@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.0

package/scripts/auditable-demo.mjs

@@ -22,6 +22,19 @@ const REQUIRED_ADAPTER_FILES = [
   "public-projection.json",
   "scene.json",
 ];
+const OPTIONAL_ADAPTER_FILES = ["terminal-capture.json"];
+const MAX_TERMINAL_CAPTURE_BYTES = 4 * 1024 * 1024;
+const MAX_TERMINAL_CAPTURE_EVENTS = 10_000;
+const TERMINAL_CAPTURE_NON_AUTHORITIES = [
+  "first-party-identity",
+  "system-identity",
+  "kfd-compliance",
+  "product-system-metadata",
+  "package-metadata",
+  "registry-history",
+  "scan-output",
+  "standalone-generation",
+];
 
 function invariant(condition, message) {
   if (!condition) throw new Error(message);
@@ -155,6 +168,19 @@ function text(value, minimum, maximum, label) {
   return value;
 }
 
+function decodeBase64(value, label) {
+  invariant(
+    typeof value === "string"
+      && value.length > 0
+      && value.length <= MAX_TERMINAL_CAPTURE_BYTES * 2
+      && /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value),
+    `${label} must be canonical base64`,
+  );
+  const decoded = Buffer.from(value, "base64");
+  invariant(decoded.toString("base64") === value, `${label} must be canonical base64`);
+  return decoded;
+}
+
 function validateScene(value) {
   exactKeys(
     value,
@@ -223,6 +249,81 @@ function validateProjection(value, scene, transcriptLineCount) {
   };
 }
 
+function validateTerminalCapture(value, scene) {
+  exactKeys(
+    value,
+    [
+      "schema",
+      "command",
+      "dimensions",
+      "durationMs",
+      "encoding",
+      "events",
+      "completion",
+      "exitCode",
+      "authority",
+    ],
+    [],
+    "terminalCapture",
+  );
+  invariant(value.schema === "kungfu.terminal-capture/v1", "unsupported terminal capture schema");
+  text(value.command, 1, 160, "terminalCapture.command");
+  exactKeys(value.dimensions, ["columns", "rows"], [], "terminalCapture.dimensions");
+  integer(value.dimensions.columns, 80, 200, "terminalCapture.dimensions.columns");
+  integer(value.dimensions.rows, 24, 80, "terminalCapture.dimensions.rows");
+  const durationMs = integer(value.durationMs, 500, 60000, "terminalCapture.durationMs");
+  invariant(
+    durationMs <= scene.durationMs && scene.durationMs - durationMs <= 2000,
+    "terminal capture duration must end within two seconds of the scene",
+  );
+  invariant(value.encoding === "base64", "terminalCapture.encoding must be base64");
+  invariant(
+    Array.isArray(value.events)
+      && value.events.length > 0
+      && value.events.length <= MAX_TERMINAL_CAPTURE_EVENTS,
+    `terminalCapture.events must contain 1 through ${MAX_TERMINAL_CAPTURE_EVENTS} events`,
+  );
+  let previousAtMs = -1;
+  let totalBytes = 0;
+  for (const [index, event] of value.events.entries()) {
+    exactKeys(event, ["atMs", "data"], [], `terminalCapture.events[${index}]`);
+    const atMs = integer(event.atMs, 0, durationMs - 1, `terminalCapture.events[${index}].atMs`);
+    invariant(atMs >= previousAtMs, "terminal capture event timestamps must be monotonic");
+    invariant(index > 0 || atMs === 0, "the first terminal capture event must start at zero");
+    previousAtMs = atMs;
+    totalBytes += decodeBase64(event.data, `terminalCapture.events[${index}].data`).length;
+    invariant(totalBytes <= MAX_TERMINAL_CAPTURE_BYTES, "terminal capture exceeds the 4 MiB byte bound");
+  }
+  exactKeys(
+    value.completion,
+    ["schema", "status", "reportRoot", "eventCount"],
+    [],
+    "terminalCapture.completion",
+  );
+  invariant(
+    value.completion.schema === "kungfu.agent-work-lab.tui-autoplay/v1"
+      && value.completion.status === "qualified"
+      && DIGEST_PATTERN.test(value.completion.reportRoot),
+    "terminal capture completion sentinel is not a qualified Agent Work Lab autoplay",
+  );
+  integer(value.completion.eventCount, 1, 100_000, "terminalCapture.completion.eventCount");
+  invariant(value.exitCode === 0, "terminal capture exitCode must be zero");
+  exactKeys(value.authority, ["classification", "grants", "nonAuthorities"], [], "terminalCapture.authority");
+  invariant(
+    value.authority.classification === "volatile-terminal-observation",
+    "terminal capture authority classification must remain observation-only",
+  );
+  invariant(
+    Array.isArray(value.authority.grants) && value.authority.grants.length === 0,
+    "terminal capture must not grant authority",
+  );
+  invariant(
+    JSON.stringify(value.authority.nonAuthorities) === JSON.stringify(TERMINAL_CAPTURE_NON_AUTHORITIES),
+    "terminal capture must declare every identity and metadata non-authority",
+  );
+  return value;
+}
+
 function validateSourceCoordinate(value) {
   exactKeys(
     value,
@@ -276,11 +377,21 @@ function validateAdapterOutput(output, strict = true) {
     scene,
     lines.length,
   );
+  const terminalCapturePath = path.join(output, "terminal-capture.json");
+  const terminalCapture = fs.existsSync(terminalCapturePath)
+    ? validateTerminalCapture(readJson(terminalCapturePath, "terminal capture"), scene)
+    : null;
   if (strict) {
-    const allowed = new Set(REQUIRED_ADAPTER_FILES);
+    const allowed = new Set([...REQUIRED_ADAPTER_FILES, ...OPTIONAL_ADAPTER_FILES]);
     for (const member of listFiles(output)) invariant(allowed.has(member), `undeclared adapter output: ${member}`);
   }
-  return { transcript: transcript.endsWith("\n") ? transcript : `${transcript}\n`, lines, scene, projection };
+  return {
+    transcript: transcript.endsWith("\n") ? transcript : `${transcript}\n`,
+    lines,
+    scene,
+    projection,
+    terminalCapture,
+  };
 }
 
