@fungi.computer/oyster 0.0.1 → 0.1.0

package/dist/build/artifact-writer.js

@@ -0,0 +1,181 @@
+/**
+ * Oyster's one immutable artifact representation: digest-addressed bytes
+ * keyed by artifact reference, with media types carried by the App build
+ * and asset manifests (never by the store). The local packer writes it to a
+ * directory, and a host's build owner writes it to that host's artifact store,
+ * so a Release built on the host and one packed and uploaded share objects.
+ *
+ * It has two halves. Staging turns a build's bytes into content-addressed
+ * objects and the output manifest that names them by digest and size. The
+ * root half turns an output manifest into the small objects only the store's
+ * owner writes: the asset manifest and the App root. The local packer runs
+ * both; a host whose builder uploaded the objects itself runs only the root
+ * half, over the same manifest, so both write identical root bytes.
+ *
+ * Every object is derived and checked before the first is stored: an asset
+ * build that its policy refuses, or a root over its bound, stores nothing.
+ */
+import { createHash } from "node:crypto";
+import mime from "mime";
+import * as Schema from "effect/Schema";
+import { assetBuildJsonSchema, assetPathSchema, decodeAssetBuild, } from "@fungi.computer/puffball/assets";
+import { appBuildJsonSchema, createAppBuild, } from "@fungi.computer/puffball/app";
+import { parseArtifactRef, parseSha256Digest, } from "@fungi.computer/puffball";
+function sha256(bytes) {
+    return parseSha256Digest(`sha256:${createHash("sha256").update(bytes).digest("hex")}`);
+}
+/** The content address of an object: `artifact:sha256-<hex>`. */
+function contentArtifactRef(digest) {
+    return parseArtifactRef(`artifact:sha256-${digest.slice("sha256:".length)}`);
+}
+/**
+ * The root bound for an App whose recipe declares no asset policy: this
+ * writer's private fallback, not recipe policy. An asset recipe's own
+ * `maxManifestBytes` bounds its root as it bounds its asset manifest.
+ */
+const fallbackRootBytes = 1024 * 1024;
+/**
+ * Stage a build's bytes: the output manifest that names each object by its
+ * digest and size, and each distinct object once.
+ */
+export function stageBuildOutput(output) {
+    const objects = [];
+    const stage = (bytes) => {
+        const digest = sha256(bytes);
+        if (!objects.some((object) => object.digest === digest))
+            objects.push({
+                artifactRef: contentArtifactRef(digest),
+                bytes: bytes.slice(),
+                digest,
+            });
+        return { digest, byteLength: bytes.byteLength };
+    };
+    const declared = output.declaration === undefined ? {} : { declaration: output.declaration };
+    const ui = (prepared) => prepared.content.kind === "html"
+        ? {
+            mediaType: "text/html; charset=utf-8",
+            content: { kind: "html", ...stage(prepared.content.bytes) },
+        }
+        : {
+            mediaType: "application/vnd.fungi.app-assets+json",
+            content: {
+                kind: "assets",
+                base: prepared.content.base,
+                assets: prepared.content.assets.map((asset) => ({
+                    path: asset.path,
+                    ...stage(asset.bytes),
+                })),
+            },
+        };
+    const manifest = output.kind === "ui"
+        ? { kind: "ui", ui: ui(output.ui), ...declared }
+        : output.kind === "backend"
+            ? { kind: "backend", backend: stage(output.backend), ...declared }
+            : {
+                kind: "app",
+                ui: ui(output.ui),
+                backend: stage(output.backend),
+                ...declared,
+            };
+    return { manifest, objects };
+}
+/**
+ * Derive the asset manifest (for an asset UI) and the App root an output
+ * manifest names, each checked against the policy, without storing either.
+ */
+function artifactRootObjects(manifest, options) {
+    const objects = [];
+    const referenced = (object) => ({
+        artifactRef: contentArtifactRef(object.digest),
+        digest: object.digest,
+        version: object.digest,
+        byteLength: object.byteLength,
+    });
+    const stage = (bytes, ref) => {
+        const digest = sha256(bytes);
+        const artifactRef = ref ?? contentArtifactRef(digest);
+        objects.push({ artifactRef, bytes, digest });
+        return {
+            artifactRef,
+            digest,
+            version: digest,
+            byteLength: bytes.byteLength,
+        };
+    };
+    const ui = manifest.kind === "backend" ? null : manifest.ui;
+    const storedUi = (() => {
+        if (ui === null)
+            return null;
+        if (ui.content.kind === "html")
+            return { ...referenced(ui.content), mediaType: ui.mediaType };
+        if (!options.assetPolicy)
+            throw new Error("Asset writer requires explicit policy");
+        const byPath = new Map();
+        for (const asset of ui.content.assets) {
+            const path = Schema.decodeUnknownSync(assetPathSchema)(asset.path);
+            if (byPath.has(path))
+                throw new Error("Duplicate build path");
+            byPath.set(path, asset);
+        }
+        const assets = [];
+        for (const [path, asset] of [...byPath].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)) {
+            const mediaType = mime.getType(path);
+            const contentType = mediaType?.startsWith("text/")
+                ? `${mediaType}; charset=utf-8`
+                : mediaType;
+            if (!contentType)
+                throw new Error("Build asset has no maintained content type");
+            assets.push({ path, ...referenced(asset), contentType });
+        }
+        const assetManifest = new TextEncoder().encode(Schema.encodeUnknownSync(assetBuildJsonSchema)({
+            format: "fungi-assets-v1",
+            base: ui.content.base,
+            assets,
+        }));
+        decodeAssetBuild(assetManifest, options.assetPolicy);
+        return { ...stage(assetManifest), mediaType: ui.mediaType };
+    })();
+    const storedBackend = manifest.kind === "ui"
+        ? null
+        : {
+            ...referenced(manifest.backend),
+            mediaType: "application/vnd.fungi.app-backend+json",
+        };
+    const rootBytes = new TextEncoder().encode(Schema.encodeUnknownSync(appBuildJsonSchema)(createAppBuild(storedUi, storedBackend, manifest.declaration)));
+    if (rootBytes.byteLength >
+        (options.assetPolicy?.maxManifestBytes ?? fallbackRootBytes))
+        throw new Error("App root exceeds its manifest bound");
+    const root = stage(rootBytes, options.rootArtifactRef);
+    return {
+        objects,
+        root: Object.freeze({
+            artifactRef: root.artifactRef,
+            artifactDigest: root.digest,
+        }),
+    };
+}
+/** Store each object once; an existing object must hold the same bytes. */
+async function storeObjects(staged, objects) {
+    for (const { artifactRef, bytes, digest } of staged)
+        if ((await objects.create(artifactRef, bytes)) === "exists") {
+            const existing = await objects.read(artifactRef);
+            if (existing === null || sha256(existing) !== digest)
+                throw new Error("Immutable artifact collision");
+        }
+}
+/**
+ * Write the asset manifest and App root an output manifest names. The
+ * objects it names are already stored, and checked, by the caller.
+ */
+export async function writeArtifactRoot(manifest, objects, options) {
+    const derived = artifactRootObjects(manifest, options);
+    await storeObjects(derived.objects, objects);
+    return derived.root;
+}
+/** Persist one build's UI, backend and root; an existing object must hold the same bytes. */
+export async function writeImmutableArtifact(output, objects, options) {
+    const staged = stageBuildOutput(output);
+    const derived = artifactRootObjects(staged.manifest, options);
+    await storeObjects([...staged.objects, ...derived.objects], objects);
+    return derived.root;
+}

