@rightkit/release 0.4.1 → 0.5.1

package/sign-qa-bundle.mjs

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+// right-release sign-qa-bundle: QA-ONLY ad hoc signing of an already-assembled .app that lives inside a QA scratch root.
+// Why it exists: an assembled QA bundle (for example an Accessibility QA copy) needs a coherent ad hoc signature, but
+// `codesign --force --deep --sign -` routed through the signing agent (SSH or non-Aqua session) is refused by design
+// (macos-signing-session.mjs codesignAgentItems; rightkit-signing-agent.mjs). Those refusals stay. This module never calls the
+// agent: it spawns /usr/bin/codesign itself, signs nested code one item at a time, deepest first, the outer bundle last, with
+// identity "-" and never `--deep`. Ad hoc output is not a release artifact: it is never notarized, sealed, published or installed
+// under /Applications, and the receipt says so (signature "adhoc", releaseArtifact false, qaOnly true).
+import { existsSync, lstatSync, mkdtempSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { adhocSafeEntitlements } from "./adhoc-entitlements.mjs";
+
+export const QA_BUNDLE_SIGNING_SCHEMA = 1;
+export const CODESIGN = "/usr/bin/codesign";
+const PLUTIL = "/usr/bin/plutil";
+// macOS paths only: posix semantics keep the checks identical on every host that unit-tests this module.
+const px = path.posix;
+
+export class QaBundleSigningError extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "QaBundleSigningError";
+    this.code = code;
+    Object.assign(this, details);
+  }
+}
+const fail = (code, message, details) => { throw new QaBundleSigningError(code, message, details); };
+
+const defaultIo = { lstatSync, readdirSync, realpathSync, existsSync, mkdtempSync, writeFileSync, rmSync };
+const captureOptions = { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: false };
+const outputOf = (result) => `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
+const inside = (parent, child) => child !== parent && child.startsWith(parent === "/" ? "/" : `${parent}/`);
+
+function checked(run, args, code, command = CODESIGN) {
+  const result = run(command, args, captureOptions);
+  if (!result || result.error || result.status !== 0) {
+    fail(code, `${command} ${args[0]} failed (${result?.status ?? "unavailable"}): ${result?.error?.message || outputOf(result ?? {})}`, { status: result?.status });
+  }
+  return result;
+}
+
+function lstatOrNull(io, file) { try { return io.lstatSync(file); } catch { return null; } }
+
+function requireAbsolute(label, value) {
+  if (typeof value !== "string" || !value.startsWith("/")) fail("QA_SIGN_PATH_NOT_ABSOLUTE", `${label} must be an absolute macOS path: ${JSON.stringify(value)}`);
+  if (value.split("/").includes("..") || value.includes("\0")) fail("QA_SIGN_PATH_NOT_NORMAL", `${label} must not contain ".." segments: ${JSON.stringify(value)}`);
+  return value.length > 1 ? value.replace(/\/+$/, "") : value;
+}
+
+/** Validate the target and return its real paths. Refusals are typed and happen before any codesign call. */
+export function resolveQaBundleTarget({ app, qaScratchRoot, platform = process.platform, home = os.homedir(), io = defaultIo }) {
+  if (platform !== "darwin") fail("QA_SIGN_DARWIN_ONLY", `sign-qa-bundle runs on macOS only (platform ${platform})`);
+  const lexicalApp = requireAbsolute("--app", app);
+  const lexicalRoot = requireAbsolute("--qa-root", qaScratchRoot);
+  const lexicalHome = requireAbsolute("home", home);
+  const applications = ["/Applications", px.join(lexicalHome, "Applications")];
+  const real = (label, file) => { try { return io.realpathSync(file); } catch { return fail("QA_SIGN_PATH_MISSING", `${label} does not exist: ${file}`); } };
+  const realApplications = applications.flatMap((dir) => { const out = [dir]; try { out.push(io.realpathSync(dir)); } catch { /* absent */ } return out; });
+  const inApplications = (file) => realApplications.some((dir) => file === dir || inside(dir, file));
