@mannyc1/ts-release 0.0.6 → 0.2.2

package/src/extensions/provider-adapter.ts

@@ -0,0 +1,99 @@
+import * as Schema from "effect/Schema"
+import { NonEmptyName } from "../model/primitives.js"
+import type { ReleaseSubject } from "../publication/coordinator.js"
+import {
+  assertRecoveryProfileMatches,
+  validatePublicationProfiles,
+  type PublicationProfileRegistration
+} from "../publication/recovery.js"
+import type { PublicationSubjectServices } from "../capabilities/module.js"
+import type { PreparedBundle } from "../release/prepared-store.js"
+
+/**
+ * Closed acknowledgements required from every custom application adapter.
+ * They are intentionally precise rather than extensible strings: a boolean
+ * success callback or generic command publisher cannot satisfy this contract.
+ */
+export class ProviderAdapterContract
+  extends Schema.Class<ProviderAdapterContract>("ProviderAdapterContract")({
+    schemaVersion: Schema.Literal("ts-release/provider-adapter-contract/v1"),
+    preparedSubject: Schema.Literal("typed-canonical-data"),
+    identity: Schema.Literal("canonical-subject-id"),
+    observation: Schema.Literal("exact-equality-and-authoritative-absence"),
+    mutation: Schema.Literal("typed-precondition-and-commitment"),
+    credentials: Schema.Literal("audience-and-purpose-scoped"),
+    recovery: Schema.Literal("coordinator-profile"),
+    certification: Schema.Literal("provider-protocol-and-public-boundary-tests")
+  }) {}
+
+export interface CustomProviderAdapterInput {
+  readonly id: string
+  readonly contract: ProviderAdapterContract
+  readonly profile: PublicationProfileRegistration
+  /**
+   * Derive typed subjects only from a verified prepared bundle and opaque host
+   * sinks. Returning no subject means this installed application adapter does
+   * not apply to that bundle.
+   */
+  readonly subjects: (
+    bundle: PreparedBundle,
+    services: PublicationSubjectServices
+  ) => ReadonlyArray<ReleaseSubject>
+}
+
+export interface CustomProviderAdapter extends Omit<CustomProviderAdapterInput, "id"> {
+  readonly _tag: "CustomProviderAdapter"
+  readonly id: NonEmptyName
+}
+
+const decodeContract = Schema.decodeUnknownSync(ProviderAdapterContract, {
+  onExcessProperty: "error"
+})
+
+/** Validate once at custom-application composition time. */
+export const makeProviderAdapter = (input: CustomProviderAdapterInput): CustomProviderAdapter => {
+  const contract = decodeContract(input.contract)
+  const id = NonEmptyName.make(input.id)
+  const profile = validatePublicationProfiles({ [id.toString()]: input.profile })[id.toString()]!
+  if (profile.id !== id.toString()) {
+    throw new Error("A custom provider adapter id must equal its recovery-profile registration id.")
+  }
+  return Object.freeze({
+    _tag: "CustomProviderAdapter" as const,
+    ...input,
+    id,
+    contract,
+    profile
+  })
+}
+
+/**
+ * Build custom subjects behind the same profile and identity checks used by
+ * built-ins. Coordinator construction performs the final request identity,
+ * audience, purpose, mutation, prerequisite, and durable-history checks.