 function parseArguments(argv) {
@@ -355,6 +466,9 @@ function runAdapter(values) {
     fs.writeFileSync(path.join(output, "complete-transcript.txt"), normalized.transcript);
     writeJson(path.join(output, "scene.json"), normalized.scene);
     writeJson(path.join(output, "public-projection.json"), normalized.projection);
+    if (normalized.terminalCapture) {
+      writeJson(path.join(output, "terminal-capture.json"), normalized.terminalCapture);
+    }
     writeJson(path.join(diagnostics, "adapter.json"), {
       schema: "buildchain.auditable-demo-adapter-execution/v1",
       path: adapterRelative,
@@ -885,6 +999,12 @@ function finalizeGate(values) {
   fs.writeFileSync(path.join(output, "complete-transcript.txt"), normalized.transcript);
   writeJson(path.join(output, "scene.json"), normalized.scene);
   writeJson(path.join(output, "public-projection.json"), normalized.projection);
+  if (normalized.terminalCapture) {
+    copyFile(
+      path.join(adapterOutput, "terminal-capture.json"),
+      path.join(output, "terminal-capture.json"),
+    );
+  }
   copyFile(sourceCoordinatePath, path.join(output, "source-artifact.json"));
   copyFile(path.join(diagnostics, "adapter.json"), path.join(output, "adapter.json"));
   for (const name of listFiles(smokeOutput)) {
@@ -914,6 +1034,14 @@ function finalizeGate(values) {
       transcript: sha256(readRegular(path.join(output, "complete-transcript.txt"), "transcript")),
       projection: sha256(readRegular(path.join(output, "public-projection.json"), "projection")),
       scene: sha256(readRegular(path.join(output, "scene.json"), "scene")),
+      ...(normalized.terminalCapture
+        ? {
+          terminalCapture: {
+            schema: normalized.terminalCapture.schema,
+            root: sha256(readRegular(path.join(output, "terminal-capture.json"), "terminal capture")),
+          },
+        }
+        : {}),
       evidenceClass: normalized.projection.evidenceClass,
       claimBoundary: normalized.projection.claimBoundary,
     },
@@ -945,6 +1073,19 @@ function verifyGate(values) {
       && receipt.qualifiedInputs?.scene === sha256(readRegular(path.join(bundle, "scene.json"), "scene")),
     "gate qualified input roots mismatch",
   );
+  const qualifiedCapture = receipt.qualifiedInputs?.terminalCapture;
+  invariant(
+    Boolean(qualifiedCapture) === Boolean(normalized.terminalCapture),
+    "gate terminal capture presence drifted",
+  );
+  if (normalized.terminalCapture) {
+    invariant(
+      qualifiedCapture.schema === normalized.terminalCapture.schema
+        && qualifiedCapture.root
+          === sha256(readRegular(path.join(bundle, "terminal-capture.json"), "terminal capture")),
+      "gate terminal capture root mismatch",
+    );
+  }
   invariant(receipt.qualifiedInputs.evidenceClass === normalized.projection.evidenceClass, "gate evidence class drifted");
 }
 