+  if (inApplications(lexicalApp)) fail("QA_SIGN_APPLICATIONS_REFUSED", `QA signing refuses installed apps (/Applications, ~/Applications): ${lexicalApp}`);
+  if (px.extname(lexicalApp) !== ".app") fail("QA_SIGN_NOT_APP", `target is not a .app bundle: ${lexicalApp}`);
+  const link = lstatOrNull(io, lexicalApp);
+  if (!link) fail("QA_SIGN_PATH_MISSING", `--app does not exist: ${lexicalApp}`);
+  if (link.isSymbolicLink()) fail("QA_SIGN_LINK_REFUSED", `--app is a symbolic link; pass the real bundle: ${lexicalApp}`);
+  if (!link.isDirectory()) fail("QA_SIGN_NOT_APP", `target is not a directory bundle: ${lexicalApp}`);
+  const realRoot = real("--qa-root", lexicalRoot);
+  const realApp = real("--app", lexicalApp);
+  if (realRoot === "/" || realRoot === lexicalHome || inApplications(realRoot) || realApplications.some((dir) => inside(realRoot, dir))) {
+    fail("QA_SIGN_ROOT_REFUSED", `QA scratch root is too broad or an installed-app location: ${realRoot}`);
+  }
+  if (inApplications(realApp)) fail("QA_SIGN_APPLICATIONS_REFUSED", `QA signing refuses installed apps (resolved to ${realApp})`);
+  if (!inside(realRoot, realApp)) fail("QA_SIGN_OUTSIDE_QA_ROOT", `bundle ${realApp} is not inside the QA scratch root ${realRoot}`);
+  if (px.extname(realApp) !== ".app") fail("QA_SIGN_NOT_APP", `target resolves to a non-.app path: ${realApp}`);
+  return { app: lexicalApp, realApp, realRoot };
+}
+
+/** Bundle kinds that are signed as a unit, and the directory whose files are loose Mach-O candidates. */
+const BUNDLE_EXTENSIONS = new Set([".app", ".xpc", ".framework"]);
+
+function readInfo(run, bundle, cache, io) {
+  if (cache.has(bundle)) return cache.get(bundle);
+  let info = {};
+  for (const location of ["Contents/Info.plist", "Resources/Info.plist", "Info.plist"]) {
+    const file = px.join(bundle, location);
+    if (!io.existsSync(file)) continue;
+    const result = checked(run, ["-convert", "json", "-o", "-", file], "QA_SIGN_PLIST_INVALID", PLUTIL);
+    try { info = JSON.parse(result.stdout); } catch { fail("QA_SIGN_PLIST_INVALID", `Invalid Info.plist JSON: ${file}`); }
+    break;
+  }
+  cache.set(bundle, info);
+  return info;
+}
+
+/**
+ * Nested code inside the bundle, ordered inside-out: deepest path first (stable by path), the outer bundle excluded.
+ * Symbolic links are never entered or signed; a link that resolves outside the bundle is refused.
+ */
+export function enumerateNestedCode({ realApp, run, io = defaultIo }) {
+  const infoCache = new Map();
+  const found = new Map();
+  const add = (file, kind) => { if (!found.has(file)) found.set(file, kind); };
+  const bundleOf = (dir) => px.dirname(px.dirname(dir)); // .../X.app/Contents/MacOS -> .../X.app
+  const walk = (dir) => {
+    for (const entry of io.readdirSync(dir, { withFileTypes: true })) {
+      const file = px.join(dir, entry.name);
+      if (entry.isSymbolicLink()) {
+        let target;
+        try { target = io.realpathSync(file); } catch { fail("QA_SIGN_LINK_REFUSED", `dangling symbolic link inside the bundle: ${file}`); }
+        if (target !== realApp && !inside(realApp, target)) fail("QA_SIGN_LINK_REFUSED", `symbolic link escapes the bundle: ${file} -> ${target}`);
+        continue;
+      }
+      const ext = px.extname(entry.name);
+      if (entry.isDirectory()) {
+        if (BUNDLE_EXTENSIONS.has(ext)) add(file, ext === ".framework" ? "framework" : ext === ".xpc" ? "xpc" : "app");
+        else if (px.basename(dir) === "LoginItems" && px.basename(px.dirname(dir)) === "Library") add(file, "login-item");
+        walk(file);
+      } else if (entry.isFile()) {
+        if (ext === ".dylib") add(file, "dylib");
+        else if (px.basename(dir) === "MacOS" && px.basename(px.dirname(dir)) === "Contents") {
+          const main = readInfo(run, bundleOf(dir), infoCache, io).CFBundleExecutable;
+          if (typeof main !== "string" || !main) fail("QA_SIGN_PLIST_INVALID", `no CFBundleExecutable for ${bundleOf(dir)}`);
+          if (entry.name !== main) add(file, "executable");