+ */
+export const customProviderSubjects = (
+  bundle: PreparedBundle,
+  adapters: ReadonlyArray<CustomProviderAdapter>,
+  services: PublicationSubjectServices,
+  reservedIds: ReadonlySet<string> = new Set()
+): ReadonlyArray<ReleaseSubject> => {
+  const result: Array<ReleaseSubject> = []
+  const ids = new Set(reservedIds)
+  for (const adapter of adapters) {
+    const subjects = adapter.subjects(bundle, services)
+    for (const subject of subjects) {
+      if (ids.has(subject.id.toString())) {
+        throw new Error(`Custom provider adapter ${adapter.id} repeats subject ${subject.id}.`)
+      }
+      assertRecoveryProfileMatches(adapter.profile.id, adapter.profile.recovery, subject.recovery)
+      if (subject.observationRequests.some((request) => request.provider.toString() !== adapter.profile.provider) ||
+          subject.mutationRequest.provider.toString() !== adapter.profile.provider) {
+        throw new Error(`Custom provider adapter ${adapter.id} emitted credential authority for a foreign provider.`)
+      }
+      ids.add(subject.id.toString())
+      result.push(subject)
+    }
+  }
+  return result
+}

package/src/host.ts

@@ -0,0 +1,140 @@
+import * as Layer from "effect/Layer"
+import type { ReleaseRuntimeShape } from "./api/runtime.js"
+import { ReleaseRuntime } from "./api/runtime.js"
+import type { ReleaseApiLayer } from "./api/types.js"
+import type { RunCommand } from "./drivers/process.js"
+import { Sha256Digest, sha256Digest } from "./model/digest.js"
+import { SafeRelativePath, WorkspaceRoot } from "./model/primitives.js"
+import type { CredentialRequest } from "./model/authority.js"
+import {
+  CredentialAudienceMismatch,
+  CredentialProvider,
+  CredentialPurposeMismatch,
+  CredentialStrategyUnsupported,
+  CredentialSubjectMismatch,
+  CredentialUnavailable,
+  makeCredentialProvider,
+  type CredentialAuthorityError,
+  type CredentialGrant,
+  type CredentialGrantAcquirer,
+  type CredentialGrantDescriptor,
+  type CredentialProviderShape,
+  type MutationCredentialGrant
+} from "./publication/authority.js"
+import {
+  AuthorizedMutationHttp,
+  HttpAuthorizer,
+  type AuthorizedMutationHttpShape,
+  type HttpAuthorizationError,
+  type HttpAuthorizerShape,
+  type HttpObservationRequest,
+  type HttpResponse
+} from "./publication/http.js"
+import {
+  CertifiedPublisherSpawn,
+  NpmUserConfigResource,
+  type CertifiedPublisherSpawnShape,
+  type NpmUserConfigResourceShape
+} from "./publication/publisher.js"
+import {
+  PublicationClaimOccupied,
+  PublicationClaimRequest,
+  PublicationClaimStore,
+  PublicationClaimUnavailable,
+  type PublicationClaimError,
+  type PublicationClaimStoreShape
+} from "./publication/claim.js"
+import {
+  ReleaseContextError,
+  SourceMaterializationError,
+  StagingEntry,
+  StagingSnapshot,
+  VerifiedSource,
+  makeSourceObserver,
+  type SourceObserverRuntime,
+  type SourceObserverShape,
+  type VerifiedReleaseContext
+} from "./release/context.js"
+import {
+  PreparedReleaseStore,
+  type PreparedReleaseStoreShape
+} from "./release/prepared-store.js"
+
+export {
+  CredentialAudienceMismatch,
+  CredentialPurposeMismatch,
+  CredentialStrategyUnsupported,
+  CredentialSubjectMismatch,
+  CredentialUnavailable,
+  PublicationClaimOccupied,
+  PublicationClaimRequest,
+  PublicationClaimUnavailable,
+  ReleaseContextError,
+  SafeRelativePath,
+  Sha256Digest,
+  SourceMaterializationError,
+  StagingEntry,
+  StagingSnapshot,
+  VerifiedSource,
+  WorkspaceRoot,
+  makeCredentialProvider,
+  makeSourceObserver,
