@git.zone/tsrust 1.8.0 → 1.9.1

package/dist_ts/mod_cli/helpers.targets.js

@@ -0,0 +1,106 @@
+export const targetAliasMap = {
+    linux_amd64: 'x86_64-unknown-linux-gnu',
+    linux_arm64: 'aarch64-unknown-linux-gnu',
+    linux_amd64_musl: 'x86_64-unknown-linux-musl',
+    linux_arm64_musl: 'aarch64-unknown-linux-musl',
+    macos_amd64: 'x86_64-apple-darwin',
+    macos_arm64: 'aarch64-apple-darwin',
+};
+const tripleToFriendlyMap = Object.fromEntries(Object.entries(targetAliasMap).map(([friendly, triple]) => [triple, friendly]));
+const supportedHostKeys = new Set([
+    'linux',
+    'macos',
+    'linux_amd64',
+    'linux_arm64',
+    'macos_amd64',
+    'macos_arm64',
+]);
+export function resolveTargetAlias(nameArg) {
+    return targetAliasMap[nameArg] || nameArg;
+}
+export function friendlyTargetName(tripleArg) {
+    return tripleToFriendlyMap[tripleArg] || tripleArg.replace(/-/g, '_');
+}
+function validateTargetName(nameArg) {
+    if (!nameArg ||
+        nameArg.length > 255 ||
+        !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(nameArg)) {
+        throw new Error(`Invalid Rust target name: ${JSON.stringify(nameArg)}`);
+    }
+}
+export function normalizeTargets(targetsArg, labelArg) {
+    if (!Array.isArray(targetsArg)) {
+        throw new Error(`${labelArg} must be an array of Rust target names`);
+    }
+    const byTriple = new Map();
+    const tripleByFriendly = new Map();
+    for (const target of targetsArg) {
+        if (typeof target !== 'string') {
+            throw new Error(`${labelArg} must contain only Rust target names`);
+        }
+        validateTargetName(target);
+        const triple = resolveTargetAlias(target);
+        validateTargetName(triple);
+        const friendly = friendlyTargetName(triple);
+        validateTargetName(friendly);
+        const collidingTriple = tripleByFriendly.get(friendly);
+        if (collidingTriple && collidingTriple !== triple) {
+            throw new Error(`${labelArg} targets ${collidingTriple} and ${triple} share output suffix ${friendly}`);
+        }
+        tripleByFriendly.set(friendly, triple);
+        byTriple.set(triple, { triple, friendly });
+    }
+    return [...byTriple.values()];
+}
+function validateTargetsByHost(configArg) {
+    if (configArg.targets !== undefined) {
+        normalizeTargets(configArg.targets, 'targets');
+    }
+    if (configArg.targetsByHost === undefined)
+        return;
+    if (!configArg.targetsByHost ||
+        typeof configArg.targetsByHost !== 'object' ||
+        Array.isArray(configArg.targetsByHost)) {
+        throw new Error('targetsByHost must be an object keyed by supported build hosts');
+    }
+    for (const [host, targets] of Object.entries(configArg.targetsByHost)) {
+        if (!supportedHostKeys.has(host)) {
+            throw new Error(`Unsupported targetsByHost key: ${host}`);
+        }
+        if (!Array.isArray(targets) || targets.length === 0) {
+            throw new Error(`targetsByHost.${host} must be a non-empty target array`);
+        }
+        normalizeTargets(targets, `targetsByHost.${host}`);
+    }
+}
+function hostFamily(hostTripleArg) {
+    if (hostTripleArg.includes('-linux-'))
+        return 'linux';
+    if (hostTripleArg.endsWith('-apple-darwin'))
+        return 'macos';
+    throw new Error(`Unsupported Rust host triple for targetsByHost: ${hostTripleArg}`);
+}
+export function resolveBuildTargets(configArg, hostTripleArg, cliTargetsArg) {
+    validateTargetsByHost(configArg);
+    if (cliTargetsArg !== undefined) {
+        if (cliTargetsArg.length === 0) {
+            throw new Error('--target requires at least one target');
+        }
+        return normalizeTargets(cliTargetsArg, '--target');
+    }
+    const exactHost = friendlyTargetName(hostTripleArg);
+    const configured = configArg.targetsByHost?.[exactHost] ||
+        configArg.targetsByHost?.[hostFamily(hostTripleArg)] ||
+        configArg.targets ||
+        [];
+    return normalizeTargets(configured, 'targets');
+}
+export function configuredAssemblyTargets(configArg) {
+    validateTargetsByHost(configArg);
+    const configured = [
+        ...(configArg.targets || []),
+        ...Object.values(configArg.targetsByHost || {}).flat(),
+    ];