@@ -973,10 +1114,14 @@ function finalizeMedia(values) {
     "--renderer-image": rendererImage,
     "--source-sha": sourceSha,
   });
+  const terminalCapturePath = path.join(gateBundle, "terminal-capture.json");
   const verifiedRenderer = verifyRendererOutput(renderOutput, rendererImage, {
     scene: path.join(gateBundle, "scene.json"),
     transcript: path.join(gateBundle, "complete-transcript.txt"),
     projection: path.join(gateBundle, "public-projection.json"),
+    ...(fs.existsSync(terminalCapturePath)
+      ? { terminalCapture: terminalCapturePath }
+      : {}),
   }, {
     mediaProfile,
     inspectMedia: mediaInspection?.inspectMedia,

package/scripts/buildchain-patrol.mjs

@@ -49,7 +49,7 @@ function normalizeRepository(value) {
 function normalizeTargetBranch(value) {
   const branch = String(value || process.env.GITHUB_REF_NAME || DEFAULT_TARGET_BRANCH).replace(/^refs\/heads\//, "");
   if (!/^dev\/v\d+\/v\d+\.\d+$/.test(branch)) {
-    throw new Error(`target-branch must be a semver dev branch such as dev/v2/v2.N, got: ${branch || "<empty>"}`);
+    throw new Error(`target-branch must be a semver dev branch such as dev/v3/v3.N, got: ${branch || "<empty>"}`);
   }
   return branch;
 }

package/scripts/check-inventory.mjs

@@ -73,6 +73,7 @@ const requiredPaths = [
   "docs/auditable-demo.md",
   "contracts/auditable-demo-media-profiles-v1.json",
   "contracts/evidence/auditable-demo-web-delivery-v1.json",
+  "contracts/buildchain-v2-residuals-v1.json",
   "contracts/fixtures/auditable-demo-web-delivery-v1/complete-transcript.txt",
   "contracts/fixtures/auditable-demo-web-delivery-v1/public-projection.json",
   "contracts/fixtures/auditable-demo-web-delivery-v1/scene.json",

package/scripts/dev-alpha-candidate-patrol.mjs

@@ -65,6 +65,13 @@ function pullRequestBodyPrefix(value) {
   return normalized;
 }
 
