@sublang/slc 0.1.0

package/dist/pin-closure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-closure.js","sourceRoot":"","sources":["../src/pin-closure.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,0EAA0E;AAE1E;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,MAAM,eAAe,GAAG,gBAAgB,CAAC;AACzC,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,QAAgB,EAChB,cAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAa,CAAC,cAAc,CAAC,CAAC;IAEzC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAY,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,QAAQ,GAAG,cAAc,CAC7B,WAAW,EACX,QAAQ,EACR,GAAG,EACH,eAAe,CAChB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtB,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,QAAgB,EAChB,MAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,UAAU,CAAC,IAAI,CACvB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,QAAQ,CAAC,GAAG,CACV,cAAc,CACZ,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,UAAU,CAAC,IAAI,EACtB,iBAAiB,CAClB,CACF,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1C,QAAQ,CAAC,GAAG,CACV,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,YAAoB;IAC/C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAc,EAAE,CAAc;IAC/C,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/pin-currency.d.ts

@@ -0,0 +1,55 @@
+import { type PinFile, type PinRecord } from './pins.js';
+/** A per-phase pin-currency verdict (DR-007). */
+export type PinVerdict = {
+    status: 'current';
+} | {
+    status: 'stale';
+    reason: string;
+} | {
+    status: 'malformed';
+    reason: string;
+};
+/** The result of evaluating a pipeline directory's pins (DR-007). */
+export interface PinsResult {
+    /** Resolved `slc.pins.json` path; `undefined` when absent (every phase unpinned). */
+    path?: string;
+    /** Per-phase verdicts keyed by phase name; `undefined` when the file is absent. */
+    verdicts?: Record<string, PinVerdict>;
+    /** File-level malformed diagnostic (unparseable or invalid file); when set, no phase is current. */
+    malformed?: string;
+}
+/**
+ * Evaluates every pin in `<pipelineDir>/slc.pins.json` (PIN-1..PIN-6).
+ *
+ * @returns `{}` when the file is absent (no pins), `{ malformed }` when the file
+ *   is unparseable or invalid at the file level, or `{ path, verdicts }` with a
+ *   per-phase verdict otherwise.
+ */
+export declare function evaluatePins(pipelineDir: string): Promise<PinsResult>;
+/** Evaluates every record and prevents one malformed record from coexisting with a current one. */
+export declare function evaluatePinFile(pipelineDir: string, file: PinFile): Promise<Record<string, PinVerdict>>;
+/**
+ * Evaluates one phase's pin record against the committed files (PIN-2..PIN-6,
+ * PIN-13).
+ *
+ * Structural defects are reported as `malformed` before currency is judged, so a
+ * record that is both malformed and stale reports `malformed`.
+ */
+export declare function evaluatePin(pipelineDir: string, file: PinFile, phase: string, record: PinRecord): Promise<PinVerdict>;
+/**
+ * Checks the canonical reviewed bundle layout beside a linked playbook entry.
+ * The tree hash binds every byte; these required siblings ensure that the tree
+ * being reviewed is actually the runnable FSM/GEARS/verification bundle.
+ */
+export declare function artifactBundleLayoutIssue(bundleRoot: string, artifactPath: string): Promise<string | null>;
+/**
+ * Deterministic `sha256:` tree hash of a directory: every file's sorted relative
+ * POSIX path and exact-byte content hash, so any added, removed, renamed, or
+ * edited file changes the digest (DR-007).
+ */
+export interface TreeHashOptions {
+    /** Artifact bundles reject links; generic directory/package identities record them. */
+    rejectSymlinks?: boolean;
+}
+export declare function hashTree(root: string, opts?: TreeHashOptions): Promise<string>;
+//# sourceMappingURL=pin-currency.d.ts.map

package/dist/pin-currency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-currency.d.ts","sourceRoot":"","sources":["../src/pin-currency.ts"],"names":[],"mappings":"AAsCA,OAAO,EAIL,KAAK,OAAO,EAGZ,KAAK,SAAS,EAEf,MAAM,WAAW,CAAC;AAMnB,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtC,oGAAoG;IACpG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAiB3E;AAED,mGAAmG;AACnG,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAqBrC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,UAAU,CAAC,CAoHrB;AAyFD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyBxB;AAmJD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAkCD,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,MAAM,CAAC,CAuBjB"}

package/dist/pin-currency.js

@@ -0,0 +1,435 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2026 SubLang International <https://sublang.ai>
+/**
+ * Pin-currency engine: the per-phase verdict that drives compiled selection
+ * (PIN-1..PIN-6, PIN-13; DR-007).
