@gregiteen/ssss-cli 0.9.0 → 0.9.2

package/scripts/conformance-09.mjs

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import { execFileSync, spawn, spawnSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
 import { definePrimitive, definitionsToExtensionRegistry } from '../src/primitive.mjs';
@@ -13,14 +14,206 @@ import {
 import { createValidator } from '../src/validator.mjs';
 import { FileSystemVfs, MemoryVfs, runVfsContract } from '../src/vfs.mjs';
 import { JsonlEventStore, MemoryEventStore, createCanonicalEvent } from '../src/events.mjs';
-import { ProjectionCoordinator } from '../src/projections.mjs';
+import {
+  ProjectionCoordinator,
+  createSqlProjectionAdapter,
+  createSearchProjectionAdapter,
+  createQueueProjectionAdapter,
+  createViewModelProjectionAdapter,
+} from '../src/projections.mjs';
 import { createKernel } from '../src/kernel.mjs';
 import { UiRegistry, actionToEnvelope, createDeterministicUi, planUi, validateUiManifest } from '../src/ui.mjs';
 import { createCommandHandler, createDomainCommand } from '../src/http.mjs';
 import { detectDirectWrites } from '../src/guard.mjs';
-import { MemoryLeaseStore, FileLeaseStore, runLeaseContract } from '../src/leases.mjs';
+import { MemoryLeaseStore, FileLeaseStore, leaseStatePath, runLeaseContract } from '../src/leases.mjs';
 import { MemoryIdempotencyStore, FileIdempotencyStore, runIdempotencyContract } from '../src/idempotency.mjs';
 import { createCapabilityAuthorizer } from '../src/authorization.mjs';
+import { validateVerifiedPrincipal } from '../src/authorization.mjs';
+
+async function rejects(promise, pattern) {
+  try { await promise; return false; } catch (error) { return pattern.test(error.message); }
+}
+
+async function replayed(store, options) {
+  const items = [];
+  for await (const item of store.replay(options)) items.push(item);
+  return items;
+}
+
+// Counts bytes read from `file` during `fn`, to prove appends do not re-read the log.
+async function bytesReadFrom(file, fn) {
+  const original = { openSync: fs.openSync, closeSync: fs.closeSync, readSync: fs.readSync, readFileSync: fs.readFileSync };
+  const fds = new Set();
+  let bytes = 0;
+  fs.openSync = (target, ...rest) => { const fd = original.openSync(target, ...rest); if (target === file) fds.add(fd); return fd; };
+  fs.closeSync = (fd) => { fds.delete(fd); return original.closeSync(fd); };
+  fs.readSync = (fd, ...rest) => { const read = original.readSync(fd, ...rest); if (fds.has(fd)) bytes += read; return read; };
+  fs.readFileSync = (target, ...rest) => {
+    const out = original.readFileSync(target, ...rest);
+    if (target === file || fds.has(target)) bytes += Buffer.byteLength(out);
+    return out;
+  };
+  try { await fn(); } finally { Object.assign(fs, original); }
+  return bytes;
+}
+
+// Runs `body` in `count` child processes released on one shared deadline, so
+// their check-then-write sections overlap. Each resolves to { ok, racer, error }.