+    return normalizeTargets(configured, 'configured assembly targets');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy50YXJnZXRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvbW9kX2NsaS9oZWxwZXJzLnRhcmdldHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsTUFBTSxDQUFDLE1BQU0sY0FBYyxHQUEyQjtJQUNwRCxXQUFXLEVBQUUsMEJBQTBCO0lBQ3ZDLFdBQVcsRUFBRSwyQkFBMkI7SUFDeEMsZ0JBQWdCLEVBQUUsMkJBQTJCO0lBQzdDLGdCQUFnQixFQUFFLDRCQUE0QjtJQUM5QyxXQUFXLEVBQUUscUJBQXFCO0lBQ2xDLFdBQVcsRUFBRSxzQkFBc0I7Q0FDcEMsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FDNUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FDL0UsQ0FBQztBQUVGLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxHQUFHLENBQUM7SUFDaEMsT0FBTztJQUNQLE9BQU87SUFDUCxhQUFhO0lBQ2IsYUFBYTtJQUNiLGFBQWE7SUFDYixhQUFhO0NBQ2QsQ0FBQyxDQUFDO0FBa0JILE1BQU0sVUFBVSxrQkFBa0IsQ0FBQyxPQUFlO0lBQ2hELE9BQU8sY0FBYyxDQUFDLE9BQU8sQ0FBQyxJQUFJLE9BQU8sQ0FBQztBQUM1QyxDQUFDO0FBRUQsTUFBTSxVQUFVLGtCQUFrQixDQUFDLFNBQWlCO0lBQ2xELE9BQU8sbUJBQW1CLENBQUMsU0FBUyxDQUFDLElBQUksU0FBUyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLENBQUM7QUFDeEUsQ0FBQztBQUVELFNBQVMsa0JBQWtCLENBQUMsT0FBZTtJQUN6QyxJQUNFLENBQUMsT0FBTztRQUNSLE9BQU8sQ0FBQyxNQUFNLEdBQUcsR0FBRztRQUNwQixDQUFDLDhCQUE4QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFDN0MsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsNkJBQTZCLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzFFLENBQUM7QUFDSCxDQUFDO0FBRUQsTUFBTSxVQUFVLGdCQUFnQixDQUFDLFVBQW9CLEVBQUUsUUFBZ0I7SUFDckUsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUMvQixNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsUUFBUSx3Q0FBd0MsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsRUFBNkIsQ0FBQztJQUN0RCxNQUFNLGdCQUFnQixHQUFHLElBQUksR0FBRyxFQUFrQixDQUFDO0lBQ25ELEtBQUssTUFBTSxNQUFNLElBQUksVUFBVSxFQUFFLENBQUM7UUFDaEMsSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUMvQixNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsUUFBUSxzQ0FBc0MsQ0FBQyxDQUFDO1FBQ3JFLENBQUM7UUFDRCxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzQixNQUFNLE1BQU0sR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMxQyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzQixNQUFNLFFBQVEsR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM1QyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM3QixNQUFNLGVBQWUsR0FBRyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDdkQsSUFBSSxlQUFlLElBQUksZUFBZSxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQ2xELE1BQU0sSUFBSSxLQUFLLENBQ2IsR0FBRyxRQUFRLFlBQVksZUFBZSxRQUFRLE1BQU0sd0JBQXdCLFFBQVEsRUFBRSxDQUN2RixDQUFDO1FBQ0osQ0FBQztRQUNELGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDdkMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM3QyxDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7QUFDaEMsQ0FBQztBQUVELFNBQVMscUJBQXFCLENBQUMsU0FBd0I7SUFDckQsSUFBSSxTQUFTLENBQUMsT0FBTyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BDLGdCQUFnQixDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDakQsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLGFBQWEsS0FBSyxTQUFTO1FBQUUsT0FBTztJQUNsRCxJQUNFLENBQUMsU0FBUyxDQUFDLGFBQWE7UUFDeEIsT0FBTyxTQUFTLENBQUMsYUFBYSxLQUFLLFFBQVE7UUFDM0MsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQ3RDLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLGdFQUFnRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELEtBQUssTUFBTSxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1FBQ3RFLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNqQyxNQUFNLElBQUksS0FBSyxDQUFDLGtDQUFrQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzVELENBQUM7UUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3BELE1BQU0sSUFBSSxLQUFLLENBQUMsaUJBQWlCLElBQUksbUNBQW1DLENBQUMsQ0FBQztRQUM1RSxDQUFDO1FBQ0QsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLGlCQUFpQixJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ3JELENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxVQUFVLENBQUMsYUFBcUI7SUFDdkMsSUFBSSxhQUFhLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQztRQUFFLE9BQU8sT0FBTyxDQUFDO0lBQ3RELElBQUksYUFBYSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUM7UUFBRSxPQUFPLE9BQU8sQ0FBQztJQUM1RCxNQUFNLElBQUksS0FBSyxDQUFDLG1EQUFtRCxhQUFhLEVBQUUsQ0FBQyxDQUFDO0FBQ3RGLENBQUM7QUFFRCxNQUFNLFVBQVUsbUJBQW1CLENBQ2pDLFNBQXdCLEVBQ3hCLGFBQXFCLEVBQ3JCLGFBQXdCO0lBRXhCLHFCQUFxQixDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ2pDLElBQUksYUFBYSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ2hDLElBQUksYUFBYSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMvQixNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELE9BQU8sZ0JBQWdCLENBQUMsYUFBYSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxrQkFBa0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNwRCxNQUFNLFVBQVUsR0FDZCxTQUFTLENBQUMsYUFBYSxFQUFFLENBQUMsU0FBUyxDQUFDO1FBQ3BDLFNBQVMsQ0FBQyxhQUFhLEVBQUUsQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDcEQsU0FBUyxDQUFDLE9BQU87UUFDakIsRUFBRSxDQUFDO0lBQ0wsT0FBTyxnQkFBZ0IsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLENBQUM7QUFDakQsQ0FBQztBQUVELE1BQU0sVUFBVSx5QkFBeUIsQ0FBQyxTQUF3QjtJQUNoRSxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNqQyxNQUFNLFVBQVUsR0FBRztRQUNqQixHQUFHLENBQUMsU0FBUyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDNUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFO0tBQ3ZELENBQUM7SUFDRixPQUFPLGdCQUFnQixDQUFDLFVBQVUsRUFBRSw2QkFBNkIsQ0FBQyxDQUFDO0FBQ3JFLENBQUMifQ==

