@git.zone/tsrust 1.8.0 → 1.9.0

package/dist_ts/mod_provenance/classes.gitstate.js

@@ -0,0 +1,34 @@
+import * as childProcess from 'child_process';
+import * as util from 'util';
+const execFile = util.promisify(childProcess.execFile);
+export async function captureGitSnapshot(cwdArg) {
+    let commit;
+    try {
+        const result = await execFile('git', ['-C', cwdArg, 'rev-parse', 'HEAD'], {
+            encoding: 'utf8',
+        });
+        commit = result.stdout.trim();
+    }
+    catch {
+        return { available: false, commit: 'unknown', status: '' };
+    }
+    try {
+        const status = await execFile('git', ['-C', cwdArg, 'status', '--porcelain=v1', '--untracked-files=all'], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+        return {
+            available: true,
+            commit,
+            status: status.stdout,
+        };
+    }
+    catch {
+        throw new Error('Failed to inspect Git worktree state');
+    }
+}
+export function assertGitSnapshotUnchanged(beforeArg, afterArg) {
+    if (beforeArg.available !== afterArg.available ||
+        beforeArg.commit !== afterArg.commit ||
+        beforeArg.status !== afterArg.status) {
+        throw new Error('Git source state changed while Cargo was building');
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5naXRzdGF0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL21vZF9wcm92ZW5hbmNlL2NsYXNzZXMuZ2l0c3RhdGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLFlBQVksTUFBTSxlQUFlLENBQUM7QUFDOUMsT0FBTyxLQUFLLElBQUksTUFBTSxNQUFNLENBQUM7QUFFN0IsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUM7QUFRdkQsTUFBTSxDQUFDLEtBQUssVUFBVSxrQkFBa0IsQ0FBQyxNQUFjO0lBQ3JELElBQUksTUFBYyxDQUFDO0lBQ25CLElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sUUFBUSxDQUFDLEtBQUssRUFBRSxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLE1BQU0sQ0FBQyxFQUFFO1lBQ3hFLFFBQVEsRUFBRSxNQUFNO1NBQ2pCLENBQUMsQ0FBQztRQUNILE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2hDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUUsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxRQUFRLENBQzNCLEtBQUssRUFDTCxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLGdCQUFnQixFQUFFLHVCQUF1QixDQUFDLEVBQ25FLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJLEVBQUUsQ0FDbEQsQ0FBQztRQUNGLE9BQU87WUFDTCxTQUFTLEVBQUUsSUFBSTtZQUNmLE1BQU07WUFDTixNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU07U0FDdEIsQ0FBQztJQUNKLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFDMUQsQ0FBQztBQUNILENBQUM7QUFFRCxNQUFNLFVBQVUsMEJBQTBCLENBQ3hDLFNBQXVCLEVBQ3ZCLFFBQXNCO0lBRXRCLElBQ0UsU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsU0FBUztRQUMxQyxTQUFTLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxNQUFNO1FBQ3BDLFNBQVMsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLE1BQU0sRUFDcEMsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUN2RSxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist_ts/mod_provenance/classes.provenancestore.d.ts

@@ -0,0 +1,11 @@
+import type { ITsrustBuildInfo } from '../mod_elf/index.js';
+export declare const PROVENANCE_SIDECAR_SUFFIX = ".tsrust-build.json";
+export declare class ProvenanceStore {
+    static sidecarPath(binaryPathArg: string): string;
+    static sha256(binaryPathArg: string): Promise<string>;
+    static write(binaryPathArg: string, infoArg: ITsrustBuildInfo): Promise<string>;
+    private static readExistingSidecar;
+    private static recoverTemporaryFiles;
+    static readSidecar(binaryPathArg: string): Promise<ITsrustBuildInfo>;
+    static read(binaryPathArg: string): Promise<ITsrustBuildInfo | undefined>;
+}