+function optionalExactSha(value, name) {
+  const normalized = text(value);
+  if (normalized && !EXACT_SHA.test(normalized))
+    throw new Error(`${name} must be an exact 40-character commit SHA`);
+  return normalized;
+}
+
 function canonical(value) {
   if (Array.isArray(value)) return value.map(canonical);
   if (value && typeof value === "object") {
@@ -225,6 +232,11 @@ export function normalizeDevAlphaPatrolOptions(options = {}) {
       options.pullRequestBodyPrefix ??
         process.env.BUILDCHAIN_CHANNEL_PATROL_PR_BODY_PREFIX,
     ),
+    expectedSelectedSha: optionalExactSha(
+      options.expectedSelectedSha ??
+        process.env.BUILDCHAIN_CHANNEL_PATROL_EXPECTED_SELECTED_SHA,
+      "expectedSelectedSha",
+    ),
     createPullRequest,
     settlementAuthorized: bool(
       options.settlementAuthorized ??
@@ -526,6 +538,14 @@ export async function runDevAlphaCandidatePatrol(
         maxAgeSeconds: options.maxAgeSeconds,
         now: options.now,
       });
+  if (
+    options.expectedSelectedSha &&
+    decision.source.sha !== options.expectedSelectedSha
+  ) {
+    throw new Error(
+      `selected source changed between observation and settlement: expected ${options.expectedSelectedSha}, observed ${decision.source.sha}`,
+    );
+  }
   const openPullRequests = await client.listOpenPullRequests(
     options.targetBranch,
   );

package/scripts/dispatch-artifact-signing-authority.mjs

@@ -17,6 +17,12 @@ function repository(value, label) {
 }
 
 const TRANSIENT_GITHUB_STATUSES = new Set([408, 429, 500, 502, 503, 504]);
+const DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF = "authority/v3/v3.0/artifact-signing";
+
+export function resolveAuthorityDispatchRef(value) {
+  const ref = required(value, "authority ref");
+  return /^[0-9a-f]{40}$/u.test(ref) ? DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF : ref;
+}
 
 function retryDelayMs(attempt) {
   return Math.min(1_000 * (2 ** (attempt - 1)), 10_000);
@@ -98,7 +104,7 @@ export async function dispatchArtifactSigningAuthority({
   const authToken = required(token, "Buildchain authority dispatch token");
   const authorityRepo = repository(authorityRepository, "authority repository");
   const sourceRepo = repository(sourceRepository, "source repository");
-  const ref = required(authorityRef, "authority ref");
+  const ref = resolveAuthorityDispatchRef(authorityRef);
   const runtime = required(runtimeSha, "Buildchain runtime SHA");
   if (!/^[0-9a-f]{40}$/u.test(runtime)) throw new Error("Buildchain runtime SHA must be exact");
   const correlationId = `${required(sourceRunId, "source run ID")}-${required(sourceRunAttempt, "source run attempt")}-${runtime.slice(0, 12)}-${required(requestArtifact, "request artifact").replace(/[^A-Za-z0-9._-]+/gu, "-")}`;

package/scripts/finalize-native-artifact-signing-result.mjs

@@ -4,8 +4,14 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-import { createArtifactSigningReceipt, validateArtifactSigningRequest } from "../packages/core/artifact-signing.js";
-import { artifactSigningEvidenceDigest, createArtifactSigningResult } from "../packages/core/artifact-signing-result.js";
+import {
+  createArtifactSigningReceipt,
+  validateArtifactSigningRequest,
+} from "../packages/core/artifact-signing.js";
+import {
+  artifactSigningEvidenceDigest,
+  createArtifactSigningResult,
+} from "../packages/core/artifact-signing-result.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 function required(value, label) {
@@ -21,7 +27,8 @@ function sha256File(filePath) {
 function resolveBelow(root, relative, label) {
   const target = path.resolve(root, required(relative, label));
   const rel = path.relative(path.resolve(root), target);
-  if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`${label} escapes its root`);
+  if (rel.startsWith("..") || path.isAbsolute(rel))
+    throw new Error(`${label} escapes its root`);
   return target;
 }
 