+  sha256Digest
+}
+
+export type {
+  CredentialAuthorityError,
+  CredentialGrant,
+  CredentialGrantAcquirer,
+  CredentialGrantDescriptor,
+  CredentialProviderShape,
+  CredentialRequest,
+  HttpAuthorizationError,
+  HttpAuthorizerShape,
+  HttpObservationRequest,
+  HttpResponse,
+  AuthorizedMutationHttpShape,
+  CertifiedPublisherSpawnShape,
+  NpmUserConfigResourceShape,
+  PublicationClaimError,
+  PublicationClaimStoreShape,
+  MutationCredentialGrant,
+  ReleaseRuntimeShape,
+  RunCommand,
+  SourceObserverRuntime,
+  SourceObserverShape,
+  VerifiedReleaseContext
+}
+
+/** Structural inputs for a library-owned host integration. */
+export interface CustomReleaseLayerInput {
+  readonly runtime: ReleaseRuntimeShape
+  readonly preparedStore: PreparedReleaseStoreShape
+  readonly credentialProvider: CredentialProviderShape
+  readonly httpAuthorizer: HttpAuthorizerShape
+  readonly authorizedMutationHttp: AuthorizedMutationHttpShape
+  readonly npmUserConfigResource: NpmUserConfigResourceShape
+  readonly certifiedPublisherSpawn: CertifiedPublisherSpawnShape
+  /** Required before a durable-cas-required publication can acquire mutation credentials. */
+  readonly publicationClaimStore?: PublicationClaimStoreShape
+}
+
+/**
+ * Compose the complete API service boundary without exposing Context service
+ * tags. Credentials remain opaque grants and HTTP authorization remains a
+ * host-owned elimination boundary.
+ */
+export const makeCustomReleaseLayer = (
+  input: CustomReleaseLayerInput
+): ReleaseApiLayer => Layer.mergeAll(
+  Layer.succeed(ReleaseRuntime, input.runtime),
+  Layer.succeed(PreparedReleaseStore, input.preparedStore),
+  Layer.succeed(CredentialProvider, input.credentialProvider),
+  Layer.succeed(HttpAuthorizer, input.httpAuthorizer),
+  Layer.succeed(AuthorizedMutationHttp, input.authorizedMutationHttp),
+  Layer.succeed(NpmUserConfigResource, input.npmUserConfigResource),
+  Layer.succeed(CertifiedPublisherSpawn, input.certifiedPublisherSpawn),
+  ...(input.publicationClaimStore === undefined
+    ? []
+    : [Layer.succeed(PublicationClaimStore, input.publicationClaimStore)])
+)

package/src/index.ts

@@ -0,0 +1,64 @@
+declare global {
+  const SchemaErrorTypeId: unique symbol
+}
+// The root is the intentionally small public lifecycle surface.
+export {
+  CorrectionReport,
+  correct,
+  inspect,
+  makeReleaseApi,
+  observe,
+  prepare,
+  publish,
+  release
+} from "./api/api.js"
+export type {
+  CorrectInput,
+  InspectInput,
+  InspectOutput,
+  ObserveInput,
+  PrepareInput,
+  PublishInput,
+  ReleaseApi,
+  ReleaseApiLayer,
+  ReleaseApiOptions,
+  ReleaseInput,
+  ReleaseResult
+} from "./api/types.js"
+export {
+  AuthoredCatalogForwardCorrection,
+  AuthoredGithubReleaseAmendment,
+  AuthoredNpmDeprecation,
+  decodeAuthoredCorrection
+} from "./correction/intent.js"
+export type { AuthoredCorrection } from "./correction/intent.js"
+export {
+  PreparationModeUnsupported, ReleaseAbortedError, ReleaseIncompleteError,
+  ReleaseInputError, ReleasePreparationError
+} from "./api/errors.js"
+export {
+  CredentialStrategyUnsupported,
+  CredentialUnavailable
+} from "./publication/authority.js"
+export {
+  CredentialFailureCause,
+  CredentialStrategyUnsupportedCause,
+  CredentialUnavailableCause,
+  ObservationReport,
+  ReleaseReport
+} from "./publication/report.js"
+export {
+  CompletePreparedReleaseRef, GitHubActionsCompletePreparedReleaseRef,
+  LocalCompletePreparedReleaseRef, PreparedReleaseRefCodecError,
+  PreparedReleaseRefMalformedError, PreparedReleaseRefUnknownSchemeError,