package/dist_ts/mod_provenance/classes.provenancestore.js

@@ -0,0 +1,184 @@
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import { ProvenanceStamper } from '../mod_elf/index.js';
+import { getHostIdentity, isLocalProcessRunning } from './helpers.owneridentity.js';
+const SIDECAR_FORMAT = 'tsrust.build-provenance.v2';
+export const PROVENANCE_SIDECAR_SUFFIX = '.tsrust-build.json';
+function isBuildInfo(valueArg) {
+    if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg))
+        return false;
+    const value = valueArg;
+    return (typeof value.binary === 'string' &&
+        typeof value.target === 'string' &&
+        typeof value.projectName === 'string' &&
+        typeof value.projectVersion === 'string' &&
+        typeof value.gitCommit === 'string' &&
+        typeof value.builtAt === 'string' &&
+        typeof value.tsrustVersion === 'string' &&
+        (value.gitDirty === undefined || typeof value.gitDirty === 'boolean'));
+}
+export class ProvenanceStore {
+    static sidecarPath(binaryPathArg) {
+        return `${binaryPathArg}${PROVENANCE_SIDECAR_SUFFIX}`;
+    }
+    static async sha256(binaryPathArg) {
+        const binary = await fs.promises.lstat(binaryPathArg);
+        if (!binary.isFile() || binary.isSymbolicLink()) {
+            throw new Error(`Provenance binary is not a regular file: ${binaryPathArg}`);
+        }
+        const digest = crypto.createHash('sha256');
+        await new Promise((resolve, reject) => {
+            const stream = fs.createReadStream(binaryPathArg);
+            stream.on('data', (chunk) => digest.update(chunk));
+            stream.on('error', reject);
+            stream.on('end', resolve);
+        });
+        return digest.digest('hex');
+    }
+    static async write(binaryPathArg, infoArg) {
+        if (!isBuildInfo(infoArg)) {
+            throw new Error('Provenance build information has an invalid shape');
+        }
+        const binary = await fs.promises.lstat(binaryPathArg);
+        if (!binary.isFile() || binary.isSymbolicLink()) {
+            throw new Error(`Provenance binary is not a regular file: ${binaryPathArg}`);
+        }
+        const sidecarPath = ProvenanceStore.sidecarPath(binaryPathArg);
+        await ProvenanceStore.recoverTemporaryFiles(sidecarPath);
+        const existing = await ProvenanceStore.readExistingSidecar(binaryPathArg);
+        if (existing) {
+            if (JSON.stringify(existing) === JSON.stringify(infoArg))
+                return sidecarPath;
+            throw new Error(`Provenance sidecar already exists with different build information: ${sidecarPath}`);
+        }
+        const record = {
+            format: SIDECAR_FORMAT,
+            binarySha256: await ProvenanceStore.sha256(binaryPathArg),
+            buildInfo: infoArg,
+        };
+        const temporaryPath = `${sidecarPath}.${getHostIdentity()}.${process.pid}.${crypto.randomUUID()}.tmp`;
+        let temporary;
+        try {
+            temporary = await fs.promises.open(temporaryPath, 'wx', 0o600);
+            await temporary.writeFile(`${JSON.stringify(record, null, 2)}\n`, 'utf8');
+            await temporary.chmod(0o644);
+            await temporary.sync();
+            await temporary.close();
+            temporary = undefined;
+            try {
+                await fs.promises.link(temporaryPath, sidecarPath);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                const concurrentlyWritten = await ProvenanceStore.readSidecar(binaryPathArg);
+                if (JSON.stringify(concurrentlyWritten) !== JSON.stringify(infoArg)) {
+                    throw new Error(`Concurrent provenance write disagreed for ${binaryPathArg}`);
+                }
+            }
+            await fs.promises.unlink(temporaryPath);
+            const directory = await fs.promises.open(path.dirname(sidecarPath), 'r');
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+            return sidecarPath;
+        }
+        finally {
+            await Promise.allSettled([
+                temporary?.close() || Promise.resolve(),
+                fs.promises.rm(temporaryPath, { force: true }),
+            ]);
+        }
+    }
+    static async readExistingSidecar(binaryPathArg) {
+        try {
+            return await ProvenanceStore.readSidecar(binaryPathArg);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+    }
+    static async recoverTemporaryFiles(sidecarPathArg) {
+        const directoryPath = path.dirname(sidecarPathArg);
+        const temporaryPrefix = `${path.basename(sidecarPathArg)}.`;
+        const entries = await fs.promises.readdir(directoryPath, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.name.startsWith(temporaryPrefix) || !entry.name.endsWith('.tmp')) {
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const suffix = entry.name.slice(temporaryPrefix.length, -'.tmp'.length);
+            const [hostIdentity, pidText, identifier, ...unexpected] = suffix.split('.');
+            const pid = Number(pidText);
+            if (unexpected.length > 0 ||
+                !/^[a-f0-9]{64}$/.test(hostIdentity || '') ||
+                !Number.isSafeInteger(pid) ||
+                !/^[a-f0-9-]{36}$/.test(identifier || '') ||
+                hostIdentity !== getHostIdentity() ||
+                isLocalProcessRunning(pid)) {
+                continue;
+            }
+            const temporaryPath = path.join(directoryPath, entry.name);
+            try {
+                const temporary = await fs.promises.lstat(temporaryPath);
