@mannyc1/ts-release 0.0.7 → 0.2.2

package/dist/drivers/seccomp-helper-source.js

@@ -0,0 +1,121 @@
+/**
+ * Embedded so source, built JS, npm consumers, and standalone CLI bundles all
+ * execute the same audited helper bytes through the pinned Bun runtime.
+ */
+export const makeNetworkIsolationHelperSource = (requiredLibrary = "libseccomp.so.2") => String.raw `import { dlopen, ptr } from "bun:ffi"
+import { createHash } from "node:crypto"
+import { readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs"
+import { arch, release } from "node:os"
+
+const fail = (reason) => {
+  process.stderr.write("ts-release network isolation failed closed: " + reason + "\n")
+  process.exit(125)
+}
+if (process.platform !== "linux" || !["x64", "arm64"].includes(process.arch)) {
+  fail("unsupported host " + process.platform + "/" + process.arch)
+}
+const identityPath = process.env.TS_RELEASE_NETWORK_IDENTITY_FILE
+const expectedHelperDigest = process.env.TS_RELEASE_NETWORK_HELPER_SHA256
+const libraryName = process.env.TS_RELEASE_NETWORK_LIBRARY
+if (!identityPath || !expectedHelperDigest || libraryName !== ${JSON.stringify(requiredLibrary)}) {
+  fail("missing or invalid internal isolation parameters")
+}
+const helperDigest = createHash("sha256").update(readFileSync(process.argv[1])).digest("hex")
+if (helperDigest !== expectedHelperDigest) fail("helper digest disagrees with parent")
+const argv = process.argv.slice(2)
+if (argv.length === 0) fail("missing command")
+const deniedSyscalls = [
+  "socket", "socketpair", "connect", "bind", "listen", "accept", "accept4",
+  "sendto", "sendmsg", "sendmmsg", "recvfrom", "recvmsg", "recvmmsg",
+  "io_uring_setup", "io_uring_enter", "io_uring_register", "pidfd_getfd"
+]
+let library
+try {
+  library = dlopen(libraryName, {
+    seccomp_init: { args: ["u32"], returns: "ptr" },
+    seccomp_rule_add: { args: ["ptr", "u32", "i32", "u32"], returns: "i32" },
+    seccomp_load: { args: ["ptr"], returns: "i32" },
+    seccomp_release: { args: ["ptr"], returns: "void" },
+    seccomp_syscall_resolve_name: { args: ["ptr"], returns: "i32" }
+  })
+} catch (cause) {
+  fail("libseccomp.so.2 unavailable: " + String(cause))
+}
+let libraryPath
+try {
+  const mapping = readFileSync("/proc/self/maps", "utf8").split("\n").find((line) => line.includes("libseccomp.so"))
+  const candidate = mapping && mapping.trim().split(/\s+/).at(-1)
+  if (!candidate || !candidate.startsWith("/")) fail("loaded libseccomp mapping is unavailable")
+  libraryPath = realpathSync(candidate)
+} catch (cause) {
+  fail("cannot identify loaded libseccomp: " + String(cause))
+}
+const libraryDigest = createHash("sha256").update(readFileSync(libraryPath)).digest("hex")
+const bunDigest = createHash("sha256").update(readFileSync(realpathSync(process.execPath))).digest("hex")
+const context = library.symbols.seccomp_init(0x7fff0000)
+if (context === null) fail("seccomp_init returned null")
+try {
+  for (const name of deniedSyscalls) {
+    const bytes = new TextEncoder().encode(name + "\0")
+    const syscall = library.symbols.seccomp_syscall_resolve_name(ptr(bytes))
+    if (syscall < 0) fail("kernel/libseccomp cannot resolve " + name)
+    const result = library.symbols.seccomp_rule_add(context, 0x00050001, syscall, 0)
+    if (result !== 0) fail("seccomp_rule_add(" + name + ") returned " + result)
+  }
+  const loaded = library.symbols.seccomp_load(context)
+  if (loaded !== 0) fail("seccomp_load returned " + loaded)
+} finally {
+  library.symbols.seccomp_release(context)
+}
+library.close()
+const identity = {
+  protocol: "ts-release-seccomp-network-deny/v1",
+  helperSha256: helperDigest,
+  librarySha256: libraryDigest,
+  bunVersion: globalThis["Bun"].version,
+  bunSha256: bunDigest,
+  kernel: release(),
+  architecture: arch(),
+  deniedSyscalls
+}
+try {
+  writeFileSync(identityPath, JSON.stringify(identity), { encoding: "utf8", flag: "wx", mode: 0o600 })
+} catch (cause) {
+  fail("cannot persist isolation identity: " + String(cause))
+}
+const childEnvironment = { ...process.env }
+delete childEnvironment.TS_RELEASE_NETWORK_IDENTITY_FILE
+delete childEnvironment.TS_RELEASE_NETWORK_HELPER_SHA256
+delete childEnvironment.TS_RELEASE_NETWORK_LIBRARY
+// The runtime spawn API preserves caller-provided non-stdio descriptors. Close only the
+// descriptors explicitly inherited without FD_CLOEXEC; Bun's own internal
+// descriptors remain untouched and are closed by exec.
+let libc
+try {
+  libc = dlopen("libc.so.6", {
+    fcntl: { args: ["i32", "i32"], returns: "i32" },
+    close: { args: ["i32"], returns: "i32" }
+  })
+  for (const item of readdirSync("/proc/self/fd")) {
+    const fd = Number(item)
+    if (!Number.isSafeInteger(fd) || fd <= 2) continue
+    const flags = libc.symbols.fcntl(fd, 1)
+    if (flags >= 0 && (flags & 1) === 0) libc.symbols.close(fd)
+  }
+  libc.close()
+} catch (cause) {
+  fail("cannot close inherited non-stdio descriptors: " + String(cause))
+}
+let child
+try {
+  child = globalThis["Bun"].spawn(argv, {
+    env: childEnvironment,
+    stdio: ["ignore", "inherit", "inherit"]
+  })
+} catch (cause) {
+  fail("isolated child spawn failed: " + String(cause))
+}
+process.exit(await child.exited)
+`;
+export const networkIsolationHelperSource = makeNetworkIsolationHelperSource();
+//# sourceMappingURL=seccomp-helper-source.js.map

