@extenshi/cli 0.17.0 → 0.19.0

package/dist/project.js

@@ -0,0 +1,671 @@
+/** Local metadata client. Never rewrites extension source or sends repository contents. */
+import { execFileSync } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { lstat, mkdir, open, readFile, readlink, rename, rm, stat } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { loadConfig } from './config.js';
+import { evidenceSchema, hashMetadata, importManifestSchema, workspacePatchSchema, } from './project-workspace.js';
+import { loadArtifact } from './review-archive.js';
+const cliVersion = createRequire(import.meta.url)('../package.json').version;
+export class ProjectApiError extends Error {
+    category;
+    status;
+    code;
+    constructor(category, status, code) {
+        super(`Project API: ${category} (${status}). ${code === 'PROJECT_PREMIUM_REQUIRED' ? 'Automated release readiness requires a Pro project. ' : ''}${category === 'auth' ? 'Run extenshi login, or reconnect your OAuth client.' : category === 'unsupported' ? 'The server does not support this command yet.' : 'Run extenshi doctor --json for diagnostics.'}`);
+        this.category = category;
+        this.status = status;
+        this.code = code;
+    }
+}
+export async function projectRequest(config, method, input = {}, mutation = false) {
+    if (!config.apiKey)
+        throw new ProjectApiError('auth', 401);
+    const procedure = method === 'cli.getApiCallerBalance' ? method : `devProject.${method}`;
+    const url = new URL(`${config.bffUrl}/api/trpc/${procedure}`);
+    if (!mutation)
+        url.searchParams.set('input', JSON.stringify(input));
+    let response;
+    try {
+        response = await fetch(url, {
+            method: mutation ? 'POST' : 'GET',
+            headers: { authorization: `Bearer ${config.apiKey}`, 'content-type': 'application/json' },
+            body: mutation ? JSON.stringify(input) : undefined,
+            signal: AbortSignal.timeout(20_000),
+        });
+    }
+    catch {
+        throw new ProjectApiError('offline', 0);
+    }
+    const body = (await response.json().catch(() => null));
+    if (!response.ok || body?.error) {
+        const status = response.status;
+        throw new ProjectApiError(status === 401
+            ? 'auth'
+            : status === 403
+                ? 'permission'
+                : status === 429
+                    ? 'quota'
+                    : status === 409
+                        ? 'conflict'
+                        : status === 404
+                            ? body?.error?.message === 'Project not found'
+                                ? 'not-found'
+                                : 'unsupported'
+                            : status >= 500
+                                ? 'server'
+                                : 'validation', status, body?.error?.message === 'PROJECT_PREMIUM_REQUIRED' ? 'PROJECT_PREMIUM_REQUIRED' : undefined);
+    }
+    if (!body?.result?.data)
+        throw new ProjectApiError('server', response.status);
+    return body.result.data;
+}
+const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export const metadataDigest = hashMetadata;
+async function jsonFile(file, limit = 256 * 1024) {
+    if ((await stat(file)).size > limit)
+        throw new Error('Metadata file exceeds 256 KiB');
+    return JSON.parse(await readFile(file, 'utf8'));
+}
+export async function atomicJson(file, value) {
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        const handle = await open(temporary, 'wx', 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify(value)}\n`);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temporary, file);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+export async function localProvenance(cwd) {
+    const git = (...args) => execFileSync('git', args, { cwd, maxBuffer: 32 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'] });
+    const result = {
+        source: 'local',
+        observedAt: new Date().toISOString(),
+        toolVersion: `extenshi-cli/${cliVersion}`,
+    };
+    let root;
+    try {
+        root = git('rev-parse', '--show-toplevel').toString().trim();
+    }
+    catch {
+        return result; // Observations outside Git require --commit to prepare a release.
+    }
+    cwd = root;
+    try {
+        result.commit = git('rev-parse', '--verify', 'HEAD').toString().trim();
+    }
+    catch {
+        // A repository without its first commit can still identify a dirty snapshot.
+    }
+    try {
+        result.branch = git('symbolic-ref', '--short', '-q', 'HEAD').toString().trim();
+    }
+    catch {
+        // Detached HEAD already has a source commit.