+ *
+ * Given a pipeline directory, {@link evaluatePins} loads `slc.pins.json` and, for
+ * each pinned phase, combines the validator stages into a verdict: `current` when
+ * every recorded input matches, `stale` (naming the changed input) when a hash or
+ * the semantic-input closure no longer matches, and `malformed` (naming the
+ * field) when a recorded hash, path, external input, or link-target identity is
+ * structurally invalid or the pin file itself is unparseable. An absent
+ * `slc.pins.json` yields no verdicts — every phase is unpinned. Validation is
+ * deterministic and reads only committed bytes; it issues no network request. A
+ * file link target is verified by exact-byte hash and a directory or package
+ * target by a deterministic `sha256:` tree hash over its files' sorted relative
+ * paths and contents. Beyond existing and matching its recorded hash, the
+ * compiled artifact must resolve to the linked `playbook` format — a module
+ * exposing the runtime factory — or the phase is stale (PIN-13). See
+ * specs/dev/pinning.md.
+ */
+import { lstat, readFile, readdir, readlink } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep, } from 'node:path';
+import { hashBytes, hashFile, isHash } from './hash.js';
+import { resolvesToPlaybook } from './phase-runner.js';
+import { closureMatchesRecord } from './pin-closure.js';
+import { resolvePinPath } from './pin-paths.js';
+import { PinError, loadPinFile, } from './pins.js';
+import { isBarePackageSpecifier, resolveRuntimePackage, } from './runtime-package.js';
+/**
+ * Evaluates every pin in `<pipelineDir>/slc.pins.json` (PIN-1..PIN-6).
+ *
+ * @returns `{}` when the file is absent (no pins), `{ malformed }` when the file
+ *   is unparseable or invalid at the file level, or `{ path, verdicts }` with a
+ *   per-phase verdict otherwise.
+ */
+export async function evaluatePins(pipelineDir) {
+    let loaded;
+    try {
+        loaded = await loadPinFile(pipelineDir);
+    }
+    catch (error) {
+        if (error instanceof PinError) {
+            return { malformed: error.message };
+        }
+        throw error;
+    }
+    if (loaded.file === undefined) {
+        return {};
+    }
+    const verdicts = await evaluatePinFile(pipelineDir, loaded.file);
+    return { path: loaded.path, verdicts };
+}
+/** Evaluates every record and prevents one malformed record from coexisting with a current one. */
+export async function evaluatePinFile(pipelineDir, file) {
+    const verdicts = {};
+    for (const [phase, record] of Object.entries(file.pins)) {
+        verdicts[phase] = await evaluatePin(pipelineDir, file, phase, record);
+    }
+    const malformedPhase = Object.entries(verdicts).find(([, verdict]) => verdict.status === 'malformed');
+    if (malformedPhase !== undefined) {
+        const [phase, verdict] = malformedPhase;
+        const reason = `pin index contains malformed phase "${phase}": ${verdict.reason}`;
+        for (const [name, candidate] of Object.entries(verdicts)) {
+            if (candidate.status === 'current') {
+                verdicts[name] = malformed(reason);
+            }
+        }
+    }
+    return verdicts;
+}
+/**
+ * Evaluates one phase's pin record against the committed files (PIN-2..PIN-6,
+ * PIN-13).
+ *
+ * Structural defects are reported as `malformed` before currency is judged, so a
+ * record that is both malformed and stale reports `malformed`.
+ */
+export async function evaluatePin(pipelineDir, file, phase, record) {
+    const boundary = file.pathBoundary.path;
+    try {
+        // Structural (malformed) checks first.