package/dist/drivers/seccomp-helper-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seccomp-helper-source.js","sourceRoot":"","sources":["../../src/drivers/seccomp-helper-source.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,eAAe,GAAG,iBAAiB,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;gEAe3C,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmG9F,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,gCAAgC,EAAE,CAAA"}

package/dist/drivers/utils.d.ts

@@ -0,0 +1,4 @@
+import { DriverError } from "./errors.js";
+export declare const failure: (reason: string, commitment?: "before-commit" | "unknown") => DriverError;
+export declare const sha256: (bytes: Uint8Array) => string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/drivers/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/drivers/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,eAAO,MAAM,OAAO,GAClB,QAAQ,MAAM,EACd,aAAY,eAAe,GAAG,SAA2B,gBACd,CAAA;AAE7C,eAAO,MAAM,MAAM,GAAI,OAAO,UAAU,KAAG,MACO,CAAA"}

package/dist/drivers/utils.js

@@ -0,0 +1,5 @@
+import { createHash } from "node:crypto";
+import { DriverError } from "./errors.js";
+export const failure = (reason, commitment = "before-commit") => DriverError.make({ reason, commitment });
+export const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+//# sourceMappingURL=utils.js.map

package/dist/drivers/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/drivers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,MAAc,EACd,aAA0C,eAAe,EACzD,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;AAE7C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE,CAClD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA"}

package/dist/drivers/workspace.d.ts

@@ -0,0 +1,6 @@
+export declare const secureRead: (root: string, path: string) => {
+    readonly bytes: Uint8Array;
+    readonly inode: number;
+};
+export declare const secureWrite: (root: string, path: string, bytes: Uint8Array | string) => void;
+//# sourceMappingURL=workspace.d.ts.map

package/dist/drivers/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../src/drivers/workspace.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAe3G,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,EAAE,OAAO,UAAU,GAAG,MAAM,KAAG,IAYpF,CAAA"}

package/dist/drivers/workspace.js

@@ -0,0 +1,49 @@
+import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { contained } from "./contain.js";
+import { DriverError } from "./errors.js";
+const fail = (reason) => DriverError.make({ reason, commitment: "before-commit" });
+export const secureRead = (root, path) => {
+    let current = root;
+    for (const part of path.split(/[\\/]+/u)) {
+        current = join(current, part);
+        if (lstatSync(current).isSymbolicLink())
+            throw fail("Structured read encountered a symlink.");
+    }
+    const descriptor = openSync(current, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const opened = fstatSync(descriptor);
+        const resolved = realpathSync(current);
+        if (!contained(root, resolved))
+            throw fail("Opened file escaped the workspace root.");
+        const landed = lstatSync(resolved);
+        if (landed.ino !== opened.ino || landed.dev !== opened.dev)
+            throw fail("Opened file changed identity.");
+        return { bytes: new Uint8Array(readFileSync(descriptor)), inode: opened.ino };
+    }
+    finally {
+        closeSync(descriptor);
+    }
+};
+export const secureWrite = (root, path, bytes) => {
+    const parts = path.split(/[\\/]+/u).filter((part) => part.length > 0);
+    let parent = root;
+    for (const part of parts.slice(0, -1)) {
+        parent = join(parent, part);
+        mkdirSync(parent, { recursive: true });
+        if (lstatSync(parent).isSymbolicLink())
+            throw fail("Structured write encountered a symlink.");
+    }
+    const target = join(parent, parts.at(-1));
+    if (existsSync(target) && lstatSync(target).isSymbolicLink())
+        throw fail("Structured write encountered a symlink.");
+    const descriptor = openSync(target, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 0o644);
+    try {
+        writeFileSync(descriptor, bytes);
+        fsyncSync(descriptor);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+};
+//# sourceMappingURL=workspace.js.map

