            const segmentPath = join(archiveDir, materialArchiveSegmentName(start, end));
+            const contents = serializeLines(prefix);
+            if (existsSync(segmentPath)) {
+                if (readFileSync(segmentPath, 'utf8') !== contents) {
+                    throw new MaterialArchiveSegmentConflictError(archiveId ?? `${start}-${end}`);
+                }
+            }
+            else {
+                durableReplace(`${segmentPath}.tmp`, segmentPath, contents);
+                fsyncDirectoryBestEffort(archiveDir);
+            }
+        }
+        const tail = state.logicalActive.slice(archivedRecords);
+        if (archivedRecords > 0 || state.overlap > 0) {
+            durableReplace(`${opts.path}.archive.tmp`, opts.path, serializeLines(tail));
+            fsyncDirectoryBestEffort(dirname(opts.path));
+        }
+        return {
+            mode: 'write',
+            activeRecordsBefore: state.logicalActive.length,
+            physicalActiveRecordsBefore: state.active.length,
+            keepRecords,
+            minCursor,
+            cursors,
+            archivedRecords,
+            retainedRecords: tail.length,
+            archiveRecords: state.archive.length + archivedRecords,
+            historyRecords,
+            recoveredOverlap: state.overlap,
+            archiveId,
+        };
+    }
+    finally {
+        releaseLock(lockPath);
+    }
+}
+/** Operational, fail-soft full history reader. Strict archive writes validate every line and range. */
+export function readMaterialHistory(path) {
+    // Snapshot active first. Writers persist an archive segment before replacing active, so every interleaving
+    // now observes either the old active state or a recoverable archive/active overlap, never a new tail with an
+    // old archive base.
+    const active = readMaterialsLenient(path);
+    const ordered = [];
+    const positions = new Map();
+    const archiveDir = materialArchiveDir(path);
+    for (const descriptor of segmentDescriptors(archiveDir)) {
+        for (const record of readMaterialsLenient(join(archiveDir, descriptor.file))) {
+            if (positions.has(record.materialId))
+                continue;
+            positions.set(record.materialId, ordered.length);
+            ordered.push(record);
+        }
+    }
+    // The active log is the current writer source. In a crash overlap it owns the duplicate record while its
+    // original absolute position remains stable.
+    for (const record of active) {
+        const position = positions.get(record.materialId);
+        if (position === undefined) {
+            positions.set(record.materialId, ordered.length);
+            ordered.push(record);
+        }
+        else {
+            ordered[position] = record;
+        }
+    }
+    return ordered;
+}
+/** Absolute-offset range reader used by durable consumers after active records move into archive segments. */
+export function readMaterialRange(path, start, count) {
+    const normalizedStart = normalizeRangeStart(start);
+    const normalizedCount = normalizeRangeCount(count);
+    if (normalizedCount === 0)
+        return [];
+    // Keep the same active-first snapshot order as readMaterialHistory; see its concurrency note.
+    const active = readMaterialsLenient(path);
+    const archiveDir = materialArchiveDir(path);
+    const descriptors = segmentDescriptors(archiveDir);
+    if (descriptors.length === 0) {
+        return active.slice(normalizedStart, normalizedStart + normalizedCount);
+    }
+    const archiveEnd = Math.max(...descriptors.map((descriptor) => descriptor.end));
+    const requestedEnd = Math.min(Number.MAX_SAFE_INTEGER, normalizedStart + normalizedCount - 1);
+    const byOffset = new Map();
+    for (const descriptor of descriptors) {
+        if (descriptor.end < normalizedStart || descriptor.start > requestedEnd)
+            continue;
+        const records = readMaterialsLenient(join(archiveDir, descriptor.file));
+        for (let index = 0; index < records.length; index += 1) {
+            const offset = descriptor.start + index;
+            if (offset >= normalizedStart && offset <= requestedEnd && !byOffset.has(offset)) {
+                byOffset.set(offset, records[index]);
+            }
+        }
+    }
+    if (requestedEnd > archiveEnd) {
+        const overlap = detectOperationalOverlap(path, descriptors, active);
+        const logicalActive = active.slice(overlap);
+        const activeStart = archiveEnd + 1;
+        for (let index = 0; index < logicalActive.length; index += 1) {
+            const offset = activeStart + index;
+            if (offset >= normalizedStart && offset <= requestedEnd)