@@ -34,63 +41,139 @@ export function finalizeNativeArtifactSigningResult({
   checks = process.env.BUILDCHAIN_SIGNING_VERIFICATION_CHECKS,
 } = {}) {
   const requests = path.resolve(required(requestRoot, "signing request root"));
-  const request = JSON.parse(fs.readFileSync(resolveBelow(requests, requestPath, "request path"), "utf8"));
+  const request = JSON.parse(
+    fs.readFileSync(
+      resolveBelow(requests, requestPath, "request path"),
+      "utf8",
+    ),
+  );
   const requestCheck = validateArtifactSigningRequest(request);
-  if (!requestCheck.ok) throw new Error(`invalid signing request: ${requestCheck.issues.join(", ")}`);
+  if (!requestCheck.ok)
+    throw new Error(
+      `invalid signing request: ${requestCheck.issues.join(", ")}`,
+    );
   if (request.signature.semantics !== "native-platform-signature") {
-    throw new Error("native result finalizer rejects non-native signature profiles");
+    throw new Error(
+      "native result finalizer rejects non-native signature profiles",
+    );
   }
   const payloadSource = path.resolve(required(signedPayload, "signed payload"));
-  const evidenceSource = path.resolve(required(evidencePath, "signing evidence"));
-  const resultDirectory = path.resolve(required(outputRoot, "signing result root"));
+  const evidenceSource = path.resolve(
+    required(evidencePath, "signing evidence"),
+  );
+  const resultDirectory = path.resolve(
+    required(outputRoot, "signing result root"),
+  );
   fs.mkdirSync(path.join(resultDirectory, "payload"), { recursive: true });
-  const payloadPath = path.join(resultDirectory, "payload", path.basename(payloadSource));
+  const payloadPath = path.join(
+    resultDirectory,
+    "payload",
+    path.basename(payloadSource),
+  );
   fs.copyFileSync(payloadSource, payloadPath, fs.constants.COPYFILE_EXCL);
   const evidenceOutput = path.join(resultDirectory, "provider-evidence.json");
   fs.copyFileSync(evidenceSource, evidenceOutput, fs.constants.COPYFILE_EXCL);
   const evidenceDocument = JSON.parse(fs.readFileSync(evidenceOutput, "utf8"));
-  if (evidenceDocument.status !== "passed" || evidenceDocument.provider !== request.signature.provider) {
-    throw new Error("provider evidence does not prove the requested native signature");
+  if (
+    evidenceDocument.status !== "passed" ||
+    evidenceDocument.provider !== request.signature.provider
+  ) {
+    throw new Error(
+      "provider evidence does not prove the requested native signature",
+    );
   }
-  const evidence = [{ kind: `${request.signature.profile}-verification`, path: "provider-evidence.json", digest: sha256File(evidenceOutput) }];
+  const evidence = [
+    {
+      kind: `${request.signature.profile}-verification`,
+      path: "provider-evidence.json",
+      digest: sha256File(evidenceOutput),
+    },
+  ];
   const payloadDigest = sha256File(payloadPath);
   const receipt = createArtifactSigningReceipt({
     request,
-    result: { artifactDigest: payloadDigest, evidenceDigest: artifactSigningEvidenceDigest(evidence) },
-    signatures: [{ kind: request.signature.profile, digest: evidence[0].digest }],
+    result: {
+      artifactDigest: payloadDigest,
+      evidenceDigest: artifactSigningEvidenceDigest(evidence),