package/dist_ts/mod_cli/index.d.ts

@@ -1 +1,2 @@
 export { TsRustCli, runCli } from './classes.tsrustcli.js';
+export { configuredAssemblyTargets, friendlyTargetName, normalizeTargets, resolveBuildTargets, resolveTargetAlias, targetAliasMap, type INormalizedTarget, type ITsrustConfig, } from './helpers.targets.js';

package/dist_ts/mod_cli/index.js

@@ -1,2 +1,3 @@
 export { TsRustCli, runCli } from './classes.tsrustcli.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9tb2RfY2xpL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLE1BQU0sd0JBQXdCLENBQUMifQ==
+export { configuredAssemblyTargets, friendlyTargetName, normalizeTargets, resolveBuildTargets, resolveTargetAlias, targetAliasMap, } from './helpers.targets.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9tb2RfY2xpL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDM0QsT0FBTyxFQUNMLHlCQUF5QixFQUN6QixrQkFBa0IsRUFDbEIsZ0JBQWdCLEVBQ2hCLG1CQUFtQixFQUNuQixrQkFBa0IsRUFDbEIsY0FBYyxHQUdmLE1BQU0sc0JBQXNCLENBQUMifQ==

package/dist_ts/mod_elf/classes.provenance.d.ts

@@ -10,11 +10,12 @@ export interface ITsrustBuildInfo {
     projectName: string;
     projectVersion: string;
     gitCommit: string;
+    gitDirty?: boolean;
     builtAt: string;
     tsrustVersion: string;
 }
 export declare class ProvenanceStamper {
-    /** Appends (or replaces awareness of) the provenance trailer on a binary. */
+    /** @deprecated New builds use hash-bound sidecars so binaries remain byte-identical. */
     static stamp(binaryPath: string, info: ITsrustBuildInfo): Promise<void>;
     /**
      * Reads the most recent provenance trailer from a binary.

package/dist_ts/mod_provenance/classes.gitstate.d.ts

@@ -0,0 +1,7 @@
+export interface IGitSnapshot {
+    available: boolean;
+    commit: string;
+    status: string;
+}
+export declare function captureGitSnapshot(cwdArg: string): Promise<IGitSnapshot>;
+export declare function assertGitSnapshotUnchanged(beforeArg: IGitSnapshot, afterArg: IGitSnapshot): void;

package/dist_ts/mod_provenance/classes.gitstate.js

@@ -0,0 +1,34 @@
+import * as childProcess from 'child_process';
+import * as util from 'util';
+const execFile = util.promisify(childProcess.execFile);
+export async function captureGitSnapshot(cwdArg) {
+    let commit;
+    try {
+        const result = await execFile('git', ['-C', cwdArg, 'rev-parse', 'HEAD'], {
+            encoding: 'utf8',
+        });
+        commit = result.stdout.trim();
+    }
+    catch {
+        return { available: false, commit: 'unknown', status: '' };
+    }
+    try {
+        const status = await execFile('git', ['-C', cwdArg, 'status', '--porcelain=v1', '--untracked-files=all'], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+        return {
+            available: true,
+            commit,
+            status: status.stdout,
+        };
+    }
+    catch {
+        throw new Error('Failed to inspect Git worktree state');
+    }
+}
+export function assertGitSnapshotUnchanged(beforeArg, afterArg) {
+    if (beforeArg.available !== afterArg.available ||
+        beforeArg.commit !== afterArg.commit ||
+        beforeArg.status !== afterArg.status) {
+        throw new Error('Git source state changed while Cargo was building');
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5naXRzdGF0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL21vZF9wcm92ZW5hbmNlL2NsYXNzZXMuZ2l0c3RhdGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLFlBQVksTUFBTSxlQUFlLENBQUM7QUFDOUMsT0FBTyxLQUFLLElBQUksTUFBTSxNQUFNLENBQUM7QUFFN0IsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUM7QUFRdkQsTUFBTSxDQUFDLEtBQUssVUFBVSxrQkFBa0IsQ0FBQyxNQUFjO0lBQ3JELElBQUksTUFBYyxDQUFDO0lBQ25CLElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sUUFBUSxDQUFDLEtBQUssRUFBRSxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLE1BQU0sQ0FBQyxFQUFFO1lBQ3hFLFFBQVEsRUFBRSxNQUFNO1NBQ2pCLENBQUMsQ0FBQztRQUNILE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2hDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUUsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxRQUFRLENBQzNCLEtBQUssRUFDTCxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLGdCQUFnQixFQUFFLHVCQUF1QixDQUFDLEVBQ25FLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJLEVBQUUsQ0FDbEQsQ0FBQztRQUNGLE9BQU87WUFDTCxTQUFTLEVBQUUsSUFBSTtZQUNmLE1BQU07WUFDTixNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU07U0FDdEIsQ0FBQztJQUNKLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFDMUQsQ0FBQztBQUNILENBQUM7QUFFRCxNQUFNLFVBQVUsMEJBQTBCLENBQ3hDLFNBQXVCLEVBQ3ZCLFFBQXNCO0lBRXRCLElBQ0UsU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsU0FBUztRQUMxQyxTQUFTLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxNQUFNO1FBQ3BDLFNBQVMsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLE1BQU0sRUFDcEMsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUN2RSxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist_ts/mod_provenance/classes.provenancestore.d.ts