+                if (temporary.isFile() && !temporary.isSymbolicLink()) {
+                    await fs.promises.rm(temporaryPath, { force: true });
+                }
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+    }
+    static async readSidecar(binaryPathArg) {
+        const sidecarPath = ProvenanceStore.sidecarPath(binaryPathArg);
+        const sidecar = await fs.promises.lstat(sidecarPath);
+        if (!sidecar.isFile() || sidecar.isSymbolicLink()) {
+            throw new Error(`Provenance sidecar is not a regular file: ${sidecarPath}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(await fs.promises.readFile(sidecarPath, 'utf8'));
+        }
+        catch {
+            throw new Error(`Provenance sidecar is invalid JSON: ${sidecarPath}`);
+        }
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error(`Provenance sidecar has an invalid shape: ${sidecarPath}`);
+        }
+        const record = parsed;
+        if (record.format !== SIDECAR_FORMAT ||
+            typeof record.binarySha256 !== 'string' ||
+            !/^[a-f0-9]{64}$/.test(record.binarySha256) ||
+            !isBuildInfo(record.buildInfo)) {
+            throw new Error(`Provenance sidecar has an unsupported shape: ${sidecarPath}`);
+        }
+        const actualSha256 = await ProvenanceStore.sha256(binaryPathArg);
+        if (actualSha256 !== record.binarySha256) {
+            throw new Error(`Provenance sidecar hash does not match ${binaryPathArg}`);
+        }
+        return record.buildInfo;
+    }
+    static async read(binaryPathArg) {
+        const sidecarPath = ProvenanceStore.sidecarPath(binaryPathArg);
+        try {
+            await fs.promises.lstat(sidecarPath);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                return ProvenanceStamper.read(binaryPathArg);
+            }
+            throw error;
+        }
+        return ProvenanceStore.readSidecar(binaryPathArg);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5wcm92ZW5hbmNlc3RvcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9tb2RfcHJvdmVuYW5jZS9jbGFzc2VzLnByb3ZlbmFuY2VzdG9yZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssTUFBTSxNQUFNLFFBQVEsQ0FBQztBQUNqQyxPQUFPLEtBQUssRUFBRSxNQUFNLElBQUksQ0FBQztBQUN6QixPQUFPLEtBQUssSUFBSSxNQUFNLE1BQU0sQ0FBQztBQUU3QixPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN4RCxPQUFPLEVBQUUsZUFBZSxFQUFFLHFCQUFxQixFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFFcEYsTUFBTSxjQUFjLEdBQUcsNEJBQTRCLENBQUM7QUFDcEQsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsb0JBQW9CLENBQUM7QUFROUQsU0FBUyxXQUFXLENBQUMsUUFBaUI7SUFDcEMsSUFBSSxDQUFDLFFBQVEsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUN2RixNQUFNLEtBQUssR0FBRyxRQUFtQyxDQUFDO0lBQ2xELE9BQU8sQ0FDTCxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUTtRQUNoQyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUTtRQUNoQyxPQUFPLEtBQUssQ0FBQyxXQUFXLEtBQUssUUFBUTtRQUNyQyxPQUFPLEtBQUssQ0FBQyxjQUFjLEtBQUssUUFBUTtRQUN4QyxPQUFPLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUTtRQUNuQyxPQUFPLEtBQUssQ0FBQyxPQUFPLEtBQUssUUFBUTtRQUNqQyxPQUFPLEtBQUssQ0FBQyxhQUFhLEtBQUssUUFBUTtRQUN2QyxDQUFDLEtBQUssQ0FBQyxRQUFRLEtBQUssU0FBUyxJQUFJLE9BQU8sS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTLENBQUMsQ0FDdEUsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLE9BQU8sZUFBZTtJQUNuQixNQUFNLENBQUMsV0FBVyxDQUFDLGFBQXFCO1FBQzdDLE9BQU8sR0FBRyxhQUFhLEdBQUcseUJBQXlCLEVBQUUsQ0FBQztJQUN4RCxDQUFDO0lBRU0sTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsYUFBcUI7UUFDOUMsTUFBTSxNQUFNLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUN0RCxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxJQUFJLE1BQU0sQ0FBQyxjQUFjLEVBQUUsRUFBRSxDQUFDO1lBQ2hELE1BQU0sSUFBSSxLQUFLLENBQUMsNENBQTRDLGFBQWEsRUFBRSxDQUFDLENBQUM7UUFDL0UsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDM0MsTUFBTSxJQUFJLE9BQU8sQ0FBTyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUMxQyxNQUFNLE1BQU0sR0FBRyxFQUFFLENBQUMsZ0JBQWdCLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDbEQsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUNuRCxNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztZQUMzQixNQUFNLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUNILE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM5QixDQUFDO0lBRU0sTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsYUFBcUIsRUFBRSxPQUF5QjtRQUN4RSxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ3RELElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLElBQUksTUFBTSxDQUFDLGNBQWMsRUFBRSxFQUFFLENBQUM7WUFDaEQsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUMvRSxDQUFDO1FBQ0QsTUFBTSxXQUFXLEdBQUcsZUFBZSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMvRCxNQUFNLGVBQWUsQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUN6RCxNQUFNLFFBQVEsR0FBRyxNQUFNLGVBQWUsQ0FBQyxtQkFBbUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMxRSxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQ2IsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDO2dCQUFFLE9BQU8sV0FBVyxDQUFDO1lBQzdFLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLFdBQVcsRUFBRSxDQUFDLENBQUM7UUFDeEcsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUF1QjtZQUNqQyxNQUFNLEVBQUUsY0FBYztZQUN0QixZQUFZLEVBQUUsTUFBTSxlQUFlLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQztZQUN6RCxTQUFTLEVBQUUsT0FBTztTQUNuQixDQUFDO1FBQ0YsTUFBTSxhQUFhLEdBQUcsR0FBRyxXQUFXLElBQUksZUFBZSxFQUFFLElBQUksT0FBTyxDQUFDLEdBQUcsSUFBSSxNQUFNLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQztRQUN0RyxJQUFJLFNBQTZDLENBQUM7UUFDbEQsSUFBSSxDQUFDO1lBQ0gsU0FBUyxHQUFHLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztZQUMvRCxNQUFNLFNBQVMsQ0FBQyxTQUFTLENBQUMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztZQUMxRSxNQUFNLFNBQVMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDN0IsTUFBTSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDdkIsTUFBTSxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDeEIsU0FBUyxHQUFHLFNBQVMsQ0FBQztZQUN0QixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsV0FBVyxDQUFDLENBQUM7WUFDckQsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSyxLQUErQixDQUFDLElBQUksS0FBSyxRQUFRO29CQUFFLE1BQU0sS0FBSyxDQUFDO2dCQUNwRSxNQUFNLG1CQUFtQixHQUFHLE1BQU0sZUFBZSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsQ0FBQztnQkFDN0UsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO29CQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxhQUFhLEVBQUUsQ0FBQyxDQUFDO2dCQUNoRixDQUFDO1lBQ0gsQ0FBQztZQUNELE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDeEMsTUFBTSxTQUFTLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQ3pFLElBQUksQ0FBQztnQkFDSCxNQUFNLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUN6QixDQUFDO29CQUFTLENBQUM7Z0JBQ1QsTUFBTSxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDMUIsQ0FBQztZQUNELE9BQU8sV0FBVyxDQUFDO1FBQ3JCLENBQUM7Z0JBQVMsQ0FBQztZQUNULE1BQU0sT0FBTyxDQUFDLFVBQVUsQ0FBQztnQkFDdkIsU0FBUyxFQUFFLEtBQUssRUFBRSxJQUFJLE9BQU8sQ0FBQyxPQUFPLEVBQUU7Z0JBQ3ZDLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQzthQUMvQyxDQUFDLENBQUM7UUFDTCxDQUFDO0lBQ0gsQ0FBQztJQUVPLE1BQU0sQ0FBQyxLQUFLLENBQUMsbUJBQW1CLENBQ3RDLGFBQXFCO1FBRXJCLElBQUksQ0FBQztZQUNILE9BQU8sTUFBTSxlQUFlLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSyxLQUErQixDQUFDLElBQUksS0FBSyxRQUFRO2dCQUFFLE9BQU8sU0FBUyxDQUFDO1lBQ3pFLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztJQUNILENBQUM7SUFFTyxNQUFNLENBQUMsS0FBSyxDQUFDLHFCQUFxQixDQUFDLGNBQXNCO1FBQy9ELE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDbkQsTUFBTSxlQUFlLEdBQUcsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUM7UUFDNUQsTUFBTSxPQUFPLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxhQUFhLEVBQUUsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNsRixLQUFLLE1BQU0sS0FBSyxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQzVCLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7Z0JBQzVFLFNBQVM7WUFDWCxDQUFDO1lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUU7Z0JBQUUsU0FBUztZQUM5QixNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxlQUFlLENBQUMsTUFBTSxFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3hFLE1BQU0sQ0FBQyxZQUFZLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxHQUFHLFVBQVUsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDN0UsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQzVCLElBQ0UsVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDO2dCQUNyQixDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxZQUFZLElBQUksRUFBRSxDQUFDO2dCQUMxQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDO2dCQUMxQixDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxVQUFVLElBQUksRUFBRSxDQUFDO2dCQUN6QyxZQUFZLEtBQUssZUFBZSxFQUFFO2dCQUNsQyxxQkFBcUIsQ0FBQyxHQUFHLENBQUMsRUFDMUIsQ0FBQztnQkFDRCxTQUFTO1lBQ1gsQ0FBQztZQUNELE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUMzRCxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxTQUFTLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQztnQkFDekQsSUFBSSxTQUFTLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFLEVBQUUsQ0FBQztvQkFDdEQsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxhQUFhLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDdkQsQ0FBQztZQUNILENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUssS0FBK0IsQ0FBQyxJQUFJLEtBQUssUUFBUTtvQkFBRSxNQUFNLEtBQUssQ0FBQztZQUN0RSxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxhQUFxQjtRQUNuRCxNQUFNLFdBQVcsR0FBRyxlQUFlLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQy9ELE1BQU0sT0FBTyxHQUFHLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDckQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsSUFBSSxPQUFPLENBQUMsY0FBYyxFQUFFLEVBQUUsQ0FBQztZQUNsRCxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxJQUFJLE1BQWUsQ0FBQztRQUNwQixJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFdBQVcsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDbkUsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsV0FBVyxFQUFFLENBQUMsQ0FBQztRQUM3RSxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQUcsTUFBcUMsQ0FBQztRQUNyRCxJQUNFLE1BQU0sQ0FBQyxNQUFNLEtBQUssY0FBYztZQUNoQyxPQUFPLE1BQU0sQ0FBQyxZQUFZLEtBQUssUUFBUTtZQUN2QyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDO1lBQzNDLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsRUFDOUIsQ0FBQztZQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0RBQWdELFdBQVcsRUFBRSxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUNELE1BQU0sWUFBWSxHQUFHLE1BQU0sZUFBZSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNqRSxJQUFJLFlBQVksS0FBSyxNQUFNLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDekMsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUM3RSxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUMsU0FBUyxDQUFDO0lBQzFCLENBQUM7SUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxhQUFxQjtRQUM1QyxNQUFNLFdBQVcsR0FBRyxlQUFlLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQy9ELElBQUksQ0FBQztZQUNILE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDdkMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFLLEtBQStCLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUN2RCxPQUFPLGlCQUFpQixDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUMvQyxDQUFDO1lBQ0QsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO1FBQ0QsT0FBTyxlQUFlLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3BELENBQUM7Q0FDRiJ9