+    },
+    signatures: [
+      { kind: request.signature.profile, digest: evidence[0].digest },
+    ],
   });
-  fs.writeFileSync(path.join(resultDirectory, "receipt.json"), `${JSON.stringify(receipt, null, 2)}\n`);
-  const verificationChecks = String(checks || "").split(",").map((value) => value.trim()).filter(Boolean);
+  fs.writeFileSync(
+    path.join(resultDirectory, "receipt.json"),
+    `${JSON.stringify(receipt, null, 2)}\n`,
+  );
+  const verificationChecks = String(checks || "")
+    .split(",")
+    .map((value) => value.trim())
+    .filter(Boolean);
+  if (
+    verificationChecks.length === 0 &&
+    Array.isArray(evidenceDocument.checks)
+  ) {
+    verificationChecks.push(
+      ...evidenceDocument.checks
+        .map((value) => String(value).trim())
+        .filter(Boolean),
+    );
+  }
+  if (verificationChecks.length === 0)
+    throw new Error("provider evidence contains no verification checks");
   const result = createArtifactSigningResult({
     request,
     receipt,
-    payload: { path: `payload/${path.basename(payloadPath)}`, bytes: fs.statSync(payloadPath).size, digest: payloadDigest },
+    payload: {
+      path: `payload/${path.basename(payloadPath)}`,
+      bytes: fs.statSync(payloadPath).size,
+      digest: payloadDigest,
+    },
     evidence,
-    verification: { status: "passed", provider: request.signature.provider, checks: verificationChecks },
+    verification: {
+      status: "passed",
+      provider: request.signature.provider,
+      checks: verificationChecks,
+    },
   });
-  fs.writeFileSync(path.join(resultDirectory, "result.json"), `${JSON.stringify(result, null, 2)}\n`);
+  fs.writeFileSync(
+    path.join(resultDirectory, "result.json"),
+    `${JSON.stringify(result, null, 2)}\n`,
+  );
   const index = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-artifact-signing-result-index/v1",
-    results: [{
-      id: request.artifact.id,
-      requestDigest: request.digest,
-      resultDigest: result.digest,
-      result: "result.json",
-      payload: result.artifact.path,
-      receipt: "receipt.json",
-    }],
+    results: [
+      {
+        id: request.artifact.id,
+        requestDigest: request.digest,
+        resultDigest: result.digest,
+        result: "result.json",
+        payload: result.artifact.path,
+        receipt: "receipt.json",
+      },
+    ],
   };
-  fs.writeFileSync(path.join(resultDirectory, "index.json"), `${JSON.stringify(index, null, 2)}\n`);
-  writeGitHubOutputs({ "result-root": resultDirectory, "result-index": path.join(resultDirectory, "index.json") });
+  fs.writeFileSync(
+    path.join(resultDirectory, "index.json"),
+    `${JSON.stringify(index, null, 2)}\n`,
+  );
+  writeGitHubOutputs({
+    "result-root": resultDirectory,
+    "result-index": path.join(resultDirectory, "index.json"),
+  });
   return index;
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
   try {
     finalizeNativeArtifactSigningResult();
   } catch (error) {
-    console.error(`::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`);
+    console.error(
+      `::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`,
+    );
     process.exitCode = 1;
   }
 }

