@git.zone/tsrust 1.8.0 → 1.9.1

package/readme.md

@@ -50,7 +50,8 @@ This will:
 4. Run `cargo build --release` with full streaming output
 5. Store Cargo intermediates in `.nogit/tsrust-target` by default
 6. Copy each binary to `dist_rust/` with executable permissions (`chmod 755`)
-7. Report file sizes and total build time
+7. Write a SHA-256-bound provenance sidecar without changing the binary bytes
+8. Report file sizes and total build time
 
 **Example output:**
 
@@ -63,6 +64,7 @@ Running: CARGO_TARGET_DIR="/path/to/project/.nogit/tsrust-target" cargo build --
    Compiling rustproxy v0.1.0
     Finished `release` profile [optimized] target(s) in 29.01s
 Copied rustproxy (13.4 MB) -> dist_rust/rustproxy
+Wrote provenance: @example/rustproxy@1.0.0 abc123def456 (native)
 Done in 29.2s
 ```
 
@@ -127,7 +129,9 @@ When using `--target`, output binaries are named `<binname>_<os>_<arch>`:
 ```
 dist_rust/
 ├── rustproxy_linux_arm64
-└── rustproxy_linux_amd64
+├── rustproxy_linux_arm64.tsrust-build.json
+├── rustproxy_linux_amd64
+└── rustproxy_linux_amd64.tsrust-build.json
 ```
 
 `tsrust` automatically installs missing rustup targets via `rustup target add` when needed.
@@ -147,12 +151,56 @@ You can set default cross-compilation targets in your project's `.smartconfig.js
 }
 ```
 
-When targets are configured in `.smartconfig.json`, simply running `tsrust` will cross-compile for all listed targets. CLI `--target` flags take full precedence — if any `--target` is provided, the `.smartconfig.json` targets are ignored entirely.
+When targets are configured in `.smartconfig.json`, simply running `tsrust` will cross-compile for all listed targets. CLI `--target` flags determine the selected targets when provided. The complete configuration is still validated first, so malformed legacy or host-specific entries are always rejected.
+
+For builds split across Linux and macOS hosts, select targets by build host:
+
+```json
+{
+  "@git.zone/tsrust": {
+    "targetsByHost": {
+      "linux": ["linux_amd64", "linux_arm64"],
+      "macos": ["macos_amd64", "macos_arm64"]
+    },
+    "locked": true
+  }
+}
+```
+
+Host selection uses this precedence: CLI `--target`, exact host key, OS-family key, legacy `targets`, then a native build. Exact host keys are `linux_amd64`, `linux_arm64`, `macos_amd64`, and `macos_arm64`; OS-family keys are `linux` and `macos`. The selected entries are not merged, so an exact host entry completely replaces its family entry for that host.
 
 `locked: true` runs Cargo builds with `--locked` for deterministic dependency resolution. This requires `Cargo.lock` to exist and remain consistent with the manifests; Cargo fails instead of updating an inconsistent lockfile.
 
 `targetDir` is optional. It must point to a tsrust-owned path under `.nogit/`, such as `.nogit/tsrust-target` or `.nogit/tsrust-custom-target`. You can also set `TSRUST_TARGET_DIR` for one-off runs. `pruneAfterBuild: true` or `TSRUST_PRUNE_AFTER_BUILD=true` removes the marked managed target cache after binaries have been copied to `dist_rust/`.
 