+        } else if (px.basename(dir) === "Frameworks" && px.basename(px.dirname(dir)) === "Contents") add(file, "executable");
+        else if (px.basename(dir) === "LoginItems" && px.basename(px.dirname(dir)) === "Library") add(file, "login-item");
+      }
+    }
+  };
+  walk(realApp);
+  const depth = (file) => file.split("/").length;
+  return [...found].map(([file, kind]) => ({ path: file, kind }))
+    .sort((a, b) => depth(b.path) - depth(a.path) || (a.path < b.path ? -1 : 1));
+}
+
+/** The only codesign argv this module emits. `--deep` and any identity other than "-" are structurally impossible. */
+export function adhocCodesignArgs(item, entitlementsFile) {
+  const args = ["--force", "--sign", "-"];
+  if (entitlementsFile) args.push("--entitlements", entitlementsFile);
+  args.push(item);
+  if (args.includes("--deep") || args[args.indexOf("--sign") + 1] !== "-") fail("QA_SIGN_ARGV_REFUSED", "internal: ad hoc argv must never carry --deep or a real identity");
+  return args;
+}
+
+export function signQaBundleAdhoc({ app, qaScratchRoot, run = spawnSync, platform = process.platform, home = os.homedir(), entitlements, io = defaultIo, out } = {}) {
+  const target = resolveQaBundleTarget({ app, qaScratchRoot, platform, home, io });
+  const { realApp, realRoot } = target;
+  let scratch;
+  try {
+    let outerEntitlements;
+    let entitlementKeys = [];
+    if (entitlements !== undefined) {
+      const source = requireAbsolute("entitlements", entitlements);
+      const parsed = checked(run, ["-convert", "json", "-o", "-", source], "QA_SIGN_ENTITLEMENTS_INVALID", PLUTIL);
+      let reduced;
+      try { reduced = adhocSafeEntitlements(JSON.parse(parsed.stdout)); } catch { fail("QA_SIGN_ENTITLEMENTS_INVALID", `Invalid entitlements plist: ${source}`); }
+      entitlementKeys = Object.keys(reduced).sort();
+      if (entitlementKeys.length) {
+        scratch = io.mkdtempSync(px.join(realRoot, ".sign-qa-"));
+        outerEntitlements = px.join(scratch, "adhoc-entitlements.plist");
+        io.writeFileSync(outerEntitlements, JSON.stringify(reduced));
+        checked(run, ["-convert", "xml1", outerEntitlements], "QA_SIGN_ENTITLEMENTS_INVALID", PLUTIL);
+      }
+    }
+    const nested = enumerateNestedCode({ realApp, run, io });
+    const plan = [...nested, { path: realApp, kind: "bundle" }];
+    const signed = [];
+    for (const item of plan) {
+      const withEntitlements = item.kind === "bundle" ? outerEntitlements : undefined;
+      checked(run, adhocCodesignArgs(item.path, withEntitlements), "QA_SIGN_CODESIGN_FAILED");
+      signed.push({ path: item.path, kind: item.kind });
+    }
+    checked(run, ["--verify", "--strict", realApp], "QA_SIGN_VERIFY_FAILED");
+    const receipt = {
+      schema: QA_BUNDLE_SIGNING_SCHEMA, signature: "adhoc", releaseArtifact: false, qaOnly: true,
+      notarized: false, published: false, usedSigningAgent: false,
+      app: realApp, qaScratchRoot: realRoot, entitlementKeys, verified: "codesign --verify --strict", signed,
+    };
+    if (out) {
+      const file = requireAbsolute("--out", out);
+      io.writeFileSync(file, `${JSON.stringify(receipt, null, 2)}\n`);
+    }
+    return receipt;
+  } finally {
+    if (scratch) { try { io.rmSync(scratch, { recursive: true, force: true }); } catch { /* best effort */ } }
+  }
+}
+
+export function main(args = process.argv.slice(2), options = {}) {
+  const take = (flag) => {
+    const index = args.indexOf(flag);
+    if (index < 0) return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) fail("QA_SIGN_USAGE", `${flag} requires a value`);
+    return value;
+  };
+  try {
+    for (const arg of args.filter((a) => a.startsWith("--"))) {
+      if (!["--app", "--qa-root", "--out", "--entitlements"].includes(arg)) fail("QA_SIGN_USAGE", `unknown option ${arg}`);
+    }
+    const receipt = signQaBundleAdhoc({ app: take("--app"), qaScratchRoot: take("--qa-root"), entitlements: take("--entitlements"), out: take("--out"), ...options });