+function raceProcesses(count, imports, body) {
+  const startAt = Date.now() + 1000;
+  const code = [
+    ...Object.entries(imports).map(([name, file]) => `import { ${name} } from ${JSON.stringify(new URL(file, import.meta.url).href)};`),
+    'const racer = Number(process.env.SSSS_RACER);',
+    `while (Date.now() < ${startAt});`,
+    `try { ${body}; console.log(JSON.stringify({ ok: true, racer })); }`,
+    'catch (error) { console.log(JSON.stringify({ ok: false, racer, error: error.message })); }',
+  ].join('\n');
+  return Promise.all(Array.from({ length: count }, (_, racer) => new Promise((resolve) => {
+    const child = spawn(process.execPath, ['--input-type=module', '-e', code], { env: { ...process.env, SSSS_RACER: String(racer) } });
+    let out = '';
+    let err = '';
+    child.stdout.on('data', (chunk) => { out += chunk; });
+    child.stderr.on('data', (chunk) => { err += chunk; });
+    child.on('close', () => {
+      try { resolve(JSON.parse(out.trim().split('\n').pop())); }
+      catch { resolve({ ok: false, racer, error: `no result: ${err || out}` }); }
+    });
+  })));
+}
+
+const winners = (results) => results.filter((result) => result.ok);
+const describe = (results) => JSON.stringify(results.map(({ ok, racer, error }) => (ok ? racer : `${racer}:${error}`)));
+
+async function checkFileAdapterRaces(root, principal, check) {
+  const racers = 6;
+  const eventsRoot = path.join(root, 'events');
+  const event = createCanonicalEvent({ workspace_id: 'acme', action: 'event', subject: 'events/race.md', operation_id: 'race', idempotency_key: 'race', principal });
+  const appends = await raceProcesses(racers, { JsonlEventStore: '../src/events.mjs' },
+    `await new JsonlEventStore(${JSON.stringify(eventsRoot)}).append(${JSON.stringify(event)})`);
+  const lines = fs.readFileSync(path.join(eventsRoot, 'acme.jsonl'), 'utf8').split('\n').filter(Boolean);
+  check('jsonl event store lets one of several processes append the same event_id', winners(appends).length === 1 && lines.length === 1, describe(appends));
+
+  const vfsRoot = path.join(root, 'vfs');
+  const creates = await raceProcesses(racers, { FileSystemVfs: '../src/vfs.mjs' },
+    `await new FileSystemVfs(${JSON.stringify(vfsRoot)}).writeAtomic('race/create.md', 'racer-' + racer, { ifAbsent: true })`);
+  const created = fs.readFileSync(path.join(vfsRoot, 'race', 'create.md'), 'utf8');
+  check('filesystem VFS lets one of several processes create the same path',
+    winners(creates).length === 1 && created === `racer-${winners(creates)[0]?.racer}`, describe(creates));
+  const base = await new FileSystemVfs(vfsRoot).writeAtomic('race/cas.md', 'base', { ifAbsent: true });
+  const swaps = await raceProcesses(racers, { FileSystemVfs: '../src/vfs.mjs' },
+    `await new FileSystemVfs(${JSON.stringify(vfsRoot)}).writeAtomic('race/cas.md', 'racer-' + racer, { version: ${JSON.stringify(base.version)} })`);
+  const swapped = fs.readFileSync(path.join(vfsRoot, 'race', 'cas.md'), 'utf8');
+  check('filesystem VFS lets one of several processes compare-and-swap the same version',
+    winners(swaps).length === 1 && swapped === `racer-${winners(swaps)[0]?.racer}`, describe(swaps));
+
+  const leaseRoot = path.join(root, 'leases');
+  const leases = await raceProcesses(racers, { FileLeaseStore: '../src/leases.mjs' },
+    `await new FileLeaseStore(${JSON.stringify(leaseRoot)}).acquire({ workspace_id: 'acme', target: 'race.md', principal_id: 'p' + racer, operation_id: 'o' + racer }, 60000)`);
+  const held = JSON.parse(fs.readFileSync(leaseStatePath(fs.realpathSync(leaseRoot), 'acme', 'race.md'), 'utf8'));
+  check('filesystem lease store grants one of several processes the same lease',
+    winners(leases).length === 1 && held.principal_id === `p${winners(leases)[0]?.racer}`, describe(leases));
+
+  const idempotencyRoot = path.join(root, 'idempotency');
+  const puts = await raceProcesses(racers, { FileIdempotencyStore: '../src/idempotency.mjs' },
+    `await new FileIdempotencyStore(${JSON.stringify(idempotencyRoot)}).put('acme', 'race', { request_hash: 'racer-' + racer })`);
+  const stored = await new FileIdempotencyStore(idempotencyRoot).get('acme', 'race');