+  decodeCompletePreparedReleaseRef, encodeCompletePreparedReleaseRef,
+  makeGitHubActionsCompletePreparedReleaseRef, makeLocalCompletePreparedReleaseRef
+} from "./release/prepared-ref.js"
+export type { PreparedReleaseSha256 } from "./release/prepared-ref.js"
+export { ReleaseRuntime } from "./api/runtime.js"
+export { unsupportedExecutionHost } from "./platform/host-support.js"
+export { resolveConfig } from "./resolve/resolve.js"
+export type { AuthoredConfig, AuthoredProject } from "./resolve/authored.js"
+export type { ObservedFacts } from "./resolve/facts.js"
+export { encodeResolvedConfig } from "./resolve/encode.js"
+export const defineRelease = <const Config>(config: Config): Config => config

package/src/model/artifact-collection.ts

@@ -0,0 +1,237 @@
+import * as Schema from "effect/Schema"
+import { encodeCanonicalJson } from "./canonical.js"
+import { sha256Digest } from "./digest.js"
+import { OperationId, OutputId, SafeRelativePath } from "./primitives.js"
+
+export const ArtifactCollectionId = Schema.NonEmptyString.check(Schema.makeFilter((value: string) =>
+  /^[A-Za-z0-9._-]+$/u.test(value)
+    ? undefined
+    : "Artifact collection id must be a portable ASCII identifier."
+)).pipe(Schema.brand("ArtifactCollectionId"))
+export type ArtifactCollectionId = typeof ArtifactCollectionId.Type
+
+export const CollectionArtifactKind = Schema.Literals([
+  "file",
+  "executable",
+  "archive",
+  "digest"
+])
+export type CollectionArtifactKind = typeof CollectionArtifactKind.Type
+
+export const ArtifactPathSuffix = Schema.NonEmptyString.check(Schema.makeFilter((value: string) =>
+  /^\.[A-Za-z0-9._-]+$/u.test(value)
+    ? undefined
+    : "Artifact collection pathSuffix must be a canonical dot suffix without path separators."
+)).pipe(Schema.brand("ArtifactPathSuffix"))
+export type ArtifactPathSuffix = typeof ArtifactPathSuffix.Type
+
+export const ArtifactCollectionRoot = SafeRelativePath.check(Schema.makeFilter((value: string) =>
+  value !== "." && value.split("/").every((part) => /^[A-Za-z0-9._-]+$/u.test(part) && part !== "." && part !== "..")
+    ? undefined
+    : "Artifact collection root must be a canonical NFC POSIX subdirectory."
+)).pipe(Schema.brand("ArtifactCollectionRoot"))
+export type ArtifactCollectionRoot = typeof ArtifactCollectionRoot.Type
+
+const nonNegativeInteger = Schema.Number.check(Schema.makeFilter((value: number) =>
+  Number.isSafeInteger(value) && value >= 0
+    ? undefined
+    : "Collection cardinality bounds must be nonnegative safe integers."
+))
+
+export class OneArtifactCardinality
+  extends Schema.Class<OneArtifactCardinality>("OneArtifactCardinality")({
+    kind: Schema.Literal("one")
+  }) {}
+
+export class OneOrMoreArtifactCardinality
+  extends Schema.Class<OneOrMoreArtifactCardinality>("OneOrMoreArtifactCardinality")({
+    kind: Schema.Literal("one-or-more")
+  }) {}
+
+export class BoundedArtifactCardinality
+  extends Schema.Class<BoundedArtifactCardinality>("BoundedArtifactCardinality")({
+    kind: Schema.Literal("bounded"),
+    minimum: nonNegativeInteger,
+    maximum: nonNegativeInteger
+  }) {}
+
+const ArtifactCardinalityVariants = Schema.Union([
+  OneArtifactCardinality,
+  OneOrMoreArtifactCardinality,
+  BoundedArtifactCardinality
+])
+
+export const ArtifactCardinality = ArtifactCardinalityVariants.pipe(Schema.check(
+  Schema.makeFilter((value) => value.kind !== "bounded" || value.minimum <= value.maximum
+    ? undefined
+    : "Bounded collection cardinality minimum must not exceed maximum.")