+    console.log(`ad hoc signed (QA only, not a release artifact) ${receipt.signed.length} item(s), outer bundle last: ${receipt.app}`);
+  } catch (error) {
+    console.error(`right-release sign-qa-bundle: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) main();

package/stage-sidecar.mjs

@@ -23,7 +23,7 @@
 // metadata`) or { npm: "<pkg>/<file>" }. The wrapper form { sidecars, profiles: { dev, release } } sets the default cargo
 // profile pair; RIGHTKIT_BUILD_MODE (dev|release, default release) selects. The target `universal-apple-darwin` builds
 // both slices of a cargo-bin and lipo-creates `<name>-universal-apple-darwin`. `ffmpeg` and `onnxruntime` do the same from their
-// per-arch catalog rows (each slice staged under .right-release/slices/<triple>, then lipo-merged), a `cmake` entry builds with
+// per-arch catalog rows (each slice staged under .right-release/slices/<triple>, then lipo-merged; an onnxruntime `universal` macOS row is staged once, lipo -archs checked, no merge), a `cmake` entry builds with
 // CMAKE_OSX_ARCHITECTURES="arm64;x86_64". A `prebuilt` entry does it from per-arch host-built inputs (`from: { aarch64, x86_64 }`, or the
 // staged `<name>-<slice triple>` files), each verified against its own manifest entry and then lipo-merged. An `ffmpeg` source may be a
 // local path (`sources.ffmpeg: { path: "../vendor/ffmpeg-lgpl" }`) instead of a pinned https archive.
@@ -526,7 +526,10 @@ export function defaultRun(command, args, { cwd, env = process.env } = {}) {
  * a `fileName` containing `/` selects the one member whose full archive path equals it (case-sensitive, leading `./` ignored on both
  * sides), so archives with the same base name in several directories (ORT DirectML nupkgs) can be addressed. The returned file is
  * always under `destDir`; callers copy it to their own declared output name, so the member path never decides where anything is written.
+ * A bare name ignores members inside a `.dSYM` bundle: Apple archives (ORT osx tgz) ship the DWARF copy under the same base name.
  */
+const isDebugSymbolMember = (member) => member.split("/").some((part) => part.toLowerCase().endsWith(".dsym"));
+
 export function defaultExtractMember({ archive, fileName, destDir, run = defaultRun }) {
   const wanted = normalizeArchiveMember(fileName);
   if (wanted.error) fail("STAGE_SIDECAR_EXTRACT_FAILED", `archive member ${JSON.stringify(fileName)} ${wanted.error}`);
@@ -535,7 +538,7 @@ export function defaultExtractMember({ archive, fileName, destDir, run = default
   const lines = String(listing.stdout).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   const members = wanted.byPath
     ? lines.filter((line) => (line.startsWith("./") ? line.slice(2) : line) === wanted.value)
-    : lines.filter((line) => path.posix.basename(line) === wanted.value);
+    : lines.filter((line) => path.posix.basename(line) === wanted.value && !isDebugSymbolMember(line));
   if (members.length !== 1) fail("STAGE_SIDECAR_EXTRACT_FAILED", `${archive} has ${members.length} members ${wanted.byPath ? "at the path" : "named"} ${wanted.value}, expected exactly one`);
   const extracted = run("tar", ["-xf", archive, "-C", destDir, members[0]], { cwd: path.dirname(archive) });
   if (extracted.status !== 0) fail("STAGE_SIDECAR_EXTRACT_FAILED", `cannot extract ${members[0]} from ${archive}`);
@@ -912,18 +915,48 @@ async function stageFfmpeg(entry, ctx) {
   }
 }
 
+/** Catalog statuses that may serve a staged library; `stale-unverified` and `planned` rows never do. */
+const SERVING_STATUS = new Set(["approved", "pinned"]);
+
+/**
+ * The one onnxruntime catalog row that serves target `t` (mirrors rightkit-onnx provision.rs select()): an approved or pinned
+ * exact-(os, arch) row wins; only when none exists does a macOS `universal` row (both Apple slices) serve an aarch64 or x86_64
+ * target. A stale-unverified or planned row is never selected. With nothing serving, the typed error names the exact-arch row's
+ * status when there is one, else the missing row.
