@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/release/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/release/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC1E,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3F;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,qEAAqE;QACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5D,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACrF;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAa5D;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,kBAAkB;AAC1B,0DAA0D;AAC1D,YAAY,GAAE,SAAS,gBAAgB,EAAO,GAC7C,eAAe,CA6FjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gEAAgE;IAChE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACpF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,YAAY,EAAE,wBAAwB,GAAG,SAAS,EAClD,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,YAAY,GAAE,SAAS,gBAAgB,EAAO,GAC7C,eAAe,CA2BjB"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/release/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,qGAAqG;AACrG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACnC,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uCAAuC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;kFAC8E;IAC9E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACjE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,CAAC;CAC5C;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC1E,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IAC9D,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3F;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oGAAoG;IACpG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9I,CAAC;IACF,2GAA2G;IAC3G,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC1I,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,+GAA+G;IAC/G,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,qEAAqE;QACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5D,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACrF;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAa5D;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,kBAAkB;AAC1B,0DAA0D;AAC1D,YAAY,GAAE,SAAS,gBAAgB,EAAO,GAC7C,eAAe,CA0GjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gEAAgE;IAChE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACpF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,YAAY,EAAE,wBAAwB,GAAG,SAAS,EAClD,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,YAAY,GAAE,SAAS,gBAAgB,EAAO,GAC7C,eAAe,CAkCjB"}

package/dist/release/manifest.js

@@ -14,11 +14,8 @@
  *     `@omnitron-dev/omnitron`, which the trail does not record at all, so
  *     «what is running there» cannot be answered from the row that says a
  *     deployment happened;
- *   - `sample` carries a 310-line GitHub Actions workflow and lives on a
- *     GitLab server, with no runner and no `.gitlab-ci.yml`, so the guard
- *     rail its own docblock describes — typecheck, lint, unit and
- *     integration — has never run anywhere but on somebody's laptop, when
- *     they remembered.
+ *   - a project carries checks for a CI provider it does not use, so the
+ *     expected typecheck, lint and tests never run on its release path.
  *
  * A release is the answer to all three: one object, built from a named
  * commit of BOTH repositories in a clean clone, carrying the artifacts by
@@ -33,6 +30,7 @@
  * repository does not live on. «Every required gate ran and passed» is
  * satisfied by none of those.
  */
+import { importedReleaseRefusal } from './origin.js';
 const SHA256 = /^[0-9a-f]{64}$/;
 /** How each non-pass reads in a refusal: which one it was is the finding. */
 const OUTCOME_WORDS = {
@@ -61,6 +59,22 @@ attestations = []) {
         // without this commit cannot be rebuilt and cannot be compared.
         return { action: 'refuse', because: 'the release does not name the omni commit its packages came from' };
     }
+    try {
+        const refusal = importedReleaseRefusal(manifest, policy.requiredApps);
+        if (refusal)
+            return { action: 'refuse', because: refusal };
+    }
+    catch (error) {
+        return { action: 'refuse', because: 'invalid imported release: ' + (error instanceof Error ? error.message : String(error)) };
+    }
+    const names = new Set();
+    if (!Array.isArray(manifest.gates) || manifest.gates.some(gate => {
+        if (!gate || typeof gate.name !== 'string' || !gate.name || names.has(gate.name) || !Object.hasOwn(OUTCOME_WORDS, gate.status))
+            return true;
+        names.add(gate.name);
+        return false;
+    }))
+        return { action: 'refuse', because: 'the release carries invalid or duplicate gate outcomes' };
     const byName = new Map(manifest.gates.map((g) => [g.name, g]));
     for (const required of policy.requiredGates) {
         const gate = byName.get(required);
@@ -150,6 +164,14 @@ attestations = []) {
  * config, where a reader can see it.
  */
 export function decideStackRelease(manifest, requirements, stackApps, attestations = []) {
+    try {
+        const refusal = requirements?.requireOnRemote ? importedReleaseRefusal(manifest, stackApps, true) : null;
+        if (refusal)
+            return { action: 'refuse', because: refusal };
+    }
+    catch (error) {
+        return { action: 'refuse', because: 'invalid imported release: ' + (error instanceof Error ? error.message : String(error)) };
+    }
     if (requirements?.requireOnRemote) {
         const local = [
             manifest.project.onRemote !== true ? `the project commit ${manifest.project.commit.slice(0, 8)}` : null,
@@ -158,11 +180,13 @@ export function decideStackRelease(manifest, requirements, stackApps, attestatio
         if (local.length > 0) {
             return {
                 action: 'refuse',
-                because: `${local.join(' and ')} ${local.length > 1 ? 'are' : 'is'} on no remote branch — nobody else could rebuild this release`,
+                because: `Source publication is not confirmed in this release for ${local.join(' and ')} — publish the commits and rebuild with a reachable origin`,
             };
         }
     }
-    const recorded = manifest.gates.map((g) => g.name);
+    if (!Array.isArray(manifest.gates))
+        return { action: 'refuse', because: 'the release carries invalid gate outcomes' };
+    const recorded = manifest.gates.map((g) => g?.name);
     if (recorded.length === 0) {
         return { action: 'refuse', because: 'the release recorded no gates at all' };
     }