package/dist_ts/mod_provenance/helpers.owneridentity.d.ts

@@ -0,0 +1,2 @@
+export declare function getHostIdentity(): string;
+export declare function isLocalProcessRunning(pidArg: number): boolean;

package/dist_ts/mod_provenance/helpers.owneridentity.js

@@ -0,0 +1,57 @@
+import * as childProcess from 'child_process';
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as os from 'os';
+let cachedHostIdentity;
+function readBootIdentity() {
+    if (process.platform === 'linux') {
+        try {
+            return fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+        }
+        catch {
+            // Fall through to the portable host fingerprint.
+        }
+    }
+    if (process.platform === 'darwin') {
+        try {
+            return childProcess.execFileSync('/usr/sbin/sysctl', ['-n', 'kern.boottime'], {
+                encoding: 'utf8',
+            }).trim();
+        }
+        catch {
+            // Fall through to the portable host fingerprint.
+        }
+    }
+    return String(Math.round((Date.now() - os.uptime() * 1000) / 60_000));
+}
+export function getHostIdentity() {
+    if (cachedHostIdentity)
+        return cachedHostIdentity;
+    const macAddresses = Object.values(os.networkInterfaces())
+        .flat()
+        .map((address) => address?.mac.toLowerCase())
+        .filter((address) => !!address && address !== '00:00:00:00:00:00')
+        .sort();
+    cachedHostIdentity = crypto
+        .createHash('sha256')
+        .update(JSON.stringify({
+        platform: process.platform,
+        hostname: os.hostname(),
+        bootIdentity: readBootIdentity(),
+        macAddresses,
+    }))
+        .digest('hex');
+    return cachedHostIdentity;
+}
+export function isLocalProcessRunning(pidArg) {
+    if (!Number.isSafeInteger(pidArg) || pidArg <= 0)
+        return false;
+    try {
+        process.kill(pidArg, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ESRCH';
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5vd25lcmlkZW50aXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvbW9kX3Byb3ZlbmFuY2UvaGVscGVycy5vd25lcmlkZW50aXR5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxZQUFZLE1BQU0sZUFBZSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBRXpCLElBQUksa0JBQXNDLENBQUM7QUFFM0MsU0FBUyxnQkFBZ0I7SUFDdkIsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ2pDLElBQUksQ0FBQztZQUNILE9BQU8sRUFBRSxDQUFDLFlBQVksQ0FBQyxpQ0FBaUMsRUFBRSxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUMzRSxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsaURBQWlEO1FBQ25ELENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2xDLElBQUksQ0FBQztZQUNILE9BQU8sWUFBWSxDQUFDLFlBQVksQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLElBQUksRUFBRSxlQUFlLENBQUMsRUFBRTtnQkFDNUUsUUFBUSxFQUFFLE1BQU07YUFDakIsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1osQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLGlEQUFpRDtRQUNuRCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDLE1BQU0sRUFBRSxHQUFHLElBQUksQ0FBQyxHQUFHLE1BQU0sQ0FBQyxDQUFDLENBQUM7QUFDeEUsQ0FBQztBQUVELE1BQU0sVUFBVSxlQUFlO0lBQzdCLElBQUksa0JBQWtCO1FBQUUsT0FBTyxrQkFBa0IsQ0FBQztJQUNsRCxNQUFNLFlBQVksR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1NBQ3ZELElBQUksRUFBRTtTQUNOLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztTQUM1QyxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQXFCLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxJQUFJLE9BQU8sS0FBSyxtQkFBbUIsQ0FBQztTQUNwRixJQUFJLEVBQUUsQ0FBQztJQUNWLGtCQUFrQixHQUFHLE1BQU07U0FDeEIsVUFBVSxDQUFDLFFBQVEsQ0FBQztTQUNwQixNQUFNLENBQ0wsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNiLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUTtRQUMxQixRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsRUFBRTtRQUN2QixZQUFZLEVBQUUsZ0JBQWdCLEVBQUU7UUFDaEMsWUFBWTtLQUNiLENBQUMsQ0FDSDtTQUNBLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNqQixPQUFPLGtCQUFrQixDQUFDO0FBQzVCLENBQUM7QUFFRCxNQUFNLFVBQVUscUJBQXFCLENBQUMsTUFBYztJQUNsRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLElBQUksQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQy9ELElBQUksQ0FBQztRQUNILE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3hCLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixPQUFRLEtBQStCLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQztJQUMzRCxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist_ts/mod_provenance/index.d.ts