+ */
+function selectOnnxRuntimeRow(loaded, entry, t, where) {
+  const candidates = (loaded.catalog?.libraries ?? []).filter((row) => row.library === "onnxruntime" && row.version === entry.version && row.os === t.os);
+  const serving = candidates.filter((row) => SERVING_STATUS.has(row.status));
+  const exact = serving.filter((row) => row.arch === t.arch);
+  const appleThin = t.os === "macos" && (t.arch === "aarch64" || t.arch === "x86_64");
+  const hits = exact.length ? exact : appleThin ? serving.filter((row) => row.arch === "universal") : [];
+  if (hits.length === 1) return hits[0];
+  if (hits.length > 1) return fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog has ${hits.length} ${where} rows`);
+  const unserved = candidates.filter((row) => row.arch === t.arch);
+  if (unserved.length === 0) return fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog has no ${where} row`);
+  if (unserved.length > 1) return fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog has ${unserved.length} ${where} rows`);
+  return fail("STAGE_SIDECAR_NOT_APPROVED", `the ${where} row ${unserved[0].id} is ${unserved[0].status}, not approved or pinned`);
+}
+
+/**
+ * The archive member of a catalog row: archive.member when present; else, for a macOS `.zip` archive, `<archive name without
+ * .zip>/lib/<artifactFileName>` (as provision.rs derives it); else the bare artifactFileName.
+ */
+function onnxRuntimeMember(row) {
+  if (row.archive.member !== undefined) return row.archive.member;
+  const archiveName = path.posix.basename(new URL(row.archive.url).pathname);
+  if (row.os === "macos" && archiveName.endsWith(".zip")) return `${archiveName.slice(0, -".zip".length)}/lib/${row.artifactFileName}`;
+  return row.artifactFileName;
+}
+
 /**
  * Stage one architecture of onnxruntime: the approved or pinned catalog row for `t`, its archive (digest-checked), the library
  * (digest-checked) into `destDir` (default the entry's resourceDir), and the notices. Returns { row, dest, outName, notices }.
  */
 async function stageOnnxRuntimeSlice(entry, ctx, loaded, t, { destDir } = {}) {
   const { appRoot, fs } = ctx;
-  const rows = (loaded.catalog?.libraries ?? []).filter((row) => row.library === "onnxruntime" && row.version === entry.version && row.os === t.os && row.arch === t.arch);
   const where = `onnxruntime ${entry.version} ${t.os}/${t.arch}`;
-  if (rows.length === 0) fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog has no ${where} row`);
-  if (rows.length > 1) fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog has ${rows.length} ${where} rows`);
-  const [row] = rows;
-  if (!["approved", "pinned"].includes(row.status)) fail("STAGE_SIDECAR_NOT_APPROVED", `the ${where} row ${row.id} is ${row.status}, not approved or pinned`);
+  const row = selectOnnxRuntimeRow(loaded, entry, t, where);
   for (const key of ["sha256", "artifactFileName"]) if (typeof row[key] !== "string" || !row[key]) fail("STAGE_SIDECAR_NOT_APPROVED", `the ${where} row ${row.id} has no ${key}`);
   if (!SHA256.test(row.sha256) || !SHA256.test(row.archive?.sha256 ?? "") || typeof row.archive?.url !== "string") fail("STAGE_SIDECAR_NOT_APPROVED", `the ${where} row ${row.id} lacks a valid library digest or archive url and digest`);
   if (!Array.isArray(row.noticeFiles) || !row.noticeFiles.length) fail("STAGE_SIDECAR_NOTICE_MISSING", `the ${where} row ${row.id} lists no notice files; the licence must ship with the library`);
@@ -936,7 +969,7 @@ async function stageOnnxRuntimeSlice(entry, ctx, loaded, t, { destDir } = {}) {
   for (const { source } of notices) if (!fs.existsSync(source)) fail("STAGE_SIDECAR_NOTICE_MISSING", `notice file not found: ${source}`);
 
   // The archive member is the catalog's archive.member (an archive path) when present, else the library file name; the output name never comes from it.