+))
+export type ArtifactCardinality = typeof ArtifactCardinality.Type
+
+/**
+ * One command-owned dynamic output set. A collection intentionally permits one
+ * artifact kind and one filename suffix: heterogeneous output sets must be
+ * split into independently selectable contracts.
+ */
+export class ArtifactCollectionContract
+  extends Schema.Class<ArtifactCollectionContract>("ArtifactCollectionContract")({
+    id: ArtifactCollectionId,
+    producer: OperationId,
+    root: ArtifactCollectionRoot,
+    artifactKind: CollectionArtifactKind,
+    pathSuffix: ArtifactPathSuffix,
+    mediaType: Schema.NonEmptyString,
+    cardinality: ArtifactCardinality
+  }) {}
+
+/** A downstream requirement over a stable collection identity. */
+export class ArtifactCollectionSelector
+  extends Schema.Class<ArtifactCollectionSelector>("ArtifactCollectionSelector")({
+    collection: ArtifactCollectionId,
+    artifactKind: CollectionArtifactKind,
+    pathSuffix: ArtifactPathSuffix,
+    mediaType: Schema.NonEmptyString,
+    cardinality: ArtifactCardinality
+  }) {}
+
+/** Exact runtime member identity persisted beside the prepared artifacts. */
+export class ArtifactCollectionMember
+  extends Schema.Class<ArtifactCollectionMember>("ArtifactCollectionMember")({
+    key: SafeRelativePath,
+    artifactId: OutputId
+  }) {}
+
+export interface CardinalityRange {
+  readonly minimum: number
+  readonly maximum?: number
+}
+
+export const cardinalityRange = (value: ArtifactCardinality): CardinalityRange => {
+  switch (value.kind) {
+    case "one": return { minimum: 1, maximum: 1 }
+    case "one-or-more": return { minimum: 1 }
+    case "bounded": return { minimum: value.minimum, maximum: value.maximum }
+  }
+}
+
+export const cardinalityIssue = (value: ArtifactCardinality): string | undefined => {
+  const range = cardinalityRange(value)
+  return !Number.isSafeInteger(range.minimum) || range.minimum < 0 ||
+      (range.maximum !== undefined && (!Number.isSafeInteger(range.maximum) || range.maximum < range.minimum))
+    ? "Collection cardinality must define a valid nonnegative integer range."
+    : undefined
+}
+
+/** Reject kind/media/suffix combinations whose observable claims conflict. */
+export const collectionContractIssue = (
+  value: Pick<ArtifactCollectionContract, "artifactKind" | "pathSuffix" | "mediaType">
+): string | undefined => {
+  const suffix = value.pathSuffix.toString()
+  switch (value.artifactKind) {
+    case "archive":
+      if (value.mediaType === "application/zip" && suffix === ".zip") return undefined
+      if (value.mediaType === "application/gzip" && [".gz", ".tgz", ".tar.gz"].includes(suffix)) return undefined
+      return "Archive collections support application/zip with .zip or application/gzip with .gz, .tgz, or .tar.gz."
+    case "digest":
+      return value.mediaType === "text/plain" && [".sha256", ".sha512"].includes(suffix)
+        ? undefined
+        : "Digest collections require text/plain with .sha256 or .sha512."
+    case "executable":
+      return value.mediaType === "application/octet-stream"
+        ? undefined
+        : "Executable collections require application/octet-stream; executable mode is observed at capture."
+    case "file":
+      return value.mediaType === "application/zip" || value.mediaType === "application/gzip"
+        ? "Archive media types require the archive artifact kind."
