@planu/cli 4.14.1 → 5.1.1

package/dist/engine/validation/validation-freshness.js

@@ -50,6 +50,7 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
+/* eslint-disable max-lines, no-param-reassign -- watcher lifecycle remains co-located and owns one mutable state machine per epoch */
 import { createHash, randomUUID } from 'node:crypto';
 import { constants, watch } from 'node:fs';
 import { lstat, mkdir, open, readdir } from 'node:fs/promises';
@@ -59,32 +60,76 @@ import { resolveStorageLayout } from '../../storage/storage-layout.js';
 import { ValidationReceiptStore } from './validation-receipt.js';
 import { isValidationSourcePath } from './validation-source-policy.js';
 import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
-import { gitSourceTreeDigest } from './durable-validation.js';
-const LEASE_TTL_MS = 35 * 60 * 1_000;
+import { gitSourceTreeDigest } from './validation-source-digest.js';
+import { getRuntimePolicy } from '../runtime-policy.js';
 const MAX_EVIDENCE_FILE_BYTES = 2 * 1024 * 1024;
 const FINGERPRINT_CHUNK_BYTES = 64 * 1024;
 const EVIDENCE_FILE = /^(?:discovery|task-plan|traceability-matrix|contract-validation-(?:api|graphql|event|ui|mcp))\.json$/u;
 const active = new Map();
+const beginQueues = new Map();
 function key(projectId, specId) {
     return `${projectId}:${specId}`;
 }
-function invalidateState(projectId, specId, state) {
-    const invalidating = state.invalidating.then(async () => {
-        const env_1 = { stack: [], error: void 0, hasError: false };
-        try {
-            const database = __addDisposableResource(env_1, new RuntimeDatabase({ path: resolveStorageLayout().runtimeDatabase }), false);
-            const store = new ValidationReceiptStore({ database, workspaceId: 'global' });
-            await store.invalidateCurrentBindings(projectId, specId);
-        }
-        catch (e_1) {
-            env_1.error = e_1;
-            env_1.hasError = true;
-        }
-        finally {
-            __disposeResources(env_1);
+async function invalidateDurably(projectId, specId) {
+    const env_1 = { stack: [], error: void 0, hasError: false };
+    try {
+        const database = __addDisposableResource(env_1, new RuntimeDatabase({
+            path: resolveStorageLayout().runtimeDatabase,
+            checkIntegrity: false,
+        }), false);
+        const store = new ValidationReceiptStore({ database, workspaceId: 'global' });
+        await store.invalidateCurrentBindings(projectId, specId);
+    }
+    catch (e_1) {
+        env_1.error = e_1;
+        env_1.hasError = true;
+    }
+    finally {
+        __disposeResources(env_1);
+    }
+}
+async function invalidateDurablyWithCanonicalIntegrity(projectId, specId) {
+    const env_2 = { stack: [], error: void 0, hasError: false };
+    try {
+        const database = __addDisposableResource(env_2, new RuntimeDatabase({ path: resolveStorageLayout().runtimeDatabase }), false);
+        const store = new ValidationReceiptStore({ database, workspaceId: 'global' });
+        await store.invalidateCurrentBindings(projectId, specId);
+    }
+    catch (e_2) {
+        env_2.error = e_2;
+        env_2.hasError = true;
+    }
+    finally {
+        __disposeResources(env_2);
+    }
+}
+function runInvalidationTurn(projectId, specId, state) {
+    if (state.running) {
+        return;
+    }
+    state.running = true;
+    state.dirty = false;
+    const turn = state.invalidating.then(async () => {
+        await invalidateDurably(projectId, specId);
+    });
+    state.invalidating = turn
+        .catch((error) => {
+        state.healthy = false;
+        reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
+    })
+        .finally(() => {
+        state.running = false;
+        if (state.dirty && state.accepting && !state.coalesceTimer) {
+            const delay = getRuntimePolicy().validation.freshnessInvalidationCoalesceMs;
+            state.coalesceTimer = setTimeout(() => {
+                state.coalesceTimer = undefined;
+                if (state.accepting && active.get(key(projectId, specId)) === state) {
+                    runInvalidationTurn(projectId, specId, state);
+                }
+            }, delay);
+            state.coalesceTimer.unref();
         }
     });
-    return { ...state, generation: state.generation + 1, bindings: undefined, invalidating };
 }
 /**
  * Invalidate the active validation lease for a spec.