package/dist/drivers/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../src/drivers/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACM,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAC5E,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAC/D,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAe,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;AAEvG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAA0D,EAAE;IAC/G,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC7B,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,CAAC,wCAAwC,CAAC,CAAA;IAC/F,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,CAAC,yCAAyC,CAAC,CAAA;QACrF,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;QAClC,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,CAAC,+BAA+B,CAAC,CAAA;QACvG,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;IAC/E,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;AACrC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,KAA0B,EAAQ,EAAE;IAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrE,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC3B,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,CAAC,yCAAyC,CAAC,CAAA;IAC/F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;IAC1C,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACnH,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAC7H,IAAI,CAAC;QAAC,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;AACnG,CAAC,CAAA"}

package/dist/extensions/provider-adapter.d.ts

@@ -0,0 +1,48 @@
+import * as Schema from "effect/Schema";
+import { NonEmptyName } from "../model/primitives.js";
+import type { ReleaseSubject } from "../publication/coordinator.js";
+import { type PublicationProfileRegistration } from "../publication/recovery.js";
+import type { PublicationSubjectServices } from "../capabilities/module.js";
+import type { PreparedBundle } from "../release/prepared-store.js";
+declare const ProviderAdapterContract_base: Schema.Class<ProviderAdapterContract, Schema.Struct<{
+    readonly schemaVersion: Schema.Literal<"ts-release/provider-adapter-contract/v1">;
+    readonly preparedSubject: Schema.Literal<"typed-canonical-data">;
+    readonly identity: Schema.Literal<"canonical-subject-id">;
+    readonly observation: Schema.Literal<"exact-equality-and-authoritative-absence">;
+    readonly mutation: Schema.Literal<"typed-precondition-and-commitment">;
+    readonly credentials: Schema.Literal<"audience-and-purpose-scoped">;
+    readonly recovery: Schema.Literal<"coordinator-profile">;
+    readonly certification: Schema.Literal<"provider-protocol-and-public-boundary-tests">;
+}>, {}>;
+/**
+ * Closed acknowledgements required from every custom application adapter.
+ * They are intentionally precise rather than extensible strings: a boolean
+ * success callback or generic command publisher cannot satisfy this contract.
+ */
+export declare class ProviderAdapterContract extends ProviderAdapterContract_base {
+}
+export interface CustomProviderAdapterInput {
+    readonly id: string;
+    readonly contract: ProviderAdapterContract;
+    readonly profile: PublicationProfileRegistration;
+    /**
+     * Derive typed subjects only from a verified prepared bundle and opaque host
+     * sinks. Returning no subject means this installed application adapter does
+     * not apply to that bundle.
+     */
+    readonly subjects: (bundle: PreparedBundle, services: PublicationSubjectServices) => ReadonlyArray<ReleaseSubject>;
+}
+export interface CustomProviderAdapter extends Omit<CustomProviderAdapterInput, "id"> {
+    readonly _tag: "CustomProviderAdapter";
+    readonly id: NonEmptyName;
+}
+/** Validate once at custom-application composition time. */
+export declare const makeProviderAdapter: (input: CustomProviderAdapterInput) => CustomProviderAdapter;
+/**
+ * Build custom subjects behind the same profile and identity checks used by
+ * built-ins. Coordinator construction performs the final request identity,
+ * audience, purpose, mutation, prerequisite, and durable-history checks.
+ */
+export declare const customProviderSubjects: (bundle: PreparedBundle, adapters: ReadonlyArray<CustomProviderAdapter>, services: PublicationSubjectServices, reservedIds?: ReadonlySet<string>) => ReadonlyArray<ReleaseSubject>;
+export {};
+//# sourceMappingURL=provider-adapter.d.ts.map

package/dist/extensions/provider-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adapter.d.ts","sourceRoot":"","sources":["../../src/extensions/provider-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAGL,KAAK,8BAA8B,EACpC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;;;;;;;;;;;AAElE;;;;GAIG;AACH,qBAAa,uBACX,SAAQ,4BASN;CAAG;AAEP,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAA;IAC1C,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,CACjB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,0BAA0B,KACjC,aAAa,CAAC,cAAc,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC;IACnF,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAA;IACtC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAA;CAC1B;AAMD,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,GAAI,OAAO,0BAA0B,KAAG,qBAcvE,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GACjC,QAAQ,cAAc,EACtB,UAAU,aAAa,CAAC,qBAAqB,CAAC,EAC9C,UAAU,0BAA0B,EACpC,cAAa,WAAW,CAAC,MAAM,CAAa,KAC3C,aAAa,CAAC,cAAc,CAmB9B,CAAA"}