+        : undefined
+  }
+}
+
+/** Byte-level checks for the formats whose kind is portable and observable. */
+export const collectionMemberBytesIssue = (
+  contract: ArtifactCollectionContract,
+  bytes: Uint8Array
+): string | undefined => {
+  if (contract.artifactKind === "archive") {
+    if (contract.mediaType === "application/zip") {
+      return bytes.length >= 4 && bytes[0] === 0x50 && bytes[1] === 0x4b &&
+          ((bytes[2] === 0x03 && bytes[3] === 0x04) ||
+            (bytes[2] === 0x05 && bytes[3] === 0x06) ||
+            (bytes[2] === 0x07 && bytes[3] === 0x08))
+        ? undefined
+        : "declared ZIP member does not have a ZIP file signature"
+    }
+    if (contract.mediaType === "application/gzip") {
+      return bytes.length >= 3 && bytes[0] === 0x1f && bytes[1] === 0x8b && bytes[2] === 0x08
+        ? undefined
+        : "declared gzip member does not have a gzip file signature"
+    }
+  }
+  if (contract.artifactKind === "digest") {
+    let text: string
+    try { text = new TextDecoder("utf-8", { fatal: true }).decode(bytes) } catch {
+      return "declared digest member is not UTF-8 text"
+    }
+    const digits = contract.pathSuffix === ".sha256" ? 64 : 128
+    const rows = text.endsWith("\n") ? text.slice(0, -1).split("\n") : text.split("\n")
+    return rows.length > 0 && rows.every((row) => new RegExp(`^[a-f0-9]{${digits}}  [^\\s/](?:.*[^\\s/])?$`, "u").test(row))
+      ? undefined
+      : `declared digest member does not contain canonical ${digits}-hex checksum rows`
+  }
+  return undefined
+}
+
+export const cardinalityAccepts = (value: ArtifactCardinality, count: number): boolean => {
+  const range = cardinalityRange(value)
+  return Number.isSafeInteger(count) && count >= range.minimum &&
+    (range.maximum === undefined || count <= range.maximum)
+}
+
+export const cardinalitiesOverlap = (
+  left: ArtifactCardinality,
+  right: ArtifactCardinality
+): boolean => {
+  const a = cardinalityRange(left)
+  const b = cardinalityRange(right)
+  const maximum = a.maximum === undefined
+    ? b.maximum
+    : b.maximum === undefined
+    ? a.maximum
+    : Math.min(a.maximum, b.maximum)
+  return maximum === undefined || Math.max(a.minimum, b.minimum) <= maximum
+}
+
+/** Paths discovered from directory entries must already be portable canon. */
+export const normalizeCollectionMemberKey = (value: string): SafeRelativePath => {
+  if (value.split("/").some((part) => !/^[A-Za-z0-9._-]+$/u.test(part) || part === "." || part === "..")) {
+    throw new Error(`Collection member path ${JSON.stringify(value)} is not portable ASCII POSIX form.`)
+  }
+  return SafeRelativePath.make(value)
+}
+
+/**
+ * Stable output identity is a digest of the declared producer/contract and the
+ * normalized member key. No guessed runtime filename becomes graph authority.