@@ -95,10 +140,13 @@ function invalidateState(projectId, specId, state) {
 export function invalidateValidationFreshness(input) {
     const identity = key(input.projectId, input.specId);
     const state = active.get(identity);
-    if (!state) {
+    if (!state?.accepting) {
         return false;
     }
-    active.set(identity, invalidateState(input.projectId, input.specId, state));
+    state.generation += 1;
+    state.bindings = undefined;
+    state.dirty = true;
+    runInvalidationTurn(input.projectId, input.specId, state);
     return true;
 }
 function startWatch(path, relevant, onRelevantChange, onError) {
@@ -115,6 +163,7 @@ function startWatch(path, relevant, onRelevantChange, onError) {
             }
         });
         watcher.on('error', onError);
+        watcher.unref();
         return watcher;
     }
     catch (error) {
@@ -187,70 +236,145 @@ async function evidenceFingerprint(path) {
     return hash.digest('hex');
 }
 /** Start both watchers before snapshotting and invalidate any older receipt immediately. */
+// eslint-disable-next-line max-lines-per-function -- serialized setup and rollback form one auditable ownership boundary
 export async function beginValidationFreshnessBarrier(input) {
     const identity = key(input.projectId, input.specId);
-    await mkdir(input.handoffPath, { recursive: true, mode: 0o700 });
-    const initialEvidenceFingerprint = await evidenceFingerprint(input.handoffPath);
-    active.get(identity)?.watchers.forEach((watcher) => {
-        watcher.close();
+    const predecessor = beginQueues.get(identity) ?? Promise.resolve();
+    let release;
+    const queued = new Promise((resolve) => {
+        release = resolve;
     });
-    let state = {
-        epoch: randomUUID(),
-        expiresAt: Date.now() + LEASE_TTL_MS,
-        generation: 0,
-        healthy: true,
-        projectPath: input.projectPath,
-        handoffPath: input.handoffPath,
-        evidenceFingerprint: initialEvidenceFingerprint,
-        invalidating: Promise.resolve(),
-        watchers: [],
-    };
-    const watchedEpoch = state.epoch;
-    const changed = () => {
-        if (active.get(identity)?.epoch !== watchedEpoch) {
-            return;
+    const tail = predecessor.then(() => queued);
+    beginQueues.set(identity, tail);
+    await predecessor;
+    try {
+        const previous = active.get(identity);
+        if (previous) {
+            await closeValidationFreshnessLease({
+                projectId: input.projectId,
+                specId: input.specId,
+                epoch: previous.epoch,
+            });
         }
-        invalidateValidationFreshness(input);
-        state = active.get(identity) ?? state;
-    };
-    const failed = () => {
-        if (active.get(identity)?.epoch !== watchedEpoch) {
-            return;
+        await mkdir(input.handoffPath, { recursive: true, mode: 0o700 });
+        const initialEvidenceFingerprint = await evidenceFingerprint(input.handoffPath);
+        const policy = getRuntimePolicy().validation;
+        const state = {
+            epoch: randomUUID(),
+            expiresAt: Date.now() + policy.freshnessLeaseTtlMs,
+            generation: 0,
+            healthy: true,
+            accepting: true,
+            projectPath: input.projectPath,
+            handoffPath: input.handoffPath,
+            evidenceFingerprint: initialEvidenceFingerprint,
+            invalidating: Promise.resolve(),
+            watchers: [],
+            dirty: false,
+            running: false,
+        };
+        const watchedEpoch = state.epoch;
+        const changed = () => {
+            if (active.get(identity)?.epoch === watchedEpoch && state.accepting) {
+                invalidateValidationFreshness(input);
+            }
+        };
+        const failed = () => {
+            if (active.get(identity)?.epoch === watchedEpoch && state.accepting) {
+                state.healthy = false;
+                changed();
+            }
+        };
+        const projectWatcher = startWatch(input.projectPath, isValidationSourcePath, changed, failed);
+        const handoffWatcher = startWatch(input.handoffPath, (filename) => EVIDENCE_FILE.test(filename), changed, failed);
+        if (!projectWatcher || !handoffWatcher) {
+            projectWatcher?.close();
+            handoffWatcher?.close();
+            throw new Error('[Planu] Validation freshness watchers could not be established');
         }
-        changed();
-        state = { ...state, healthy: false };