+  check('filesystem idempotency store accepts one of several processes putting the same key',
+    winners(puts).length === 1 && stored?.request_hash === `racer-${winners(puts)[0]?.racer}`, describe(puts));
+}
+
+async function checkFileLocks(root, principal, check) {
+  const make = (id) => createCanonicalEvent({ workspace_id: 'acme', action: 'event', subject: 'events/lock.md', operation_id: id, idempotency_key: id, principal });
+  const lock = path.join(root, 'acme.jsonl.lock');
+  const holder = (fields) => fs.writeFileSync(lock, JSON.stringify({ token: 'other', host: os.hostname(), ...fields }));
+  const store = new JsonlEventStore(root, { lock: { timeoutMs: 500, staleMs: 60_000 } });
+
+  holder({ pid: process.pid });
+  const started = Date.now();
+  check('file locks make a writer wait for a live holder and then time out',
+    await rejects(store.append(make('lock-live')), /Timed out waiting for lock/) && Date.now() - started >= 450 && fs.existsSync(lock));
+  const exited = spawnSync(process.execPath, ['-e', '']).pid;
+  holder({ pid: exited });
+  await store.append(make('lock-dead'));
+  check('file locks break a lock whose holder process has exited', !fs.existsSync(lock));
+  holder({ pid: process.pid, host: 'another-host' });
+  const past = new Date(Date.now() - 120_000);
+  fs.utimesSync(lock, past, past);
+  await new JsonlEventStore(root, { lock: { timeoutMs: 500, staleMs: 30_000 } }).append(make('lock-stale'));
+  check('file locks break a lock older than the stale threshold', !fs.existsSync(lock));
+  const decoy = path.join(root, 'decoy.txt');
+  fs.writeFileSync(decoy, 'untouched');
+  fs.symlinkSync(decoy, lock);
+  check('file locks refuse a symlinked lock file',
+    await rejects(store.append(make('lock-symlink')), /not a regular file/) && fs.readFileSync(decoy, 'utf8') === 'untouched');
+  fs.rmSync(lock);
+
+  const vfs = new FileSystemVfs(path.join(root, 'vfs'));
+  await vfs.writeAtomic('docs/one.md', 'one', { ifAbsent: true });
+  fs.writeFileSync(path.join(vfs.root, '.ssss-locks', 'leftover.lock'), '{}');
+  const listed = [];
+  for await (const entry of vfs.list()) listed.push(entry.path);
+  check('filesystem VFS reserves its lock directory',
+    await rejects(vfs.writeAtomic('.ssss-locks/forged.lock', 'x'), /reserved/)
+    && await rejects(vfs.writeAtomic('.SSSS-Locks/forged.lock', 'x'), /reserved/)
+    && JSON.stringify(listed) === JSON.stringify(['docs/one.md']));
+}
+
+async function checkJsonlEventStoreIndex(root, principal, check) {
+  let seq = 0;
+  const make = (workspace = 'acme') => createCanonicalEvent({
+    workspace_id: workspace, action: 'event', subject: 'events/indexed.md',
+    operation_id: `indexed-${++seq}`, idempotency_key: `indexed-${seq}`, principal,
+  });
+  const first = new JsonlEventStore(root);
+  const second = new JsonlEventStore(root);
+  const log = path.join(first.root, 'acme.jsonl');
+  const appended = [];
+  const add = async (store, event) => { await store.append(event); appended.push(event.event_id); return event; };
+
+  const own = await add(first, make());
+  check('jsonl event store rejects a duplicate from its own index', await rejects(first.append(own), /Duplicate event_id/));
+  const foreign = await add(second, make());
+  check('jsonl event store rejects a duplicate appended by another store instance', await rejects(first.append(foreign), /Duplicate event_id/));
+  const external = make();
+  execFileSync(process.execPath, ['--input-type=module', '-e', [
+    `import { JsonlEventStore } from ${JSON.stringify(new URL('../src/events.mjs', import.meta.url).href)};`,
+    `await new JsonlEventStore(${JSON.stringify(root)}).append(${JSON.stringify(external)});`,
+  ].join('\n')]);
+  appended.push(external.event_id);
+  check('jsonl event store rejects a duplicate appended by another process', await rejects(second.append(external), /Duplicate event_id/));
+  await add(first, make());
+  check('jsonl event store rejects a duplicate after interleaved writers', await rejects(second.append(own), /Duplicate event_id/));
+
+  const seeded = fs.statSync(log).size;
+  const fresh = new JsonlEventStore(root);