+        for (const [field, ref] of recordedFileRefs(record)) {
+            if (!isHash(ref.hash)) {
+                return malformed(`${field} hash is not a sha256 hash`);
+            }
+        }
+        if (!isHash(record.artifactBundle.hash)) {
+            return malformed('artifactBundle hash is not a sha256 hash');
+        }
+        const phaseMalformed = phaseRecordMalformed(phase, record);
+        if (phaseMalformed !== null) {
+            return malformed(phaseMalformed);
+        }
+        const linkMalformed = linkTargetMalformed(record.linkTarget);
+        if (linkMalformed !== null) {
+            return malformed(linkMalformed);
+        }
+        const externalMalformed = externalInputsMalformed(record.externalInputs);
+        if (externalMalformed !== null) {
+            return malformed(externalMalformed);
+        }
+        for (let index = 0; index < record.runtimeDependencies.length; index++) {
+            const dependencyMalformed = runtimeDependencyMalformed(record.runtimeDependencies[index], `runtimeDependencies[${index}]`);
+            if (dependencyMalformed !== null)
+                return malformed(dependencyMalformed);
+        }
+        const bundleMalformed = artifactBundleMalformed(pipelineDir, boundary, record);
+        if (bundleMalformed !== null) {
+            return malformed(bundleMalformed);
+        }
+        // Currency (stale) checks. resolvePinPath throws PinError for a bad path,
+        // which the catch below maps to malformed (PIN-5).
+        for (const [field, ref] of recordedFileRefs(record)) {
+            const reason = await fileStale(pipelineDir, boundary, ref, field);
+            if (reason !== null) {
+                return stale(reason);
+            }
+        }
+        const bundleReason = await treeStale(pipelineDir, boundary, record.artifactBundle, 'artifactBundle');
+        if (bundleReason !== null) {
+            return stale(bundleReason);
+        }
+        const bundleLayout = await artifactBundleLayoutIssue(resolvePinPath(pipelineDir, boundary, record.artifactBundle.path, 'artifactBundle'), resolvePinPath(pipelineDir, boundary, record.artifact.path, 'artifact'));
+        if (bundleLayout !== null) {
+            return stale(bundleLayout);
+        }
+        // The hash-verified artifact must resolve to the linked `phase` format (PIN-13).
+        const artifactFormat = await artifactFormatStale(pipelineDir, boundary, record.artifact);
+        if (artifactFormat !== null) {
+            return stale(artifactFormat);
+        }
+        if (!(await closureMatchesRecord(pipelineDir, boundary, record))) {
+            return stale("the semantic-input closure differs from the definition's ## Pin Inputs");
+        }
+        const linkStale = await linkTargetStale(pipelineDir, boundary, record.linkTarget);
+        if (linkStale !== null) {
+            return stale(linkStale);
+        }
+        for (let index = 0; index < record.runtimeDependencies.length; index++) {
+            const resolutionStale = runtimeDependencyResolutionStale(pipelineDir, boundary, record.artifact, record.runtimeDependencies[index], `runtimeDependencies[${index}]`);
+            if (resolutionStale !== null)
+                return stale(resolutionStale);
+            const dependencyStale = await linkTargetStale(pipelineDir, boundary, record.runtimeDependencies[index], `runtimeDependencies[${index}]`);
+            if (dependencyStale !== null)
+                return stale(dependencyStale);
+        }
+        return { status: 'current' };
+    }
+    catch (error) {
+        if (error instanceof PinError) {
+            return malformed(error.message);
+        }
+        throw error;
+    }
+}
+function phaseRecordMalformed(phase, record) {
+    const expectedDefinition = `${phase}.md`;
+    const expectedBundle = `${phase}.slc`;
+    const expectedArtifact = `${expectedBundle}/${phase}.playbook.ts`;
+    if (record.definition.path !== expectedDefinition) {
+        return `pin key "${phase}" requires definition path "${expectedDefinition}"`;
+    }
+    if (record.artifactBundle.path !== expectedBundle) {
+        return `pin key "${phase}" requires artifactBundle path "${expectedBundle}"`;