@@ -0,0 +1,11 @@
+import type { ITsrustBuildInfo } from '../mod_elf/index.js';
+export declare const PROVENANCE_SIDECAR_SUFFIX = ".tsrust-build.json";
+export declare class ProvenanceStore {
+    static sidecarPath(binaryPathArg: string): string;
+    static sha256(binaryPathArg: string): Promise<string>;
+    static write(binaryPathArg: string, infoArg: ITsrustBuildInfo): Promise<string>;
+    private static readExistingSidecar;
+    private static recoverTemporaryFiles;
+    static readSidecar(binaryPathArg: string): Promise<ITsrustBuildInfo>;
+    static read(binaryPathArg: string): Promise<ITsrustBuildInfo | undefined>;
+}

package/dist_ts/mod_provenance/classes.provenancestore.js

@@ -0,0 +1,184 @@
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import { ProvenanceStamper } from '../mod_elf/index.js';
+import { getHostIdentity, isLocalProcessRunning } from './helpers.owneridentity.js';
+const SIDECAR_FORMAT = 'tsrust.build-provenance.v2';
+export const PROVENANCE_SIDECAR_SUFFIX = '.tsrust-build.json';
+function isBuildInfo(valueArg) {
+    if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg))
+        return false;
+    const value = valueArg;
+    return (typeof value.binary === 'string' &&
+        typeof value.target === 'string' &&
+        typeof value.projectName === 'string' &&
+        typeof value.projectVersion === 'string' &&
+        typeof value.gitCommit === 'string' &&
+        typeof value.builtAt === 'string' &&
+        typeof value.tsrustVersion === 'string' &&
+        (value.gitDirty === undefined || typeof value.gitDirty === 'boolean'));
+}
+export class ProvenanceStore {
+    static sidecarPath(binaryPathArg) {
+        return `${binaryPathArg}${PROVENANCE_SIDECAR_SUFFIX}`;
+    }
+    static async sha256(binaryPathArg) {
+        const binary = await fs.promises.lstat(binaryPathArg);
+        if (!binary.isFile() || binary.isSymbolicLink()) {
+            throw new Error(`Provenance binary is not a regular file: ${binaryPathArg}`);
+        }
+        const digest = crypto.createHash('sha256');
+        await new Promise((resolve, reject) => {
+            const stream = fs.createReadStream(binaryPathArg);
+            stream.on('data', (chunk) => digest.update(chunk));
+            stream.on('error', reject);
+            stream.on('end', resolve);
+        });
+        return digest.digest('hex');
+    }
+    static async write(binaryPathArg, infoArg) {
+        if (!isBuildInfo(infoArg)) {
+            throw new Error('Provenance build information has an invalid shape');
+        }
+        const binary = await fs.promises.lstat(binaryPathArg);
+        if (!binary.isFile() || binary.isSymbolicLink()) {
+            throw new Error(`Provenance binary is not a regular file: ${binaryPathArg}`);
+        }
+        const sidecarPath = ProvenanceStore.sidecarPath(binaryPathArg);
+        await ProvenanceStore.recoverTemporaryFiles(sidecarPath);
+        const existing = await ProvenanceStore.readExistingSidecar(binaryPathArg);
+        if (existing) {
+            if (JSON.stringify(existing) === JSON.stringify(infoArg))
+                return sidecarPath;
+            throw new Error(`Provenance sidecar already exists with different build information: ${sidecarPath}`);
+        }
+        const record = {
+            format: SIDECAR_FORMAT,
+            binarySha256: await ProvenanceStore.sha256(binaryPathArg),
+            buildInfo: infoArg,
+        };
+        const temporaryPath = `${sidecarPath}.${getHostIdentity()}.${process.pid}.${crypto.randomUUID()}.tmp`;
+        let temporary;
+        try {
+            temporary = await fs.promises.open(temporaryPath, 'wx', 0o600);
+            await temporary.writeFile(`${JSON.stringify(record, null, 2)}\n`, 'utf8');
+            await temporary.chmod(0o644);
+            await temporary.sync();
+            await temporary.close();
+            temporary = undefined;
+            try {
+                await fs.promises.link(temporaryPath, sidecarPath);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                const concurrentlyWritten = await ProvenanceStore.readSidecar(binaryPathArg);
+                if (JSON.stringify(concurrentlyWritten) !== JSON.stringify(infoArg)) {
+                    throw new Error(`Concurrent provenance write disagreed for ${binaryPathArg}`);
+                }
+            }
+            await fs.promises.unlink(temporaryPath);
+            const directory = await fs.promises.open(path.dirname(sidecarPath), 'r');
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+            return sidecarPath;
+        }
+        finally {
+            await Promise.allSettled([
+                temporary?.close() || Promise.resolve(),
+                fs.promises.rm(temporaryPath, { force: true }),
+            ]);
+        }
+    }
+    static async readExistingSidecar(binaryPathArg) {
+        try {
+            return await ProvenanceStore.readSidecar(binaryPathArg);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+    }
+    static async recoverTemporaryFiles(sidecarPathArg) {
+        const directoryPath = path.dirname(sidecarPathArg);
+        const temporaryPrefix = `${path.basename(sidecarPathArg)}.`;
+        const entries = await fs.promises.readdir(directoryPath, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.name.startsWith(temporaryPrefix) || !entry.name.endsWith('.tmp')) {
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const suffix = entry.name.slice(temporaryPrefix.length, -'.tmp'.length);
+            const [hostIdentity, pidText, identifier, ...unexpected] = suffix.split('.');
+            const pid = Number(pidText);
+            if (unexpected.length > 0 ||
+                !/^[a-f0-9]{64}$/.test(hostIdentity || '') ||