package/dist/extensions/provider-adapter.js

@@ -0,0 +1,64 @@
+import * as Schema from "effect/Schema";
+import { NonEmptyName } from "../model/primitives.js";
+import { assertRecoveryProfileMatches, validatePublicationProfiles } from "../publication/recovery.js";
+/**
+ * Closed acknowledgements required from every custom application adapter.
+ * They are intentionally precise rather than extensible strings: a boolean
+ * success callback or generic command publisher cannot satisfy this contract.
+ */
+export class ProviderAdapterContract extends Schema.Class("ProviderAdapterContract")({
+    schemaVersion: Schema.Literal("ts-release/provider-adapter-contract/v1"),
+    preparedSubject: Schema.Literal("typed-canonical-data"),
+    identity: Schema.Literal("canonical-subject-id"),
+    observation: Schema.Literal("exact-equality-and-authoritative-absence"),
+    mutation: Schema.Literal("typed-precondition-and-commitment"),
+    credentials: Schema.Literal("audience-and-purpose-scoped"),
+    recovery: Schema.Literal("coordinator-profile"),
+    certification: Schema.Literal("provider-protocol-and-public-boundary-tests")
+}) {
+}
+const decodeContract = Schema.decodeUnknownSync(ProviderAdapterContract, {
+    onExcessProperty: "error"
+});
+/** Validate once at custom-application composition time. */
+export const makeProviderAdapter = (input) => {
+    const contract = decodeContract(input.contract);
+    const id = NonEmptyName.make(input.id);
+    const profile = validatePublicationProfiles({ [id.toString()]: input.profile })[id.toString()];
+    if (profile.id !== id.toString()) {
+        throw new Error("A custom provider adapter id must equal its recovery-profile registration id.");
+    }
+    return Object.freeze({
+        _tag: "CustomProviderAdapter",
+        ...input,
+        id,
+        contract,
+        profile
+    });
+};
+/**
+ * Build custom subjects behind the same profile and identity checks used by
+ * built-ins. Coordinator construction performs the final request identity,
+ * audience, purpose, mutation, prerequisite, and durable-history checks.
+ */
+export const customProviderSubjects = (bundle, adapters, services, reservedIds = new Set()) => {
+    const result = [];
+    const ids = new Set(reservedIds);
+    for (const adapter of adapters) {
+        const subjects = adapter.subjects(bundle, services);
+        for (const subject of subjects) {
+            if (ids.has(subject.id.toString())) {
+                throw new Error(`Custom provider adapter ${adapter.id} repeats subject ${subject.id}.`);
+            }
+            assertRecoveryProfileMatches(adapter.profile.id, adapter.profile.recovery, subject.recovery);
+            if (subject.observationRequests.some((request) => request.provider.toString() !== adapter.profile.provider) ||
+                subject.mutationRequest.provider.toString() !== adapter.profile.provider) {
+                throw new Error(`Custom provider adapter ${adapter.id} emitted credential authority for a foreign provider.`);
+            }
+            ids.add(subject.id.toString());
+            result.push(subject);
+        }
+    }
+    return result;
+};
+//# sourceMappingURL=provider-adapter.js.map

package/dist/extensions/provider-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adapter.js","sourceRoot":"","sources":["../../src/extensions/provider-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAE5B,MAAM,4BAA4B,CAAA;AAInC;;;;GAIG;AACH,MAAM,OAAO,uBACX,SAAQ,MAAM,CAAC,KAAK,CAA0B,yBAAyB,CAAC,CAAC;IACvE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,yCAAyC,CAAC;IACxE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACvD,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAChD,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,0CAA0C,CAAC;IACvE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAC1D,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAC/C,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,6CAA6C,CAAC;CAC7E,CAAC;CAAG;AAsBP,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC,uBAAuB,EAAE;IACvE,gBAAgB,EAAE,OAAO;CAC1B,CAAC,CAAA;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAiC,EAAyB,EAAE;IAC9F,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAE,CAAA;IAC/F,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAA;IAClG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,uBAAgC;QACtC,GAAG,KAAK;QACR,EAAE;QACF,QAAQ;QACR,OAAO;KACR,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,MAAsB,EACtB,QAA8C,EAC9C,QAAoC,EACpC,cAAmC,IAAI,GAAG,EAAE,EACb,EAAE;IACjC,MAAM,MAAM,GAA0B,EAAE,CAAA;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,EAAE,oBAAoB,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;YACzF,CAAC;YACD,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC5F,IAAI,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,EAAE,uDAAuD,CAAC,CAAA;YAC/G,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAA;YAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/dist/host.d.ts