+        state.watchers.push(projectWatcher, handoffWatcher);
         active.set(identity, state);
-    };
-    const projectWatcher = startWatch(input.projectPath, isValidationSourcePath, changed, failed);
-    const handoffWatcher = startWatch(input.handoffPath, (filename) => EVIDENCE_FILE.test(filename), changed, failed);
-    if (!projectWatcher || !handoffWatcher) {
-        projectWatcher?.close();
-        handoffWatcher?.close();
-        throw new Error('[Planu] Validation freshness watchers could not be established');
-    }
-    state = { ...state, watchers: [projectWatcher, handoffWatcher] };
-    active.set(identity, state);
-    if (input.invalidateCurrentBindings !== false) {
-        const env_2 = { stack: [], error: void 0, hasError: false };
-        try {
-            const database = __addDisposableResource(env_2, new RuntimeDatabase({ path: resolveStorageLayout().runtimeDatabase }), false);
-            const store = new ValidationReceiptStore({ database, workspaceId: 'global' });
-            await store.invalidateCurrentBindings(input.projectId, input.specId);
+        state.ttlTimer = setTimeout(() => {
+            if (!state.accepting || active.get(identity) !== state) {
+                return;
+            }
+            void closeValidationFreshnessLease({
+                projectId: input.projectId,
+                specId: input.specId,
+                epoch: state.epoch,
+            }).catch((error) => {
+                reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
+            });
+        }, policy.freshnessLeaseTtlMs);
+        state.ttlTimer.unref();
+        if (input.invalidateCurrentBindings !== false) {
+            try {
+                await invalidateDurablyWithCanonicalIntegrity(input.projectId, input.specId);
+            }
+            catch (error) {
+                await closeValidationFreshnessLease({
+                    projectId: input.projectId,
+                    specId: input.specId,
+                    epoch: state.epoch,
+                });
+                throw error;
+            }
+        }
+        return {
+            projectId: input.projectId,
+            specId: input.specId,
+            epoch: state.epoch,
+            generation: state.generation,
+        };
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
+        throw error;
+    }
+    finally {
+        release();
+        if (beginQueues.get(identity) === tail) {
+            beginQueues.delete(identity);
+        }
+    }
+}
+/** Stop one exact epoch and drain all invalidations accepted before closure. */
+export async function closeValidationFreshnessLease(lease) {
+    const identity = key(lease.projectId, lease.specId);
+    const state = active.get(identity);
+    if (state?.epoch !== lease.epoch) {
+        return;
+    }
+    state.closing ??= (async () => {
+        state.accepting = false;
+        state.watchers.splice(0).forEach((watcher) => {
+            watcher.close();
+        });
+        if (state.ttlTimer) {
+            clearTimeout(state.ttlTimer);
         }
-        catch (e_2) {
-            env_2.error = e_2;
-            env_2.hasError = true;
+        state.ttlTimer = undefined;
+        if (state.coalesceTimer) {
+            clearTimeout(state.coalesceTimer);
+        }
+        state.coalesceTimer = undefined;
+        try {
+            if (state.dirty && !state.running) {
+                runInvalidationTurn(lease.projectId, lease.specId, state);
+            }
+            await state.invalidating;
+            if (state.dirty) {
+                state.dirty = false;
+                await invalidateDurably(lease.projectId, lease.specId);
+            }
         }
         finally {
-            __disposeResources(env_2);
+            if (active.get(identity)?.epoch === lease.epoch) {
+                active.delete(identity);
+            }
         }
-    }
-    return {
-        projectId: input.projectId,
-        specId: input.specId,
-        epoch: state.epoch,
-        generation: state.generation,
-    };
+    })();
+    await state.closing;
 }
 /** Bind the post-watch snapshot; an event before this call makes the lease unusable. */
 export async function bindValidationFreshnessLease(lease, bindings) {
@@ -285,10 +409,7 @@ export async function bindValidationFreshnessLease(lease, bindings) {
         confirmed.generation !== state.generation) {
         return false;
     }
-    active.set(key(lease.projectId, lease.specId), {
-        ...confirmed,
-        bindings: structuredClone(bindings),