package/dist/build/build-jobs.js

@@ -52,6 +52,7 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
 });
 import * as Schema from "effect/Schema";
 import { base64url } from "jose";
+import { workspaceBuildPolicy } from "./build-policy.js";
 /** The secret-free Team job; no provider token enters publication. */
 const jobSchema = Schema.Struct({
     jobId: Schema.NonEmptyString,
@@ -177,6 +178,8 @@ export function createTeamBuildPublisher(options) {
 export function teamAppBuildCommand(configuration, uploadGrant) {
     const encoded = base64url.encode(JSON.stringify({
         uploadGrant,
+        // A builder that predates this policy refuses the whole request.
+        buildPolicy: workspaceBuildPolicy,
         appId: configuration.appId,
         sourceRevision: configuration.sourceRevision,
         recipe: configuration.source.recipe,
@@ -191,7 +194,10 @@ export function teamAppBuildCommand(configuration, uploadGrant) {
         `trap 'rm -rf "$work"' EXIT`,
         'mkdir "$work/tmp"',
         'export TMPDIR="$work/tmp"',
+        "clone_started=$(date +%s%3N)",
         'git clone -q --no-checkout -- "$TEAM_BUILD_REMOTE" "$work/source" 2>/dev/null',
-        `node /opt/fungi/team-candidate-builder.mjs '${encoded}' "$work/source" "$work/candidate.json"`,
+        // The builder reports each phase's duration with its outcome.
+        "export TEAM_BUILD_CLONE_MS=$(( $(date +%s%3N) - clone_started ))",
+        `node /opt/fungi/team-candidate-builder.mjs '${encoded}' "$work/source" "$work/candidate"`,
     ].join("\n");
 }

