@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/release/runtime-provenance.js

@@ -0,0 +1,229 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { resolveInstalledDependency } from './package-resolution.js';
+import { fileURLToPath } from 'node:url';
+import { targetRuntime, releaseNodeOptions } from './target-runtime.js';
+import { shellEscape } from '../shared/shell-escape.js';
+import { readInstalledReleaseReceipt, writeInstalledReleaseReceipt, validOrigin } from './installed-origin.js';
+export { validOrigin } from './installed-origin.js';
+export const RELEASE_RECEIPT = '.omnitron-release.json';
+/** Self-contained so exactly this implementation also seals the remote candidate. */
+export async function releaseTreeDigest(directory, portable = false, skipDependencies = false, excludedRootEntries = []) {
+    const io = await import('node:fs/promises');
+    const paths = await import('node:path');
+    const { createHash } = await import('node:crypto');
+    const root = await io.realpath(directory), digest = createHash('sha256');
+    const seen = new Map();
+    let files = 0, bytes = 0;
+    const deadline = Date.now() + 60_000;
+    const walk = async (absolute, label) => {
+        if (Date.now() > deadline)
+            throw new Error('Release tree verification deadline exceeded');
+        const before = await io.lstat(absolute, { bigint: true });
+        if (process.getuid && before.uid !== BigInt(process.getuid()))
+            throw new Error('Release tree belongs to another user');
+        if (before.isSymbolicLink()) {
+            const target = await io.realpath(absolute);
+            if (portable && target !== root && !target.startsWith(root + paths.sep))
+                throw Error('Release payload links outside its packed boundary');
+            if (!portable)
+                digest.update(`link\0${label}\0${await io.readlink(absolute)}\0${target}\0`);
+            // Follow dependency links, including an externally bound framework, once.
+            await walk(target, portable ? label : `resolved:${target}`);
+            const after = await io.lstat(absolute, { bigint: true });
+            if (before.dev !== after.dev || before.ino !== after.ino || before.ctimeNs !== after.ctimeNs)
+                throw new Error('Release dependency binding changed during verification');
+            return;
+        }
+        if ((before.mode & 18n) !== 0n)
+            throw new Error('Release tree is writable by another user');
+        if (seen.has(absolute)) {
+            digest.update(`reference\0${label}\0${seen.get(absolute)}\0`);
+            return;
+        }
+        seen.set(absolute, label);
+        if (before.isDirectory()) {
+            digest.update(`directory\0${label}\0`);
+            for (const name of (await io.readdir(absolute)).sort()) {
+                if (skipDependencies && absolute === root && name === 'node_modules')
+                    continue;
+                if (absolute === root && excludedRootEntries.includes(name))
+                    continue;
+                // Operational receipts are written after deployment; they are not code.
+                if (absolute === root && ['.omnitron-release.json', '.artifact-sha256'].includes(name))
+                    continue;
+                await walk(paths.join(absolute, name), `${label}/${name}`);
+            }
+        }
+        else if (before.isFile()) {
+            if (++files > 200_000 || (bytes += Number(before.size)) > 2_147_483_648 || before.size > 268435456n)
+                throw new Error('Release tree exceeds verification capacity');
+            digest.update(`file\0${label}\0${portable ? (before.mode & 73n ? 73n : 0n) : before.mode & 73n}\0`);
+            digest.update(await io.readFile(absolute));
+            digest.update('\0');
+        }
+        else
+            throw new Error('Unsupported file in release tree');
+        const after = await io.lstat(absolute, { bigint: true });
+        if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+            throw new Error('Release tree changed during verification');
+    };
+    await walk(root, '.');
+    return digest.digest('hex');
+}
+/** Compare package bytes and resolution edges, independent of installation paths. */
+export async function frameworkDependencyGraph(application, selected) {
+    const io = await import('node:fs/promises');
+    const paths = await import('node:path');
+    const { createHash } = await import('node:crypto');
+    const graph = [];
+    const known = new Map();
+    const deadline = Date.now() + 60_000;
+    const visit = async (directory) => {
+        const root = await io.realpath(directory);
+        const old = known.get(root);
+        if (old !== undefined)
+            return old;
+        if (Date.now() > deadline || graph.length >= 4096)
+            throw new Error('Framework dependency graph exceeds verification capacity');
+        const meta = JSON.parse(await io.readFile(paths.join(root, 'package.json'), 'utf8'));
+        if (typeof meta.name !== 'string' || typeof meta.version !== 'string')
+            throw new Error('Invalid framework dependency package');
+        const id = graph.length;
+        known.set(root, id);
+        const item = { name: meta.name, version: meta.version, content: await releaseTreeDigest(root, true, true), dependencies: Object.create(null) };
+        graph.push(item);
+        for (const name of Object.keys({ ...meta.dependencies, ...meta.optionalDependencies, ...meta.peerDependencies }).sort()) {
+            const target = await resolveInstalledDependency(root, name, selected !== undefined);
+            if (target)
+                item.dependencies[name] = await visit(target);
+            else if (name in (meta.optionalDependencies ?? {}) || meta.peerDependenciesMeta?.[name]?.optional)
+                item.dependencies[name] = null;
+            else
+                throw new Error('Missing framework dependency: ' + meta.name + ' → ' + name);
+        }
+        return id;
+    };
+    const scope = paths.join(application, 'node_modules', '@omnitron-dev');
+    const roots = {};
+    const pathsByName = selected ?? Object.fromEntries((await io.readdir(scope)).filter(name => !name.startsWith('.')).map(name => [name, paths.join(scope, name)]));
+    for (const name of Object.keys(pathsByName).sort())
+        roots[name] = await visit(pathsByName[name]);
+    const sha256 = createHash('sha256').update(JSON.stringify({ roots, graph })).digest('hex');
+    return { roots, graph, directories: [...known.keys()], sha256 };
+}
+export async function frameworkDependencyDigest(application, selected) {
+    return (await frameworkDependencyGraph(application, selected)).sha256;
+}
+// Both commands execute the same verifier on the target using only its Node executable.