package/dist/release/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/release/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA4MH,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,aAAa,GAA0C;IAC3D,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,aAAa;IACxB,WAAW,EAAE,wBAAwB;IACrC,MAAM,EAAE,+BAA+B;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAyB,EACzB,MAA0B;AAC1B,0DAA0D;AAC1D,YAAY,GAAgC,EAAE;IAE9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3B,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,QAAQ,2CAA2C,EAAE,CAAC;QACzG,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,gBAAgB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACtF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,kCAAkC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACxG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,oEAAoE;YACpE,kEAAkE;YAClE,sEAAsE;YACtE,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,2BAA2B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACjG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wCAAwC,GAAG,GAAG,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,8BAA8B,EAAE,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,oBAAoB,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,oDAAoD,KAAK,+DAA+D;aAClI,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,QAAQ,+CAA+C,KAAK,GAAG,EAAE,CAAC;YAC5G,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,IAAI,QAAQ,KAAK,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,KAAK,GAAG;wBACvF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EACL,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,2BAA2B;YACzD,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,sBAAsB;YACnD,CAAC,MAAM,CAAC,UAAU;gBAChB,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,iBAAiB,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG;gBAChF,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC;AAkCD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,YAAkD,EAClD,SAA4B,EAC5B,YAAY,GAAgC,EAAE;IAE9C,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG;YACZ,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YACvG,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;SAC/F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,+DAA+D;aAClI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,aAAa,CAClB,QAAQ,EACR;QACE,aAAa;QACb,YAAY,EAAE,SAAS;QACvB,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,EACD,YAAY,CACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/release/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAqRrD,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,aAAa,GAA0C;IAC3D,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,aAAa;IACxB,WAAW,EAAE,wBAAwB;IACrC,MAAM,EAAE,+BAA+B;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAyB,EACzB,MAA0B;AAC1B,0DAA0D;AAC1D,YAAY,GAAgC,EAAE;IAE9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3B,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IAC3G,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAChI,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC/D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5I,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;IACnG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,QAAQ,2CAA2C,EAAE,CAAC;QACzG,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,gBAAgB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACtF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,kCAAkC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACxG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,oEAAoE;YACpE,kEAAkE;YAClE,sEAAsE;YACtE,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,2BAA2B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACjG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wCAAwC,GAAG,GAAG,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,8BAA8B,EAAE,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,oBAAoB,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,oDAAoD,KAAK,+DAA+D;aAClI,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,QAAQ,+CAA+C,KAAK,GAAG,EAAE,CAAC;YAC5G,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,IAAI,QAAQ,KAAK,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,KAAK,GAAG;wBACvF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EACL,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,2BAA2B;YACzD,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,sBAAsB;YACnD,CAAC,MAAM,CAAC,UAAU;gBAChB,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,iBAAiB,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG;gBAChF,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC;AAkCD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,YAAkD,EAClD,SAA4B,EAC5B,YAAY,GAAgC,EAAE;IAE9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzG,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAChI,CAAC;IACD,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG;YACZ,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YACvG,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;SAC/F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,2DAA2D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,4DAA4D;aACpJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACtH,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,aAAa,CAClB,QAAQ,EACR;QACE,aAAa;QACb,YAAY,EAAE,SAAS;QACvB,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,EACD,YAAY,CACb,CAAC;AACJ,CAAC"}