@@ -0,0 +1,33 @@
+import type { ReleaseRuntimeShape } from "./api/runtime.js";
+import type { ReleaseApiLayer } from "./api/types.js";
+import type { RunCommand } from "./drivers/process.js";
+import { Sha256Digest, sha256Digest } from "./model/digest.js";
+import { SafeRelativePath, WorkspaceRoot } from "./model/primitives.js";
+import type { CredentialRequest } from "./model/authority.js";
+import { CredentialAudienceMismatch, CredentialPurposeMismatch, CredentialStrategyUnsupported, CredentialSubjectMismatch, CredentialUnavailable, makeCredentialProvider, type CredentialAuthorityError, type CredentialGrant, type CredentialGrantAcquirer, type CredentialGrantDescriptor, type CredentialProviderShape, type MutationCredentialGrant } from "./publication/authority.js";
+import { type AuthorizedMutationHttpShape, type HttpAuthorizationError, type HttpAuthorizerShape, type HttpObservationRequest, type HttpResponse } from "./publication/http.js";
+import { type CertifiedPublisherSpawnShape, type NpmUserConfigResourceShape } from "./publication/publisher.js";
+import { PublicationClaimOccupied, PublicationClaimRequest, PublicationClaimUnavailable, type PublicationClaimError, type PublicationClaimStoreShape } from "./publication/claim.js";
+import { ReleaseContextError, SourceMaterializationError, StagingEntry, StagingSnapshot, VerifiedSource, makeSourceObserver, type SourceObserverRuntime, type SourceObserverShape, type VerifiedReleaseContext } from "./release/context.js";
+import { type PreparedReleaseStoreShape } from "./release/prepared-store.js";
+export { CredentialAudienceMismatch, CredentialPurposeMismatch, CredentialStrategyUnsupported, CredentialSubjectMismatch, CredentialUnavailable, PublicationClaimOccupied, PublicationClaimRequest, PublicationClaimUnavailable, ReleaseContextError, SafeRelativePath, Sha256Digest, SourceMaterializationError, StagingEntry, StagingSnapshot, VerifiedSource, WorkspaceRoot, makeCredentialProvider, makeSourceObserver, sha256Digest };
+export type { CredentialAuthorityError, CredentialGrant, CredentialGrantAcquirer, CredentialGrantDescriptor, CredentialProviderShape, CredentialRequest, HttpAuthorizationError, HttpAuthorizerShape, HttpObservationRequest, HttpResponse, AuthorizedMutationHttpShape, CertifiedPublisherSpawnShape, NpmUserConfigResourceShape, PublicationClaimError, PublicationClaimStoreShape, MutationCredentialGrant, ReleaseRuntimeShape, RunCommand, SourceObserverRuntime, SourceObserverShape, VerifiedReleaseContext };
+/** Structural inputs for a library-owned host integration. */
+export interface CustomReleaseLayerInput {
+    readonly runtime: ReleaseRuntimeShape;
+    readonly preparedStore: PreparedReleaseStoreShape;
+    readonly credentialProvider: CredentialProviderShape;
+    readonly httpAuthorizer: HttpAuthorizerShape;
+    readonly authorizedMutationHttp: AuthorizedMutationHttpShape;
+    readonly npmUserConfigResource: NpmUserConfigResourceShape;
+    readonly certifiedPublisherSpawn: CertifiedPublisherSpawnShape;
+    /** Required before a durable-cas-required publication can acquire mutation credentials. */
+    readonly publicationClaimStore?: PublicationClaimStoreShape;
+}
+/**
+ * Compose the complete API service boundary without exposing Context service
+ * tags. Credentials remain opaque grants and HTTP authorization remains a
+ * host-owned elimination boundary.
+ */
+export declare const makeCustomReleaseLayer: (input: CustomReleaseLayerInput) => ReleaseApiLayer;
+//# sourceMappingURL=host.d.ts.map

package/dist/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EACL,0BAA0B,EAE1B,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC7B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAGL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAGL,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAChC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EAEvB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAChC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC5B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,0BAA0B,EAC1B,YAAY,EACZ,eAAe,EACf,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACb,CAAA;AAED,YAAY,EACV,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,YAAY,EACZ,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACvB,CAAA;AAED,8DAA8D;AAC9D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAA;IACjD,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAA;IACpD,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAA;IAC5C,QAAQ,CAAC,sBAAsB,EAAE,2BAA2B,CAAA;IAC5D,QAAQ,CAAC,qBAAqB,EAAE,0BAA0B,CAAA;IAC1D,QAAQ,CAAC,uBAAuB,EAAE,4BAA4B,CAAA;IAC9D,2FAA2F;IAC3F,QAAQ,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAA;CAC5D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO,uBAAuB,KAC7B,eAWF,CAAA"}

package/dist/host.js

@@ -0,0 +1,20 @@
+import * as Layer from "effect/Layer";
+import { ReleaseRuntime } from "./api/runtime.js";
+import { Sha256Digest, sha256Digest } from "./model/digest.js";
+import { SafeRelativePath, WorkspaceRoot } from "./model/primitives.js";
+import { CredentialAudienceMismatch, CredentialProvider, CredentialPurposeMismatch, CredentialStrategyUnsupported, CredentialSubjectMismatch, CredentialUnavailable, makeCredentialProvider } from "./publication/authority.js";
+import { AuthorizedMutationHttp, HttpAuthorizer } from "./publication/http.js";
+import { CertifiedPublisherSpawn, NpmUserConfigResource } from "./publication/publisher.js";
+import { PublicationClaimOccupied, PublicationClaimRequest, PublicationClaimStore, PublicationClaimUnavailable } from "./publication/claim.js";
+import { ReleaseContextError, SourceMaterializationError, StagingEntry, StagingSnapshot, VerifiedSource, makeSourceObserver } from "./release/context.js";
+import { PreparedReleaseStore } from "./release/prepared-store.js";
+export { CredentialAudienceMismatch, CredentialPurposeMismatch, CredentialStrategyUnsupported, CredentialSubjectMismatch, CredentialUnavailable, PublicationClaimOccupied, PublicationClaimRequest, PublicationClaimUnavailable, ReleaseContextError, SafeRelativePath, Sha256Digest, SourceMaterializationError, StagingEntry, StagingSnapshot, VerifiedSource, WorkspaceRoot, makeCredentialProvider, makeSourceObserver, sha256Digest };
+/**
+ * Compose the complete API service boundary without exposing Context service
+ * tags. Credentials remain opaque grants and HTTP authorization remains a
+ * host-owned elimination boundary.
+ */
+export const makeCustomReleaseLayer = (input) => Layer.mergeAll(Layer.succeed(ReleaseRuntime, input.runtime), Layer.succeed(PreparedReleaseStore, input.preparedStore), Layer.succeed(CredentialProvider, input.credentialProvider), Layer.succeed(HttpAuthorizer, input.httpAuthorizer), Layer.succeed(AuthorizedMutationHttp, input.authorizedMutationHttp), Layer.succeed(NpmUserConfigResource, input.npmUserConfigResource), Layer.succeed(CertifiedPublisherSpawn, input.certifiedPublisherSpawn), ...(input.publicationClaimStore === undefined
+    ? []
+    : [Layer.succeed(PublicationClaimStore, input.publicationClaimStore)]));
+//# sourceMappingURL=host.js.map