+export function frameworkGraphCommandSource() {
+    return 'const resolveInstalledDependency=' + resolveInstalledDependency.toString() +
+        ';const releaseTreeDigest=' + releaseTreeDigest.toString() + ';const frameworkDependencyGraph=' + frameworkDependencyGraph.toString() + ';';
+}
+export function frameworkDigestCommand(application) {
+    return `node --input-type=module -e ${shellEscape(`${frameworkGraphCommandSource()}const inspect=${frameworkDependencyDigest.toString()};console.log(await inspect(${JSON.stringify(application)}));`)}`;
+}
+/** Dependency installers may add locks, but must not silently rewrite the shipped payload. */
+export function artifactPayloadDigestCommand(application, archiveName) {
+    const excluded = [archiveName, 'package-lock.json', 'npm-shrinkwrap.json'];
+    return `node --input-type=module -e ${shellEscape(`const inspect=${releaseTreeDigest.toString()};console.log(await inspect(${JSON.stringify(application)},true,true,${JSON.stringify(excluded)}));`)}`;
+}
+/** Called only after checked delivery and dependency installation in a new directory. */
+export function sealReleaseArtifactCommand(directory, origin, installedFrameworkCommit, frameworkContentUnchanged, artifactPayloadUnchanged, launch) {
+    if (!validOrigin(origin) || !path.isAbsolute(directory) || !/^[a-f0-9]{40}$/.test(installedFrameworkCommit))
+        throw new Error('Invalid release origin');
+    if (launch && (!path.isAbsolute(launch.executable) || !path.isAbsolute(launch.ownerPackage) ||
+        releaseNodeOptions(launch.nodeOptions) !== launch.nodeOptions || !frameworkContentUnchanged || !artifactPayloadUnchanged ||
+        installedFrameworkCommit !== origin.frameworkCommit))
+        throw new Error('A verified release requires unchanged application SDK and payload');
+    const source = `import fs from 'node:fs/promises';
+const root=await fs.realpath(${JSON.stringify(directory)}), origin=${JSON.stringify(origin)};
+const treeSha256=await (${releaseTreeDigest.toString()})(root);
+const launch=${launch ? `{version:2,nodeOptions:${JSON.stringify(launch.nodeOptions)},ownerPackage:await fs.realpath(${JSON.stringify(launch.ownerPackage)}),target:await (${targetRuntime.toString()})()}` : '{version:1}'};
+await (${writeInstalledReleaseReceipt.toString()})(root,{...launch,root,origin,treeSha256,installedFrameworkCommit:${JSON.stringify(installedFrameworkCommit)},frameworkContentUnchanged:${JSON.stringify(frameworkContentUnchanged)},artifactPayloadUnchanged:${JSON.stringify(artifactPayloadUnchanged)}});`;
+    return `env -u NODE_OPTIONS -u NODE_PATH ${launch ? shellEscape(launch.executable) : 'node'} --input-type=module -e ${shellEscape(source)}`;
+}
+/** The old input marker is only a performance hint. Reuse also requires this
+ * exact installed receipt, unchanged bytes and the current execution binding. */
+export function installedReleaseCheckCommand(directory, origin, owner, nodeOptions) {
+    if (!validOrigin(origin) || ![directory, owner.executable, owner.root].every(p => path.isAbsolute(p)))
+        throw Error('Invalid release verification input');
+    const source = `import fs from 'node:fs/promises';import {isDeepStrictEqual} from 'node:util';try {
+const root=await fs.realpath(${JSON.stringify(directory)}),file=root+'/${RELEASE_RECEIPT}',stat=await fs.lstat(file);
+if(!stat.isFile()||stat.size>16384||(stat.mode&63)!==0||(process.getuid&&stat.uid!==process.getuid()))throw Error();
+const r=JSON.parse(await fs.readFile(file,'utf8')), expected=${JSON.stringify(origin)};
+if(r.version!==2||r.root!==root||r.nodeOptions!==${JSON.stringify(releaseNodeOptions(nodeOptions))}||r.ownerPackage!==await fs.realpath(${JSON.stringify(owner.root)})||
+r.installedFrameworkCommit!==expected.frameworkCommit||r.frameworkContentUnchanged!==true||r.artifactPayloadUnchanged!==true||
+!isDeepStrictEqual(r.origin,expected))throw Error();
+const target=await (${targetRuntime.toString()})();if(Object.keys(target).some(key=>target[key]!==r.target?.[key]))throw Error();
+if(await (${releaseTreeDigest.toString()})(root)!==r.treeSha256)throw Error();console.log('verified');
+}catch{console.log('stale')}`;
+    return `env -u NODE_OPTIONS -u NODE_PATH ${shellEscape(owner.executable)} --input-type=module -e ${shellEscape(source)}`;
+}
+/** A fresh launch may verify a receipt; a surviving legacy process may not. */
+export async function verifyLaunchRelease(entry, launchId, executionPaths = []) {
+    const unavailable = (reason) => ({ state: 'unreported', reason });
+    const effective = (key) => entry.env && Object.hasOwn(entry.env, key) ? entry.env[key] : process.env[key];
+    if (effective('NODE_PATH'))
+        return unavailable('Additional Node module paths are outside the release boundary.');
+    if (!entry.releaseRoot || !path.isAbsolute(entry.releaseRoot))