+  const batchBytes = await bytesReadFrom(log, async () => { for (let i = 0; i < 200; i++) await add(fresh, make()); });
+  check('jsonl event store reads the log once for many appends from one instance', batchBytes === seeded, `read ${batchBytes} bytes; log was ${seeded}`);
+  await add(second, make());
+  const revalidateBytes = await bytesReadFrom(log, () => add(fresh, make()));
+  check('jsonl event store rebuilds its index after another writer appends', revalidateBytes > seeded);
+
+  const other = [];
+  for (let i = 0; i < 3; i++) other.push((await (i % 2 ? second : first).append(make('aaa'))).event_id);
+  const acme = await replayed(fresh, { workspaceId: 'acme' });
+  check('jsonl event store replays one log in append order',
+    JSON.stringify(acme.map((item) => item.event.event_id)) === JSON.stringify(appended)
+    && acme.every((item, index) => item.cursor === index + 1));
+  const all = await replayed(fresh, {});
+  const expected = [...other, ...appended];
+  const resumed = await replayed(fresh, { cursor: 2 });
+  check('jsonl event store replays all logs in file order and resumes from a cursor',
+    JSON.stringify(all.map((item) => item.event.event_id)) === JSON.stringify(expected)
+    && JSON.stringify(resumed.map((item) => item.event.event_id)) === JSON.stringify(expected.slice(2)));
+
+  if (process.platform !== 'win32') {
+    check('jsonl event logs are created with mode 0600', (fs.statSync(path.join(root, 'aaa.jsonl')).mode & 0o777) === 0o600);
+  }
+  const target = path.join(root, 'target.txt');
+  fs.writeFileSync(target, '');
+  fs.symlinkSync(target, path.join(root, 'linked.jsonl'));
+  check('jsonl event store refuses symlinked logs',
+    await rejects(fresh.append(make('linked')), /Symlinked event logs are forbidden/) && fs.readFileSync(target, 'utf8') === '');
+}
 
 export async function runKernel09Conformance() {
   const checks = [];
@@ -93,11 +286,23 @@ export async function runKernel09Conformance() {
       ['filesystem', new FileLeaseStore(path.join(temp, 'leases'))],
     ]) check(`${name} lease store passes the shared contract`, (await runLeaseContract(store)).passed);
 
-    const authorize = createCapabilityAuthorizer();
+    const authorize = createCapabilityAuthorizer({
+      policyFloors: { [definition.primitive_id]: { delete: ['booking:admin'] } },
+    });
+    check('verified principal contract requires provenance', !validateVerifiedPrincipal({ id: 'x', kind: 'human', workspaceIds: [] }).valid);
+    check('verified principal contract accepts complete identity', validateVerifiedPrincipal({
+      id: 'greg', kind: 'human', workspaceIds: ['acme'], authentication: { provider: 'conformance', assurance: 'verified' },
+    }).valid);
     const protectedPrincipal = { id: 'agent', kind: 'agent', workspaceIds: ['acme'], capabilities: ['booking:update'], authentication: { provider: 'test', assurance: 'verified' } };
     const protectedContext = { principal: protectedPrincipal, workspaceId: 'acme', definition, action: 'patch', context: { requiredAssurance: 'elevated' } };
     check('protected actions require authentication step-up', !(await authorize(protectedContext)).allowed);
     check('protected actions require explicit verified-human confirmation', !(await authorize({ ...protectedContext, principal: { ...protectedPrincipal, kind: 'human', authentication: { provider: 'test', assurance: 'elevated' } }, context: { requiresHumanConfirmation: true } })).allowed);
+    check('policy floors fail closed without elevated capabilities', !(await authorize({
+      principal: { ...protectedPrincipal, capabilities: ['booking:delete'] },
+      workspaceId: 'acme',
+      definition,
+      action: 'delete',
+    })).allowed);
 
     const vfs = new MemoryVfs();
     const eventStore = new MemoryEventStore();
@@ -110,27 +315,61 @@ export async function runKernel09Conformance() {
       reset: async () => projected.clear(),
       snapshot: async () => Object.fromEntries([...projected.entries()].sort()),
     });
-    const kernel = createKernel({ vfs, eventStore, projectionCoordinator: coordinator, validator });
+    const sql = createSqlProjectionAdapter();