+    }
+    if (record.artifact.path !== expectedArtifact) {
+        return `pin key "${phase}" requires artifact path "${expectedArtifact}"`;
+    }
+    return null;
+}
+function* recordedFileRefs(record) {
+    yield ['definition', record.definition];
+    yield ['artifact', record.artifact];
+    for (const input of record.semanticInputs) {
+        yield [`semanticInput ${input.path}`, input];
+    }
+}
+async function fileStale(pipelineDir, boundary, ref, field) {
+    const resolved = resolvePinPath(pipelineDir, boundary, ref.path, field);
+    const current = await hashFileOrNull(resolved);
+    if (current === null) {
+        return `${field} is missing or unreadable (${ref.path})`;
+    }
+    if (current !== ref.hash) {
+        return `${field} changed (${ref.path})`;
+    }
+    return null;
+}
+async function treeStale(pipelineDir, boundary, ref, field) {
+    const resolved = resolvePinPath(pipelineDir, boundary, ref.path, field);
+    let current;
+    try {
+        current = await hashTree(resolved, { rejectSymlinks: true });
+    }
+    catch {
+        return `${field} is missing, unreadable, or contains an unsupported entry (${ref.path})`;
+    }
+    if (current !== ref.hash) {
+        return `${field} changed (${ref.path})`;
+    }
+    return null;
+}
+function artifactBundleMalformed(pipelineDir, boundary, record) {
+    const artifact = resolvePinPath(pipelineDir, boundary, record.artifact.path, 'artifact');
+    const bundle = resolvePinPath(pipelineDir, boundary, record.artifactBundle.path, 'artifactBundle');
+    const rel = relative(bundle, artifact);
+    return rel !== '' &&
+        rel !== '..' &&
+        !rel.startsWith(`..${sep}`) &&
+        !isAbsolute(rel) &&
+        dirname(rel) === '.'
+        ? null
+        : 'artifact must be a direct child of artifactBundle';
+}
+/**
+ * Checks the canonical reviewed bundle layout beside a linked playbook entry.
+ * The tree hash binds every byte; these required siblings ensure that the tree
+ * being reviewed is actually the runnable FSM/GEARS/verification bundle.
+ */
+export async function artifactBundleLayoutIssue(bundleRoot, artifactPath) {
+    const entry = basename(artifactPath);
+    if (!entry.endsWith('.playbook.ts')) {
+        return `artifact is not a canonical .playbook.ts entry module (${entry})`;
+    }
+    const base = entry.slice(0, -'.playbook.ts'.length);
+    const required = [
+        `${base}.fsm.ts`,
+        `${base}.gears.md`,
+        `${base}.gears-fsm.test.ts`,
+        `${base}.fsm.introspect.test.ts`,
+        `${base}.prompt-contract.test.ts`,
+        `${base}.fsm.coverage.test.ts`,
+    ];
+    for (const sibling of required) {
+        try {
+            const info = await lstat(join(bundleRoot, sibling));
+            if (!info.isFile() || info.isSymbolicLink()) {
+                return `artifactBundle required sibling is not a regular file (${sibling})`;
+            }
+        }
+        catch {
+            return `artifactBundle is missing required sibling (${sibling})`;
+        }
+    }
+    return null;
+}
+/**
+ * Returns a stale reason when the compiled artifact's bytes do not resolve to the
+ * linked `playbook` format, or `null` when they do (PIN-13). The caller has already
+ * verified the artifact exists and matches its recorded hash.
+ */
+async function artifactFormatStale(pipelineDir, boundary, artifact) {
+    const resolved = resolvePinPath(pipelineDir, boundary, artifact.path, 'artifact');
+    let source;
+    try {
+        source = await readFile(resolved, 'utf8');
+    }
+    catch {
+        return `artifact is unreadable (${artifact.path})`;
+    }
+    if (!resolved.endsWith('.playbook.ts')) {
+        return `artifact is not a linked playbook .playbook.ts entry module (${artifact.path})`;
+    }
+    if (!resolvesToPlaybook(source)) {
+        return `artifact does not resolve to the linked playbook format (${artifact.path})`;
+    }
+    return null;
+}
+function linkTargetMalformed(linkTarget, field = 'linkTarget') {
+    // The validator's link-target identity is a sha256 content hash (file) or
+    // sha256 tree hash (directory/package), so it must be `sha256:<hex>`.