+    }
+    const paths = ['--', '.', ':(exclude).extenshi', ':(exclude)**/.extenshi/**'];
+    const diff = result.commit
+        ? git('diff', '--no-ext-diff', '--no-textconv', '--binary', 'HEAD', ...paths)
+        : Buffer.concat([
+            git('diff', '--no-ext-diff', '--no-textconv', '--binary', '--cached', ...paths),
+            git('diff', '--no-ext-diff', '--no-textconv', '--binary', ...paths),
+        ]);
+    const untracked = git('ls-files', '--others', '--exclude-standard', '-z', ...paths)
+        .toString()
+        .split('\0')
+        .filter(Boolean)
+        .sort();
+    if (diff.length || untracked.length) {
+        const entries = [];
+        for (const file of untracked) {
+            const location = path.join(root, file);
+            const info = await lstat(location);
+            const digest = createHash('sha256');
+            if (info.isSymbolicLink())
+                digest.update(await readlink(location));
+            else if (info.isFile()) {
+                for await (const chunk of createReadStream(location))
+                    digest.update(chunk);
+            }
+            else
+                throw new Error('Cannot identify the dirty snapshot: an untracked entry is not a file.');
+            entries.push({
+                path: file,
+                mode: info.mode & 0o777,
+                symlink: info.isSymbolicLink(),
+                hash: digest.digest('hex'),
+            });
+        }
+        result.dirtyTreeDigest = hashMetadata({ version: 1, trackedDiff: sha(diff), untracked: entries });
+    }
+    return result;
+}
+const missingOriginFields = (origin, prefix) => ['branch', 'commit', 'dirtyTreeDigest']
+    .filter((key) => origin[key] === undefined)
+    .map((key) => `${prefix}/${key}`);
+const print = (value) => console.log(JSON.stringify(value, null, 2));
+async function localState(cwd) {
+    try {
+        return await jsonFile(path.join(cwd, '.extenshi/project.json'), 512 * 1024);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new Error('Run extenshi project bind --project <id> --repo <owner/repo> first.');
+        throw error;
+    }
+}
+async function withLocalLock(cwd, work) {
+    const directory = path.join(cwd, '.extenshi');
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const lock = path.join(directory, 'workspace.lock');
+    try {
+        await mkdir(lock);
+    }
+    catch (error) {
+        if (error.code === 'EEXIST')
+            throw new Error('Another project command holds .extenshi/workspace.lock. If it crashed, verify it has stopped before removing the lock directory.');
+        throw error;
+    }
+    try {
+        return await work();
+    }
+    finally {
+        await rm(lock, { recursive: true, force: true });
+    }
+}
+async function queue(cwd, operation) {
+    const file = path.join(cwd, '.extenshi/pending.json');
+    let pending = [];
+    try {
+        pending = (await jsonFile(file, 8 * 1024 * 1024)).operations ?? [];
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (pending.length >= 20)
+        throw new Error('Pending queue is full; synchronize it first.');
+    await atomicJson(file, { operations: [...pending, operation] });
+}
+async function flush(cwd, config, binding) {
+    const file = path.join(cwd, '.extenshi/pending.json');
+    let operations;
+    try {
+        operations = (await jsonFile(file, 8 * 1024 * 1024)).operations ?? [];
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    while (operations.length) {
+        const next = operations[0];
+        if (next.input.projectId !== binding.projectId)
+            throw new Error('Pending operation belongs to another project. Resolve the binding before syncing.');
+        const result = await projectRequest(config, next.method, next.input, true);
+        if (result.conflicts?.length) {
+            print({ status: 'conflict', operation: next.input.idempotencyKey, ...result });
+            throw new ProjectApiError('conflict', 409);
+        }
+        // Persist the receipt before removing the immutable queued request. A crash replays its key.