+                byOffset.set(offset, logicalActive[index]);
+        }
+    }
+    return [...byOffset.entries()]
+        .sort(([left], [right]) => left - right)
+        .map(([, record]) => record);
+}
+export function inspectMaterialArchive(path) {
+    const archiveDir = materialArchiveDir(path);
+    const descriptors = segmentDescriptors(archiveDir);
+    let bytes = 0;
+    let records = 0;
+    let invalidLines = 0;
+    for (const descriptor of descriptors) {
+        const segmentPath = join(archiveDir, descriptor.file);
+        bytes += statSync(segmentPath).size;
+        for (const line of readFileSync(segmentPath, 'utf8').split('\n')) {
+            if (line.length === 0)
+                continue;
+            try {
+                material.parse(JSON.parse(line));
+                records += 1;
+            }
+            catch {
+                invalidLines += 1;
+            }
+        }
+    }
+    return {
+        exists: descriptors.length > 0,
+        segments: descriptors.length,
+        bytes,
+        records,
+        invalidLines,
+        firstOffset: descriptors[0]?.start ?? null,
+        lastOffset: descriptors[descriptors.length - 1]?.end ?? null,
+    };
+}
+function readStrictHistory(path) {
+    const archive = readArchiveStrict(materialArchiveDir(path));
+    const active = readActiveStrict(path);
+    const overlap = detectOverlap(archive, active);
+    const logicalActive = active.slice(overlap);
+    const seen = new Map();
+    for (const line of [...archive, ...logicalActive]) {
+        const canonical = JSON.stringify(line.record);
+        const existing = seen.get(line.record.materialId);
+        if (existing !== undefined) {
+            if (existing !== canonical)
+                throw new MaterialArchiveSegmentConflictError(line.record.materialId);
+            throw new MaterialArchiveRangeError(`duplicate material ${line.record.materialId}`);
+        }
+        seen.set(line.record.materialId, canonical);
+    }
+    return { archive, active, logicalActive, overlap };
+}
+function readArchiveStrict(archiveDir) {
+    const descriptors = segmentDescriptors(archiveDir, true);
+    const out = [];
+    let expectedStart = 0;
+    for (const descriptor of descriptors) {
+        if (descriptor.start !== expectedStart) {
+            throw new MaterialArchiveRangeError(`expected offset ${expectedStart} but found ${descriptor.start}`);
+        }
+        const lines = readStrictLines(join(archiveDir, descriptor.file), descriptor.file, true);
+        const expectedLength = descriptor.end - descriptor.start + 1;
+        if (lines.length !== expectedLength) {
+            throw new MaterialArchiveRangeError(`${descriptor.file} declares ${expectedLength} record(s) but contains ${lines.length}`);
+        }
+        out.push(...lines);
+        expectedStart = descriptor.end + 1;
+    }
+    return out;
+}
+function readActiveStrict(path) {
+    if (!existsSync(path))
+        return [];
+    const out = [];
+    const lines = readFileSync(path, 'utf8').split('\n');
+    for (let index = 0; index < lines.length; index += 1) {
+        const raw = lines[index];
+        if (raw.length === 0)
+            continue;
+        try {
+            out.push({ record: material.parse(JSON.parse(raw)), raw });
+        }
+        catch {
+            throw new InvalidMaterialLogError(index + 1, 'invalid json or material schema');
+        }
+    }
+    return out;
+}
+function readStrictLines(path, segment, archive) {
+    const out = [];
+    const lines = readFileSync(path, 'utf8').split('\n');
+    for (let index = 0; index < lines.length; index += 1) {
+        const raw = lines[index];
+        if (raw.length === 0)
+            continue;
+        try {
+            out.push({ record: material.parse(JSON.parse(raw)), raw });
+        }
+        catch {
+            if (archive)
+                throw new InvalidMaterialArchiveError(segment, index + 1, 'invalid json or material schema');
+            throw new InvalidMaterialLogError(index + 1, 'invalid json or material schema');
+        }
+    }
+    return out;
+}
+function readMaterialsLenient(path) {
+    if (!existsSync(path))
+        return [];
+    const out = [];
+    for (const line of readFileSync(path, 'utf8').split('\n')) {
+        if (line.length === 0)
+            continue;
+        try {
+            out.push(material.parse(JSON.parse(line)));
+        }
+        catch {
+            // Preserve MaterialStore's existing fail-soft reads. Archive writes use strict parsing.
+        }
+    }
+    return out;
+}
+function segmentDescriptors(archiveDir, strict = false) {
+    if (!existsSync(archiveDir))
+        return [];
+    const out = [];