+    const search = createSearchProjectionAdapter();
+    const queue = createQueueProjectionAdapter();
+    const viewModel = createViewModelProjectionAdapter();
+    for (const adapter of [sql, search, queue, viewModel]) coordinator.register(adapter);
+    const leaseStore = new MemoryLeaseStore();
+    const kernel = createKernel({
+      vfs, eventStore, projectionCoordinator: coordinator, validator, leaseStore, authorize,
+    });
     const principal = {
-      id: 'greg', kind: 'human', workspaceIds: ['acme'], capabilities: ['booking:create', 'booking:update', 'booking:delete'],
+      id: 'greg', kind: 'human', workspaceIds: ['acme'], capabilities: ['booking:create', 'booking:update', 'booking:delete', 'booking:admin'],
       authentication: { provider: 'conformance', assurance: 'verified' },
     };
     const createEnvelope = { type: 'operation', workspace_id: 'acme', idempotency_key: 'create-booking', path: 'bookings/one.md', content };
     const created = await kernel.execute(createEnvelope, { principal });
     check('shared kernel commits an authorized runtime primitive', created.success, JSON.stringify(created));
+    const leaseDenied = await kernel.execute({
+      type: 'patch', workspace_id: 'acme', idempotency_key: 'lease-denied', path: 'bookings/one.md', patches: { status: 'confirmed' },
+    }, { principal, requireLease: true });
+    check('kernel fails closed when a required lease is missing', leaseDenied.success === false && /lease/i.test(leaseDenied.validation.errors.join(' ')));
+    const lease = await leaseStore.acquire({
+      workspace_id: 'acme', target: 'bookings/one.md', principal_id: principal.id, operation_id: 'lease-ok',
+    }, 30_000);
+    const leased = await kernel.execute({
+      type: 'patch', workspace_id: 'acme', idempotency_key: 'lease-ok', path: 'bookings/one.md',
+      patches: { status: 'confirmed' }, lease_id: lease.lease_id, operation_id: 'lease-ok',
+    }, { principal, requireLease: true });
+    check('kernel accepts a matching verified lease', leased.success, JSON.stringify(leased));
     const replay = await kernel.execute(createEnvelope, { principal });
     check('exact retries replay idempotently', replay.replay === true);
     const conflict = await kernel.execute({ ...createEnvelope, content: content.replace('status: pending', 'status: confirmed') }, { principal });
     check('idempotency key reuse with changed content conflicts', conflict.success === false);
-    const patched = await kernel.execute({ type: 'patch', workspace_id: 'acme', idempotency_key: 'patch-booking', path: 'bookings/one.md', patches: { status: 'confirmed' } }, { principal });
-    check('shared kernel patches and events the primitive', patched.success && await eventStore.size() === 2);
+    const patched = await kernel.execute({ type: 'patch', workspace_id: 'acme', idempotency_key: 'patch-booking', path: 'bookings/one.md', patches: { status: 'pending' } }, { principal });
+    check('shared kernel patches and events the primitive', patched.success && await eventStore.size() === 3);
     check('projection dispatch follows committed events', projected.has('bookings/one.md'));
+    const sqlSnap = await sql.snapshot();
+    const searchSnap = await search.snapshot();
+    const queueSnap = await queue.snapshot();
+    const viewSnap = await viewModel.snapshot();
+    check('SQL/search/queue/view-model adapters receive events',
+      Object.values(sqlSnap).some((row) => row.subject === 'bookings/one.md')
+      && Object.hasOwn(searchSnap, 'bookings/one.md')
+      && queueSnap.length >= 1
+      && viewSnap['bookings/one.md']?.last_action);
     const rebuilt = await coordinator.replay('bookings', { rebuild: true });
-    check('projection is rebuildable from the event log', rebuilt.applied === 2 && projected.has('bookings/one.md'));
+    check('projection is rebuildable from the event log', rebuilt.applied === 3 && projected.has('bookings/one.md'));
     const expectedProjectionHash = rebuilt.output_hash;
     projected.set('tampered', 'direct-write');
     check('projection drift is detectable', (await coordinator.detectDrift('bookings', expectedProjectionHash)).drift);