+        if (result.newRevision !== undefined) {
+            binding.revision = result.newRevision;
+            binding.document = result.document;
+            if (result.dojoStateHash)
+                binding.dojoStateHash = result.dojoStateHash;
+            binding.fetchedAt = new Date().toISOString();
+            await atomicJson(path.join(cwd, '.extenshi/project.json'), binding);
+        }
+        operations = operations.slice(1);
+        await atomicJson(file, { operations });
+    }
+}
+async function syncPatch(cwd, patch, options) {
+    return withLocalLock(cwd, async () => {
+        const binding = await localState(cwd);
+        const config = await loadConfig();
+        const observed = options.observed ?? (await localProvenance(cwd));
+        const input = workspacePatchSchema.parse({
+            schemaVersion: 1,
+            projectId: binding.projectId,
+            expectedRevision: binding.revision,
+            idempotencyKey: randomUUID(),
+            provenance: observed,
+            patch,
+            tombstones: options.tombstones ?? [],
+        });
+        if (options.dryRun) {
+            print(await projectRequest(config, 'agentDiffWorkspace', input, true));
+            return;
+        }
+        await queue(cwd, { method: 'agentPatchWorkspace', input });
+        try {
+            await flush(cwd, config, binding);
+            print({ status: 'synced', projectId: binding.projectId, revision: binding.revision });
+        }
+        catch (error) {
+            if (error instanceof ProjectApiError && ['offline', 'server'].includes(error.category)) {
+                print({
+                    status: 'pending-sync',
+                    savedAt: observed.observedAt,
+                    message: 'Metadata is queued. Run extenshi project sync when connected.',
+                });
+                process.exitCode = 1;
+            }
+            else
+                throw error;
+        }
+    });
+}
+export function registerProjectCommands(program) {
+    const run = (fn) => async (...args) => {
+        try {
+            await fn(...args);
+        }
+        catch (error) {
+            console.error(error instanceof Error ? error.message : 'Project command failed');
+            process.exitCode = 1;
+        }
+    };
+    program
+        .command('doctor')
+        .option('--json', 'Emit JSON')
+        .action(run(async () => {
+        const config = await loadConfig();
+        try {
+            const [connection, balance] = await Promise.all([
+                projectRequest(config, 'agentConnectionDiagnostics'),
+                projectRequest(config, 'cli.getApiCallerBalance'),
+            ]);
+            print({
+                status: 'connected',
+                ...connection,
+                balance,
+                client: { version: cliVersion, workspaceContract: 1, authMode: 'api-key', refreshTokens: false },
+            });
+        }
+        catch (error) {
+            print({
+                status: 'unavailable',
+                category: error instanceof ProjectApiError ? error.category : 'unknown',
+                recovery: error instanceof ProjectApiError && error.category === 'unsupported'
+                    ? 'This backend does not provide project-workspace v1 yet. Deploy or connect to a compatible backend. Existing CLI commands remain available.'
+                    : error instanceof ProjectApiError && error.category === 'offline'
+                        ? 'The backend is unreachable. Keep queued metadata and run project sync when connected.'
+                        : error instanceof ProjectApiError && error.category === 'permission'
+                            ? 'Check granted OAuth scopes and project access. Automated readiness requires Pro.'
+                            : 'Run extenshi login for API-key authentication errors. For OAuth invalid_grant, reconnect the MCP client and serialize refresh in its credential store. Retry server failures after recovery.',
+            });
+            process.exitCode = 1;
+        }
+    }));
+    const project = program
+        .command('project')
+        .description('Synchronize project metadata and evidence with Dojo');
+    project
+        .command('bind')
+        .requiredOption('--project <id>')
+        .requiredOption('--repo <owner/repo>')
+        .option('--branch <branch>', 'Default branch', 'main')
+        .action(run(async (options) => {
+        const cwd = process.cwd();
+        await withLocalLock(cwd, async () => {
+            let existing;
+            try {
+                existing = await jsonFile(path.join(cwd, '.extenshi/project.json'), 512 * 1024);
+            }
+            catch (e) {
+                if (e.code !== 'ENOENT')
+                    throw e;
+            }
+            if (existing && existing.projectId !== options.project)
+                throw new Error('This directory is already bound to another project.');
+            const state = await projectRequest(await loadConfig(), 'agentGetWorkspace', {
+                projectId: options.project,
+            });
+            await atomicJson(path.join(cwd, '.extenshi/project.json'), {
+                ...state,
+                fetchedAt: new Date().toISOString(),