package/dist/build/build-policy.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The pinned workspace build policy: how a captured workspace's manifests
+ * build (`package.json#fungi.build`). v2 lets a dependency name its own
+ * package build script, which only an admitted Computer build runs.
+ *
+ * It is part of every workspace HTML recipe's toolchain, so its digest moves
+ * with it, and the Computer build request carries it at the top level, where
+ * a builder compiled before it existed refuses the request outright.
+ */
+export declare const workspaceBuildPolicy = "package-json-fungi-build-v2";

package/dist/build/build-policy.js

@@ -0,0 +1,10 @@
+/**
+ * The pinned workspace build policy: how a captured workspace's manifests
+ * build (`package.json#fungi.build`). v2 lets a dependency name its own
+ * package build script, which only an admitted Computer build runs.
+ *
+ * It is part of every workspace HTML recipe's toolchain, so its digest moves
+ * with it, and the Computer build request carries it at the top level, where
+ * a builder compiled before it existed refuses the request outright.
+ */
+export const workspaceBuildPolicy = "package-json-fungi-build-v2";

package/dist/build/build-step.d.ts

@@ -3,7 +3,10 @@ import * as Schema from "effect/Schema";
  * One captured dependency build step. Paths are relative to the captured
  * snapshot root. A TypeScript step compiles one config; a Tailwind step
  * compiles one stylesheet input into its output (the same path for an App's
- * own stylesheet, which compiles in place).
+ * own stylesheet, which compiles in place). A script step runs the one
+ * `package.json` script a workspace dependency names as its build
+ * (`fungi.build.script`), with pnpm, in that package's directory; only an
+ * admitted Computer build executes it.
  */
 export declare const workspaceBuildStepSchema: Schema.Union<readonly [Schema.Struct<{
     readonly kind: Schema.Literal<"typescript">;
@@ -12,6 +15,10 @@ export declare const workspaceBuildStepSchema: Schema.Union<readonly [Schema.Str
     readonly kind: Schema.Literal<"tailwind">;
     readonly input: Schema.String;
     readonly output: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"script">;
+    readonly directory: Schema.String;
+    readonly script: Schema.String;
 }>]>;
 /** One captured dependency build step. */
 export type WorkspaceBuildStep = Schema.Schema.Type<typeof workspaceBuildStepSchema>;
@@ -23,4 +30,8 @@ export declare const workspaceBuildStepsJsonSchema: Schema.fromJsonString<Schema
     readonly kind: Schema.Literal<"tailwind">;
     readonly input: Schema.String;
     readonly output: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"script">;
+    readonly directory: Schema.String;
+    readonly script: Schema.String;
 }>]>>>;

package/dist/build/build-step.js

@@ -3,7 +3,10 @@ import * as Schema from "effect/Schema";
  * One captured dependency build step. Paths are relative to the captured
  * snapshot root. A TypeScript step compiles one config; a Tailwind step
  * compiles one stylesheet input into its output (the same path for an App's
- * own stylesheet, which compiles in place).
+ * own stylesheet, which compiles in place). A script step runs the one
+ * `package.json` script a workspace dependency names as its build
+ * (`fungi.build.script`), with pnpm, in that package's directory; only an
+ * admitted Computer build executes it.
  */
 export const workspaceBuildStepSchema = Schema.Union([
     Schema.Struct({
@@ -15,6 +18,11 @@ export const workspaceBuildStepSchema = Schema.Union([
         input: Schema.String,
         output: Schema.String,
     }),
+    Schema.Struct({
+        kind: Schema.Literal("script"),
+        directory: Schema.String,
+        script: Schema.String,
+    }),
 ]);
 /** The steps one dependency-build process runs, encoded as one argument. */
 export const workspaceBuildStepsJsonSchema = Schema.fromJsonString(Schema.Array(workspaceBuildStepSchema));