     projected.delete('tampered');
+    const sqlBefore = await sql.snapshot();
+    await coordinator.replay(sql.id, { rebuild: true });
+    check('projections can be deleted and rebuilt without losing canonical meaning',
+      JSON.stringify(await sql.snapshot()) === JSON.stringify(sqlBefore)
+      && (await vfs.read('bookings/one.md'))?.hash);
     coordinator.register({ id: 'broken', apply: async () => { throw new Error('projection offline'); } });
     const beforeFailure = (await vfs.read('bookings/one.md')).hash;
     const failureDispatch = await coordinator.dispatch(createCanonicalEvent({ workspace_id: 'acme', action: 'patch', subject: 'bookings/one.md', operation_id: 'projection-failure', idempotency_key: 'projection-failure', principal }));
@@ -145,6 +384,9 @@ export async function runKernel09Conformance() {
       for await (const item of store.replay({ workspaceId: 'acme' })) if (item.event.event_id === sample.event_id) replayed++;
       check(`${name} event store is append-only and replayable`, duplicate && replayed === 1);
     }
+    await checkJsonlEventStoreIndex(path.join(temp, 'events-index'), principal, check);
+    await checkFileAdapterRaces(path.join(temp, 'races'), principal, check);
+    await checkFileLocks(path.join(temp, 'locks'), principal, check);
     const denied = await kernel.execute({ type: 'patch', workspace_id: 'acme', idempotency_key: 'denied', path: 'bookings/one.md', patches: { status: 'pending' } }, {
       principal: { ...principal, id: 'outsider', workspaceIds: [], capabilities: ['*:*'] },
     });

package/scripts/conformance.mjs

@@ -691,6 +691,53 @@ async function runCliSmokeConformance() {
     check('ssss import --dry-run reports would-commit counts and leaves target empty',
       dryRunOut.includes('would commit') && dryRunFiles.length === 0,
       dryRunOut.trim());
+
+    const primitiveOut = JSON.parse(execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'primitive', 'create',
+      '--namespace', 'acme',
+      '--name', '顧客予約',
+      '--language', 'ja',
+      '--fields', JSON.stringify([{ id: 'status', name: '状態', kind: 'enum', values: ['pending', 'confirmed'], required: true }]),
+    ], { encoding: 'utf8' }));
+    check('ssss primitive create emits a stable qualified identity',
+      /^acme:p_[a-f0-9]{20}$/.test(primitiveOut.primitive_id),
+      JSON.stringify(primitiveOut));
+
+    const defPath = path.join(tmp, 'definition.json');
+    fs.writeFileSync(defPath, `${JSON.stringify(primitiveOut)}\n`);
+    const inspectOut = JSON.parse(execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'primitive', 'inspect',
+      defPath,
+    ], { encoding: 'utf8' }));
+    const extensionPath = path.join(tmp, 'extension.json');
+    fs.writeFileSync(extensionPath, `${JSON.stringify(inspectOut.registry)}\n`);
+    const lockOut = JSON.parse(execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'registry', 'lock',
+      '--extension', extensionPath,
+    ], { encoding: 'utf8' }));
+    check('ssss registry lock emits integrity metadata',
+      typeof lockOut.integrity === 'string' && lockOut.integrity.startsWith('sha256:'),
+      JSON.stringify(lockOut));
+
+    const adapterOut = JSON.parse(execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'adapter', 'conformance',
+    ], { encoding: 'utf8' }));
+    check('ssss adapter conformance report is machine-readable and green',
+      adapterOut.passed === true && adapterOut.suites?.vfs_memory?.passed === true,
+      JSON.stringify(adapterOut));
+
+    const migrateOut = JSON.parse(execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'migrate', '0.8-to-0.9',
+      vault,
+    ], { encoding: 'utf8' }));
+    check('ssss migrate 0.8-to-0.9 dry-run emits backup manifest without writes',
+      migrateOut.dry_run === true && migrateOut.writes_performed === 0 && Array.isArray(migrateOut.backup_manifest),
+      JSON.stringify(migrateOut));
   } finally {
     fs.rmSync(tmp, { recursive: true, force: true });
   }

package/scripts/generate-sbom.mjs

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+/**
+ * Generate a minimal SPDX-lite SBOM for @gregiteen/ssss-cli publish artifacts.