package/dist/release/migration-programs.d.ts

@@ -0,0 +1,12 @@
+import type { IEcosystemConfig } from '../config/types.js';
+import { type MigrationRequest } from '../services/migration-target.js';
+export type MigrationProgramInput = Pick<MigrationRequest, 'mode' | 'source' | 'release'>;
+export type PackedMigrationProgram = MigrationProgramInput & {
+    releaseSha256: string;
+};
+/** Reuse the deployment declaration policy. A file's spelling does not decide
+ * whether it owns a migration registry. No application or migration code runs. */
+export declare function declaredMigrationPrograms(config: IEcosystemConfig, forStack?: string): ReadonlyMap<string, readonly MigrationProgramInput[]>;
+/** Read the actual staged bytes before packing, never a later mutable dist. */
+export declare function packedMigrationPrograms(root: string, programs: readonly MigrationProgramInput[]): Promise<PackedMigrationProgram[]>;
+//# sourceMappingURL=migration-programs.d.ts.map

package/dist/release/migration-programs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-programs.d.ts","sourceRoot":"","sources":["../../src/release/migration-programs.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,OAAO,EAAgD,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGtH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;AAC1F,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF;kFACkF;AAClF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAqB5I;AAED,+EAA+E;AAC/E,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,qBAAqB,EAAE,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAQzI"}

package/dist/release/migration-programs.js

@@ -0,0 +1,45 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs/promises';
+import { expandServiceDeclarations } from '../infrastructure/config-normalizer.js';
+import { mergeInfrastructure } from '../infrastructure/merge-config.js';
+import { createDefaultRegistry } from '../infrastructure/presets/index.js';
+import { requestedMigrations, validateMigrationOwners } from '../services/migration-target.js';
+import { frozenMember } from './frozen-installation.js';
+/** Reuse the deployment declaration policy. A file's spelling does not decide
+ * whether it owns a migration registry. No application or migration code runs. */
+export function declaredMigrationPrograms(config, forStack) {
+    const stacks = config.stacks ?? {};
+    if (forStack && !Object.hasOwn(stacks, forStack))
+        throw Error('Unknown release migration stack: ' + forStack);
+    const scopes = forStack ? [stacks[forStack]] : Object.values(stacks);
+    if (!scopes.length)
+        scopes.push({ type: 'local', apps: 'all' });
+    const result = new Map();
+    for (const stack of scopes) {
+        const services = expandServiceDeclarations(mergeInfrastructure(config, stack) ?? {}, createDefaultRegistry());
+        const requests = requestedMigrations(services);
+        const apps = config.apps.filter(app => app.enabled !== false && (!Array.isArray(stack.apps) || stack.apps.includes(app.name)));
+        validateMigrationOwners(requests, apps);
+        for (const { app, mode, source, release } of requests) {
+            const programs = result.get(app) ?? [];
+            const prior = programs.find(p => p.release === release);
+            if (prior && (prior.source !== source || prior.mode !== mode))
+                throw Error('Conflicting declared migration source for ' + app + '/' + release);
+            if (!prior)
+                programs.push({ mode, source, release });
+            result.set(app, programs);
+        }
+    }
+    return result;
+}
+/** Read the actual staged bytes before packing, never a later mutable dist. */
+export async function packedMigrationPrograms(root, programs) {
+    const result = [];
+    for (const program of programs) {
+        const file = await frozenMember(root, program.release);
+        const bytes = await fs.readFile(file);
+        result.push({ ...program, releaseSha256: createHash('sha256').update(bytes).digest('hex') });
+    }
+    return result;
+}
+//# sourceMappingURL=migration-programs.js.map