package/scripts/gate-profile-core.mjs

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 
 export const GATE_MATRIX_CONTRACT = "buildchain.shifu-gate-matrix/v1";
 export const GATE_AGGREGATE_CONTRACT = "buildchain.shifu-gate-aggregate/v1";
+export const GATE_JOB_CONTROL_PLANE_OVERHEAD_MINUTES = 30;
 
 function stableValue(value) {
   if (Array.isArray(value)) return value.map(stableValue);
@@ -265,7 +266,11 @@ export function createGateExecutionMatrix({
       planDigest: inspected.planDigest,
       timeoutMinutes: Math.max(
         1,
-        Math.min(360, Math.ceil(timeoutSeconds / 60)),
+        Math.min(
+          360,
+          Math.ceil(timeoutSeconds / 60) +
+            GATE_JOB_CONTROL_PLANE_OVERHEAD_MINUTES,
+        ),
       ),
       gates: inspected.gates.map((gate) => ({
         id: gate.id,

package/scripts/inspect-artifact-signing-requests.mjs

@@ -38,7 +38,8 @@ export function inspectArtifactSigningRequests({
 } = {}) {
   const root = path.resolve(required(inputRoot, "signing request root"));
   const indexes = walk(root, "index.json");
-  if (indexes.length === 0) throw new Error("no artifact signing request indexes found");
+  if (indexes.length === 0)
+    throw new Error("no artifact signing request indexes found");
   const seen = new Set();
   const matrices = {
     detached: [],
@@ -47,41 +48,66 @@ export function inspectArtifactSigningRequests({
   };
   for (const indexPath of indexes) {
     const index = JSON.parse(fs.readFileSync(indexPath, "utf8"));
-    if (index.contract !== "kungfu-buildchain-artifact-signing-request-index/v1") continue;
+    if (
+      index.contract !== "kungfu-buildchain-artifact-signing-request-index/v1"
+    )
+      continue;
     for (const entry of index.requests || []) {
       const requestPath = path.resolve(path.dirname(indexPath), entry.path);
       const relative = path.relative(root, requestPath);
       if (relative.startsWith("..") || path.isAbsolute(relative)) {
-        throw new Error("signing request path escapes the authority intake root");
+        throw new Error(
+          "signing request path escapes the authority intake root",
+        );
       }
       const request = JSON.parse(fs.readFileSync(requestPath, "utf8"));
       const check = validateArtifactSigningRequest(request);
       if (!check.ok || request.digest !== entry.digest) {
         throw new Error(`invalid artifact signing request: ${entry.id}`);
       }
-      if (expectedRepository && request.source.repository !== expectedRepository) {
+      if (
+        expectedRepository &&
+        request.source.repository !== expectedRepository
+      ) {
         throw new Error("signing request source repository mismatch");
       }
       if (expectedRuntimeSha && request.runtime.sha !== expectedRuntimeSha) {
         throw new Error("signing request runtime SHA mismatch");
       }
       const key = `${request.source.sha}:${request.artifact.id}:${request.artifact.platform}`;
-      if (seen.has(key)) throw new Error(`duplicate artifact signing request: ${key}`);
+      if (seen.has(key))
+        throw new Error(`duplicate artifact signing request: ${key}`);
       seen.add(key);
       const item = {
         id: request.artifact.id,
         slug: safeId(request.artifact.id),
         request: path.relative(root, requestPath).split(path.sep).join("/"),
-        directory: path.relative(root, path.dirname(requestPath)).split(path.sep).join("/"),
-        indexRoot: path.relative(root, path.dirname(indexPath)).split(path.sep).join("/") || ".",
+        directory: path
+          .relative(root, path.dirname(requestPath))
+          .split(path.sep)
+          .join("/"),
+        indexRoot:
+          path
+            .relative(root, path.dirname(indexPath))
+            .split(path.sep)
+            .join("/") || ".",
+        kind: request.artifact.kind,
+        transportFormat: request.artifact.transport?.format || "",
       };
-      if (request.signature.profile === "detached-signature-v1") matrices.detached.push(item);
-      else if (request.signature.profile === "apple-developer-id") matrices.macos.push(item);
-      else if (request.signature.profile === "windows-authenticode") matrices.windows.push(item);
-      else throw new Error(`unsupported signing authority profile: ${request.signature.profile}`);
+      if (request.signature.profile === "detached-signature-v1")
+        matrices.detached.push(item);
+      else if (request.signature.profile === "apple-developer-id")
+        matrices.macos.push(item);
+      else if (request.signature.profile === "windows-authenticode")
+        matrices.windows.push(item);
+      else
+        throw new Error(
+          `unsupported signing authority profile: ${request.signature.profile}`,
+        );
     }
   }
-  for (const entries of Object.values(matrices)) entries.sort((a, b) => a.request.localeCompare(b.request));
+  for (const entries of Object.values(matrices))
+    entries.sort((a, b) => a.request.localeCompare(b.request));
   writeGitHubOutputs({
     "detached-matrix": JSON.stringify(matrices.detached),
     "macos-matrix": JSON.stringify(matrices.macos),
@@ -91,11 +117,16 @@ export function inspectArtifactSigningRequests({
   return matrices;
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
   try {
     inspectArtifactSigningRequests();
   } catch (error) {
-    console.error(`::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`);
+    console.error(
+      `::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`,
+    );
     process.exitCode = 1;
   }
 }