+    for (const file of readdirSync(archiveDir).sort()) {
+        const match = SEGMENT_PATTERN.exec(file);
+        if (match === null)
+            continue;
+        const start = Number(match[1]);
+        const end = Number(match[2]);
+        if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start) {
+            if (strict)
+                throw new MaterialArchiveRangeError(`invalid segment filename ${file}`);
+            continue;
+        }
+        out.push({ file, start, end });
+    }
+    return out.sort((left, right) => left.start - right.start || left.end - right.end);
+}
+function detectOverlap(archive, active) {
+    const max = Math.min(archive.length, active.length);
+    for (let length = max; length > 0; length -= 1) {
+        const archiveStart = archive.length - length;
+        let matches = true;
+        for (let index = 0; index < length; index += 1) {
+            if (JSON.stringify(archive[archiveStart + index].record) !== JSON.stringify(active[index].record)) {
+                matches = false;
+                break;
+            }
+        }
+        if (matches)
+            return length;
+    }
+    return 0;
+}
+function detectOperationalOverlap(path, descriptors, active) {
+    const latest = descriptors[descriptors.length - 1];
+    if (latest === undefined || active.length === 0)
+        return 0;
+    const archived = readMaterialsLenient(join(materialArchiveDir(path), latest.file));
+    const max = Math.min(archived.length, active.length);
+    for (let length = max; length > 0; length -= 1) {
+        const archiveStart = archived.length - length;
+        let matches = true;
+        for (let index = 0; index < length; index += 1) {
+            if (JSON.stringify(archived[archiveStart + index]) !== JSON.stringify(active[index])) {
+                matches = false;
+                break;
+            }
+        }
+        if (matches)
+            return length;
+    }
+    return 0;
+}
+function readCursorsStrict(paths, historyRecords) {
+    const out = [];
+    for (const path of paths) {
+        if (!existsSync(path))
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(path, 'utf8'));
+        }
+        catch {
+            throw new InvalidMaterialArchiveCursorError('cursor file is not valid JSON');
+        }
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            throw new InvalidMaterialArchiveCursorError('cursor file must contain an object');
+        }
+        for (const [group, value] of Object.entries(parsed)) {
+            if (!Number.isSafeInteger(value) || value < 0 || value > historyRecords) {
+                throw new InvalidMaterialArchiveCursorError(`group ${group} is outside history bounds`);
+            }
+            out.push({ group, position: value });
+        }
+    }
+    return out;
+}
+function minimumCursor(cursors, archiveRecords) {
+    return cursors.length === 0 ? archiveRecords : Math.min(...cursors.map((cursor) => cursor.position));
+}
+function archiveableCount(state, minCursor, keepRecords) {
+    const committedActive = Math.max(0, minCursor - state.archive.length);
+    const tailBound = Math.max(0, state.logicalActive.length - keepRecords);
+    return Math.min(committedActive, tailBound);
+}
+function serializeLines(lines) {
+    return lines.length === 0 ? '' : `${lines.map((line) => line.raw).join('\n')}\n`;
+}
+function durableReplace(tmpPath, finalPath, contents) {
+    let fd = null;
+    try {
+        fd = openSync(tmpPath, 'w', 0o600);
+        writeSync(fd, contents, undefined, 'utf8');
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = null;
+        renameSync(tmpPath, finalPath);
+    }
+    catch (error) {
+        if (fd !== null)
+            closeSync(fd);
+        rmSync(tmpPath, { force: true });
+        throw error;
+    }
+}
+function fsyncDirectoryBestEffort(path) {
+    let fd = null;
+    try {
+        fd = openSync(path, 'r');
+        fsyncSync(fd);
+    }
+    catch {
+        // Windows and some filesystems do not support fsync on directories.
+    }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
+}
+function normalizeKeepRecords(value) {
+    if (value === undefined)
+        return MATERIAL_ARCHIVE_DEFAULT_KEEP_RECORDS;
+    if (!Number.isFinite(value) || value < 1)
+        throw new RangeError('keepRecords must be a positive integer');
+    return Math.floor(value);
+}
+function normalizeRangeStart(value) {
+    if (!Number.isFinite(value) || value < 0)
+        return 0;
+    return Math.floor(value);
+}
+function normalizeRangeCount(value) {
+    if (!Number.isFinite(value))
+        return Number.MAX_SAFE_INTEGER;
+    if (value <= 0)
+        return 0;
+    return Math.floor(value);
+}