@@ -0,0 +1,3 @@
+export { captureGitSnapshot, assertGitSnapshotUnchanged, type IGitSnapshot, } from './classes.gitstate.js';
+export { ProvenanceStore, PROVENANCE_SIDECAR_SUFFIX, } from './classes.provenancestore.js';
+export { getHostIdentity, isLocalProcessRunning } from './helpers.owneridentity.js';

package/dist_ts/mod_provenance/index.js

@@ -0,0 +1,4 @@
+export { captureGitSnapshot, assertGitSnapshotUnchanged, } from './classes.gitstate.js';
+export { ProvenanceStore, PROVENANCE_SIDECAR_SUFFIX, } from './classes.provenancestore.js';
+export { getHostIdentity, isLocalProcessRunning } from './helpers.owneridentity.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9tb2RfcHJvdmVuYW5jZS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsa0JBQWtCLEVBQ2xCLDBCQUEwQixHQUUzQixNQUFNLHVCQUF1QixDQUFDO0FBQy9CLE9BQU8sRUFDTCxlQUFlLEVBQ2YseUJBQXlCLEdBQzFCLE1BQU0sOEJBQThCLENBQUM7QUFDdEMsT0FBTyxFQUFFLGVBQWUsRUFBRSxxQkFBcUIsRUFBRSxNQUFNLDRCQUE0QixDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@git.zone/tsrust",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "private": false,
   "description": "A tool for compiling Rust projects, detecting Cargo workspaces, building with cargo, and placing binaries in a conventional dist_rust directory.",
   "main": "dist_ts/index.js",
@@ -34,8 +34,8 @@
     "@push.rocks/smartconfig": "^6.1.1",
     "@push.rocks/smartfile": "^13.1.3",
     "@push.rocks/smartpath": "^6.0.0",
-    "@push.rocks/smartshell": "^3.3.8",
-    "smol-toml": "^1.6.1"
+    "@push.rocks/smartshell": "^4.1.1",
+    "smol-toml": "^1.7.1"
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.2",

package/readme.hints.md

@@ -1,12 +1,15 @@
 # tsrust hints
 
 ## Architecture
-- Follows tsbuild patterns exactly (cli.js, cli.child.ts, cli.ts.js entry points)
-- Uses smartcli for CLI, smartshell for cargo execution, smol-toml for TOML parsing
-- Three modules: mod_cli, mod_cargo, mod_fs
+- Follows tsbuild patterns for the `cli.js` entry point and TypeScript module layout.
+- Uses smartcli for CLI dispatch, smartshell for Cargo execution, native `child_process.execFile` for Git snapshots, and smol-toml for TOML parsing.
+- `mod_artifact` owns strict multi-host assembly; `mod_provenance` owns byte-preserving, hash-bound sidecars and Git source snapshots.
 
 ## Key patterns
 - smartshell `.exec()` streams output to terminal (non-silent)
 - smartshell `.execSilent()` captures output without printing
 - Cargo workspace detection: check for `[workspace]` section in Cargo.toml
 - Binary targets: look for `[[bin]]` entries in member crate Cargo.toml files
+- New builds never append provenance to binaries. Keep legacy `ProvenanceStamper` reads for tsrust 1.7/1.8 artifacts, but use `ProvenanceStore` sidecars for all writes.
+- Host target precedence is CLI, exact host, OS family, legacy targets, then native. Assembly uses the union of all configured targets unless repeated CLI `--target` values define an explicit matrix, and rejects dirty or incomplete matrices.
+- Assembly owns only `dist_rust/`, `.nogit/tsrust-assembly*`, and transient `.nogit/.tsrust-assembly-*.tmp` owner records. Its atomically linked owner lock, serialized recovery claim, and phase journal recover readable, owner-consistent transactions; malformed or inconsistent state fails closed.