+                !Number.isSafeInteger(pid) ||
+                !/^[a-f0-9-]{36}$/.test(identifier || '') ||
+                hostIdentity !== getHostIdentity() ||
+                isLocalProcessRunning(pid)) {
+                continue;
+            }
+            const temporaryPath = path.join(directoryPath, entry.name);
+            try {
+                const temporary = await fs.promises.lstat(temporaryPath);
+                if (temporary.isFile() && !temporary.isSymbolicLink()) {
+                    await fs.promises.rm(temporaryPath, { force: true });
+                }
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+    }
+    static async readSidecar(binaryPathArg) {
+        const sidecarPath = ProvenanceStore.sidecarPath(binaryPathArg);
+        const sidecar = await fs.promises.lstat(sidecarPath);
+        if (!sidecar.isFile() || sidecar.isSymbolicLink()) {
+            throw new Error(`Provenance sidecar is not a regular file: ${sidecarPath}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(await fs.promises.readFile(sidecarPath, 'utf8'));
+        }
+        catch {
+            throw new Error(`Provenance sidecar is invalid JSON: ${sidecarPath}`);
+        }
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error(`Provenance sidecar has an invalid shape: ${sidecarPath}`);
+        }
+        const record = parsed;
+        if (record.format !== SIDECAR_FORMAT ||
+            typeof record.binarySha256 !== 'string' ||
+            !/^[a-f0-9]{64}$/.test(record.binarySha256) ||
+            !isBuildInfo(record.buildInfo)) {
+            throw new Error(`Provenance sidecar has an unsupported shape: ${sidecarPath}`);
+        }
+        const actualSha256 = await ProvenanceStore.sha256(binaryPathArg);
+        if (actualSha256 !== record.binarySha256) {
+            throw new Error(`Provenance sidecar hash does not match ${binaryPathArg}`);
+        }
+        return record.buildInfo;
+    }
+    static async read(binaryPathArg) {
+        const sidecarPath = ProvenanceStore.sidecarPath(binaryPathArg);
+        try {
+            await fs.promises.lstat(sidecarPath);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                return ProvenanceStamper.read(binaryPathArg);
+            }
+            throw error;
+        }
+        return ProvenanceStore.readSidecar(binaryPathArg);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5wcm92ZW5hbmNlc3RvcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9tb2RfcHJvdmVuYW5jZS9jbGFzc2VzLnByb3ZlbmFuY2VzdG9yZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssTUFBTSxNQUFNLFFBQVEsQ0FBQztBQUNqQyxPQUFPLEtBQUssRUFBRSxNQUFNLElBQUksQ0FBQztBQUN6QixPQUFPLEtBQUssSUFBSSxNQUFNLE1BQU0sQ0FBQztBQUU3QixPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN4RCxPQUFPLEVBQUUsZUFBZSxFQUFFLHFCQUFxQixFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFFcEYsTUFBTSxjQUFjLEdBQUcsNEJBQTRCLENBQUM7QUFDcEQsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsb0JBQW9CLENBQUM7QUFROUQsU0FBUyxXQUFXLENBQUMsUUFBaUI7SUFDcEMsSUFBSSxDQUFDLFFBQVEsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUN2RixNQUFNLEtBQUssR0FBRyxRQUFtQyxDQUFDO0lBQ2xELE9BQU8sQ0FDTCxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUTtRQUNoQyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUTtRQUNoQyxPQUFPLEtBQUssQ0FBQyxXQUFXLEtBQUssUUFBUTtRQUNyQyxPQUFPLEtBQUssQ0FBQyxjQUFjLEtBQUssUUFBUTtRQUN4QyxPQUFPLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUTtRQUNuQyxPQUFPLEtBQUssQ0FBQyxPQUFPLEtBQUssUUFBUTtRQUNqQyxPQUFPLEtBQUssQ0FBQyxhQUFhLEtBQUssUUFBUTtRQUN2QyxDQUFDLEtBQUssQ0FBQyxRQUFRLEtBQUssU0FBUyxJQUFJLE9BQU8sS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTLENBQUMsQ0FDdEUsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLE9BQU8sZUFBZTtJQUNuQixNQUFNLENBQUMsV0FBVyxDQUFDLGFBQXFCO1FBQzdDLE9BQU8sR0FBRyxhQUFhLEdBQUcseUJBQXlCLEVBQUUsQ0FBQztJQUN4RCxDQUFDO0lBRU0sTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsYUFBcUI7UUFDOUMsTUFBTSxNQUFNLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUN0RCxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxJQUFJLE1BQU0sQ0FBQyxjQUFjLEVBQUUsRUFBRSxDQUFDO1lBQ2hELE1BQU0sSUFBSSxLQUFLLENBQUMsNENBQTRDLGFBQWEsRUFBRSxDQUFDLENBQUM7UUFDL0UsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDM0MsTUFBTSxJQUFJLE9BQU8sQ0FBTyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUMxQyxNQUFNLE1BQU0sR0FBRyxFQUFFLENBQUMsZ0JBQWdCLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDbEQsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUNuRCxNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztZQUMzQixNQUFNLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUNILE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM5QixDQUFDO0lBRU0sTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsYUFBcUIsRUFBRSxPQUF5QjtRQUN4RSxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ3RELElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLElBQUksTUFBTSxDQUFDLGNBQWMsRUFBRSxFQUFFLENBQUM7WUFDaEQsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUMvRSxDQUFDO1FBQ0QsTUFBTSxXQUFXLEdBQUcsZUFBZSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMvRCxNQUFNLGVBQWUsQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUN6RCxNQUFNLFFBQVEsR0FBRyxNQUFNLGVBQWUsQ0FBQyxtQkFBbUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMxRSxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQ2IsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDO2dCQUFFLE9BQU8sV0FBVyxDQUFDO1lBQzdFLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLFdBQVcsRUFBRSxDQUFDLENBQUM7UUFDeEcsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUF1QjtZQUNqQyxNQUFNLEVBQUUsY0FBYztZQUN0QixZQUFZLEVBQUUsTUFBTSxlQUFlLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQztZQUN6RCxTQUFTLEVBQUUsT0FBTztTQUNuQixDQUFDO1FBQ0YsTUFBTSxhQUFhLEdBQUcsR0FBRyxXQUFXLElBQUksZUFBZSxFQUFFLElBQUksT0FBTyxDQUFDLEdBQUcsSUFBSSxNQUFNLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQztRQUN0RyxJQUFJLFNBQTZDLENBQUM7UUFDbEQsSUFBSSxDQUFDO1lBQ0gsU0FBUyxHQUFHLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztZQUMvRCxNQUFNLFNBQVMsQ0FBQyxTQUFTLENBQUMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztZQUMxRSxNQUFNLFNBQVMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDN0IsTUFBTSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDdkIsTUFBTSxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDeEIsU0FBUyxHQUFHLFNBQVMsQ0FBQztZQUN0QixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsV0FBVyxDQUFDLENBQUM7WUFDckQsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSyxLQUErQixDQUFDLElBQUksS0FBSyxRQUFRO29CQUFFLE1BQU0sS0FBSyxDQUFDO2dCQUNwRSxNQUFNLG1CQUFtQixHQUFHLE1BQU0sZUFBZSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsQ0FBQztnQkFDN0UsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO29CQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxhQUFhLEVBQUUsQ0FBQyxDQUFDO2dCQUNoRixDQUFDO1lBQ0gsQ0FBQztZQUNELE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDeEMsTUFBTSxTQUFTLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQ3pFLElBQUksQ0FBQztnQkFDSCxNQUFNLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUN6QixDQUFDO29CQUFTLENBQUM7Z0JBQ1QsTUFBTSxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDMUIsQ0FBQztZQUNELE9BQU8sV0FBVyxDQUFDO1FBQ3JCLENBQUM7Z0JBQVMsQ0FBQztZQUNULE1BQU0sT0FBTyxDQUFDLFVBQVUsQ0FBQztnQkFDdkIsU0FBUyxFQUFFLEtBQUssRUFBRSxJQUFJLE9BQU8sQ0FBQyxPQUFPLEVBQUU7Z0JBQ3ZDLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQzthQUMvQyxDQUFDLENBQUM7UUFDTCxDQUFDO0lBQ0gsQ0FBQztJQUVPLE1BQU0sQ0FBQyxLQUFLLENBQUMsbUJBQW1CLENBQ3RDLGFBQXFCO1FBRXJCLElBQUksQ0FBQztZQUNILE9BQU8sTUFBTSxlQUFlLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSyxLQUErQixDQUFDLElBQUksS0FBSyxRQUFRO2dCQUFFLE9BQU8sU0FBUyxDQUFDO1lBQ3pFLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztJQUNILENBQUM7SUFFTyxNQUFNLENBQUMsS0FBSyxDQUFDLHFCQUFxQixDQUFDLGNBQXNCO1FBQy9ELE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDbkQsTUFBTSxlQUFlLEdBQUcsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUM7UUFDNUQsTUFBTSxPQUFPLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxhQUFhLEVBQUUsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNsRixLQUFLLE1BQU0sS0FBSyxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQzVCLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7Z0JBQzVFLFNBQVM7WUFDWCxDQUFDO1lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUU7Z0JBQUUsU0FBUztZQUM5QixNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxlQUFlLENBQUMsTUFBTSxFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3hFLE1BQU0sQ0FBQyxZQUFZLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxHQUFHLFVBQVUsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDN0UsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQzVCLElBQ0UsVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDO2dCQUNyQixDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxZQUFZLElBQUksRUFBRSxDQUFDO2dCQUMxQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDO2dCQUMxQixDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxVQUFVLElBQUksRUFBRSxDQUFDO2dCQUN6QyxZQUFZLEtBQUssZUFBZSxFQUFFO2dCQUNsQyxxQkFBcUIsQ0FBQyxHQUFHLENBQUMsRUFDMUIsQ0FBQztnQkFDRCxTQUFTO1lBQ1gsQ0FBQztZQUNELE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUMzRCxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxTQUFTLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQztnQkFDekQsSUFBSSxTQUFTLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFLEVBQUUsQ0FBQztvQkFDdEQsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxhQUFhLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDdkQsQ0FBQztZQUNILENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUssS0FBK0IsQ0FBQyxJQUFJLEtBQUssUUFBUTtvQkFBRSxNQUFNLEtBQUssQ0FBQztZQUN0RSxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxhQUFxQjtRQUNuRCxNQUFNLFdBQVcsR0FBRyxlQUFlLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQy9ELE1BQU0sT0FBTyxHQUFHLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDckQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsSUFBSSxPQUFPLENBQUMsY0FBYyxFQUFFLEVBQUUsQ0FBQztZQUNsRCxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxJQUFJLE1BQWUsQ0FBQztRQUNwQixJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFdBQVcsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDbkUsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsV0FBVyxFQUFFLENBQUMsQ0FBQztRQUM3RSxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQUcsTUFBcUMsQ0FBQztRQUNyRCxJQUNFLE1BQU0sQ0FBQyxNQUFNLEtBQUssY0FBYztZQUNoQyxPQUFPLE1BQU0sQ0FBQyxZQUFZLEtBQUssUUFBUTtZQUN2QyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDO1lBQzNDLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsRUFDOUIsQ0FBQztZQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0RBQWdELFdBQVcsRUFBRSxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUNELE1BQU0sWUFBWSxHQUFHLE1BQU0sZUFBZSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNqRSxJQUFJLFlBQVksS0FBSyxNQUFNLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDekMsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUM3RSxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUMsU0FBUyxDQUFDO0lBQzFCLENBQUM7SUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxhQUFxQjtRQUM1QyxNQUFNLFdBQVcsR0FBRyxlQUFlLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQy9ELElBQUksQ0FBQztZQUNILE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDdkMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFLLEtBQStCLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUN2RCxPQUFPLGlCQUFpQixDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUMvQyxDQUFDO1lBQ0QsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO1FBQ0QsT0FBTyxlQUFlLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3BELENBQUM7Q0FDRiJ9