package/dist/release/migration-programs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-programs.js","sourceRoot":"","sources":["../../src/release/migration-programs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAyB,MAAM,iCAAiC,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD;kFACkF;AAClF,MAAM,UAAU,yBAAyB,CAAC,MAAwB,EAAE,QAAiB;IACnF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,MAAM,KAAK,CAAC,mCAAmC,GAAG,QAAQ,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/H,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YACxD,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;gBAC3D,MAAM,KAAK,CAAC,4CAA4C,GAAG,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,QAA0C;IACpG,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/release/migrations.d.ts

@@ -22,11 +22,22 @@
  * added before it failed; those are not compared here, and the node's
  * migrator stays their judge.
  */
-/** Every tracked migration file under `dir`: repository path → sha256 of its bytes. */
+import type { ReleaseManifest, ReleasePackageSource } from './manifest.js';
+import type { PackedMigrationProgram } from './migration-programs.js';
+export declare function releaseMigrationSources(workspace: string, commit: string, packageDirectories: readonly string[], programs?: readonly (PackedMigrationProgram & {
+    directory: string;
+})[]): Promise<{
+    migrations: Record<string, string>;
+    packages: Map<string, ReleasePackageSource>;
+}>;
+/** Existing workspace inventory, also used by release admission for older releases. */
 export declare function migrationDigests(dir: string): Promise<Record<string, string>>;
 /**
  * The migrations that ran with `deployed` and are not the same in
  * `candidate`: edited, or gone. Added ones are not listed.
  */
 export declare function changedReleasedMigrations(deployed: Readonly<Record<string, string>>, candidate: Readonly<Record<string, string>>): string[];
+/** A consumer's workspace migration map cannot describe another producer's
+ * schema history. Compare the physical package that supplied each retained app. */
+export declare function changedImportedMigrations(deployed: ReleaseManifest, candidate: ReleaseManifest, apps: readonly string[]): string[];
 //# sourceMappingURL=migrations.d.ts.map

package/dist/release/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/release/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAaH,uFAAuF;AACvF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOnF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC1C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,MAAM,EAAE,CAIV"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/release/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAoBtE,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACpH,QAAQ,GAAE,SAAS,CAAC,sBAAsB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAAO,GAAG,OAAO,CAAC;IACrF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CACjF,CAAC,CAoED;AAED,uFAAuF;AACvF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAGnF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC1C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,MAAM,EAAE,CAIV;AAED;mFACmF;AACnF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAqBlI"}

