@grosspoetrysystems/oompf 0.1.1 → 0.2.1

package/dist/index.d.mts

@@ -168,10 +168,12 @@ interface CliDeps {
 /**
  * OOMPF CLI version, surfaced by `oompf --version`.
  *
- * Must match `package.json`; `index.test.ts` asserts it, because a published
- * binary reporting the wrong version makes every bug report ambiguous.
+ * Read from `package.json` rather than restated, because npm publishes the
+ * manifest's version regardless of what the binary claims: a hand-maintained
+ * copy can only ever drift, and a binary reporting the wrong version makes
+ * every bug report ambiguous. The bundler inlines this at build time.
  */
-declare const CLI_VERSION = "0.1.1";
+declare const CLI_VERSION: string;
 /** Build the OOMPF CLI with the given (optional) injectable seams. */
 declare function createCli(deps?: CliDeps): Cli.Cli<{}, undefined, undefined, undefined>;
 //#endregion

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../packages/core/dist/omp-profile.d.ts","../../../packages/github/dist/gh.d.ts","../../../packages/github/dist/gists.d.ts","../src/deps.ts","../src/index.ts"],"mappings":";;;;;;;;;;;;;;;;;UAeiB;;WAEJ;;WAEA;;WAEA;;;UAGI;;WAEJ;;WAEA;;WAEA,UAAU;;WAEV;;;UAGI;;WAEJ;;;;;;;;;iBASW,qBAAqB,cAAc,UAAU,oBAAoB;;;;;;;;iBAQjE,qBAAqB,iBAAiB,UAAU,oBAAoB,QAAQ;;;;;;;;;iBAS5E,iBAAiB,UAAU,oBAAoB,QAAQ;;;;;;;;;;;;;;;;;;UChD9D;;WAEJ;WACA;WACA;;;UAGI;;WAEJ;;WAEA;;WAEA;;;;;;;;;;KAUD,iBAAiB,OAAO,iBAAiB,QAAQ;;;;UCG5C;WACJ;WACA;EACT,QAAQ;;;KAGA,aAAa,aAAa;WACzB,UAAU;MACjB,QAAQ;;;;UC3BG;WACN;WACA;EACT,QAAQ;;;KAIE,aACV,aACA;WACW;WACA,UAAU;WACV;MAER,QAAQ;;UAGI;;EAEf,OAAO,eAAe;;EAEtB,MAAM,cAAc,eAAe;;EAEnC,SAAS,eAAe;;EAExB,UAAU,cAAc,cAAc,eAAe;;;UAoCtC;;WAEN,0BAA0B;;WAE1B,KAAK;;WAEL;;WAEA,YAAY;;WAEZ,YAAY;;WAEZ;;WAEA,8BAA8B;;WAE9B,8BAA8B;;WAE9B,SAAS;;;;;;;;;;cC5EP;;iBAGG,UAAU,OAAM,UAAY,IAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../packages/core/dist/omp-profile.d.ts","../../../packages/github/dist/gh.d.ts","../../../packages/github/dist/gists.d.ts","../src/deps.ts","../src/index.ts"],"mappings":";;;;;;;;;;;;;;;;;UAeiB;;WAEJ;;WAEA;;WAEA;;;UAGI;;WAEJ;;WAEA;;WAEA,UAAU;;WAEV;;;UAGI;;WAEJ;;;;;;;;;iBASW,qBAAqB,cAAc,UAAU,oBAAoB;;;;;;;;iBAQjE,qBAAqB,iBAAiB,UAAU,oBAAoB,QAAQ;;;;;;;;;iBAS5E,iBAAiB,UAAU,oBAAoB,QAAQ;;;;;;;;;;;;;;;;;;UChD9D;;WAEJ;WACA;WACA;;;UAGI;;WAEJ;;WAEA;;WAEA;;;;;;;;;;KAUD,iBAAiB,OAAO,iBAAiB,QAAQ;;;;UCG5C;WACJ;WACA;EACT,QAAQ;;;KAGA,aAAa,aAAa;WACzB,UAAU;MACjB,QAAQ;;;;UC3BG;WACN;WACA;EACT,QAAQ;;;KAIE,aACV,aACA;WACW;WACA,UAAU;WACV;MAER,QAAQ;;UAGI;;EAEf,OAAO,eAAe;;EAEtB,MAAM,cAAc,eAAe;;EAEnC,SAAS,eAAe;;EAExB,UAAU,cAAc,cAAc,eAAe;;;UAoCtC;;WAEN,0BAA0B;;WAE1B,KAAK;;WAEL;;WAEA,YAAY;;WAEZ,YAAY;;WAEZ;;WAEA,8BAA8B;;WAE9B,8BAA8B;;WAE9B,SAAS;;;;;;;;;;;;cC1EP;;iBAGG,UAAU,OAAM,UAAY,IAAA"}

package/dist/index.mjs

@@ -10,6 +10,9 @@ import { spawn } from "node:child_process";
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
+//#region package.json
+var version = "0.2.1";
+//#endregion
 //#region ../../packages/core/src/guards.ts
 /**
 * Canonical runtime type guards for `@oompf/core`.
@@ -8161,8 +8164,17 @@ function registerAdd(cli, deps) {
 			try {
 				const oompfId = parseOompfRef(c.args.ref);
 				let sourceUrl = c.args.ref;
-				if (oompfId !== null) sourceUrl = (await fetchProfileMetadata(c.env.OOMPF_BASE_URL, oompfId, deps.httpFetch)).sourceUrl;
-				const gist = await fetchPublicGist(sourceUrl, { fetch: deps.gistFetch });
+				let fetchUrl = sourceUrl;
+				let expectedHash = null;
+				if (oompfId !== null) {
+					const record = await fetchProfileMetadata(c.env.OOMPF_BASE_URL, oompfId, deps.httpFetch);
+					if (record.revision === null) throw new CommandError("unverifiable_artifact", "The indexed profile has no pinned revision and cannot be installed reproducibly.");
+					sourceUrl = record.sourceUrl;
+					fetchUrl = `https://api.github.com/gists/${record.gistId}/${record.revision}`;
+					expectedHash = record.contentHash;
+				}
+				const gist = await fetchPublicGist(fetchUrl, { fetch: deps.gistFetch });
+				if (expectedHash !== null && gist.contentHash !== expectedHash) throw new CommandError("fingerprint_mismatch", "The pinned profile bytes do not match the indexed fingerprint. Refusing to install.");
 				const validation = validateArtifact({ yaml: gist.content });
 				if (validation.structural === "invalid") throw new CommandError("invalid_artifact", `Refusing to install an invalid artifact: ${validation.errors.join("; ")}`);
 				const stem = filenameStem$1(gist.filename);
@@ -8438,10 +8450,12 @@ function registerSearch(cli, deps) {
 /**
 * OOMPF CLI version, surfaced by `oompf --version`.
 *
-* Must match `package.json`; `index.test.ts` asserts it, because a published
-* binary reporting the wrong version makes every bug report ambiguous.
+* Read from `package.json` rather than restated, because npm publishes the
+* manifest's version regardless of what the binary claims: a hand-maintained
+* copy can only ever drift, and a binary reporting the wrong version makes
+* every bug report ambiguous. The bundler inlines this at build time.
 */
-const CLI_VERSION = "0.1.1";
+const CLI_VERSION = version;
 /** Build the OOMPF CLI with the given (optional) injectable seams. */
 function createCli(deps = {}) {
 	const resolved = resolveDeps(deps);