+        return unavailable('No installed release boundary was recorded for this launch.');
+    const root = await fs.realpath(entry.releaseRoot).catch(() => null);
+    if (!root)
+        return unavailable('The launch directory could not be read.');
+    let receipt;
+    try {
+        receipt = await readInstalledReleaseReceipt(root);
+        if (receipt.version === 1) {
+            if (effective('NODE_OPTIONS'))
+                return unavailable('Node runtime options are outside this legacy receipt.');
+        }
+        else {
+            let options;
+            try {
+                options = releaseNodeOptions(effective('NODE_OPTIONS'));
+            }
+            catch {
+                return unavailable('This launch uses Node options not permitted for a verified release.');
+            }
+            if (receipt.nodeOptions !== options)
+                return unavailable('The Node resource settings differ from the settings sealed at build time.');
+            const ownerPackage = await fs.realpath(fileURLToPath(new URL('../../', import.meta.url)));
+            if (receipt.ownerPackage !== ownerPackage)
+                return { state: 'modified', releaseId: receipt.origin.releaseId, reason: 'This launch uses a different execution owner than the verified delivery.' };
+            const target = await targetRuntime();
+            if (Object.keys(target).some(k => target[k] !== receipt.target?.[k]))
+                return { state: 'modified', releaseId: receipt.origin.releaseId, reason: 'The execution runtime differs from the target verified at delivery.' };
+        }
+        const executable = entry.bootstrap ?? entry.script;
+        if (executable && /\.(?:[cm]?ts|tsx)$/.test(executable))
+            return unavailable('This launch compiles source files; the installed release receipt does not identify the generated executable.');
+        if (!executable || !(await fs.realpath(path.resolve(entry.cwd ?? root, executable))).startsWith(root + path.sep) ||
+            entry.name.split('/').at(-1) !== receipt.origin.app)
+            return unavailable('The installed release receipt does not match this application entry point.');
+        for (const executablePath of executionPaths) {
+            if (!path.isAbsolute(executablePath) || /\.(?:[cm]?ts|tsx)$/.test(executablePath) ||
+                !(await fs.realpath(executablePath)).startsWith(root + path.sep))
+                return unavailable('A launch module is outside the verified precompiled release boundary.');
+        }
+    }
+    catch {
+        return unavailable('No readable release receipt was recorded for this launch; deployment history cannot establish its identity.');
+    }
+    const releaseId = receipt.origin.releaseId;
+    if (receipt.artifactPayloadUnchanged !== true)
+        return { state: 'modified', releaseId, reason: 'The application payload changed while dependencies were installed.' };
+    try {
+        if (await releaseTreeDigest(root) !== receipt.treeSha256)
+            return { state: 'modified', releaseId, reason: 'Installed application files or resolved dependencies changed after delivery.' };
+    }
+    catch {
+        return { state: 'modified', releaseId, reason: 'The installed application tree could not be verified at launch.' };
+    }
+    if (receipt.installedFrameworkCommit !== receipt.origin.frameworkCommit || receipt.frameworkContentUnchanged !== true)
+        return { state: 'modified', releaseId, reason: 'The installed framework differs from the framework recorded by this release.' };
+    return { state: 'confirmed', releaseId, manifestSha256: receipt.origin.manifestSha256,
+        ...(receipt.version === 2 && receipt.origin.runtimeOrigin && { consumer: { ...receipt.origin.runtimeOrigin.consumer } }),
+        artifactSha256: receipt.origin.artifactSha256, treeSha256: receipt.treeSha256, observedAt: new Date().toISOString(), launchId, basis: 'verified-launch' };
+}
+//# sourceMappingURL=runtime-provenance.js.map

package/dist/release/runtime-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-provenance.js","sourceRoot":"","sources":["../../src/release/runtime-provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAsB,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,WAAW,EAA4D,MAAM,uBAAuB,CAAC;AACzK,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIpD,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAExD,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,QAAQ,GAAG,KAAK,EAAE,gBAAgB,GAAG,KAAK,EAAE,mBAAmB,GAAsB,EAAE;IAChJ,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,EAAE,QAAgB,EAAE,KAAa,EAAiB,EAAE;QACpE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvH,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;YAC1I,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,KAAK,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;YAC5F,0EAA0