+### Build Provenance
+
+Every new build writes `<binary>.tsrust-build.json` beside the binary. In a Git checkout, the sidecar records the consuming package name and version, exact commit and dirty state, target, build time, and tsrust version. Non-Git builds record `gitCommit: "unknown"` and omit `gitDirty`. The sidecar also contains the binary's SHA-256 digest, so provenance reads fail if either file no longer belongs to the pair. The binary itself remains byte-identical to the postprocessed Cargo target-cache binary, preserving Mach-O signatures and other binary-format integrity checks. On Darwin targets, tsrust preserves an existing valid signature and applies an ad-hoc signature only when `codesign` explicitly identifies the Cargo output as unsigned. Invalid or ambiguous signature states fail the build. Signing happens before the binary is copied and before its provenance digest is written.
+
+Inspect a built artifact with:
+
+```bash
+tsrust inspect dist_rust/rustproxy_linux_amd64
+```
+
+`inspect` verifies and reads the sidecar. It retains read compatibility with provenance trailers produced by tsrust 1.7 and 1.8, but new builds no longer append those trailers.
+
+tsrust snapshots the Git commit and complete worktree status before each Cargo build and verifies that neither changed before copying artifacts. Dirty builds remain possible for development and are marked as dirty; strict multi-host assembly rejects them.
+
+### Multi-Host Assembly
+
+Each host build owns and cleans its own `dist_rust/`. Copy those host outputs into separate artifact directories, then assemble the complete matrix from the same clean Git checkout and package version:
+
+```bash
+tsrust assemble .nogit/artifacts/linux .nogit/artifacts/macos
+```
+
+The union of `targets` and `targetsByHost` defines the required target matrix. Repeated `--target` options can define an explicit matrix instead. Assembly always publishes to the tsrust-owned `dist_rust/` directory.
+
+Assembly requires every Cargo binary for every expected target. It rejects missing, duplicate, unexpected, non-executable, symlinked, hash-mismatched, dirty, wrong-commit, wrong-package, and wrong-tsrust-version inputs. Validation and copying happen in a same-filesystem transaction under `.nogit/tsrust-assembly/`, guarded by the atomically published `.nogit/tsrust-assembly.lock`. The Git commit, clean worktree, and package identity are checked again immediately before publication. The previous output is retained until the complete staged matrix is ready, and successful publication removes files left by older matrices.
+
+The transaction records a boot-scoped host identity, process, owner token, and publication phase. A separate atomic recovery claim serializes dead-owner recovery. When the owner lock and state are readable and consistent, a later invocation on the owning host rejects a live process, rolls back an interrupted pre-commit publication after that process exits, and completes publication or cleanup after durable commit intent. A confirmed missing state file is safe to clean because the owner-lock protocol forbids output mutation before initial state persistence; malformed, non-regular, unreadable, or owner-inconsistent state fails closed. A transaction owned by another host is never taken over automatically because portable filesystem operations cannot fence a paused remote writer. If committed cleanup cannot finish immediately, the programmatic result reports `cleanupPending: true` and the CLI prints a warning; the owning process can retry it immediately.
+
 ### Static Linking
 
 `tsrust` can produce fully statically linked Linux binaries (static-pie) that run on both glibc distros (Debian/Ubuntu) and musl distros (Alpine). Enable it via `.smartconfig.json`:
@@ -260,7 +308,8 @@ my-project/
 │           ├── Cargo.toml
 │           └── src/
 ├── dist_rust/              # 📦 Output: compiled binaries go here
-│   └── my-binary
+│   ├── my-binary
+│   └── my-binary.tsrust-build.json
 ├── .nogit/
 │   └── tsrust-target/      # 🧹 Managed Cargo target cache
 ├── ts/                     #    (your TypeScript code, built by tsbuild)
@@ -286,7 +335,18 @@ If no `rust/` directory is found, `tsrust` checks for `ts_rust/` as a fallback.
 `tsrust` exports its internals for use in other Node.js/TypeScript tools:
 
 ```typescript
-import { CargoConfig, CargoRunner, FsHelpers, TsRustCli, resolveManagedTargetDir } from '@git.zone/tsrust';
+import {
+  ArtifactAssembler,
+  CargoConfig,
+  CargoRunner,
+  FsHelpers,
+  ProvenanceStore,
+  TsRustCli,
+  configuredAssemblyTargets,
+  normalizeTargets,
+  resolveBuildTargets,
+  resolveManagedTargetDir,
+} from '@git.zone/tsrust';
 
 // Parse a Cargo workspace
 const config = new CargoConfig('/path/to/rust');
@@ -309,6 +369,18 @@ const size = await FsHelpers.getFileSize(dest);
 console.log(FsHelpers.formatFileSize(size));  // "13.4 MB"
 ```
 
+Important exported build and artifact APIs:
+
+| API | Purpose |
+| --- | --- |
+| `resolveBuildTargets()` | Apply CLI, exact-host, OS-family, legacy, and native target precedence. |
+| `configuredAssemblyTargets()` | Normalize and deduplicate the union required for multi-host assembly. |
+| `normalizeTargets()` | Resolve friendly aliases and reject invalid or colliding target names. |
+| `ProvenanceStore` | Write, hash-verify, and read byte-preserving provenance sidecars. |
+| `ArtifactAssembler` | Validate and transactionally publish a complete exact-commit artifact matrix to `dist_rust/`. |
+| `captureGitSnapshot()` / `assertGitSnapshotUnchanged()` | Capture and compare Git commit and worktree state around a build. |
+| `ProvenanceStamper` | Read legacy tsrust 1.7/1.8 embedded trailers; new builds use `ProvenanceStore`. |
+
 ## License and Legal Information
 
 This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license.md) file.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@git.zone/tsrust',
-  version: '1.8.0',
+  version: '1.9.1',
   description: 'A tool for compiling Rust projects, detecting Cargo workspaces, building with cargo, and placing binaries in a conventional dist_rust directory.'
 }

package/ts/index.ts

@@ -3,8 +3,10 @@ plugins.early.start('@git.zone/tsrust');
 
 export * from './mod_fs/index.js';
 export * from './mod_cargo/index.js';
+export * from './mod_artifact/index.js';
 export * from './mod_cli/index.js';
 export * from './mod_elf/index.js';
+export * from './mod_provenance/index.js';
 export * from './mod_toolchain/index.js';
 
 plugins.early.stop();