-  const member = row.archive.member ?? row.artifactFileName;
+  const member = onnxRuntimeMember(row);
   const memberCheck = normalizeArchiveMember(member);
   if (memberCheck.error) fail("STAGE_SIDECAR_NOT_APPROVED", `the ${where} row ${row.id} has an invalid archive member ${JSON.stringify(member)}: ${memberCheck.error}`);
   const outName = entry.as ?? row.artifactFileName;
@@ -978,7 +1011,19 @@ async function stageOnnxRuntime(entry, ctx) {
     const { row, dest, outName, notices } = await stageOnnxRuntimeSlice(entry, ctx, loaded, target);
     return [{ kind: "onnxruntime", name: outName, path: rel(ctx, dest), sha256: row.sha256, sizeBytes: fs.statSync(dest).size, changed: null, catalogRow: row.id, version: row.version, archiveSha256: row.archive.sha256, license: row.licenseSpdx ?? null, notices, externalBin: false }];
   }
-  // universal-apple-darwin: each arch row is staged thin under SLICE_ROOT, then merged into the entry's resource file.
+  // universal-apple-darwin: one macOS `universal` row serving both slices is staged once, in place, with no lipo merge.
+  const selected = SLICES.map((triple) => selectOnnxRuntimeRow(loaded, entry, parseTargetTriple(triple), `onnxruntime ${entry.version} macos/${triple.split("-")[0]}`));
+  if (selected.some((row) => row.arch === "universal")) {
+    if (selected[0] !== selected[1]) fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog mixes a universal row with exact-arch rows (${selected.map((row) => row.id).join(", ")}); universal-apple-darwin takes either one universal row or one row per arch`);
+    const staged = await stageOnnxRuntimeSlice(entry, ctx, loaded, parseTargetTriple(SLICES[0]));
+    requireUniversalFile(ctx, staged.dest, `onnxruntime ${entry.version} ${staged.row.id}`);
+    return [{
+      kind: "onnxruntime", name: staged.outName, path: rel(ctx, staged.dest), sha256: staged.row.sha256, sizeBytes: fs.statSync(staged.dest).size, changed: null, sourceSha256: staged.row.sha256,
+      catalogRow: staged.row.id, version: entry.version, archiveSha256: staged.row.archive.sha256, license: staged.row.licenseSpdx ?? null, notices: staged.notices, externalBin: false,
+      slices: SLICES.map((triple) => ({ triple, sha256: staged.row.sha256, catalogRow: staged.row.id, archiveSha256: staged.row.archive.sha256 })),
+    }];
+  }
+  // Otherwise each arch row is staged thin under SLICE_ROOT, then merged into the entry's resource file.
   const slices = [];
   for (const triple of SLICES) slices.push({ triple, ...(await stageOnnxRuntimeSlice(entry, ctx, loaded, parseTargetTriple(triple), { destDir: `${SLICE_ROOT}/${triple}` })) });
   const names = [...new Set(slices.map((slice) => slice.outName))];

package/workflow-yaml.mjs

@@ -0,0 +1,177 @@
+// A strict parser for the YAML subset GitHub Actions workflows in this repository use: block
+// mappings, block sequences, literal block scalars (`|` and `|-`, no indentation indicator), flow
+// sequences of scalars on one line, quoted and plain single-line scalars, comments. It parses
+// structure so a contract test can assert on it. It REJECTS everything it does not implement exactly
+// instead of guessing, so an unparsed construct can never pass as "absent" and no scalar can mean
+// something different to GitHub than to the contract: tabs anywhere, folded scalars (`>`) in any
+// form, block scalars with an indentation indicator or `+` chomping, anchors, aliases, tags, merge
+// keys, explicit keys, document markers, flow mappings (except the empty `{}`), flow collections that span lines, multi-line
+// scalars, duplicate keys. Every scalar is returned as a string. Literal block scalars follow the
+// spec: `|` keeps one trailing newline, `|-` none.