package/dist/release/migrations.js

@@ -27,17 +27,107 @@ import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
+import { artifactReleaseContexts } from './origin.js';
+import { migrationEntryPath } from '../services/migration-target.js';
 const exec = promisify(execFile);
-/** A tracked file inside a `migrations` directory of an app. */
-const MIGRATION = /^apps\/[^/]+\/(?:.+\/)?migrations\/[^/]+\.(?:ts|mts|js|mjs|sql)$/;
-/** Every tracked migration file under `dir`: repository path → sha256 of its bytes. */
-export async function migrationDigests(dir) {
-    const { stdout } = await exec('git', ['ls-files', '-z', '--', 'apps'], { cwd: dir, maxBuffer: 64 * 1024 * 1024 });
-    const out = {};
-    for (const file of stdout.split('\0').filter((f) => MIGRATION.test(f)).sort()) {
-        out[file] = createHash('sha256').update(fs.readFileSync(path.join(dir, file))).digest('hex');
+/** Migration filenames the existing stack admission policy recognizes. */
+const MIGRATION = /(?:^|\/)migrations\/[^/]+\.(?:ts|mts|js|mjs|sql)$/;
+/** Read a tracked regular file as it exists in the checked-out package, and prove
+ * its bytes against the named Git object. Gates and builds can change a checkout. */
+function checkedBlob(root, file, mode, object) {
+    const full = path.join(root, file);
+    if (!/^100(?:644|755)$/.test(mode) || fs.realpathSync(full) !== full || !fs.lstatSync(full).isFile())
+        throw Error('Release source must be a physical tracked file: ' + file);
+    const bytes = fs.readFileSync(full);
+    const oid = createHash(object.length === 64 ? 'sha256' : 'sha1')
+        .update('blob ' + bytes.length + '\0').update(bytes).digest('hex');
+    if (oid !== object)
+        throw Error('Release source differs from its Git commit: ' + file);
+    return bytes;
+}
+export async function releaseMigrationSources(workspace, commit, packageDirectories, programs = []) {
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(commit))
+        throw Error('Expected the full release source commit');
+    const root = fs.realpathSync((await exec('git', ['rev-parse', '--show-toplevel'], { cwd: workspace })).stdout.trimEnd());
+    const physicalWorkspace = fs.realpathSync(workspace);
+    const prefix = path.relative(root, physicalWorkspace).split(path.sep).join('/');
+    const declared = new Set();
+    for (const program of programs) {
+        if (!packageDirectories.includes(program.directory) || !['config', 'script'].includes(program.mode) ||
+            typeof program.releaseSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(program.releaseSha256))
+            throw Error('Invalid packed migration program');
+        migrationEntryPath(program.source, 'source');
+        migrationEntryPath(program.release, 'release');
+        if (!/\.[cm]?js$/.test(program.release))
+            throw Error('A released migration must name a compiled JavaScript module');
+        declared.add(path.posix.join(prefix, program.directory, program.source));
+    }
+    const { stdout } = await exec('git', ['--no-replace-objects', '--literal-pathspecs', 'ls-tree', '-r', '-z', '--full-tree',
+        commit, '--', prefix || '.'], { cwd: root, maxBuffer: 64 * 1024 * 1024 });
+    const files = new Map();
+    for (const record of stdout.split('\0').filter(Boolean)) {
+        const tab = record.indexOf('\t'), [mode, kind, oid] = record.slice(0, tab).split(' ');
+        const file = record.slice(tab + 1);
+        if (kind === 'blob' && (path.posix.basename(file) === 'package.json' || MIGRATION.test(file) || declared.has(file)))
+            files.set(file, { mode: mode, oid: oid });
+    }
+    const packages = new Map();
+    const owned = new Map();
+    for (const input of new Set(packageDirectories)) {
+        const directory = input.split(path.sep).join('/');
+        if (directory !== '.' && directory.split('/').some(p => !p || p === '.' || p === '..' || /[\\:\0]/.test(p)))
+            throw Error('Invalid release package directory: ' + input);
+        const pkg = path.posix.join(prefix, directory), file = path.posix.join(pkg, 'package.json'), tracked = files.get(file);
+        if (!tracked)
+            throw Error('Compiled package has no tracked package.json: ' + file);
+        checkedBlob(root, file, tracked.mode, tracked.oid);
+        const migrations = {};
+        owned.set(pkg, migrations);
+        packages.set(input, { directory: pkg, manifestBlob: tracked.oid, migrations });
+    }
+    const migrations = {};
+    const packageOf = (file) => {
+        let owner = path.posix.dirname(file);
+        while (owner !== '.' && !files.has(path.posix.join(owner, 'package.json')))
+            owner = path.posix.dirname(owner);
+        return owner;
+    };
+    for (const [file, blob] of files) {
+        if (!MIGRATION.test(file))
+            continue;
+        // Attribute a file to its nearest tracked package, even if that nested
+        // package is not among the applications selected for this release.
+        const owner = packageOf(file);
+        const scoped = owned.get(owner);
+        const workspaceFile = prefix ? file.slice(prefix.length + 1) : file;
+        const stackFile = /^apps\/[^/]+\/(?:.+\/)?migrations\//.test(workspaceFile);
+        if (!scoped && !stackFile)
+            continue;
+        const digest = createHash('sha256').update(checkedBlob(root, file, blob.mode, blob.oid)).digest('hex');
+        if (scoped)
+            scoped[path.posix.relative(owner, file)] = digest;
+        migrations[workspaceFile] = digest;
     }
-    return out;
+    for (const program of programs) {
+        const source = packages.get(program.directory);
+        const file = path.posix.join(source.directory, program.source), blob = files.get(file);
+        if (!blob || packageOf(file) !== source.directory)
+            throw Error('Declared migration source is not tracked by its owning package: ' + file);
+        const sourceSha256 = createHash('sha256').update(checkedBlob(root, file, blob.mode, blob.oid)).digest('hex');
+        const entry = { mode: program.mode, source: program.source, sourceBlob: blob.oid, sourceSha256,
+            release: program.release, releaseSha256: program.releaseSha256 };
+        const previous = source.migrationPrograms?.find(p => p.release === entry.release);
+        if (previous && JSON.stringify(previous) !== JSON.stringify(entry))
+            throw Error('Conflicting migration program provenance: ' + file);
+        if (!previous)
+            packages.set(program.directory, { ...source, migrationPrograms: [...(source.migrationPrograms ?? []), entry] });
+    }
+    return { migrations, packages };
+}
+/** Existing workspace inventory, also used by release admission for older releases. */
+export async function migrationDigests(dir) {
+    const { stdout } = await exec('git', ['rev-parse', 'HEAD'], { cwd: dir });
+    return (await releaseMigrationSources(dir, stdout.trim(), [])).migrations;
 }
 /**
  * The migrations that ran with `deployed` and are not the same in
@@ -48,4 +138,29 @@ export function changedReleasedMigrations(deployed, candidate) {
         .filter((file) => candidate[file] !== deployed[file])
         .sort();
 }
+/** A consumer's workspace migration map cannot describe another producer's
+ * schema history. Compare the physical package that supplied each retained app. */
+export function changedImportedMigrations(deployed, candidate, apps) {
+    const changes = [];
+    const oldSources = new Map(artifactReleaseContexts(deployed).map(source => [source.app, source]));
+    const newSources = new Map(artifactReleaseContexts(candidate).map(source => [source.app, source]));
+    for (const app of apps) {
+        const previous = deployed.artifacts.find(artifact => artifact.app === app);
+        const next = candidate.artifacts.find(artifact => artifact.app === app);
+        if (!previous || !next || (!previous.origin && !next.origin))
+            continue;
+        const before = oldSources.get(app), after = newSources.get(app);
+        const oldPackage = before.artifact.packageSource, newPackage = after.artifact.packageSource;
+        if (!oldPackage || !newPackage) {
+            changes.push(app + ': migration provenance is unavailable for one of the producer packages');
+            continue;
+        }
+        if (Object.keys(oldPackage.migrations).length && (before.manifest.project.repo !== after.manifest.project.repo || oldPackage.directory !== newPackage.directory)) {
+            changes.push(app + ': the package that owns existing migrations changed');
+            continue;
+        }
+        changes.push(...changedReleasedMigrations(oldPackage.migrations, newPackage.migrations).map(file => app + '/' + file));
+    }
+    return changes;
+}
 //# sourceMappingURL=migrations.js.map