package/readme.md

@@ -50,7 +50,8 @@ This will:
 4. Run `cargo build --release` with full streaming output
 5. Store Cargo intermediates in `.nogit/tsrust-target` by default
 6. Copy each binary to `dist_rust/` with executable permissions (`chmod 755`)
-7. Report file sizes and total build time
+7. Write a SHA-256-bound provenance sidecar without changing the binary bytes
+8. Report file sizes and total build time
 
 **Example output:**
 
@@ -63,6 +64,7 @@ Running: CARGO_TARGET_DIR="/path/to/project/.nogit/tsrust-target" cargo build --
    Compiling rustproxy v0.1.0
     Finished `release` profile [optimized] target(s) in 29.01s
 Copied rustproxy (13.4 MB) -> dist_rust/rustproxy
+Wrote provenance: @example/rustproxy@1.0.0 abc123def456 (native)
 Done in 29.2s
 ```
 
@@ -127,7 +129,9 @@ When using `--target`, output binaries are named `<binname>_<os>_<arch>`:
 ```
 dist_rust/
 ├── rustproxy_linux_arm64
-└── rustproxy_linux_amd64
+├── rustproxy_linux_arm64.tsrust-build.json
+├── rustproxy_linux_amd64
+└── rustproxy_linux_amd64.tsrust-build.json
 ```
 
 `tsrust` automatically installs missing rustup targets via `rustup target add` when needed.
@@ -147,12 +151,56 @@ You can set default cross-compilation targets in your project's `.smartconfig.js
 }
 ```
 
-When targets are configured in `.smartconfig.json`, simply running `tsrust` will cross-compile for all listed targets. CLI `--target` flags take full precedence — if any `--target` is provided, the `.smartconfig.json` targets are ignored entirely.
+When targets are configured in `.smartconfig.json`, simply running `tsrust` will cross-compile for all listed targets. CLI `--target` flags determine the selected targets when provided. The complete configuration is still validated first, so malformed legacy or host-specific entries are always rejected.
+
+For builds split across Linux and macOS hosts, select targets by build host:
+
+```json
+{
+  "@git.zone/tsrust": {
+    "targetsByHost": {
+      "linux": ["linux_amd64", "linux_arm64"],
+      "macos": ["macos_amd64", "macos_arm64"]
+    },
+    "locked": true
+  }
+}
+```
+
+Host selection uses this precedence: CLI `--target`, exact host key, OS-family key, legacy `targets`, then a native build. Exact host keys are `linux_amd64`, `linux_arm64`, `macos_amd64`, and `macos_arm64`; OS-family keys are `linux` and `macos`. The selected entries are not merged, so an exact host entry completely replaces its family entry for that host.
 
 `locked: true` runs Cargo builds with `--locked` for deterministic dependency resolution. This requires `Cargo.lock` to exist and remain consistent with the manifests; Cargo fails instead of updating an inconsistent lockfile.
 
 `targetDir` is optional. It must point to a tsrust-owned path under `.nogit/`, such as `.nogit/tsrust-target` or `.nogit/tsrust-custom-target`. You can also set `TSRUST_TARGET_DIR` for one-off runs. `pruneAfterBuild: true` or `TSRUST_PRUNE_AFTER_BUILD=true` removes the marked managed target cache after binaries have been copied to `dist_rust/`.
 