+
+function fail(no, message) { throw new Error(`yaml line ${no}: ${message}`); }
+
+function stripComment(text) {
+  let quote = null;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    if (quote) { if (c === quote) quote = null; continue; }
+    if ((c === '"' || c === "'") && (i === 0 || /[\s[,:]/.test(text[i - 1]))) { quote = c; continue; }
+    if (c === "#" && (i === 0 || /\s/.test(text[i - 1]))) return text.slice(0, i).trimEnd();
+  }
+  return text.trimEnd();
+}
+
+function scalar(raw, no) {
+  const text = raw.trim();
+  if (text === "") return "";
+  if (/^[&*!]/.test(text)) fail(no, `anchors, aliases and tags are not supported: ${text.slice(0, 40)}`);
+  if (/^[|>]/.test(text)) fail(no, `block scalar header ${JSON.stringify(text.slice(0, 12))} is not supported here (only "|" and "|-" after a mapping key)`);
+  if (/^(?:[-?:](?:\s|$)|[%@`])/.test(text)) fail(no, `YAML indicator at the start of a plain scalar is not supported: ${text.slice(0, 40)}`);
+  // The empty flow mapping alone (`permissions: {}`) is unambiguous; any other flow mapping is refused.
+  if (text === "{}") return {};
+  if (text.startsWith("{")) fail(no, "flow mappings are not supported");
+  if (text.startsWith('"')) {
+    if (!/^"(?:[^"\\]|\\.)*"$/.test(text)) fail(no, `unterminated or trailing text after a quoted scalar: ${text.slice(0, 40)}`);
+    return JSON.parse(text);
+  }
+  if (text.startsWith("'")) {
+    if (!/^'(?:[^']|'')*'$/.test(text)) fail(no, `unterminated or trailing text after a quoted scalar: ${text.slice(0, 40)}`);
+    return text.slice(1, -1).replaceAll("''", "'");
+  }
+  if (text.startsWith("[")) {
+    if (!text.endsWith("]")) fail(no, "flow sequence must close on the same line");
+    const inner = text.slice(1, -1);
+    const items = []; let current = ""; let quote = null;
+    for (const c of inner) {
+      if (quote) { current += c; if (c === quote) quote = null; continue; }
+      if (c === '"' || c === "'") { quote = c; current += c; continue; }
+      if (c === "[" || c === "{") fail(no, "nested flow collections are not supported");
+      if (c === ",") { items.push(current); current = ""; continue; }
+      current += c;
+    }
+    if (quote) fail(no, "unterminated quote in flow sequence");
+    items.push(current);
+    const kept = items.map((item) => item.trim());
+    while (kept.length && kept.at(-1) === "") kept.pop(); // a trailing comma
+    if (kept.includes("")) fail(no, "empty item in a flow sequence");
+    return kept.map((item) => scalar(item, no));
+  }
+  return text;
+}
+
+export function parseYaml(source) {
+  const raw = String(source).replace(/\r\n/g, "\n").split("\n");
+  raw.forEach((line, i) => { if (line.includes("\t")) fail(i + 1, "tabs are not allowed"); });
+  const lines = raw.map((text, i) => ({ no: i + 1, raw: text, indent: /^( *)/.exec(text)[1].length, body: stripComment(text).trim() }));
+  let cursor = 0;
+
+  const skipBlank = () => { while (cursor < lines.length && lines[cursor].body === "") cursor += 1; };
+
+  function blockScalar(parentIndent, header, no) {
+    const strip = header === "|-";
+    const body = [];
+    let blockIndent = null;
+    while (cursor < lines.length) {
+      const line = lines[cursor];
+      if (line.raw.trim() === "") {
+        // A blank line deeper than the block indentation carries content (its spaces); not modeled.