+ */
+export const collectionMemberId = (
+  contract: ArtifactCollectionContract,
+  key: SafeRelativePath
+): OutputId => OutputId.make(`collection-sha256-${sha256Digest(new TextEncoder().encode(
+  encodeCanonicalJson({
+    producer: contract.producer.toString(),
+    collection: contract.id.toString(),
+    root: contract.root.toString(),
+    artifactKind: contract.artifactKind,
+    pathSuffix: contract.pathSuffix.toString(),
+    mediaType: contract.mediaType,
+    cardinality: contract.cardinality.kind === "bounded"
+      ? { kind: contract.cardinality.kind, minimum: contract.cardinality.minimum, maximum: contract.cardinality.maximum }
+      : { kind: contract.cardinality.kind },
+    key: key.toString()
+  })
+)).hex}`)
+
+export const collectionMemberPath = (
+  contract: ArtifactCollectionContract,
+  key: SafeRelativePath
+): SafeRelativePath => SafeRelativePath.make(`${contract.root}/${key}`)

package/src/model/authority.ts

@@ -0,0 +1,116 @@
+import * as Schema from "effect/Schema"
+
+const identifier = <const Name extends string>(name: Name) =>
+  Schema.NonEmptyString.pipe(Schema.brand(name))
+
+/** Stable identity of one remotely observable publication/correction subject. */
+export const SubjectId = identifier("SubjectId")
+export type SubjectId = typeof SubjectId.Type
+
+export const ProviderId = identifier("ProviderId")
+export type ProviderId = typeof ProviderId.Type
+
+/** Canonical provider audience, including any authority-relevant base path. */
+export const CanonicalAudience = identifier("CanonicalAudience")
+export type CanonicalAudience = typeof CanonicalAudience.Type
+
+/** A host-owned secret reference. It is a name/handle, never secret material. */
+export const CredentialRef = identifier("CredentialRef")
+export type CredentialRef = typeof CredentialRef.Type
+
+export const EnvironmentName = Schema.String.check(
+  Schema.makeFilter((value: string) => /^[A-Za-z_][A-Za-z0-9_]*$/u.test(value)
+    ? undefined
+    : "EnvironmentName must be a portable environment variable name.")
+).pipe(Schema.brand("EnvironmentName"))
+export type EnvironmentName = typeof EnvironmentName.Type
+
+export const CredentialPurpose = Schema.Literals(["observe", "publish", "correct"])
+export type CredentialPurpose = typeof CredentialPurpose.Type
+
+/** Exact verified source revision projected into npm's GitHub provenance statement. */
+export const TrustedPublishingSourceCommit = Schema.String.check(
+  Schema.makeFilter((value: string) => /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u.test(value)
+    ? undefined
+    : "TrustedPublishingSourceCommit must be a lowercase full Git SHA (40 or 64 hex characters).")
+).pipe(Schema.brand("TrustedPublishingSourceCommit"))
+export type TrustedPublishingSourceCommit = typeof TrustedPublishingSourceCommit.Type
+
+export class AnonymousAuthStrategy
+  extends Schema.Class<AnonymousAuthStrategy>("AnonymousAuthStrategy")({
+    kind: Schema.Literal("anonymous")
+  }) {}
+
+export class TokenAuthStrategy
+  extends Schema.Class<TokenAuthStrategy>("TokenAuthStrategy")({
+    kind: Schema.Literal("token"),
+    credential: CredentialRef
+  }) {}
+
+export class TrustedPublishingAuthStrategy
+  extends Schema.Class<TrustedPublishingAuthStrategy>("TrustedPublishingAuthStrategy")({
+    kind: Schema.Literal("trusted-publishing"),
+    identityProvider: Schema.Literal("github-actions"),
+    runnerClass: Schema.Literal("github-hosted"),
+    repository: Schema.NonEmptyString,
+    workflow: Schema.NonEmptyString,
+    workflowRef: Schema.NonEmptyString,
+    sourceCommit: TrustedPublishingSourceCommit,
+    provenanceEnvironmentContract: Schema.Literal("github-actions-npm-provenance-v1"),
+    allowedAction: Schema.Literal("npm-publish-direct"),
+    publisherSink: Schema.Literal("certified-npm-cli")
+  }) {}
+
+/**
+ * A supported external workflow owner. The stock coordinator persists and
+ * reports this identity but deliberately cannot mint or consume its token.