E;YAC1E,MAAM,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAC1F,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,GAAM,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC/F,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,cAAc,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAClG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvD,IAAI,gBAAgB,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,KAAK,cAAc;oBAAE,SAAS;gBAC/E,IAAI,QAAQ,KAAK,IAAI,IAAI,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACtE,wEAAwE;gBACxE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACjG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,aAAa,IAAI,MAAM,CAAC,IAAI,GAAG,UAAY;gBACnG,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,GAAM,CAAC,CAAC,CAAC,GAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,GAAM,IAAI,CAAC,CAAC;YAC7G,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAC5J,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAAmB,EAAE,QAA2C;IAC7G,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,KAAK,GAA2G,EAAE,CAAC;IACzH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,EAAE,SAAiB,EAAmB,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;QAC/D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC/H,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC/H,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAiB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAkC,EAAE,CAAC;QACpM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,oBAAoB,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACxH,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC;YACpF,IAAI,MAAM;gBAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;iBACrD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ;gBAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;;gBAC7H,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACvE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjK,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAE,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,WAAmB,EAAE,QAA2C;IAC9G,OAAO,CAAC,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,2BAA2B;IACzC,OAAO,mCAAmC,GAAG,0BAA0B,CAAC,QAAQ,EAAE;QAChF,2BAA2B,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,kCAAkC,GAAG,wBAAwB,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC;AAChJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO,+BAA+B,WAAW,CAAC,GAAG,2BAA2B,EAAE,iBAAiB,yBAAyB,CAAC,QAAQ,EAAE,8BAA8B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3M,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,4BAA4B,CAAC,WAAmB,EAAE,WAAmB;IACnF,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAC3E,OAAO,+BAA+B,WAAW,CAAC,iBAAiB,iBAAiB,CAAC,QAAQ,EAAE,8BAA8B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACzM,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,MAA6B,EAAE,wBAAgC,EAAE,yBAAkC,EAAE,wBAAiC,EAClM,MAA0E;IAC1E,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,wBAAwB,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;QACzF,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,WAAW,IAAI,CAAC,yBAAyB,IAAI,CAAC,wBAAwB;QACxH,wBAAwB,KAAK,MAAM,CAAC,eAAe,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC7I,MAAM,MAAM,GAAG;+BACc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;0BACjE,iBAAiB,CAAC,QAAQ,EAAE;eACvC,MAAM,CAAC,CAAC,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,mBAAmB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa;SAClN,4BAA4B,CAAC,QAAQ,EAAE,qEAAqE,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,KAAK,CAAC;IAC7S,OAAO,oCAAoC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,2BAA2B,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9I,CAAC;AAED;iFACiF;AACjF,MAAM,UAAU,4BAA4B,CAAC,SAAiB,EAAE,MAA6B,EAAE,KAA2D,EAAE,WAAmB;IAC7K,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACzJ,MAAM,MAAM,GAAG;+BACc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,eAAe;;+DAEzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;mDAClC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;;;sBAG9I,aAAa,CAAC,QAAQ,EAAE;YAClC,iBAAiB,CAAC,QAAQ,EAAE;6BACX,CAAC;IAC5B,OAAO,oCAAoC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,2BAA2B,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3H,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAyB,EAAE,QAAgB,EAAE,cAAc,GAAsB,EAAE;IAC3H,MAAM,WAAW,GAAG,CAAC,MAAc,EAA0B,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3H,IAAI,SAAS,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC,gEAAgE,CAAC,CAAC;IACjH,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC,6DAA6D,CAAC,CAAC;IACjJ,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,WAAW,CAAC,yCAAyC,CAAC,CAAC;IACzE,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,SAAS,CAAC,cAAc,CAAC;gBAAE,OAAO,WAAW,CAAC,uDAAuD,CAAC,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBAAC,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;YAAC,CAAC;YAChE,MAAM,CAAC;gBAAC,OAAO,WAAW,CAAC,qEAAqE,CAAC,CAAC;YAAC,CAAC;YACpG,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO;gBAAE,OAAO,WAAW,CAAC,2EAA2E,CAAC,CAAC;YACrI,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY;gBACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,0EAA0E,EAAE,CAAC;YACxJ,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAwB,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAwB,CAAC,CAAC;gBAChH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,qEAAqE,EAAE,CAAC;QACrJ,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;QACnD,IAAI,UAAU,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC;YACrD,OAAO,WAAW,CAAC,8GAA8G,CAAC,CAAC;QACrI,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;YAC9G,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG;YACnD,OAAO,WAAW,CAAC,4EAA4E,CAAC,CAAC;QACnG,KAAK,MAAM,cAAc,IAAI,cAAc,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC/E,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;gBAChE,OAAO,WAAW,CAAC,uEAAuE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,6GAA6G,CAAC,CAAC;IACpI,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;IAC3C,IAAI,OAAO,CAAC,wBAAwB,KAAK,IAAI;QAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,oEAAoE,EAAE,CAAC;IACxH,IAAI,CAAC;QACH,IAAI,MAAM,iBAAiB,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,UAAU;YACtD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAC;IACpI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IACrH,CAAC;IACD,IAAI,OAAO,CAAC,wBAAwB,KAAK,OAAO,CAAC,MAAM,CAAC,eAAe,IAAI,OAAO,CAAC,yBAAyB,KAAK,IAAI;QACnH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAC;IAClI,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;QACnF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC;QACxH,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;AAC9J,CAAC"}

package/dist/release/source.d.ts

@@ -0,0 +1,12 @@
+import type { ReleaseSource } from './manifest.js';
+export declare function networkRepository(repository: string): boolean;
+/** Publication is a network-origin observation, independent of explicit local-source trust. */
+export declare function sourcePublication(checkout: string, repository: string, commit: string, options?: {
+    ref?: string;
+    signal?: AbortSignal;
+}): Promise<boolean | null>;
+/** An explicitly selected ref is a build constraint, including in offline/local repositories. */
+export declare function sourceRefContains(checkout: string, repository: string, commit: string, ref: string, signal?: AbortSignal): Promise<boolean | null>;
+/** Credential-free recorded identity and an independently checked publication fact. */
+export declare function readReleaseSource(checkout: string, commit: string): Promise<ReleaseSource>;
+//# sourceMappingURL=source.d.ts.map

package/dist/release/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/release/source.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAcnD,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAI7D;AAkFD,+FAA+F;AAC/F,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAC1F,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAc/E;AAED,iGAAiG;AACjG,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EACvG,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAG/C;AAED,uFAAuF;AACvF,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAMhG"}

package/dist/release/source.js

@@ -0,0 +1,168 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ExecutionEngine } from '@xec-sh/core';
+import { assertRepositoryIdentity } from './repository-identity.js';
+import { isFrameworkRef } from '../shared/framework-source.js';
+const SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const MAX_HEADS = 4096;
+const TIMEOUT = 10_000;
+const REPOSITORY_ENV = ['GIT_DIR', 'GIT_COMMON_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_NAMESPACE', 'GIT_REPLACE_REF_BASE', 'GIT_SHALLOW_FILE', 'GIT_GRAFT_FILE'];
+class GitSourceContextError extends Error {
+}
+function assertCheckoutEnvironment() {
+    const present = REPOSITORY_ENV.filter(name => process.env[name] !== undefined);
+    if (present.length)
+        throw new GitSourceContextError('Git source verification requires an explicit checkout; unset repository redirection variables: ' + present.join(', '));
+}
+export function networkRepository(repository) {
+    if (/^(?:\/|\.\.?\/|~\/|[A-Za-z]:[\\/])/.test(repository))
+        return false;
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(repository))
+        return new URL(repository).protocol !== 'file:';
+    return repository.includes(':') && (!repository.includes('/') || repository.indexOf(':') < repository.indexOf('/'));
+}
+function environment() {
+    const env = { ...process.env };
+    // Xec 0.11.2 merges the ambient environment. Refuse repository redirects instead
+    // of pretending that omitting them here isolates a child. User transport remains intact.