+    if (!isHash(linkTarget.identity)) {
+        return `${field}.identity is not a sha256 hash`;
+    }
+    return null;
+}
+function runtimeDependencyMalformed(dependency, field) {
+    const targetMalformed = linkTargetMalformed(dependency, field);
+    if (targetMalformed !== null)
+        return targetMalformed;
+    if (dependency.kind === 'package' &&
+        (typeof dependency.specifier !== 'string' ||
+            !isBarePackageSpecifier(dependency.specifier))) {
+        return `${field}.specifier must be a bare package specifier`;
+    }
+    if (dependency.kind !== 'package' && dependency.specifier !== undefined) {
+        return `${field}.specifier is only valid for a package dependency`;
+    }
+    return null;
+}
+function runtimeDependencyResolutionStale(pipelineDir, boundary, artifact, dependency, field) {
+    if (dependency.kind !== 'package' || dependency.specifier === undefined) {
+        return null;
+    }
+    const artifactPath = resolvePinPath(pipelineDir, boundary, artifact.path, 'artifact');
+    const recordedRoot = resolvePinPath(pipelineDir, boundary, dependency.locator, `${field}.locator`);
+    let selectedRoot;
+    try {
+        selectedRoot = resolveRuntimePackage(artifactPath, dependency.specifier).root;
+    }
+    catch {
+        return `${field} import no longer resolves (${dependency.specifier})`;
+    }
+    return resolve(selectedRoot) === resolve(recordedRoot)
+        ? null
+        : `${field} resolution changed (${dependency.specifier})`;
+}
+async function linkTargetStale(pipelineDir, boundary, linkTarget, field = 'linkTarget') {
+    const resolved = resolvePinPath(pipelineDir, boundary, linkTarget.locator, `${field}.locator`);
+    const current = linkTarget.kind === 'file'
+        ? await hashFileOrNull(resolved)
+        : await hashTreeOrNull(resolved);
+    if (current === null) {
+        return `${field} is missing or unreadable (${linkTarget.locator})`;
+    }
+    if (current !== linkTarget.identity) {
+        return `${field} changed (${linkTarget.locator})`;
+    }
+    return null;
+}
+function externalInputsMalformed(externalInputs) {
+    for (let index = 0; index < externalInputs.length; index++) {
+        const identity = externalInputs[index].identity;
+        // A well-formed immutable content-addressed identity is the validator's own
+        // sha256:<hex> form; broader digest schemes await a future DR (DR-007).
+        if (typeof identity !== 'string' || !isHash(identity)) {
+            return `externalInputs[${index}] must carry a well-formed immutable content-addressed identity (sha256:<hex>), not a mutable reference`;
+        }
+    }
+    return null;
+}
+async function hashFileOrNull(resolved) {
+    try {
+        return await hashFile(resolved);
+    }
+    catch {
+        return null;
+    }
+}
+function canonicalJsonString(value) {
+    let serialized = '"';
+    for (const character of value) {
+        const codePoint = character.codePointAt(0);
+        if (codePoint === undefined)
+            continue;
+        if (codePoint >= 0xd800 && codePoint <= 0xdfff) {
+            throw new Error('tree entry contains an unpaired Unicode surrogate');
+        }
+        if (character === '"' || character === '\\') {
+            serialized += `\\${character}`;
+        }
+        else if (codePoint <= 0x1f) {
+            serialized += `\\u${codePoint.toString(16).padStart(4, '0')}`;
+        }
+        else {
+            serialized += character;
+        }
+    }
+    return `${serialized}"`;
+}
+function serializeTreeRecord(kind, path, identity) {
+    return `[${canonicalJsonString(kind)},${canonicalJsonString(path)},${canonicalJsonString(identity)}]`;
+}
+export async function hashTree(root, opts = {}) {
+    const rootInfo = await lstat(root);
+    const records = [];
+    if (rootInfo.isSymbolicLink()) {
+        if (opts.rejectSymlinks === true) {
+            throw new Error('tree root is a symbolic link');
+        }
+        records.push(await symlinkRecord(root, '.'));
+    }
+    else if (!rootInfo.isDirectory()) {
+        throw new Error('tree root is not a real directory');
+    }
+    await collectTreeRecords(root, '', records, opts);
+    records.sort((left, right) => Buffer.compare(Buffer.from(left.path, 'utf8'), Buffer.from(right.path, 'utf8')));