package/dist/build/candidate-builder.d.ts

@@ -0,0 +1,68 @@
+import * as Schema from "effect/Schema";
+export declare class TeamCandidateBuildError extends Error {
+    readonly code: "invalid_recipe" | "output_limit" | "report_failed";
+    constructor(code: "invalid_recipe" | "output_limit" | "report_failed");
+}
+export declare const teamCandidateConfigurationSchema: Schema.Struct<{
+    /** The build policy the host expects; a builder that predates it refuses
+     * the request, and this one refuses any other. */
+    readonly buildPolicy: Schema.Literal<"package-json-fungi-build-v2">;
+    readonly appId: Schema.refine<import("@fungi.computer/puffball").AppId, Schema.String>;
+    readonly sourceRevision: Schema.refine<import("@fungi.computer/puffball").SourceRevision, Schema.String>;
+    readonly recipe: Schema.Struct<{
+        readonly kind: Schema.optional<Schema.Literals<readonly ["bundled-html", "source-html"]>>;
+        readonly bundle: Schema.Literal<true>;
+        readonly entry: Schema.String;
+        readonly format: Schema.Literals<readonly ["html", "esm", "assets"]>;
+        readonly assets: Schema.optional<Schema.Struct<{
+            readonly maxManifestBytes: Schema.Number;
+            readonly maxObjects: Schema.Number;
+            readonly maxObjectBytes: Schema.Number;
+            readonly maxTotalBytes: Schema.Number;
+        }>>;
+        readonly assetBase: Schema.optionalKey<Schema.String>;
+        readonly toolchain: Schema.$Record<Schema.String, Schema.String>;
+        readonly maxOutputBytes: Schema.Number;
+        readonly platform: Schema.Literals<readonly ["browser", "neutral"]>;
+        readonly backend: Schema.Union<readonly [Schema.Null, Schema.Struct<{
+            readonly entry: Schema.optional<Schema.String>;
+            readonly runtime: Schema.Struct<{
+                readonly kind: Schema.Literal<"durable-facet">;
+                readonly stateSchema: Schema.Number;
+            }>;
+            readonly compatibilityDate: Schema.String;
+            readonly exportName: Schema.String;
+        }>]>;
+        readonly target: Schema.Tuple<readonly [Schema.Literal<"es2022">]>;
+    }>;
+    readonly buildRecipeDigest: Schema.refine<import("@fungi.computer/puffball").Sha256Digest, Schema.String>;
+}>;
+/** Where a built candidate's manifest and its objects are written. */
+export declare function teamCandidateLayout(outputPath: string): {
+    manifest: string;
+    object: (digest: string) => string;
+};
+/**
+ * Runs inside the admitted Computer, using Oyster's captured builder.
+ * This is the one composition that runs a dependency's declared package
+ * build script; its executor refuses a recipe pinned under another policy.
+ * It writes a new directory: each built object under its digest, and the
+ * small manifest that names them, ready to upload one at a time.
+ */
+export declare function buildTeamCandidate(input: {
+    configuration: unknown;
+    repositoryPath: string;
+    /** A directory this build creates; it must not exist yet. */
+    outputPath: string;
+    /** Trusted Computer-local cache; never part of customer configuration. */
+    packageStoreDirectory?: string;
+}): Promise<Readonly<{
+    digest: string;
+    bytes: number;
+    /** Milliseconds: capturing the cloned source, installing, compiling. */
+    phases: Readonly<{
+        capture: number;
+        install: number;
+        build: number;
+    }>;
+}>>;