package/dist/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGjD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEvE,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EAOvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,sBAAsB,EACtB,cAAc,EAMf,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EAGtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAG5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,EACf,cAAc,EACd,kBAAkB,EAInB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,oBAAoB,EAErB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,0BAA0B,EAC1B,YAAY,EACZ,eAAe,EACf,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACb,CAAA;AAuCD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAA8B,EACb,EAAE,CAAC,KAAK,CAAC,QAAQ,CAClC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAC5C,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,EACxD,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAC3D,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACnD,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,CAAC,EACnE,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,CAAC,EACjE,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,CAAC,EACrE,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;IAC3C,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACzE,CAAA"}

package/dist/index.d.ts

@@ -1,2 +1,20 @@
-export {};
+declare global {
+    const SchemaErrorTypeId: unique symbol;
+}
+export { CorrectionReport, correct, inspect, makeReleaseApi, observe, prepare, publish, release } from "./api/api.js";
+export type { CorrectInput, InspectInput, InspectOutput, ObserveInput, PrepareInput, PublishInput, ReleaseApi, ReleaseApiLayer, ReleaseApiOptions, ReleaseInput, ReleaseResult } from "./api/types.js";
+export { AuthoredCatalogForwardCorrection, AuthoredGithubReleaseAmendment, AuthoredNpmDeprecation, decodeAuthoredCorrection } from "./correction/intent.js";
+export type { AuthoredCorrection } from "./correction/intent.js";
+export { PreparationModeUnsupported, ReleaseAbortedError, ReleaseIncompleteError, ReleaseInputError, ReleasePreparationError } from "./api/errors.js";
+export { CredentialStrategyUnsupported, CredentialUnavailable } from "./publication/authority.js";
+export { CredentialFailureCause, CredentialStrategyUnsupportedCause, CredentialUnavailableCause, ObservationReport, ReleaseReport } from "./publication/report.js";
+export { CompletePreparedReleaseRef, GitHubActionsCompletePreparedReleaseRef, LocalCompletePreparedReleaseRef, PreparedReleaseRefCodecError, PreparedReleaseRefMalformedError, PreparedReleaseRefUnknownSchemeError, decodeCompletePreparedReleaseRef, encodeCompletePreparedReleaseRef, makeGitHubActionsCompletePreparedReleaseRef, makeLocalCompletePreparedReleaseRef } from "./release/prepared-ref.js";
+export type { PreparedReleaseSha256 } from "./release/prepared-ref.js";
+export { ReleaseRuntime } from "./api/runtime.js";
+export { unsupportedExecutionHost } from "./platform/host-support.js";
+export { resolveConfig } from "./resolve/resolve.js";
+export type { AuthoredConfig, AuthoredProject } from "./resolve/authored.js";
+export type { ObservedFacts } from "./resolve/facts.js";
+export { encodeResolvedConfig } from "./resolve/encode.js";
+export declare const defineRelease: <const Config>(config: Config) => Config;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,CAAC;IACb,MAAM,iBAAiB,EAAE,OAAO,MAAM,CAAA;CACvC;AAED,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACR,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EACL,0BAA0B,EAAE,mBAAmB,EAAE,sBAAsB,EACvE,iBAAiB,EAAE,uBAAuB,EAC3C,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACd,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,0BAA0B,EAAE,uCAAuC,EACnE,+BAA+B,EAAE,4BAA4B,EAC7D,gCAAgC,EAAE,oCAAoC,EACtE,gCAAgC,EAAE,gCAAgC,EAClE,2CAA2C,EAAE,mCAAmC,EACjF,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5E,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,eAAO,MAAM,aAAa,GAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,MAAM,KAAG,MAAgB,CAAA"}