-    });
+    confirmed.bindings = structuredClone(bindings);
     return true;
 }
 async function readStableState(lease, expectedGeneration) {
@@ -300,12 +421,15 @@ async function readStableState(lease, expectedGeneration) {
             (expectedGeneration !== undefined && before.generation !== expectedGeneration)) {
             return undefined;
         }
-        await before.invalidating;
+        const generationBefore = before.generation;
+        const invalidatingBefore = before.invalidating;
+        await invalidatingBefore;
         const after = active.get(identity);
         if (after?.healthy &&
             after.epoch === before.epoch &&
-            after.generation === before.generation &&
-            after.invalidating === before.invalidating) {
+            after.generation === generationBefore &&
+            (expectedGeneration === undefined || after.generation === expectedGeneration) &&
+            after.invalidating === invalidatingBefore) {
             return after;
         }
     }
@@ -383,6 +507,7 @@ export async function rebaselineValidationFreshnessLeaseAfterRecompute(input) {
         if (!before || Date.now() >= before.expiresAt) {
             return undefined;
         }
+        const generationBefore = before.generation;
         let fingerprintBefore;
         let observedBindings;
         let fingerprintAfter;
@@ -397,7 +522,7 @@ export async function rebaselineValidationFreshnessLeaseAfterRecompute(input) {
             return undefined;
         }
         const after = await readStableState(input.lease);
-        if (after?.generation !== before.generation || fingerprintBefore !== fingerprintAfter) {
+        if (after?.generation !== generationBefore || fingerprintBefore !== fingerprintAfter) {
             continue;
         }
         if (JSON.stringify(input.expectedBindings) !== JSON.stringify(observedBindings)) {
@@ -407,21 +532,36 @@ export async function rebaselineValidationFreshnessLeaseAfterRecompute(input) {
         if (confirmed?.generation !== after.generation) {
             continue;
         }
-        active.set(key(input.lease.projectId, input.lease.specId), {
-            ...confirmed,
-            bindings: structuredClone(observedBindings),
-            evidenceFingerprint: fingerprintAfter,
-        });
+        confirmed.bindings = structuredClone(observedBindings);
+        confirmed.evidenceFingerprint = fingerprintAfter;
         return { ...input.lease, generation: confirmed.generation };
     }
     return undefined;
 }
-export function resetValidationFreshnessForTests() {
+export async function resetValidationFreshnessForTests() {
+    const leases = [...active.entries()].map(([identity, state]) => {
+        const separator = identity.indexOf(':');
+        return {
+            projectId: identity.slice(0, separator),
+            specId: identity.slice(separator + 1),
+            epoch: state.epoch,
+        };
+    });
+    await Promise.all(leases.map((lease) => closeValidationFreshnessLease(lease)));
+    beginQueues.clear();
+}
+/** Count-only process diagnostic; intentionally absent from the package entrypoint. */
+export function getValidationFreshnessDiagnosticsForTests() {
+    let watchers = 0;
+    let queuedInvalidations = 0;
+    let timers = 0;
+    let generationTotal = 0;
     for (const state of active.values()) {
-        state.watchers.forEach((watcher) => {
-            watcher.close();
-        });
+        watchers += state.watchers.length;
+        queuedInvalidations += Number(state.running) + Number(state.dirty);
+        timers += Number(Boolean(state.ttlTimer)) + Number(Boolean(state.coalesceTimer));
+        generationTotal += state.generation;
     }
-    active.clear();
+    return { activeLeases: active.size, watchers, queuedInvalidations, timers, generationTotal };
 }
 //# sourceMappingURL=validation-freshness.js.map

package/dist/engine/validation/validation-receipt.d.ts

@@ -3,10 +3,6 @@ import type { RuntimeDatabase } from '../../storage/runtime-db.js';
 import { type StorageCatalogContext } from '../../storage/storage-catalog.js';
 export { normalizeValidationCommand } from './validation-receipt-codec.js';
 export declare const LOCAL_VALIDATION_RECEIPT_ISSUER = "planu-local-validator";
-export declare class ValidationIssuerKeyError extends Error {
-    readonly code: 'VALIDATION_ISSUER_KEY_NOT_CONFIGURED';
-    constructor();
-}
 export declare class ValidationReceiptStore implements ValidationReceiptPersistence {
     private readonly options;