package/dist/build/candidate-builder.js

@@ -0,0 +1,91 @@
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { appIdSchema, sourceRevisionSchema, sha256DigestSchema, } from "@fungi.computer/puffball/effect";
+import { parseReleaseId } from "@fungi.computer/puffball";
+import { capturedPinnedRecipeSchema, createCapturedCandidatePreparer, digestPinnedRecipe, encodeTeamAppCandidateManifest, TEAM_APP_CANDIDATE_MANIFEST_MAX_BYTES, workspaceBuildPolicy, } from "../build-contract.js";
+import { createLocalCommitSourceCapture, createLocalBuildExecutor, stageBuildOutput, } from "../build.js";
+export class TeamCandidateBuildError extends Error {
+    code;
+    constructor(code) {
+        super(`Team candidate ${code}`);
+        this.code = code;
+        this.name = "TeamCandidateBuildError";
+    }
+}
+export const teamCandidateConfigurationSchema = Schema.Struct({
+    /** The build policy the host expects; a builder that predates it refuses
+     * the request, and this one refuses any other. */
+    buildPolicy: Schema.Literal(workspaceBuildPolicy),
+    appId: appIdSchema,
+    sourceRevision: sourceRevisionSchema,
+    recipe: capturedPinnedRecipeSchema,
+    buildRecipeDigest: sha256DigestSchema,
+});
+/** Where a built candidate's manifest and its objects are written. */
+export function teamCandidateLayout(outputPath) {
+    return {
+        manifest: join(outputPath, "manifest.json"),
+        object: (digest) => join(outputPath, "objects", digest.replace(":", "-")),
+    };
+}
+/**
+ * Runs inside the admitted Computer, using Oyster's captured builder.
+ * This is the one composition that runs a dependency's declared package
+ * build script; its executor refuses a recipe pinned under another policy.
+ * It writes a new directory: each built object under its digest, and the
+ * small manifest that names them, ready to upload one at a time.
+ */
+export async function buildTeamCandidate(input) {
+    const config = Schema.decodeUnknownSync(teamCandidateConfigurationSchema, {
+        onExcessProperty: "error",
+    })(input.configuration);
+    if (digestPinnedRecipe(config.recipe) !== config.buildRecipeDigest)
+        throw new TeamCandidateBuildError("invalid_recipe");
+    const phases = { install: 0, build: 0 };
+    const onPhase = (phase, milliseconds) => {
+        phases[phase] += milliseconds;
+    };
+    const prepareStarted = performance.now();
+    const candidate = await Effect.runPromise(createCapturedCandidatePreparer(config, {
+        sourceCapture: createLocalCommitSourceCapture(input.repositoryPath, config.sourceRevision),
+        buildExecutor: createLocalBuildExecutor(input.packageStoreDirectory === undefined
+            ? { packageScripts: "run", onPhase }
+            : {
+                packageScripts: "run",
+                packageStoreDirectory: input.packageStoreDirectory,
+                onPhase,
+            }),
+    }).prepareCandidate(parseReleaseId("rel_build")));
+    const prepared = performance.now() - prepareStarted;
+    const staged = stageBuildOutput(candidate.output);
+    const bytes = Buffer.from(encodeTeamAppCandidateManifest({
+        appId: candidate.appId,
+        output: staged.manifest,
+        provenance: candidate.provenance,
+    }));
+    if (bytes.byteLength > TEAM_APP_CANDIDATE_MANIFEST_MAX_BYTES)
+        throw new TeamCandidateBuildError("output_limit");
+    const layout = teamCandidateLayout(input.outputPath);
+    // A new directory: an earlier build's output is never mixed in.
+    await mkdir(input.outputPath, { mode: 0o700 });
+    await mkdir(join(input.outputPath, "objects"), { mode: 0o700 });
+    for (const object of staged.objects)
+        await writeFile(layout.object(object.digest), object.bytes, {
+            flag: "wx",
+            mode: 0o600,
+        });
+    await writeFile(layout.manifest, bytes, { flag: "wx", mode: 0o600 });
+    return {
+        digest: `sha256:${createHash("sha256").update(bytes).digest("hex")}`,
+        bytes: bytes.byteLength,
+        phases: {
+            // Snapshot capture and staging: everything but the install and compile.
+            capture: Math.max(0, prepared - phases.install - phases.build),
+            install: phases.install,
+            build: phases.build,
+        },
+    };
+}

package/dist/build/candidate-cli.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/build/candidate-cli.js