+        if (blockIndent !== null && line.raw.length > blockIndent) fail(line.no, "whitespace-only line inside a block scalar is indented past the block; not supported");
+        body.push(""); cursor += 1; continue;
+      }
+      if (line.indent <= parentIndent) break;
+      if (blockIndent === null) blockIndent = line.indent;
+      if (line.indent < blockIndent) fail(line.no, "block scalar line is indented less than its first line");
+      body.push(line.raw.slice(blockIndent));
+      cursor += 1;
+    }
+    while (body.length && body.at(-1) === "") body.pop();
+    if (body.length === 0) return "";
+    return body.join("\n") + (strip ? "" : "\n");
+  }
+
+  function parseBlock(indent) {
+    skipBlank();
+    if (cursor >= lines.length) return null;
+    const first = lines[cursor];
+    if (first.indent !== indent) fail(first.no, `expected indent ${indent}, found ${first.indent}`);
+    return /^-(\s|$)/.test(first.body) ? parseSequence(indent) : parseMapping(indent);
+  }
+
+  function parseSequence(indent) {
+    const out = [];
+    for (;;) {
+      skipBlank();
+      if (cursor >= lines.length) break;
+      const line = lines[cursor];
+      if (line.indent < indent) break;
+      if (line.indent > indent) fail(line.no, "unexpected indentation inside a sequence");
+      if (!/^-(\s|$)/.test(line.body)) break;
+      const rest = line.body.slice(1);
+      const offset = rest.length - rest.trimStart().length;
+      const content = rest.trimStart();
+      if (content === "") {
+        cursor += 1; skipBlank();
+        const next = lines[cursor];
+        if (!next || next.indent <= indent) { out.push(""); continue; }
+        out.push(parseBlock(next.indent));
+        continue;
+      }
+      // "- key: value" opens a mapping whose keys sit at the column after "- ".
+      if (keyMatch(content) && !/^["'[]/.test(content)) {
+        const childIndent = indent + 1 + offset;
+        lines[cursor] = { ...line, indent: childIndent, body: content, raw: " ".repeat(childIndent) + content };
+        out.push(parseMapping(childIndent));
+        continue;
+      }
+      cursor += 1;
+      out.push(scalar(content, line.no));
+    }
+    return out;
+  }
+
+  function keyMatch(body) {
+    const m = /^("(?:[^"\\]|\\.)*"|'(?:[^']|'')*'|[^\s:#"'[\]{},&*!|>-][^:]*?|-[^\s:][^:]*?)\s*:(?:\s+(.*))?$/.exec(body);
+    return m ? { key: m[1], value: m[2] ?? "" } : null;
+  }
+
+  function parseMapping(indent) {
+    const out = {};
+    for (;;) {
+      skipBlank();
+      if (cursor >= lines.length) break;
+      const line = lines[cursor];
+      if (line.indent < indent) break;
+      if (line.indent > indent) fail(line.no, "unexpected indentation inside a mapping");
+      if (/^-(\s|$)/.test(line.body)) break;
+      const hit = keyMatch(line.body);
+      if (!hit) fail(line.no, `cannot parse mapping entry: ${line.body.slice(0, 60)}`);
+      const key = hit.key.startsWith('"') || hit.key.startsWith("'") ? scalar(hit.key, line.no) : hit.key;
+      if (Object.hasOwn(out, key)) fail(line.no, `duplicate key ${JSON.stringify(key)}`);
+      cursor += 1;
+      const value = hit.value.trim();
+      if (value === "") {
+        skipBlank();
+        const next = lines[cursor];
+        if (next && next.indent > indent) out[key] = parseBlock(next.indent);
+        else if (next && next.indent === indent && /^-(\s|$)/.test(next.body)) out[key] = parseSequence(indent);
+        else out[key] = "";
+      } else if (value === "|" || value === "|-") {
+        out[key] = blockScalar(indent, value, line.no);
+      } else if (/^[|>]/.test(value)) {
+        fail(line.no, `block scalar header ${JSON.stringify(value.slice(0, 12))} is not supported (indentation indicators, "+" chomping and folded scalars are rejected)`);
+      } else {
+        const next = (skipBlank(), lines[cursor]);
+        if (next && next.indent > indent) fail(next.no, "multi-line plain scalars are not supported");
+        out[key] = scalar(value, line.no);
+      }
+    }
+    return out;
+  }
+
+  skipBlank();
+  const result = cursor >= lines.length ? {} : parseBlock(lines[cursor].indent);
+  skipBlank();
+  if (cursor < lines.length) fail(lines[cursor].no, "unparsed trailing content");
+  return result;
+}