+ */
+export class ExternalTrustedPublishingAuthStrategy
+  extends Schema.Class<ExternalTrustedPublishingAuthStrategy>("ExternalTrustedPublishingAuthStrategy")({
+    kind: Schema.Literal("trusted-publishing"),
+    identityProvider: Schema.Literal("github-actions"),
+    runnerClass: Schema.Literal("github-hosted"),
+    repository: Schema.NonEmptyString,
+    workflow: Schema.NonEmptyString,
+    workflowRef: Schema.NonEmptyString,
+    sourceCommit: TrustedPublishingSourceCommit,
+    provenanceEnvironmentContract: Schema.Literal("external-pypa-action-v1"),
+    allowedAction: Schema.Literal("external-pypa-action"),
+    publisherSink: Schema.Literal("external-host-owned"),
+    environment: Schema.NonEmptyString,
+    projects: Schema.NonEmptyArray(Schema.NonEmptyString)
+  }) {}
+
+export const ResolvedTrustedPublishingAuthStrategy = Schema.Union([
+  TrustedPublishingAuthStrategy,
+  ExternalTrustedPublishingAuthStrategy
+])
+export type ResolvedTrustedPublishingAuthStrategy = typeof ResolvedTrustedPublishingAuthStrategy.Type
+
+export const ResolvedAuthStrategy = Schema.Union([
+  AnonymousAuthStrategy,
+  TokenAuthStrategy,
+  ResolvedTrustedPublishingAuthStrategy
+])
+export type ResolvedAuthStrategy = typeof ResolvedAuthStrategy.Type
+
+/**
+ * Exact authority requested for a verified prepared subject. This value is
+ * safe to report and persist: it contains only host references and intent.
+ */
+export class CredentialRequest
+  extends Schema.Class<CredentialRequest>("CredentialRequest")({
+    subject: SubjectId,
+    provider: ProviderId,
+    audience: CanonicalAudience,
+    purpose: CredentialPurpose,
+    strategy: ResolvedAuthStrategy
+  }) {}
+
+export type ObservationCredentialRequest = CredentialRequest & {
+  readonly purpose: "observe"
+}
+
+export type MutationCredentialRequest = CredentialRequest & {
+  readonly purpose: "publish" | "correct"
+}

package/src/model/bun-targets.ts

@@ -0,0 +1,34 @@
+/**
+ * The one advertised Bun artifact-target vocabulary. Config decoding, graph
+ * compilation, capability documentation, and cross-compile certification all
+ * project from these values.
+ */
+export const bunArtifactTargets = Object.freeze([
+  { id: "linux-x64", bunTarget: "bun-linux-x64", format: "elf", architecture: "x86_64" },
+  { id: "linux-arm64", bunTarget: "bun-linux-arm64", format: "elf", architecture: "aarch64" },
+  { id: "darwin-x64", bunTarget: "bun-darwin-x64", format: "mach-o", architecture: "x86_64" },
+  { id: "darwin-arm64", bunTarget: "bun-darwin-arm64", format: "mach-o", architecture: "aarch64" }
+] as const)
+
+// Windows targets are deliberately not advertised or shipped by this
+// candidate. Header-valid cross-compilation alone cannot certify execution.
+// Reopen one only after its public CLI binary executes on that Windows host in
+// the same clean-candidate gate.
+export type BunArtifactTarget = typeof bunArtifactTargets[number]
+export type BunArtifactTargetId = BunArtifactTarget["id"]
+export type BunBinaryFormat = BunArtifactTarget["format"]
+export type BunBinaryArchitecture = BunArtifactTarget["architecture"]
+
+const idsOf = <const Entries extends ReadonlyArray<{ readonly id: string }>>(
+  entries: Entries
+): { readonly [Index in keyof Entries]: Entries[Index] extends { readonly id: infer Id } ? Id : never } =>
+  Object.freeze(entries.map(({ id }) => id)) as never
+
+export const bunArtifactTargetIds = idsOf(bunArtifactTargets)
+
+const byId = new Map<BunArtifactTargetId, BunArtifactTarget>(
+  bunArtifactTargets.map((target) => [target.id, target])
+)
+
+/** Total after strict config decoding against `bunArtifactTargetIds`. */
+export const bunArtifactTarget = (id: BunArtifactTargetId): BunArtifactTarget => byId.get(id)!