@@ -0,0 +1,119 @@
+import * as Schema from "effect/Schema";
+import { releaseSchema } from "@fungi.computer/puffball/effect";
+import { readFile } from "node:fs/promises";
+import { candidateManifestObjects, teamAppCandidateManifestSchema, } from "../build-contract.js";
+import { buildTeamCandidate, teamCandidateConfigurationSchema, teamCandidateLayout, TeamCandidateBuildError, } from "./candidate-builder.js";
+/** Objects in flight at once; each is read from disk only while it uploads. */
+const uploadConcurrency = 4;
+/** Attempts per object when its connection drops before a response. */
+const uploadAttempts = 3;
+/** Report a failed build to the host's build output: its kind, never its text. */
+function reportFailure(cause) {
+    process.stderr.write(`${JSON.stringify({
+        source: "oyster-candidate-builder",
+        failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+    })}\n`);
+}
+const [configuration, repositoryPath, outputPath] = process.argv.slice(2);
+if (!configuration || !repositoryPath || !outputPath)
+    throw new Error("Usage: team-candidate-builder CONFIG_BASE64 REPOSITORY OUTPUT_DIRECTORY");
+try {
+    const { uploadGrant, ...config } = Schema.decodeUnknownSync(Schema.Struct({
+        ...teamCandidateConfigurationSchema.fields,
+        uploadGrant: Schema.String,
+    }), { onExcessProperty: "error" })(JSON.parse(Buffer.from(configuration, "base64url").toString("utf8")));
+    const { phases, ...artifact } = await buildTeamCandidate({
+        configuration: config,
+        repositoryPath,
+        outputPath,
+        // Computer scratch survives captured snapshot cleanup, without a global or durable Workspace store.
+        packageStoreDirectory: "/var/tmp/fungi-app-package-store",
+    });
+    const reportUrl = process.env.TEAM_BUILD_REPORT;
+    if (!reportUrl)
+        throw new TeamCandidateBuildError("report_failed");
+    const layout = teamCandidateLayout(outputPath);
+    const manifestBytes = await readFile(layout.manifest);
+    const manifest = Schema.decodeUnknownSync(Schema.fromJsonString(teamAppCandidateManifestSchema))(new TextDecoder().decode(manifestBytes));
+    // Every object first, each streamed alone; the manifest only names them.
+    const uploadStarted = performance.now();
+    const pending = [...candidateManifestObjects(manifest.output)];
+    // A write-once PUT is safe to repeat, so a dropped connection is retried.
+    const put = async (object) => {
+        for (let attempt = 1;; attempt += 1) {
+            const stored = await fetch(`${reportUrl}/objects/${object.digest.replace(":", "-")}`, {
+                method: "PUT",
+                headers: {
+                    "Content-Type": object.mediaType,
+                    "X-Team-App-Build": uploadGrant,
+                },
+                body: await readFile(layout.object(object.digest)),
+            }).catch((cause) => {
+                if (attempt >= uploadAttempts)
+                    throw cause;
+                return null;
+            });
+            await stored?.body?.cancel();
+            if (stored?.ok)
+                return;
+            if (stored !== null || attempt >= uploadAttempts)
+                throw new TeamCandidateBuildError("report_failed");
+        }
+    };
+    const upload = async () => {
+        for (let object = pending.shift(); object; object = pending.shift())
+            await put(object);
+    };
+    await Promise.all(Array.from({ length: uploadConcurrency }, upload));
+    const candidate = await fetch(`${reportUrl}/candidate`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "X-Team-App-Build": uploadGrant,
+        },
+        body: manifestBytes,
+    });
+    if (!candidate.ok)
+        throw new TeamCandidateBuildError("report_failed");
+    const receipt = Schema.decodeUnknownSync(Schema.Struct({
+        kind: Schema.Literal("submitted"),
+        release: releaseSchema,
+    }))(await candidate.json());
+    const recorded = await fetch(`${reportUrl}/artifact`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(artifact),
+    });
+    if (!recorded.ok)
+        throw new TeamCandidateBuildError("report_failed");
+    await recorded.body?.cancel();
+    const uploaded = performance.now() - uploadStarted;
+    // The success detail reports where the build's time went; the owner reads
+    // it with the build. The clone ran before this program (TEAM_BUILD_CLONE_MS).
+    const cloned = Number(process.env.TEAM_BUILD_CLONE_MS ?? "0");
+    const status = await fetch(`${reportUrl}/status`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            status: "succeeded",
+            detail: JSON.stringify({
+                phasesMs: {
+                    clone: Math.round((Number.isFinite(cloned) ? cloned : 0) + phases.capture),
+                    install: Math.round(phases.install),
+                    build: Math.round(phases.build),
+                    upload: Math.round(uploaded),
+                },
+            }),
+        }),
+    });
+    if (!status.ok)
+        throw new TeamCandidateBuildError("report_failed");
+    await status.body?.cancel();
+    process.stdout.write(JSON.stringify({ ...artifact, release: receipt.release }));
+}
+catch (cause) {
+    reportFailure(cause);
+    // Customer source and provider messages can contain secrets; only expose the stage.
+    process.stderr.write("Team App source/build failed\n");
+    process.exitCode = 1;
+}