package/dist_ts/mod_provenance/helpers.owneridentity.d.ts

@@ -0,0 +1,2 @@
+export declare function getHostIdentity(): string;
+export declare function isLocalProcessRunning(pidArg: number): boolean;

package/dist_ts/mod_provenance/helpers.owneridentity.js

@@ -0,0 +1,57 @@
+import * as childProcess from 'child_process';
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as os from 'os';
+let cachedHostIdentity;
+function readBootIdentity() {
+    if (process.platform === 'linux') {
+        try {
+            return fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+        }
+        catch {
+            // Fall through to the portable host fingerprint.
+        }
+    }
+    if (process.platform === 'darwin') {
+        try {
+            return childProcess.execFileSync('/usr/sbin/sysctl', ['-n', 'kern.boottime'], {
+                encoding: 'utf8',
+            }).trim();
+        }
+        catch {
+            // Fall through to the portable host fingerprint.
+        }
+    }
+    return String(Math.round((Date.now() - os.uptime() * 1000) / 60_000));
+}
+export function getHostIdentity() {
+    if (cachedHostIdentity)
+        return cachedHostIdentity;
+    const macAddresses = Object.values(os.networkInterfaces())
+        .flat()
+        .map((address) => address?.mac.toLowerCase())
+        .filter((address) => !!address && address !== '00:00:00:00:00:00')
+        .sort();
+    cachedHostIdentity = crypto
+        .createHash('sha256')
+        .update(JSON.stringify({
+        platform: process.platform,
+        hostname: os.hostname(),
+        bootIdentity: readBootIdentity(),
+        macAddresses,
+    }))
+        .digest('hex');
+    return cachedHostIdentity;
+}
+export function isLocalProcessRunning(pidArg) {
+    if (!Number.isSafeInteger(pidArg) || pidArg <= 0)
+        return false;
+    try {
+        process.kill(pidArg, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ESRCH';
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5vd25lcmlkZW50aXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvbW9kX3Byb3ZlbmFuY2UvaGVscGVycy5vd25lcmlkZW50aXR5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxZQUFZLE1BQU0sZUFBZSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBRXpCLElBQUksa0JBQXNDLENBQUM7QUFFM0MsU0FBUyxnQkFBZ0I7SUFDdkIsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ2pDLElBQUksQ0FBQztZQUNILE9BQU8sRUFBRSxDQUFDLFlBQVksQ0FBQyxpQ0FBaUMsRUFBRSxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUMzRSxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsaURBQWlEO1FBQ25ELENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2xDLElBQUksQ0FBQztZQUNILE9BQU8sWUFBWSxDQUFDLFlBQVksQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLElBQUksRUFBRSxlQUFlLENBQUMsRUFBRTtnQkFDNUUsUUFBUSxFQUFFLE1BQU07YUFDakIsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1osQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLGlEQUFpRDtRQUNuRCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDLE1BQU0sRUFBRSxHQUFHLElBQUksQ0FBQyxHQUFHLE1BQU0sQ0FBQyxDQUFDLENBQUM7QUFDeEUsQ0FBQztBQUVELE1BQU0sVUFBVSxlQUFlO0lBQzdCLElBQUksa0JBQWtCO1FBQUUsT0FBTyxrQkFBa0IsQ0FBQztJQUNsRCxNQUFNLFlBQVksR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1NBQ3ZELElBQUksRUFBRTtTQUNOLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztTQUM1QyxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQXFCLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxJQUFJLE9BQU8sS0FBSyxtQkFBbUIsQ0FBQztTQUNwRixJQUFJLEVBQUUsQ0FBQztJQUNWLGtCQUFrQixHQUFHLE1BQU07U0FDeEIsVUFBVSxDQUFDLFFBQVEsQ0FBQztTQUNwQixNQUFNLENBQ0wsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNiLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUTtRQUMxQixRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsRUFBRTtRQUN2QixZQUFZLEVBQUUsZ0JBQWdCLEVBQUU7UUFDaEMsWUFBWTtLQUNiLENBQUMsQ0FDSDtTQUNBLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNqQixPQUFPLGtCQUFrQixDQUFDO0FBQzVCLENBQUM7QUFFRCxNQUFNLFVBQVUscUJBQXFCLENBQUMsTUFBYztJQUNsRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLElBQUksQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQy9ELElBQUksQ0FBQztRQUNILE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3hCLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixPQUFRLEtBQStCLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQztJQUMzRCxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist_ts/mod_provenance/index.d.ts