     private readonly logDirectory;
@@ -14,6 +10,7 @@ export declare class ValidationReceiptStore implements ValidationReceiptPersiste
         readonly database: RuntimeDatabase;
         readonly workspaceId: string;
         readonly catalogContext?: StorageCatalogContext;
+        readonly authorizePersistence?: (database: RuntimeDatabase) => void;
     });
     logPath(logDigest: string): string;
     persist(receipt: ValidationReceipt, log: Buffer): Promise<void>;
@@ -21,7 +18,7 @@ export declare class ValidationReceiptStore implements ValidationReceiptPersiste
     readCurrent(projectId: string, specId: string): Promise<ValidationReceipt | undefined>;
     readCurrentBindings(projectId: string, specId: string): Promise<ValidationReceiptBindings | undefined>;
     projectCurrentBindings(bindings: ValidationReceiptBindings): Promise<void>;
-    invalidateCurrentBindings(projectId: string, specId: string): Promise<void>;
+    invalidateCurrentBindings(projectId: string, specId: string, receiptId?: string): Promise<void>;
     readLog(logDigest: string): Promise<Buffer | undefined>;
     private writeLog;
 }
@@ -46,6 +43,7 @@ export declare function createValidationReceiptAuthority(options: {
     readonly projectId: string;
     readonly issuerId: string;
     readonly catalogContext?: StorageCatalogContext;
+    readonly authorizePersistence?: (database: RuntimeDatabase) => void;
 }): {
     readonly authority: ValidationReceiptAuthority;
     readonly store: ValidationReceiptStore;
@@ -55,5 +53,10 @@ export declare function createValidationReceiptAuthority(options: {
 export declare function ensureValidationIssuerKey(identity: {
     readonly projectId: string;
     readonly issuerId: string;
-}): Promise<string>;
+}, platform?: NodeJS.Platform): Promise<string>;
+/** Prove that this process can resolve or provision its canonical receipt-signing key. */
+export declare function preflightValidationReceiptSigner(identity: {
+    readonly projectId: string;
+    readonly issuerId: string;
+}, platform?: NodeJS.Platform): Promise<string>;
 //# sourceMappingURL=validation-receipt.d.ts.map

package/dist/engine/validation/validation-receipt.js

@@ -6,16 +6,11 @@ import { reportClassifiedDegradation } from '../../errors/classified-degradation
 import { resolvedStorageArtifactPath, } from '../../storage/storage-catalog.js';
 import { formatSecretReference, getSecretProvider, parseSecretReference, SecretProviderError, } from '../../security/secret-provider.js';
 import { redactText } from '../../security/redactor.js';
+import { ValidationReceiptSignerUnavailableError } from '../macos-keychain-native-port.js';
+import { acquireLock, releaseLock } from '../safety/file-mutex.js';
 import { canonicalize, DIGEST, ISSUER_ID, PROJECT_ID, receiptCore, safeProof, sha256, SPEC_ID, validBindings, validReceiptShape, } from './validation-receipt-codec.js';
 export { normalizeValidationCommand } from './validation-receipt-codec.js';
 export const LOCAL_VALIDATION_RECEIPT_ISSUER = 'planu-local-validator';
-export class ValidationIssuerKeyError extends Error {
-    code = 'VALIDATION_ISSUER_KEY_NOT_CONFIGURED';
-    constructor() {
-        super('[Planu] Validation issuer key is not configured in the explicit environment adapter');
-        this.name = 'ValidationIssuerKeyError';
-    }
-}
 export class ValidationReceiptStore {
     options;
     logDirectory;
@@ -35,6 +30,7 @@ export class ValidationReceiptStore {
         }
         await this.writeLog(receipt.logDigest, log);
         this.options.database.transaction(() => {
+            this.options.authorizePersistence?.(this.options.database);
             this.options.database.putRecord({
                 projectId: receipt.bindings.projectId,
                 workspaceId: this.options.workspaceId,
@@ -96,16 +92,26 @@ export class ValidationReceiptStore {
         });
         return Promise.resolve();
     }
-    invalidateCurrentBindings(projectId, specId) {
-        if (!PROJECT_ID.test(projectId) || !SPEC_ID.test(specId)) {
+    invalidateCurrentBindings(projectId, specId, receiptId) {
+        if (!PROJECT_ID.test(projectId) ||
+            !SPEC_ID.test(specId) ||
+            (receiptId !== undefined && !DIGEST.test(receiptId))) {
             throw new Error('[Planu] Validation binding identity is invalid');
         }
-        this.options.database.putRecord({
-            projectId,
-            workspaceId: this.options.workspaceId,
-            kind: 'audit-state',
-            key: `validation-bindings-current:${specId}`,