package/dist/release/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/release/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,gEAAgE;AAChE,MAAM,SAAS,GAAG,kEAAkE,CAAC;AAErF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAClH,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA0C,EAC1C,SAA2C;IAE3C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;SACpD,IAAI,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/release/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,0EAA0E;AAC1E,MAAM,SAAS,GAAG,mDAAmD,CAAC;AAEtE;qFACqF;AACrF,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,MAAc;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;QAClG,MAAM,KAAK,CAAC,kDAAkD,GAAG,IAAI,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;SAC7D,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,KAAK,CAAC,8CAA8C,GAAG,IAAI,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAiB,EAAE,MAAc,EAAE,kBAAqC,EACpH,QAAQ,GAAgE,EAAE;IAG1E,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzH,MAAM,iBAAiB,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAC/F,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5F,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAClD,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACpH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa;QACvH,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,cAAc,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjH,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAK,EAAE,GAAG,EAAE,GAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzG,MAAM,KAAK,CAAC,qCAAqC,GAAG,KAAK,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvH,IAAI,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,gDAAgD,GAAG,IAAI,CAAC,CAAC;QACnF,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE;QACjC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9G,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,MAAM,SAAS,GAAG,qCAAqC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,SAAS;QACpC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvG,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC;QAC9D,UAAU,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAE,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS;YAC/C,MAAM,KAAK,CAAC,kEAAkE,GAAG,IAAI,CAAC,CAAC;QACzF,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7G,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY;YAC5F,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;QAClF,IAAI,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;QACrI,IAAI,CAAC,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA0C,EAC1C,SAA2C;IAE3C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;SACpD,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,yBAAyB,CAAC,QAAyB,EAAE,SAA0B,EAAE,IAAuB;IACtH,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,EAAE,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAClE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5F,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,wEAAwE,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjK,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,qDAAqD,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/release/origin.d.ts