package/dist/index.js

@@ -1,2 +1,13 @@
-export {};
+// The root is the intentionally small public lifecycle surface.
+export { CorrectionReport, correct, inspect, makeReleaseApi, observe, prepare, publish, release } from "./api/api.js";
+export { AuthoredCatalogForwardCorrection, AuthoredGithubReleaseAmendment, AuthoredNpmDeprecation, decodeAuthoredCorrection } from "./correction/intent.js";
+export { PreparationModeUnsupported, ReleaseAbortedError, ReleaseIncompleteError, ReleaseInputError, ReleasePreparationError } from "./api/errors.js";
+export { CredentialStrategyUnsupported, CredentialUnavailable } from "./publication/authority.js";
+export { CredentialFailureCause, CredentialStrategyUnsupportedCause, CredentialUnavailableCause, ObservationReport, ReleaseReport } from "./publication/report.js";
+export { CompletePreparedReleaseRef, GitHubActionsCompletePreparedReleaseRef, LocalCompletePreparedReleaseRef, PreparedReleaseRefCodecError, PreparedReleaseRefMalformedError, PreparedReleaseRefUnknownSchemeError, decodeCompletePreparedReleaseRef, encodeCompletePreparedReleaseRef, makeGitHubActionsCompletePreparedReleaseRef, makeLocalCompletePreparedReleaseRef } from "./release/prepared-ref.js";
+export { ReleaseRuntime } from "./api/runtime.js";
+export { unsupportedExecutionHost } from "./platform/host-support.js";
+export { resolveConfig } from "./resolve/resolve.js";
+export { encodeResolvedConfig } from "./resolve/encode.js";
+export const defineRelease = (config) => config;
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,gEAAgE;AAChE,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACR,MAAM,cAAc,CAAA;AAcrB,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,0BAA0B,EAAE,mBAAmB,EAAE,sBAAsB,EACvE,iBAAiB,EAAE,uBAAuB,EAC3C,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACd,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,0BAA0B,EAAE,uCAAuC,EACnE,+BAA+B,EAAE,4BAA4B,EAC7D,gCAAgC,EAAE,oCAAoC,EACtE,gCAAgC,EAAE,gCAAgC,EAClE,2CAA2C,EAAE,mCAAmC,EACjF,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAe,MAAc,EAAU,EAAE,CAAC,MAAM,CAAA"}

package/dist/model/artifact-collection.d.ts

@@ -0,0 +1,84 @@
+import * as Schema from "effect/Schema";
+import { OutputId, SafeRelativePath } from "./primitives.js";
+export declare const ArtifactCollectionId: Schema.brand<Schema.NonEmptyString, "ArtifactCollectionId">;
+export type ArtifactCollectionId = typeof ArtifactCollectionId.Type;
+export declare const CollectionArtifactKind: Schema.Literals<readonly ["file", "executable", "archive", "digest"]>;
+export type CollectionArtifactKind = typeof CollectionArtifactKind.Type;
+export declare const ArtifactPathSuffix: Schema.brand<Schema.NonEmptyString, "ArtifactPathSuffix">;
+export type ArtifactPathSuffix = typeof ArtifactPathSuffix.Type;
+export declare const ArtifactCollectionRoot: Schema.brand<Schema.brand<Schema.String, "SafeRelativePath">, "ArtifactCollectionRoot">;
+export type ArtifactCollectionRoot = typeof ArtifactCollectionRoot.Type;
+declare const OneArtifactCardinality_base: Schema.Class<OneArtifactCardinality, Schema.Struct<{
+    readonly kind: Schema.Literal<"one">;
+}>, {}>;
+export declare class OneArtifactCardinality extends OneArtifactCardinality_base {
+}
+declare const OneOrMoreArtifactCardinality_base: Schema.Class<OneOrMoreArtifactCardinality, Schema.Struct<{
+    readonly kind: Schema.Literal<"one-or-more">;
+}>, {}>;
+export declare class OneOrMoreArtifactCardinality extends OneOrMoreArtifactCardinality_base {
+}
+declare const BoundedArtifactCardinality_base: Schema.Class<BoundedArtifactCardinality, Schema.Struct<{
+    readonly kind: Schema.Literal<"bounded">;
+    readonly minimum: Schema.Number;
+    readonly maximum: Schema.Number;
+}>, {}>;
+export declare class BoundedArtifactCardinality extends BoundedArtifactCardinality_base {
+}
+export declare const ArtifactCardinality: Schema.Union<readonly [typeof OneArtifactCardinality, typeof OneOrMoreArtifactCardinality, typeof BoundedArtifactCardinality]>;
+export type ArtifactCardinality = typeof ArtifactCardinality.Type;
+declare const ArtifactCollectionContract_base: Schema.Class<ArtifactCollectionContract, Schema.Struct<{
+    readonly id: Schema.brand<Schema.NonEmptyString, "ArtifactCollectionId">;
+    readonly producer: Schema.brand<Schema.NonEmptyString, "OperationId">;
+    readonly root: Schema.brand<Schema.brand<Schema.String, "SafeRelativePath">, "ArtifactCollectionRoot">;
+    readonly artifactKind: Schema.Literals<readonly ["file", "executable", "archive", "digest"]>;
+    readonly pathSuffix: Schema.brand<Schema.NonEmptyString, "ArtifactPathSuffix">;
+    readonly mediaType: Schema.NonEmptyString;
+    readonly cardinality: Schema.Union<readonly [typeof OneArtifactCardinality, typeof OneOrMoreArtifactCardinality, typeof BoundedArtifactCardinality]>;
+}>, {}>;
+/**
+ * One command-owned dynamic output set. A collection intentionally permits one
+ * artifact kind and one filename suffix: heterogeneous output sets must be
+ * split into independently selectable contracts.
+ */
+export declare class ArtifactCollectionContract extends ArtifactCollectionContract_base {
+}
+declare const ArtifactCollectionSelector_base: Schema.Class<ArtifactCollectionSelector, Schema.Struct<{
+    readonly collection: Schema.brand<Schema.NonEmptyString, "ArtifactCollectionId">;
+    readonly artifactKind: Schema.Literals<readonly ["file", "executable", "archive", "digest"]>;
+    readonly pathSuffix: Schema.brand<Schema.NonEmptyString, "ArtifactPathSuffix">;
+    readonly mediaType: Schema.NonEmptyString;
+    readonly cardinality: Schema.Union<readonly [typeof OneArtifactCardinality, typeof OneOrMoreArtifactCardinality, typeof BoundedArtifactCardinality]>;
+}>, {}>;
+/** A downstream requirement over a stable collection identity. */
+export declare class ArtifactCollectionSelector extends ArtifactCollectionSelector_base {
+}
+declare const ArtifactCollectionMember_base: Schema.Class<ArtifactCollectionMember, Schema.Struct<{
+    readonly key: Schema.brand<Schema.String, "SafeRelativePath">;
+    readonly artifactId: Schema.brand<Schema.NonEmptyString, "OutputId">;
+}>, {}>;
+/** Exact runtime member identity persisted beside the prepared artifacts. */
+export declare class ArtifactCollectionMember extends ArtifactCollectionMember_base {
+}
+export interface CardinalityRange {
+    readonly minimum: number;
+    readonly maximum?: number;
+}
+export declare const cardinalityRange: (value: ArtifactCardinality) => CardinalityRange;
+export declare const cardinalityIssue: (value: ArtifactCardinality) => string | undefined;
+/** Reject kind/media/suffix combinations whose observable claims conflict. */
+export declare const collectionContractIssue: (value: Pick<ArtifactCollectionContract, "artifactKind" | "pathSuffix" | "mediaType">) => string | undefined;
+/** Byte-level checks for the formats whose kind is portable and observable. */
+export declare const collectionMemberBytesIssue: (contract: ArtifactCollectionContract, bytes: Uint8Array) => string | undefined;
+export declare const cardinalityAccepts: (value: ArtifactCardinality, count: number) => boolean;
+export declare const cardinalitiesOverlap: (left: ArtifactCardinality, right: ArtifactCardinality) => boolean;
+/** Paths discovered from directory entries must already be portable canon. */
+export declare const normalizeCollectionMemberKey: (value: string) => SafeRelativePath;
+/**
+ * Stable output identity is a digest of the declared producer/contract and the
+ * normalized member key. No guessed runtime filename becomes graph authority.
+ */
+export declare const collectionMemberId: (contract: ArtifactCollectionContract, key: SafeRelativePath) => OutputId;
+export declare const collectionMemberPath: (contract: ArtifactCollectionContract, key: SafeRelativePath) => SafeRelativePath;
+export {};
+//# sourceMappingURL=artifact-collection.d.ts.map