-            value: { invalidatedAt: new Date().toISOString() },
+        this.options.database.transaction(() => {
+            if (receiptId !== undefined) {
+                const current = this.options.database.getRecord(projectId, this.options.workspaceId, 'audit-state', `validation-current:${specId}`);
+                if (!validReceiptShape(current?.value) || current.value.receiptId !== receiptId) {
+                    return;
+                }
+            }
+            this.options.database.putRecord({
+                projectId,
+                workspaceId: this.options.workspaceId,
+                kind: 'audit-state',
+                key: `validation-bindings-current:${specId}`,
+                value: { invalidatedAt: new Date().toISOString() },
+            });
         });
         return Promise.resolve();
     }
@@ -261,22 +267,76 @@ export function createValidationReceiptAuthority(options) {
     };
 }
 /** Provision or resolve a machine-local issuer key without exposing raw key material. */
-export async function ensureValidationIssuerKey(identity) {
-    const provider = getSecretProvider();
+export async function ensureValidationIssuerKey(identity, platform = process.platform) {
+    const canonicalProvider = platform === 'darwin'
+        ? 'macos-keychain'
+        : platform === 'linux'
+            ? 'linux-secret-service'
+            : platform === 'win32'
+                ? 'windows-credential-manager'
+                : undefined;
+    if (canonicalProvider === undefined) {
+        throw new ValidationReceiptSignerUnavailableError('PLATFORM_UNSUPPORTED');
+    }
+    let provider;
+    try {
+        provider = getSecretProvider();
+    }
+    catch {
+        throw new ValidationReceiptSignerUnavailableError('PROVIDER_UNAVAILABLE');
+    }
+    if (provider.adapter.kind !== canonicalProvider) {
+        throw new ValidationReceiptSignerUnavailableError('PROVIDER_NONCANONICAL');
+    }
     const reference = parseSecretReference(validationIssuerReference(identity));
+    let lock;
     try {
-        await provider.resolve(reference);
-        return formatSecretReference(reference);
+        lock = await acquireLock(`validation-issuer:${identity.projectId}:${identity.issuerId}`);
+    }
+    catch {
+        throw new ValidationReceiptSignerUnavailableError('PROVIDER_UNAVAILABLE');
+    }
+    let result;
+    try {
+        try {
+            await provider.resolve(reference);
+            result = formatSecretReference(reference);
+        }
+        catch (error) {
+            if (!(error instanceof SecretProviderError) || error.code !== 'SECRET_NOT_FOUND') {
+                throw new ValidationReceiptSignerUnavailableError('PROVIDER_UNAVAILABLE');
+            }
+            try {
+                await provider.store(reference, randomBytes(32).toString('base64url'));
+                result = formatSecretReference(reference);
+            }
+            catch {
+                throw new ValidationReceiptSignerUnavailableError('PROVIDER_UNAVAILABLE');
+            }
+        }
     }
     catch (error) {
-        if (!(error instanceof SecretProviderError) || error.code !== 'SECRET_NOT_FOUND') {
+        try {
+            await releaseLock(lock);
+        }
+        catch {
+            reportClassifiedDegradation('VALIDATION_ISSUER_LOCK_RELEASE_FAILURE', new Error('Validation issuer lock release failed'));
+        }
+        if (error instanceof ValidationReceiptSignerUnavailableError) {
             throw error;
         }
+        throw new ValidationReceiptSignerUnavailableError('PROVIDER_UNAVAILABLE');
     }
-    if (provider.adapter.kind === 'environment') {
-        throw new ValidationIssuerKeyError();
+    try {
+        await releaseLock(lock);
+    }
+    catch {
+        throw new ValidationReceiptSignerUnavailableError('PROVIDER_UNAVAILABLE');
     }
-    await provider.store(reference, randomBytes(32).toString('base64url'));
-    return formatSecretReference(reference);
+    return result;
+}
+/** Prove that this process can resolve or provision its canonical receipt-signing key. */
+export function preflightValidationReceiptSigner(identity, platform = process.platform) {
+    return ensureValidationIssuerKey(identity, platform);
 }
 //# sourceMappingURL=validation-receipt.js.map

package/dist/engine/validation/validation-source-digest.d.ts

@@ -0,0 +1,2 @@
+export declare function gitSourceTreeDigest(projectPath: string): Promise<string>;
+//# sourceMappingURL=validation-source-digest.d.ts.map