+    assertCheckoutEnvironment();
+    // Preserve configured askpass programs (including core.askPass): they may be
+    // noninteractive token providers. Only terminal/GCM interaction is disabled.
+    return { ...env, GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'Never',
+        ...(!env['SSH_ASKPASS'] && env['SSH_ASKPASS_REQUIRE'] === undefined ? { SSH_ASKPASS_REQUIRE: 'never' } : {}),
+        GIT_NO_REPLACE_OBJECTS: '1', GIT_NO_LAZY_FETCH: '1' };
+}
+async function git(checkout, args, signal, stdin = '') {
+    const engine = new ExecutionEngine({ defaultTimeout: 0, adapters: { local: { killSignal: 'SIGKILL' } } });
+    try {
+        const result = await engine.execute({ command: 'git', args: ['--no-replace-objects', '-c', 'http.lowSpeedLimit=1', '-c', 'http.lowSpeedTime=5', ...args],
+            cwd: checkout, env: Object.fromEntries(Object.entries(environment()).filter((entry) => typeof entry[1] === 'string')),
+            signal, stdin, shell: false, adapter: 'local', nothrow: true, maxBuffer: 1024 * 1024 });
+        if (result.exitCode !== 0)
+            throw Error('Git source verification failed');
+        return result.stdout.replace(/\r?\n$/, '');
+    }
+    finally {
+        await engine.dispose();
+    }
+}
+/** Current origin advertisement is evidence; cached tracking refs and another
+ * remote are not. This probe never fetches objects or writes refs. Unknown ancestry,
+ * bounded-out reads and unavailable transport remain unknown instead of becoming false. */
+async function advertisedCommit(checkout, repository, commit, options = {}) {
+    assertCheckoutEnvironment();
+    assertRepositoryIdentity(repository);
+    if (!SHA.test(commit) || options.ref !== undefined && !isFrameworkRef(options.ref))
+        return null;
+    const deadline = AbortSignal.timeout(TIMEOUT);
+    const signal = options.signal ? AbortSignal.any([options.signal, deadline]) : deadline;
+    const ref = options.ref ?? null;
+    try {
+        const tag = ref?.startsWith('refs/tags/') === true;
+        const transport = repository.replace(/^git\+(?=(?:https?|ssh):\/\/)/, '');
+        const output = await git(checkout, ['ls-remote', '--quiet', '--', transport,
+            ...(ref ? [ref, ...(tag ? [ref + '^{}'] : [])] : ['refs/heads/*', 'refs/tags/*'])], signal);
+        const heads = new Set();
+        const advertised = new Map();
+        for (const line of output ? output.split('\n') : []) {
+            const match = /^([a-f0-9]{40}|[a-f0-9]{64})\t(refs\/(?:heads|tags)\/[^\s]+)$/.exec(line);
+            if (!match)
+                return null;
+            const actual = match[2];
+            if (ref && actual !== ref && (!tag || actual !== ref + '^{}') || advertised.has(actual))
+                return null;
+            advertised.set(actual, match[1]);
+        }
+        for (const [name, sha] of advertised) {
+            if (name.endsWith('^{}')) {
+                if (!name.startsWith('refs/tags/') || !advertised.has(name.slice(0, -3)))
+                    return null;
+            }
+            else
+                heads.add(advertised.get(name + '^{}') ?? sha);
+        }
+        if (heads.has(commit))
+            return true;
+        if (heads.size > MAX_HEADS)
+            return null;
+        if (tag)
+            return false; // An explicit release tag selects its exact peeled commit.
+        if (heads.size === 0)
+            return false;
+        // An exact advertised object does not require local history. An ancestry proof
+        // does: old graft files must never turn an unrelated commit into a parent.