+### Build Provenance
+
+Every new build writes `<binary>.tsrust-build.json` beside the binary. In a Git checkout, the sidecar records the consuming package name and version, exact commit and dirty state, target, build time, and tsrust version. Non-Git builds record `gitCommit: "unknown"` and omit `gitDirty`. The sidecar also contains the binary's SHA-256 digest, so provenance reads fail if either file no longer belongs to the pair. The binary itself remains byte-identical to Cargo's output, preserving Mach-O signatures and other binary-format integrity checks.
+
+Inspect a built artifact with:
+
+```bash
+tsrust inspect dist_rust/rustproxy_linux_amd64
+```
+
+`inspect` verifies and reads the sidecar. It retains read compatibility with provenance trailers produced by tsrust 1.7 and 1.8, but new builds no longer append those trailers.
+
+tsrust snapshots the Git commit and complete worktree status before each Cargo build and verifies that neither changed before copying artifacts. Dirty builds remain possible for development and are marked as dirty; strict multi-host assembly rejects them.
+
+### Multi-Host Assembly
+
+Each host build owns and cleans its own `dist_rust/`. Copy those host outputs into separate artifact directories, then assemble the complete matrix from the same clean Git checkout and package version:
+
+```bash
+tsrust assemble .nogit/artifacts/linux .nogit/artifacts/macos
+```
+
+The union of `targets` and `targetsByHost` defines the required target matrix. Repeated `--target` options can define an explicit matrix instead. Assembly always publishes to the tsrust-owned `dist_rust/` directory.
+
+Assembly requires every Cargo binary for every expected target. It rejects missing, duplicate, unexpected, non-executable, symlinked, hash-mismatched, dirty, wrong-commit, wrong-package, and wrong-tsrust-version inputs. Validation and copying happen in a same-filesystem transaction under `.nogit/tsrust-assembly/`, guarded by the atomically published `.nogit/tsrust-assembly.lock`. The Git commit, clean worktree, and package identity are checked again immediately before publication. The previous output is retained until the complete staged matrix is ready, and successful publication removes files left by older matrices.
+
+The transaction records a boot-scoped host identity, process, owner token, and publication phase. A separate atomic recovery claim serializes dead-owner recovery. When the owner lock and state are readable and consistent, a later invocation on the owning host rejects a live process, rolls back an interrupted pre-commit publication after that process exits, and completes publication or cleanup after durable commit intent. A confirmed missing state file is safe to clean because the owner-lock protocol forbids output mutation before initial state persistence; malformed, non-regular, unreadable, or owner-inconsistent state fails closed. A transaction owned by another host is never taken over automatically because portable filesystem operations cannot fence a paused remote writer. If committed cleanup cannot finish immediately, the programmatic result reports `cleanupPending: true` and the CLI prints a warning; the owning process can retry it immediately.
+
 ### Static Linking
 
 `tsrust` can produce fully statically linked Linux binaries (static-pie) that run on both glibc distros (Debian/Ubuntu) and musl distros (Alpine). Enable it via `.smartconfig.json`:
@@ -260,7 +308,8 @@ my-project/
 │           ├── Cargo.toml
 │           └── src/
 ├── dist_rust/              # 📦 Output: compiled binaries go here
-│   └── my-binary
+│   ├── my-binary
+│   └── my-binary.tsrust-build.json
 ├── .nogit/
 │   └── tsrust-target/      # 🧹 Managed Cargo target cache
 ├── ts/                     #    (your TypeScript code, built by tsbuild)
@@ -286,7 +335,18 @@ If no `rust/` directory is found, `tsrust` checks for `ts_rust/` as a fallback.
 `tsrust` exports its internals for use in other Node.js/TypeScript tools:
 
 ```typescript
-import { CargoConfig, CargoRunner, FsHelpers, TsRustCli, resolveManagedTargetDir } from '@git.zone/tsrust';
+import {
+  ArtifactAssembler,
+  CargoConfig,
+  CargoRunner,
+  FsHelpers,
+  ProvenanceStore,
+  TsRustCli,
+  configuredAssemblyTargets,
+  normalizeTargets,
+  resolveBuildTargets,
+  resolveManagedTargetDir,
+} from '@git.zone/tsrust';
 
 // Parse a Cargo workspace
 const config = new CargoConfig('/path/to/rust');
@@ -309,6 +369,18 @@ const size = await FsHelpers.getFileSize(dest);
 console.log(FsHelpers.formatFileSize(size));  // "13.4 MB"
 ```
 
+Important exported build and artifact APIs:
+
+| API | Purpose |
+| --- | --- |
+| `resolveBuildTargets()` | Apply CLI, exact-host, OS-family, legacy, and native target precedence. |
+| `configuredAssemblyTargets()` | Normalize and deduplicate the union required for multi-host assembly. |
+| `normalizeTargets()` | Resolve friendly aliases and reject invalid or colliding target names. |
+| `ProvenanceStore` | Write, hash-verify, and read byte-preserving provenance sidecars. |
+| `ArtifactAssembler` | Validate and transactionally publish a complete exact-commit artifact matrix to `dist_rust/`. |
+| `captureGitSnapshot()` / `assertGitSnapshotUnchanged()` | Capture and compare Git commit and worktree state around a build. |
+| `ProvenanceStamper` | Read legacy tsrust 1.7/1.8 embedded trailers; new builds use `ProvenanceStore`. |
+
 ## License and Legal Information
 
 This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license.md) file.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@git.zone/tsrust',
-  version: '1.8.0',
+  version: '1.9.0',
   description: 'A tool for compiling Rust projects, detecting Cargo workspaces, building with cargo, and placing binaries in a conventional dist_rust directory.'
 }

package/ts/index.ts

@@ -3,8 +3,10 @@ plugins.early.start('@git.zone/tsrust');
 
 export * from './mod_fs/index.js';
 export * from './mod_cargo/index.js';
+export * from './mod_artifact/index.js';
 export * from './mod_cli/index.js';
 export * from './mod_elf/index.js';
+export * from './mod_provenance/index.js';
 export * from './mod_toolchain/index.js';
 
 plugins.early.stop();