package/dist/material/materialStore.d.ts

@@ -17,6 +17,7 @@ export declare class MaterialStore {
     private putLocked;
     get(materialId: string): Material | undefined;
     readAll(): Material[];
+    readRange(start: number, count: number): Material[];
     iterate(opts?: {
         consumerGroup?: string;
         since?: string;

package/dist/material/materialStore.js

@@ -1,8 +1,9 @@
-import { openSync, writeSync, fsyncSync, closeSync, existsSync, readFileSync, mkdirSync } from 'node:fs';
+import { openSync, writeSync, fsyncSync, closeSync, mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { material } from '../schema/material.js';
 import { acquireLock, releaseLock } from '../util/fileLock.js';
 import { assertMaterialSource } from './boundary.js';
+import { readMaterialHistory, readMaterialRange } from './materialArchive.js';
 /** 原材料库 (append-only jsonl + single-writer + materialId 去重). */
 export class MaterialStore {
     path;
@@ -51,18 +52,10 @@ export class MaterialStore {
         return undefined;
     }
     readAll() {
-        if (!existsSync(this.path))
-            return [];
-        const out = [];
-        for (const l of readFileSync(this.path, 'utf8').split('\n')) {
-            if (!l)
-                continue;
-            try {
-                out.push(material.parse(JSON.parse(l)));
-            }
-            catch { /* skip */ }
-        }
-        return out;
+        return readMaterialHistory(this.path);
+    }
+    readRange(start, count) {
+        return readMaterialRange(this.path, start, count);
     }
     *iterate(opts = {}) {
         for (const m of this.readAll()) {

package/dist/ops/savingsCore.js

@@ -6,8 +6,7 @@
 // gate (it reads the vendored files at runtime, so this module stays free of cross-rootDir JSON
 // imports), and savings-core's daily drift-check locks the vendored copies to upstream. To change a
 // coefficient: change savings-core first, regenerate vectors there, bump spec_version, then
-// re-vendor here AND in evomap-hub / evomap-private / evox-online-deck / evomap-desktop / evox /
-// evolver-private-dev / evolver-v2-enterprise-dev.
+// re-vendor it into each consuming distribution.
 //
 // Core purity contract holds: no I/O, no Date.now/Math.random — pure functions over numbers.
 export const SAVINGS_SPEC_VERSION = '0.3.0';