@@ -0,0 +1,33 @@
+import type { ReleaseArtifact, ReleaseArtifactReference, ReleaseManifest } from './manifest.js';
+import { type ReleaseArtifactOrigin } from './installed-origin.js';
+/** The outer manifest includes JSON-escaped producer evidence, bounded separately below. */
+export declare const MAX_RELEASE_MANIFEST_BYTES = 8388608;
+/** Safe to display as recorded evidence. Empty checksums and zero-byte artifacts stay
+ * readable so admission can explain their refusal; readability never grants admission. */
+export declare function isReadableReleaseManifest(value: unknown): value is ReleaseManifest;
+export declare function assertReleaseArtifactReference(value: unknown): asserts value is ReleaseArtifactReference;
+export interface ArtifactReleaseContext {
+    /** The actual producer of these bytes, never the consumer's source or SDK. */
+    readonly manifest: ReleaseManifest;
+    readonly artifact: ReleaseArtifact;
+    /** Ordered from the direct dependency to the original producer. */
+    readonly chain: readonly ReleaseArtifactReference[];
+}
+/** An import is an independently portable application, not a claim inferred from a legacy tar. */
+export declare function assertImportableArtifact(manifest: ReleaseManifest, artifact: ReleaseArtifact): void;
+/** Shared by build, admission, receipts and diagnostics. No application JavaScript executes. */
+export declare function artifactReleaseContext(manifest: ReleaseManifest, app: string): ArtifactReleaseContext;
+/** Every origin must resolve, including artifacts outside the currently selected stack. */
+export declare function artifactReleaseContexts(manifest: ReleaseManifest): ReadonlyArray<ArtifactReleaseContext & {
+    readonly app: string;
+}>;
+/** One receipt mapping for local installation and remote delivery. Imported bytes
+ * always retain the original producer; only the launch alias belongs to the consumer. */
+export declare function releaseArtifactOrigins(manifest: ReleaseManifest, manifestSha256: string): ReadonlyArray<ArtifactReleaseContext & {
+    readonly app: string;
+    readonly origin: ReleaseArtifactOrigin;
+}>;
+export declare function validateReleaseOrigins(manifest: ReleaseManifest): void;
+/** Dependencies are independent releases: consumer gates never stand in for producer gates. */
+export declare function importedReleaseRefusal(manifest: ReleaseManifest, apps: readonly string[], requireOnRemote?: boolean): string | null;
+//# sourceMappingURL=origin.d.ts.map

package/dist/release/origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/release/origin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChG,OAAO,EAAe,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAShF,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,UAAY,CAAC;AAQpD;0FAC0F;AAC1F,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CA8BlF;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,wBAAwB,CAMxG;AAED,MAAM,WAAW,sBAAsB;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACrD;AAuED,kGAAkG;AAClG,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAYnG;AAmBD,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAErG;AAED,2FAA2F;AAC3F,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,aAAa,CAAC,sBAAsB,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAOnI;AAED;yFACyF;AACzF,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,GACtF,aAAa,CAAC,sBAAsB,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAqBzG;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAEtE;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,eAAe,UAAQ,GAAG,MAAM,GAAG,IAAI,CAuBjI"}