+            });
+        });
+        await syncPatch(cwd, { repository: { repo: options.repo, defaultBranch: options.branch } }, {});
+    }));
+    project
+        .command('import-manifest <file>')
+        .option('--built', 'Record a built observation without replacing source editor paths')
+        .option('--browser <browser>', 'Target browser', 'chrome')
+        .option('--messages <file>', 'Default-locale messages for project name and description')
+        .option('--expected-state-hash <hash>', 'Reviewed Dojo state hash; overrides the cached binding')
+        .option('--dry-run')
+        .action(run(async (file, options) => {
+        const cwd = process.cwd();
+        await withLocalLock(cwd, async () => {
+            const binding = await localState(cwd);
+            const config = await loadConfig();
+            const location = path.resolve(file);
+            const manifest = await jsonFile(location);
+            const observed = await localProvenance(cwd);
+            let messages = options.messages ? await jsonFile(path.resolve(options.messages)) : undefined;
+            if (!messages &&
+                typeof manifest.default_locale === 'string' &&
+                /^[a-z]{2,3}(?:[_-][A-Za-z0-9]+)*$/.test(manifest.default_locale)) {
+                try {
+                    messages = await jsonFile(path.join(path.dirname(location), '_locales', manifest.default_locale, 'messages.json'));
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+            }
+            const base = importManifestSchema.parse({
+                projectId: binding.projectId,
+                schemaVersion: 1,
+                expectedRevision: binding.revision,
+                idempotencyKey: randomUUID(),
+                provenance: observed,
+                browser: options.browser,
+                kind: options.built ? 'built' : 'source',
+                manifest,
+                messages,
+                dryRun: true,
+                tombstones: missingOriginFields(observed, `/${options.built ? 'builtManifests' : 'sourceManifests'}/${options.browser}/provenance`),
+            });
+            if (options.dryRun) {
+                print(await projectRequest(config, 'agentImportManifest', base, true));
+                return;
+            }
+            let expectedStateHash = options.expectedStateHash ?? binding.dojoStateHash;
+            if (!expectedStateHash) {
+                const preview = await projectRequest(config, 'agentImportManifest', base, true);
+                if (preview.conflicts?.length) {
+                    print(preview);
+                    throw new ProjectApiError('conflict', 409);
+                }
+                expectedStateHash = preview.expectedStateHash;
+            }
+            const input = importManifestSchema.parse({ ...base, dryRun: false, expectedStateHash });
+            await queue(cwd, { method: 'agentImportManifest', input });
+            try {
+                await flush(cwd, config, binding);
+                print({ status: 'synced', revision: binding.revision, dojoUpdated: !options.built });
+            }
+            catch (error) {
+                if (error instanceof ProjectApiError && ['offline', 'server'].includes(error.category)) {
+                    print({
+                        status: 'pending-sync',
+                        message: 'Manifest import is queued. Run extenshi project sync when connected.',
+                    });
+                    process.exitCode = 1;
+                }
+                else
+                    throw error;
+            }
+        });
+    }));
+    project
+        .command('diff')
+        .option('--patch <file>', 'Typed metadata patch JSON')
+        .action(run(async (options) => {
+        const binding = await localState(process.cwd());
+        if (options.patch)
+            await syncPatch(process.cwd(), await jsonFile(path.resolve(options.patch)), { dryRun: true });
+        else {
+            const remote = await projectRequest(await loadConfig(), 'agentGetWorkspace', {
+                projectId: binding.projectId,
+            });
+            print({
+                localRevision: binding.revision,
+                serverRevision: remote.revision,
+                snapshotAgeSeconds: Math.max(0, (Date.now() - Date.parse(binding.fetchedAt)) / 1000),
+                local: binding.document,
+                server: remote.document,
+            });
+        }
+    }));
+    project
+        .command('sync')
+        .option('--patch <file>', 'Typed repository/sourceManifests/builtManifests/spec/release patch')
+        .option('--expected-revision <revision>')
+        .option('--delete <pointer...>', 'Explicit metadata tombstones')
+        .action(run(async (options) => {
+        const cwd = process.cwd();
+        if (options.expectedRevision !== undefined &&
+            Number(options.expectedRevision) !== (await localState(cwd)).revision)
+            throw new Error('Expected revision does not match the local baseline. Review project diff first.');
+        if (options.patch || options.delete)
+            await syncPatch(cwd, options.patch ? await jsonFile(path.resolve(options.patch)) : {}, {
+                tombstones: options.delete ?? [],