+        const grafts = await git(checkout, ['rev-parse', '--git-path', 'info/grafts'], signal);
+        const graft = await fs.stat(path.resolve(checkout, grafts)).catch(error => {
+            if (error.code !== 'ENOENT')
+                throw error;
+            return null;
+        });
+        if (graft && (!graft.isFile() || graft.size > 0))
+            return null;
+        let unknown = (await git(checkout, ['rev-parse', '--is-shallow-repository'], signal)) !== 'false';
+        const objects = await git(checkout, ['cat-file', '--batch-check=%(objectname) %(objecttype)'], signal, [...heads].join('\n') + '\n');
+        const known = [];
+        const rows = objects.split('\n');
+        if (rows.length !== heads.size)
+            return null;
+        for (const row of rows) {
+            const [sha, type] = row.split(' ');
+            if (!sha || !heads.has(sha))
+                return null;
+            if (type === 'commit')
+                known.push(sha);
+            else
+                unknown = true;
+        }
+        if (known.length && await git(checkout, ['rev-list', '--max-count=1', '--ancestry-path', ...known, '--not', commit], signal))
+            return true;
+        return unknown ? null : false;
+    }
+    catch (error) {
+        if (error instanceof GitSourceContextError)
+            throw error;
+        options.signal?.throwIfAborted();
+        return null;
+    }
+}
+/** Publication is a network-origin observation, independent of explicit local-source trust. */
+export async function sourcePublication(checkout, repository, commit, options = {}) {
+    assertCheckoutEnvironment();
+    assertRepositoryIdentity(repository);
+    if (!networkRepository(repository))
+        return repository === '(no origin)' ? null : false;
+    const deadline = AbortSignal.timeout(TIMEOUT);
+    const signal = options.signal ? AbortSignal.any([options.signal, deadline]) : deadline;
+    try {
+        // Git may deliberately route a logical network URL to an offline mirror. Expanded
+        // credential-bearing transport URLs stay private and are never recorded or logged.
+        const transport = repository.replace(/^git\+(?=(?:https?|ssh):\/\/)/, '');
+        const effective = await git(checkout, ['ls-remote', '--get-url', '--', transport], signal);
+        if (!networkRepository(effective))
+            return false;
+        return await advertisedCommit(checkout, repository, commit, { ...options, signal });
+    }
+    catch (error) {
+        if (error instanceof GitSourceContextError)
+            throw error;
+        options.signal?.throwIfAborted();
+        return null;
+    }
+}
+/** An explicitly selected ref is a build constraint, including in offline/local repositories. */
+export async function sourceRefContains(checkout, repository, commit, ref, signal) {
+    if (!isFrameworkRef(ref))
+        throw Error('Framework ref must be a full refs/heads/ or refs/tags/ name');
+    return advertisedCommit(checkout, repository, commit, { ref, ...(signal && { signal }) });
+}
+/** Credential-free recorded identity and an independently checked publication fact. */
+export async function readReleaseSource(checkout, commit) {
+    assertCheckoutEnvironment();
+    const repo = await git(checkout, ['config', '--get-all', 'remote.origin.url'], AbortSignal.timeout(TIMEOUT))
+        .then(value => value.split('\n')[0]).catch(error => { if (error instanceof GitSourceContextError)
+        throw error; return '(no origin)'; });
+    assertRepositoryIdentity(repo);
+    return { repo, commit, onRemote: await sourcePublication(checkout, repo, commit) };
+}
+//# sourceMappingURL=source.js.map

package/dist/release/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/release/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAG/D,MAAM,GAAG,GAAG,iCAAiC,CAAC;AAC9C,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,OAAO,GAAG,MAAM,CAAC;AACvB,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAsB;IAC5G,kCAAkC,EAAE,eAAe,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,gBAAgB,CAAU,CAAC;AAE9H,MAAM,qBAAsB,SAAQ,KAAK;CAAG;AAC5C,SAAS,yBAAyB;IAChC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,iGAAiG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9K,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,oCAAoC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IACtG,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,iFAAiF;IACjF,yFAAyF;IACzF,yBAAyB,EAAE,CAAC;IAC5B,6EAA6E;IAC7E,6EAA6E;IAC7E,OAAO,EAAE,GAAG,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO;QACjE,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,sBAAsB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,QAAgB,EAAE,IAAc,EAAE,MAAmB,EAAE,KAAK,GAAG,EAAE;IAClF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,sBAAsB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC;YACtJ,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YAChJ,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACvC,CAAC;AAED;;2FAE2F;AAC3F,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,UAAkB,EAAE,MAAc,EAClF,OAAO,GAA2C,EAAE;IACpD,yBAAyB,EAAE,CAAC;IAC5B,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,EAAE,UAAU,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;QACnD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS;YACzE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,+DAA+D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzF,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACzB,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YACxF,CAAC;;gBAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,GAAG,SAAS;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC,CAAC,2DAA2D;QAClF,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,+EAA+E;QAC/E,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACxE,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC;QAClG,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,2CAA2C,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACrI,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,IAAI,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;gBAAM,OAAO,GAAG,IAAI,CAAC;QAC9D,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1I,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,KAAK,YAAY,qBAAqB;YAAE,MAAM,KAAK,CAAC;QAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC7H,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,UAAkB,EAAE,MAAc,EAC1F,OAAO,GAA2C,EAAE;IACpD,yBAAyB,EAAE,CAAC;IAC5B,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACvF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvF,IAAI,CAAC;QACH,kFAAkF;QAClF,mFAAmF;QACnF,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3F,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,OAAO,MAAM,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,KAAK,YAAY,qBAAqB;YAAE,MAAM,KAAK,CAAC;QAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC7H,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,UAAkB,EAAE,MAAc,EAAE,GAAW,EACvG,MAAoB;IACpB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACrG,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAc;IACtE,yBAAyB,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,mBAAmB,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;SACzG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,YAAY,qBAAqB;QAAE,MAAM,KAAK,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3I,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AACrF,CAAC"}