package/dist/model/artifact-collection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-collection.d.ts","sourceRoot":"","sources":["../../src/model/artifact-collection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,EAAe,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEzE,eAAO,MAAM,oBAAoB,6DAIY,CAAA;AAC7C,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE,eAAO,MAAM,sBAAsB,uEAKjC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE,eAAO,MAAM,kBAAkB,2DAIY,CAAA;AAC3C,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,sBAAsB,yFAIY,CAAA;AAC/C,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;;;;AAQvE,qBAAa,sBACX,SAAQ,2BAEN;CAAG;;;;AAEP,qBAAa,4BACX,SAAQ,iCAEN;CAAG;;;;;;AAEP,qBAAa,0BACX,SAAQ,+BAIN;CAAG;AAQP,eAAO,MAAM,mBAAmB,gIAI9B,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;;;;;;;;;;AAEjE;;;;GAIG;AACH,qBAAa,0BACX,SAAQ,+BAQN;CAAG;;;;;;;;AAEP,kEAAkE;AAClE,qBAAa,0BACX,SAAQ,+BAMN;CAAG;;;;;AAEP,6EAA6E;AAC7E,qBAAa,wBACX,SAAQ,6BAGN;CAAG;AAEP,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,eAAO,MAAM,gBAAgB,GAAI,OAAO,mBAAmB,KAAG,gBAM7D,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAI,OAAO,mBAAmB,KAAG,MAAM,GAAG,SAMtE,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,GAClC,OAAO,IAAI,CAAC,0BAA0B,EAAE,cAAc,GAAG,YAAY,GAAG,WAAW,CAAC,KACnF,MAAM,GAAG,SAoBX,CAAA;AAED,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,GACrC,UAAU,0BAA0B,EACpC,OAAO,UAAU,KAChB,MAAM,GAAG,SA4BX,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,OAAO,mBAAmB,EAAE,OAAO,MAAM,KAAG,OAI9E,CAAA;AAED,eAAO,MAAM,oBAAoB,GAC/B,MAAM,mBAAmB,EACzB,OAAO,mBAAmB,KACzB,OASF,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,4BAA4B,GAAI,OAAO,MAAM,KAAG,gBAK5D,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAU,0BAA0B,EACpC,KAAK,gBAAgB,KACpB,QAaM,CAAA;AAET,eAAO,MAAM,oBAAoB,GAC/B,UAAU,0BAA0B,EACpC,KAAK,gBAAgB,KACpB,gBAAoE,CAAA"}