package/dist/ops/selfUpdate.d.ts

@@ -103,4 +103,13 @@ export interface DownloadedArtifact {
  *
  * Fail-closed everywhere: any doubt (bad structure, hash gap, signature failure, thrown crypto error) → reject.
  */
-export declare function verifyManifest(manifest: unknown, downloaded: readonly DownloadedArtifact[], publicKey?: string | KeyObject): VerifyResult;
+export declare function verifyManifest(manifest: unknown, downloaded: readonly DownloadedArtifact[], publicKey?: string | KeyObject): VerifyResult;
+/**
+ * Verify exactly one explicitly selected download against a complete release manifest.
+ *
+ * Unlike verifyManifest, this verifier does not require downloading every platform artifact. When a public key is
+ * configured it first verifies the Ed25519 signature over the complete canonical manifest, then requires exactly
+ * one downloaded artifact and exactly one manifest entry with the same path, and finally checks that artifact's
+ * sha256. The complete manifest is never filtered or reconstructed before signature verification.
+ */
+export declare function verifySelectedManifestArtifact(manifest: unknown, downloaded: readonly DownloadedArtifact[], publicKey?: string | KeyObject): VerifyResult;

package/dist/ops/selfUpdate.js

@@ -238,6 +238,25 @@ function toPublicKey(publicKey) {
     const der = Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), raw]);
     return createPublicKey({ key: der, format: 'der', type: 'spki' });
 }
+/** Verify the signature over the complete canonical manifest when a public key is configured. */
+function verifyConfiguredManifestSignature(manifest, publicKey) {
+    if (!publicKey)
+        return { ok: true, reason: 'signature_not_required' };
+    if (!manifest.signature)
+        return { ok: false, reason: 'signature_required_but_missing' };
+    if (manifest.signatureAlg && manifest.signatureAlg !== 'ed25519') {
+        return { ok: false, reason: 'signature_alg_unsupported' };
+    }
+    try {
+        const key = toPublicKey(publicKey);
+        const ok = cryptoVerify(null, // Ed25519 ignores the digest-name arg
+        canonicalManifestBytes(manifest), key, Buffer.from(manifest.signature, 'base64'));
+        return ok ? { ok: true, reason: 'signature_verified' } : { ok: false, reason: 'signature_invalid' };
+    }
+    catch (err) {
+        return { ok: false, reason: `signature_verify_error: ${err instanceof Error ? err.message : String(err)}` };
+    }
+}
 /**
  * Verify downloaded artifacts against the manifest. PURE + deterministic (takes already-read bytes/hashes; does
  * NO I/O). Two layers:
@@ -274,21 +293,51 @@ export function verifyManifest(manifest, downloaded, publicKey) {
             return { ok: false, reason: `sha256_mismatch: ${art.path}` };
     }
     // Layer 2: Ed25519 signature — enforced ONLY when a key is configured (then fail-closed).
-    if (publicKey) {
-        if (!m.signature)
-            return { ok: false, reason: 'signature_required_but_missing' };
-        if (m.signatureAlg && m.signatureAlg !== 'ed25519')
-            return { ok: false, reason: 'signature_alg_unsupported' };
-        try {
-            const key = toPublicKey(publicKey);
-            const ok = cryptoVerify(null, // Ed25519 ignores the digest-name arg
-            canonicalManifestBytes(m), key, Buffer.from(m.signature, 'base64'));
-            if (!ok)
-                return { ok: false, reason: 'signature_invalid' };
-        }
-        catch (err) {
-            return { ok: false, reason: `signature_verify_error: ${err instanceof Error ? err.message : String(err)}` };
-        }
+    const signature = verifyConfiguredManifestSignature(m, publicKey);
+    if (!signature.ok)
+        return signature;
+    return { ok: true, reason: 'verified' };
+}
+/**
+ * Verify exactly one explicitly selected download against a complete release manifest.
+ *
+ * Unlike verifyManifest, this verifier does not require downloading every platform artifact. When a public key is
+ * configured it first verifies the Ed25519 signature over the complete canonical manifest, then requires exactly
+ * one downloaded artifact and exactly one manifest entry with the same path, and finally checks that artifact's
+ * sha256. The complete manifest is never filtered or reconstructed before signature verification.
+ */
+export function verifySelectedManifestArtifact(manifest, downloaded, publicKey) {
+    const structErr = manifestStructuralError(manifest);
+    if (structErr)
+        return { ok: false, reason: structErr };
+    const m = manifest;
+    const signature = verifyConfiguredManifestSignature(m, publicKey);
+    if (!signature.ok)
+        return signature;
+    if (downloaded.length !== 1) {
+        return { ok: false, reason: `downloaded_artifact_count_invalid: ${downloaded.length}` };
+    }
+    const selected = downloaded[0];
+    if (!selected || typeof selected.path !== 'string' || !selected.path) {
+        return { ok: false, reason: 'downloaded_artifact_path_invalid' };
+    }
+    const matches = m.artifacts.filter((artifact) => artifact.path === selected.path);
+    if (matches.length === 0)
+        return { ok: false, reason: `artifact_missing: ${selected.path}` };
+    if (matches.length !== 1)
+        return { ok: false, reason: `artifact_duplicate: ${selected.path}` };
+    const expected = matches[0];
+    if (!expected)
+        return { ok: false, reason: `artifact_missing: ${selected.path}` };
+    let digest;
+    if (selected.sha256)
+        digest = selected.sha256.toLowerCase();
+    else if (selected.bytes)
+        digest = sha256Hex(selected.bytes);
+    else
+        return { ok: false, reason: `artifact_no_content: ${selected.path}` };
+    if (digest !== expected.sha256.toLowerCase()) {
+        return { ok: false, reason: `sha256_mismatch: ${selected.path}` };
     }
     return { ok: true, reason: 'verified' };
 }