+ * Dependency-free: packages only what is declared in package.json (zero runtime deps).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+
+function walk(dir, out = []) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === 'node_modules' || entry.name === '.git') continue;
+    const abs = path.join(dir, entry.name);
+    if (entry.isDirectory()) walk(abs, out);
+    else if (entry.isFile()) out.push(abs);
+  }
+  return out;
+}
+
+const files = walk(root).filter(
+  (f) =>
+    !f.includes(`${path.sep}artifacts${path.sep}`) &&
+    !f.endsWith('package-lock.json'),
+);
+
+const packages = [
+  {
+    name: pkg.name,
+    version: pkg.version,
+    downloadLocation: `https://registry.npmjs.org/${pkg.name}/-/${pkg.name.split('/').pop()}-${pkg.version}.tgz`,
+    filesAnalyzed: true,
+    licenseConcluded: pkg.license || 'NOASSERTION',
+  },
+];
+
+// Zero runtime dependencies by design — still list optional peer/dev if present
+for (const [section, deps] of Object.entries({
+  dependencies: pkg.dependencies || {},
+  optionalDependencies: pkg.optionalDependencies || {},
+})) {
+  for (const [name, version] of Object.entries(deps)) {
+    packages.push({
+      name,
+      version: String(version).replace(/^[\^~]/, ''),
+      relationship: section,
+    });
+  }
+}
+
+const fileEntries = files.map((abs) => {
+  const rel = path.relative(root, abs).split(path.sep).join('/');
+  const buf = fs.readFileSync(abs);
+  return {
+    fileName: rel,
+    checksums: [
+      {
+        algorithm: 'SHA256',
+        checksumValue: crypto.createHash('sha256').update(buf).digest('hex'),
+      },
+    ],
+  };
+});
+
+const sbom = {
+  spdxVersion: 'SPDX-2.3',
+  dataLicense: 'CC0-1.0',
+  SPDXID: 'SPDXRef-DOCUMENT',
+  name: `${pkg.name}-${pkg.version}`,
+  documentNamespace: `https://github.com/gregiteen/ssss/sbom/${pkg.version}`,
+  creationInfo: {
+    created: new Date().toISOString(),
+    creators: ['Tool: ssss-generate-sbom'],
+  },
+  packages,
+  files: fileEntries,
+  relationships: [
+    {
+      spdxElementId: 'SPDXRef-DOCUMENT',
+      relationshipType: 'DESCRIBES',
+      relatedSpdxElement: 'SPDXRef-Package',
+    },
+  ],
+  comment:
+    'SSSS reference package is intentionally dependency-free at runtime. Host apps supply adapters.',
+};
+
+const outDir = path.join(root, 'artifacts');
+fs.mkdirSync(outDir, { recursive: true });
+const outFile = path.join(outDir, `sbom-${pkg.version}.spdx.json`);
+fs.writeFileSync(outFile, `${JSON.stringify(sbom, null, 2)}\n`);
+console.log(`SBOM written: ${outFile}`);
+console.log(`Packages: ${packages.length}, files hashed: ${fileEntries.length}`);