+            });
+        else
+            await withLocalLock(cwd, async () => {
+                const binding = await localState(cwd);
+                const config = await loadConfig();
+                await flush(cwd, config, binding);
+                const state = await projectRequest(config, 'agentGetWorkspace', { projectId: binding.projectId });
+                await atomicJson(path.join(cwd, '.extenshi/project.json'), {
+                    ...state,
+                    fetchedAt: new Date().toISOString(),
+                });
+                print({ status: 'synced', revision: state.revision });
+            });
+    }));
+    project
+        .command('export-manifest')
+        .option('--browser <browser>', 'Target browser', 'chrome')
+        .option('--built')
+        .action(run(async (options) => {
+        if (!['chrome', 'firefox', 'edge'].includes(options.browser))
+            throw new Error('Browser must be chrome, firefox or edge');
+        const binding = await localState(process.cwd());
+        const state = await projectRequest(await loadConfig(), 'agentGetWorkspace', {
+            projectId: binding.projectId,
+        });
+        const observation = state.document[options.built ? 'builtManifests' : 'sourceManifests']?.[options.browser];
+        if (!observation)
+            throw new Error('No manifest observation for this browser');
+        print(observation.manifest);
+    }));
+    project
+        .command('resolve')
+        .requiredOption('--operation <id>', 'Conflicting operation idempotency key')
+        .requiredOption('--patch <file>', 'Reviewed replacement metadata patch')
+        .option('--delete <pointer...>')
+        .action(run(async (options) => {
+        const cwd = process.cwd();
+        await withLocalLock(cwd, async () => {
+            const binding = await localState(cwd);
+            const config = await loadConfig();
+            const pendingFile = path.join(cwd, '.extenshi/pending.json');
+            const pending = await jsonFile(pendingFile, 8 * 1024 * 1024);
+            const index = pending.operations.findIndex((op) => op.input.idempotencyKey === options.operation);
+            if (index < 0 ||
+                !['agentPatchWorkspace', 'agentImportManifest'].includes(pending.operations[index].method))
+                throw new Error('No matching pending project patch');
+            const current = await projectRequest(config, 'agentGetWorkspace', { projectId: binding.projectId });
+            if (pending.operations[index].method === 'agentImportManifest') {
+                const replacement = importManifestSchema.parse({
+                    ...pending.operations[index].input,
+                    manifest: await jsonFile(path.resolve(options.patch)),
+                    provenance: await localProvenance(cwd),
+                    tombstones: options.delete ?? pending.operations[index].input.tombstones,
+                    expectedRevision: current.revision,
+                    expectedStateHash: current.dojoStateHash,
+                    idempotencyKey: randomUUID(),
+                    dryRun: false,
+                });
+                print(await projectRequest(config, 'agentImportManifest', { ...replacement, dryRun: true }, true));
+                pending.operations[index] = { method: 'agentImportManifest', input: replacement };
+                await atomicJson(pendingFile, pending);
+                await flush(cwd, config, binding);
+                return;
+            }
+            const replacement = workspacePatchSchema.parse({
+                schemaVersion: 1,
+                projectId: binding.projectId,
+                expectedRevision: current.revision,
+                idempotencyKey: randomUUID(),
+                provenance: await localProvenance(cwd),
+                patch: await jsonFile(path.resolve(options.patch)),
+                tombstones: options.delete ?? [],
+            });
+            const preview = await projectRequest(config, 'agentDiffWorkspace', replacement, true);
+            print(preview);
+            pending.operations[index] = { method: 'agentPatchWorkspace', input: replacement };
+            await atomicJson(pendingFile, pending);
+            await flush(cwd, config, binding);
+        });
+    }));
+    program
+        .command('evidence')
+        .command('push <report>')
+        .requiredOption('--artifact <file>', 'Exact ZIP/XPI covered by this report')
+        .action(run(async (report, options) => {
+        const cwd = process.cwd();
+        await withLocalLock(cwd, async () => {
+            const binding = await localState(cwd);
+            const metadata = await jsonFile(path.resolve(report));
+            const artifactDigest = sha(await readFile(path.resolve(options.artifact)));
+            if (metadata.artifactDigest !== artifactDigest)
+                throw new Error('Report artifactDigest does not match the supplied artifact. Rerun the check for this package.');
+            if (!['local', 'agent'].includes(metadata.provenance?.source))
+                throw new Error('Evidence source must be local or agent; this command cannot attest CI.');
+            // Explicit metadata allowlist. Full logs and arbitrary report properties stay local.