package/dist/schema/common.d.ts

@@ -22,7 +22,7 @@ export declare const artifactRef: z.ZodObject<{
 }>;
 export type ArtifactRef = z.infer<typeof artifactRef>;
 /** runtime 来源 (D11). 'generic-chat' = 任何输出标准 OpenAI/Anthropic messages 的 AI(经 genericChatAdapter 接入). */
-export declare const sourceAgent: z.ZodEnum<["claude-code", "codex", "cursor", "gemini", "kimi", "kiro", "opencode", "generic-chat"]>;
+export declare const sourceAgent: z.ZodEnum<["claude-code", "codex", "cursor", "gemini", "antigravity", "kimi", "kiro", "opencode", "generic-chat"]>;
 export type SourceAgent = z.infer<typeof sourceAgent>;
 export declare const blastRadius: z.ZodEnum<["file", "module", "package", "system"]>;
 export type BlastRadius = z.infer<typeof blastRadius>;

package/dist/schema/common.js

@@ -13,5 +13,5 @@ export const artifactRef = z.object({
     size: z.number().int().nonnegative(),
 });
 /** runtime 来源 (D11). 'generic-chat' = 任何输出标准 OpenAI/Anthropic messages 的 AI(经 genericChatAdapter 接入). */
-export const sourceAgent = z.enum(['claude-code', 'codex', 'cursor', 'gemini', 'kimi', 'kiro', 'opencode', 'generic-chat']);
+export const sourceAgent = z.enum(['claude-code', 'codex', 'cursor', 'gemini', 'antigravity', 'kimi', 'kiro', 'opencode', 'generic-chat']);
 export const blastRadius = z.enum(['file', 'module', 'package', 'system']);