@@ -0,0 +1,3 @@
+export { captureGitSnapshot, assertGitSnapshotUnchanged, type IGitSnapshot, } from './classes.gitstate.js';
+export { ProvenanceStore, PROVENANCE_SIDECAR_SUFFIX, } from './classes.provenancestore.js';
+export { getHostIdentity, isLocalProcessRunning } from './helpers.owneridentity.js';

package/dist_ts/mod_provenance/index.js

@@ -0,0 +1,4 @@
+export { captureGitSnapshot, assertGitSnapshotUnchanged, } from './classes.gitstate.js';
+export { ProvenanceStore, PROVENANCE_SIDECAR_SUFFIX, } from './classes.provenancestore.js';
+export { getHostIdentity, isLocalProcessRunning } from './helpers.owneridentity.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9tb2RfcHJvdmVuYW5jZS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsa0JBQWtCLEVBQ2xCLDBCQUEwQixHQUUzQixNQUFNLHVCQUF1QixDQUFDO0FBQy9CLE9BQU8sRUFDTCxlQUFlLEVBQ2YseUJBQXlCLEdBQzFCLE1BQU0sOEJBQThCLENBQUM7QUFDdEMsT0FBTyxFQUFFLGVBQWUsRUFBRSxxQkFBcUIsRUFBRSxNQUFNLDRCQUE0QixDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@git.zone/tsrust",
-  "version": "1.8.0",
+  "version": "1.9.1",
   "private": false,
   "description": "A tool for compiling Rust projects, detecting Cargo workspaces, building with cargo, and placing binaries in a conventional dist_rust directory.",
   "main": "dist_ts/index.js",
@@ -34,8 +34,8 @@
     "@push.rocks/smartconfig": "^6.1.1",
     "@push.rocks/smartfile": "^13.1.3",
     "@push.rocks/smartpath": "^6.0.0",
-    "@push.rocks/smartshell": "^3.3.8",
-    "smol-toml": "^1.6.1"
+    "@push.rocks/smartshell": "^4.1.1",
+    "smol-toml": "^1.7.1"
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.2",

package/readme.hints.md

@@ -1,12 +1,15 @@
 # tsrust hints
 
 ## Architecture
-- Follows tsbuild patterns exactly (cli.js, cli.child.ts, cli.ts.js entry points)
-- Uses smartcli for CLI, smartshell for cargo execution, smol-toml for TOML parsing
-- Three modules: mod_cli, mod_cargo, mod_fs
+- Follows tsbuild patterns for the `cli.js` entry point and TypeScript module layout.
+- Uses smartcli for CLI dispatch, smartshell for Cargo execution, native `child_process.execFile` for Git snapshots, and smol-toml for TOML parsing.
+- `mod_artifact` owns strict multi-host assembly; `mod_provenance` owns byte-preserving, hash-bound sidecars and Git source snapshots.
 
 ## Key patterns
 - smartshell `.exec()` streams output to terminal (non-silent)
 - smartshell `.execSilent()` captures output without printing
 - Cargo workspace detection: check for `[workspace]` section in Cargo.toml
 - Binary targets: look for `[[bin]]` entries in member crate Cargo.toml files
+- New builds never append provenance to binaries. Keep legacy `ProvenanceStamper` reads for tsrust 1.7/1.8 artifacts, but use `ProvenanceStore` sidecars for all writes.
+- Host target precedence is CLI, exact host, OS family, legacy targets, then native. Assembly uses the union of all configured targets unless repeated CLI `--target` values define an explicit matrix, and rejects dirty or incomplete matrices.
+- Assembly owns only `dist_rust/`, `.nogit/tsrust-assembly*`, and transient `.nogit/.tsrust-assembly-*.tmp` owner records. Its atomically linked owner lock, serialized recovery claim, and phase journal recover readable, owner-consistent transactions; malformed or inconsistent state fails closed.