+            const { kind, browser, locale, inputDigest, status, provenance: origin, reportUrl } = metadata;
+            const input = evidenceSchema.parse({
+                projectId: binding.projectId,
+                idempotencyKey: randomUUID(),
+                kind,
+                browser,
+                locale,
+                artifactDigest,
+                inputDigest,
+                status,
+                provenance: origin,
+                reportUrl,
+            });
+            await queue(cwd, { method: 'agentRecordEvidence', input });
+            try {
+                await flush(cwd, await loadConfig(), binding);
+            }
+            catch (error) {
+                if (error instanceof ProjectApiError && ['offline', 'server'].includes(error.category)) {
+                    print({
+                        status: 'pending-sync',
+                        artifactDigest,
+                        message: 'Evidence metadata is queued. Run extenshi project sync when connected.',
+                    });
+                    process.exitCode = 1;
+                    return;
+                }
+                throw error;
+            }
+            print({ status: 'recorded', artifactDigest });
+        });
+    }));
+    const release = program.command('release');
+    release
+        .command('prepare <artifact>')
+        .option('--browser <browser>', 'Target browser', 'chrome')
+        .option('--locales <locales>', 'Comma-separated release locales')
+        .option('--source-manifest <file>', 'Source manifest used for this build')
+        .option('--listing <file>', 'Listing revision to bind by hash')
+        .option('--policy <file>', 'Policy revision to bind by hash')
+        .requiredOption('--payment <mode>', 'required or not-used; an explicit release decision')
+        .option('--payment-config <file>', 'Payment configuration metadata to hash locally')
+        .option('--commit <sha>', 'Explicit source commit when outside a Git checkout')
+        .option('--dry-run')
+        .action(run(async (artifact, options) => {
+        if (!['chrome', 'firefox', 'edge'].includes(options.browser))
+            throw new Error('Browser must be chrome, firefox or edge');
+        if (!['required', 'not-used'].includes(options.payment))
+            throw new Error('--payment must be required or not-used');
+        if (options.paymentConfig && options.payment !== 'required')
+            throw new Error('Payment configuration requires --payment required');
+        const bytes = await readFile(path.resolve(artifact));
+        const loaded = await loadArtifact(bytes);
+        const origin = await localProvenance(process.cwd());
+        if (options.commit) {
+            if (origin.commit && origin.commit !== options.commit)
+                throw new Error('Explicit commit differs from the checked-out commit');
+            origin.commit = options.commit;
+        }
+        const source = options.sourceManifest
+            ? await jsonFile(path.resolve(options.sourceManifest))
+            : undefined;
+        const hashFile = async (file) => file ? sha(await readFile(path.resolve(file))) : undefined;
+        const locale = typeof loaded.manifest.default_locale === 'string' ? loaded.manifest.default_locale : undefined;
+        if (!options.locales && !locale)
+            throw new Error('Specify --locales for a package without default_locale');
+        const patch = {
+            builtManifests: { [options.browser]: { manifest: loaded.manifest, provenance: origin } },
+            ...(source
+                ? { sourceManifests: { [options.browser]: { manifest: source, provenance: origin } } }
+                : {}),
+            release: {
+                browser: options.browser,
+                version: loaded.manifest.version,
+                artifactDigest: sha(bytes),
+                manifestDigest: metadataDigest(loaded.manifest),
+                sourceManifestDigest: source ? metadataDigest(source) : undefined,
+                commit: origin.commit,
+                dirtyTreeDigest: origin.dirtyTreeDigest,
+                locales: options.locales ? options.locales.split(',').map((s) => s.trim()) : [locale],
+                listingDigest: await hashFile(options.listing),
+                policyDigest: await hashFile(options.policy),
+                paymentDigest: await hashFile(options.paymentConfig),
+                paymentRequired: options.payment === 'required',
+            },
+        };
+        await syncPatch(process.cwd(), patch, {
+            ...options,
+            observed: origin,
+            tombstones: [
+                ...missingOriginFields(origin, `/builtManifests/${options.browser}/provenance`),
+                ...(source ? missingOriginFields(origin, `/sourceManifests/${options.browser}/provenance`) : []),
+                ...[
+                    'commit',
+                    'dirtyTreeDigest',
+                    'sourceManifestDigest',
+                    'listingDigest',
+                    'policyDigest',
+                    'paymentDigest',
+                ]
+                    .filter((key) => patch.release[key] === undefined)
+                    .map((key) => `/release/${key}`),
+            ],
+        });
+    }));
+    release
+        .command('status')
+        .option('--browser <browser>')
+        .option('--artifact-digest <sha256>')
+        .option('--json')
+        .action(run(async (options) => {
+        const binding = await localState(process.cwd());
+        const status = await projectRequest(await loadConfig(), 'agentReleaseReadiness', {
+            projectId: binding.projectId,
+            browser: options.browser,
+            artifactDigest: options.artifactDigest,
+        });
+        if (options.browser && status.release?.browser !== options.browser) {
+            print({ ready: false, blockers: ['NO_RELEASE_FOR_REQUESTED_BROWSER'], browser: options.browser });
+            process.exitCode = 1;
+            return;
+        }
+        print(status);
+        if (!status.ready)
+            process.exitCode = 1;
+    }));
+}
+//# sourceMappingURL=project.js.map