package/dist/release/store.d.ts

@@ -16,14 +16,17 @@
 import { type StoredAttestation } from './attest.js';
 import { releasesRoot } from './load.js';
 import type { GateOutcome, ReleaseManifest } from './manifest.js';
+import type { ArtifactSourceReading } from '../shared/dto/releases.js';
 export { releasesRoot };
 /** One release, as a list shows it. */
 export interface ReleaseSummary {
     readonly id: string;
     /** The project it was built for, read back out of the id. */
     readonly project: string;
-    /** False when the directory holds no manifest: a build that did not finish. */
+    /** True only for readable recorded metadata; manifestError distinguishes refusal from absence. */
     readonly complete: boolean;
+    /** Present when recorded metadata was refused, rather than absent from an unfinished build. */
+    readonly manifestError?: string;
     readonly builtAt: string | null;
     readonly builtBy: string | null;
     /** The omnitron that packed it — version and the omni commit it ran from. */
@@ -32,7 +35,7 @@ export interface ReleaseSummary {
     readonly omniCommit: string | null;
     readonly projectRepo: string | null;
     readonly omniRepo: string | null;
-    /** Whether each commit is on a remote branch: `null` — there was no remote to ask. */
+    /** Recorded source publication; null means it could not be verified, not that it is unpublished. */
     readonly onRemote: {
         project: boolean | null;
         omni: boolean | null;
@@ -97,6 +100,10 @@ export interface ReleaseSummary {
 /** A release in full, for one screen: the manifest, plus what is beside it. */
 export interface ReleaseDetail extends ReleaseSummary {
     readonly manifest: ReleaseManifest | null;
+    /** Digest of the exact bytes read for this detail; older daemons omit it. */
+    readonly manifestSha256?: string | null;
+    /** Optional when read from an older daemon; imported sources must never fall back to the consumer. */
+    readonly artifactSources?: readonly ArtifactSourceReading[];
     readonly logs: ReadonlyArray<{
         name: string;
         bytes: number;
@@ -105,15 +112,17 @@ export interface ReleaseDetail extends ReleaseSummary {
     /** What each stack measured about this release after carrying it. */
     readonly attestations: readonly StoredAttestation[];
 }
-/** `daos-202609221432-81c8a074-c64963f6` → `daos`; a name may hold dashes too. */
+/** `sample-202609221432-81c8a074-c64963f6` → `sample`; a name may hold dashes too. */
 export declare function projectOfId(id: string): string;
 /** Bytes under a directory. Unreadable or absent counts as zero, not as a failure. */
 export declare function dirBytes(dir: string): number;
+/** One bounded interpretation shared by CLI JSON/text and Console detail. Archive verification
+ * remains part of loadRelease at admission; this view does not claim a process is running it. */
+export declare function readArtifactSources(manifest: ReleaseManifest): readonly ArtifactSourceReading[];
 /** Every release on this machine, newest build first; unfinished ones last. */
 export declare function listReleases(root?: string): ReleaseSummary[];
 /**
- * One release's manifest, unchecked — or null when there is none: not built
- * here, pruned, or a build that did not finish.
+ * One release's manifest, structurally checked — or null when absent or unsafe.
  *
  * For comparing what a release says with what another one says, which needs
  * neither the sizes of the directory nor a sha256 of its tarballs.

package/dist/release/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/release/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACrE;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtH;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvF,QAAQ,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzE,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChG;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACrD;AAED,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C;AA4CD,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuB5C;AA+DD,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAuB,GAAG,cAAc,EAAE,CAW5E;AAOD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,eAAe,GAAG,IAAI,CAErG;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,aAAa,CAe1F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,SAAM,EACX,IAAI,GAAE,MAAuB,GAC5B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAU/C;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnF,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3F,WAAW,CAuBb"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/release/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGlE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACrE;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtH;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvF,QAAQ,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzE,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChG;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,sGAAsG;IACtG,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACrD;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C;AA4CD,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuB5C;AAwFD;iGACiG;AACjG,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,qBAAqB,EAAE,CAY/F;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAuB,GAAG,cAAc,EAAE,CAc5E;AAOD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,eAAe,GAAG,IAAI,CAErG;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,aAAa,CAgB1F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,SAAM,EACX,IAAI,GAAE,MAAuB,GAC5B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAU/C;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnF,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3F,WAAW,CAuBb"}