+    return hashBytes(new TextEncoder().encode(records.map((record) => record.serialized).join('\n')));
+}
+async function hashTreeOrNull(root) {
+    try {
+        return await hashTree(root);
+    }
+    catch {
+        return null;
+    }
+}
+async function collectTreeRecords(root, prefix, records, opts) {
+    const here = prefix ? join(root, ...prefix.split('/')) : root;
+    const entries = await readdir(here, {
+        withFileTypes: true,
+        encoding: 'buffer',
+    });
+    for (const entry of entries) {
+        const rawName = entry.name;
+        const name = rawName.toString('utf8');
+        if (!Buffer.from(name, 'utf8').equals(rawName)) {
+            throw new Error('tree contains a filename that is not valid UTF-8');
+        }
+        const rel = prefix ? `${prefix}/${name}` : name;
+        if (entry.isDirectory()) {
+            await collectTreeRecords(root, rel, records, opts);
+        }
+        else if (entry.isFile()) {
+            records.push({
+                path: rel,
+                serialized: serializeTreeRecord('file', rel, await hashFile(join(root, ...rel.split('/')))),
+            });
+        }
+        else if (entry.isSymbolicLink()) {
+            if (opts.rejectSymlinks === true) {
+                throw new Error(`tree contains a symbolic link: ${rel}`);
+            }
+            records.push(await symlinkRecord(join(root, ...rel.split('/')), rel));
+        }
+        else {
+            throw new Error(`tree contains an unsupported entry: ${rel}`);
+        }
+    }
+}
+async function symlinkRecord(path, relativePath) {
+    const target = await readlink(path, { encoding: 'buffer' });
+    return {
+        path: relativePath,
+        serialized: serializeTreeRecord('symlink', relativePath, target.toString('hex')),
+    };
+}
+function stale(reason) {
+    return { status: 'stale', reason };
+}
+function malformed(reason) {
+    return { status: 'malformed', reason };
+}
+//# sourceMappingURL=pin-currency.js.map

package/dist/pin-currency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-currency.js","sourceRoot":"","sources":["../src/pin-currency.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,0EAA0E;AAE1E;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,QAAQ,EACR,OAAO,EACP,UAAU,EACV,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,GAAG,GACJ,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EACL,QAAQ,EACR,WAAW,GAOZ,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAkB9B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,WAAmB;IACpD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAmB,EACnB,IAAa;IAEb,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,KAAK,CAAC,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClD,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,CAChD,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,cAGxB,CAAC;QACF,MAAM,MAAM,GAAG,uCAAuC,KAAK,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAClF,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,WAAmB,EACnB,IAAa,EACb,KAAa,EACb,MAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,uCAAuC;QACvC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,cAAc,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC,cAAc,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACzE,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACvE,MAAM,mBAAmB,GAAG,0BAA0B,CACpD,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EACjC,uBAAuB,KAAK,GAAG,CAChC,CAAC;YACF,IAAI,mBAAmB,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,eAAe,GAAG,uBAAuB,CAC7C,WAAW,EACX,QAAQ,EACR,MAAM,CACP,CAAC;QACF,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,eAAe,CAAC,CAAC;QACpC,CAAC;QAED,0EAA0E;QAC1E,mDAAmD;QACnD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAClE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,SAAS,CAClC,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,cAAc,EACrB,gBAAgB,CACjB,CAAC;QACF,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAClD,cAAc,CACZ,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,cAAc,CAAC,IAAI,EAC1B,gBAAgB,CACjB,EACD,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CACxE,CAAC;QACF,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7B,CAAC;QACD,iFAAiF;QACjF,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAC9C,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,QAAQ,CAChB,CAAC;QACF,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,KAAK,CACV,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,eAAe,CACrC,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,UAAU,CAClB,CAAC;QACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACvE,MAAM,eAAe,GAAG,gCAAgC,CACtD,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EACjC,uBAAuB,KAAK,GAAG,CAChC,CAAC;YACF,IAAI,eAAe,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,MAAM,eAAe,CAC3C,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EACjC,uBAAuB,KAAK,GAAG,CAChC,CAAC;YACF,IAAI,eAAe,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC,eAAe,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,MAAiB;IAC5D,MAAM,kBAAkB,GAAG,GAAG,KAAK,KAAK,CAAC;IACzC,MAAM,cAAc,GAAG,GAAG,KAAK,MAAM,CAAC;IACtC,MAAM,gBAAgB,GAAG,GAAG,cAAc,IAAI,KAAK,cAAc,CAAC;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAClD,OAAO,YAAY,KAAK,+BAA+B,kBAAkB,GAAG,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAClD,OAAO,YAAY,KAAK,mCAAmC,cAAc,GAAG,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9C,OAAO,YAAY,KAAK,6BAA6B,gBAAgB,GAAG,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,QAAQ,CAAC,CAAC,gBAAgB,CAAC,MAAiB;IAC1C,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,CAAC,iBAAiB,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,WAAmB,EACnB,QAAgB,EAChB,GAAe,EACf,KAAa;IAEb,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,8BAA8B,GAAG,CAAC,IAAI,GAAG,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,GAAG,KAAK,aAAa,GAAG,CAAC,IAAI,GAAG,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,WAAmB,EACnB,QAAgB,EAChB,GAAe,EACf,KAAa;IAEb,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,KAAK,8DAA8D,GAAG,CAAC,IAAI,GAAG,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,GAAG,KAAK,aAAa,GAAG,CAAC,IAAI,GAAG,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAC9B,WAAmB,EACnB,QAAgB,EAChB,MAAiB;IAEjB,MAAM,QAAQ,GAAG,cAAc,CAC7B,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,QAAQ,CAAC,IAAI,EACpB,UAAU,CACX,CAAC;IACF,MAAM,MAAM,GAAG,cAAc,CAC3B,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,cAAc,CAAC,IAAI,EAC1B,gBAAgB,CACjB,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,EAAE;QACf,GAAG,KAAK,IAAI;QACZ,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3B,CAAC,UAAU,CAAC,GAAG,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;QACpB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,mDAAmD,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAkB,EAClB,YAAoB;IAEpB,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,OAAO,0DAA0D,KAAK,GAAG,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,SAAS;QAChB,GAAG,IAAI,WAAW;QAClB,GAAG,IAAI,oBAAoB;QAC3B,GAAG,IAAI,yBAAyB;QAChC,GAAG,IAAI,0BAA0B;QACjC,GAAG,IAAI,uBAAuB;KAC/B,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC5C,OAAO,0DAA0D,OAAO,GAAG,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,+CAA+C,OAAO,GAAG,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAChC,WAAmB,EACnB,QAAgB,EAChB,QAAoB;IAEpB,MAAM,QAAQ,GAAG,cAAc,CAC7B,WAAW,EACX,QAAQ,EACR,QAAQ,CAAC,IAAI,EACb,UAAU,CACX,CAAC;IACF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,QAAQ,CAAC,IAAI,GAAG,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,OAAO,gEAAgE,QAAQ,CAAC,IAAI,GAAG,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,4DAA4D,QAAQ,CAAC,IAAI,GAAG,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAyB,EACzB,KAAK,GAAG,YAAY;IAEpB,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,GAAG,KAAK,gCAAgC,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAgC,EAChC,KAAa;IAEb,MAAM,eAAe,GAAG,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IACrD,IACE,UAAU,CAAC,IAAI,KAAK,SAAS;QAC7B,CAAC,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ;YACvC,CAAC,sBAAsB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAChD,CAAC;QACD,OAAO,GAAG,KAAK,6CAA6C,CAAC;IAC/D,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,GAAG,KAAK,mDAAmD,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gCAAgC,CACvC,WAAmB,EACnB,QAAgB,EAChB,QAAoB,EACpB,UAAgC,EAChC,KAAa;IAEb,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,cAAc,CACjC,WAAW,EACX,QAAQ,EACR,QAAQ,CAAC,IAAI,EACb,UAAU,CACX,CAAC;IACF,MAAM,YAAY,GAAG,cAAc,CACjC,WAAW,EACX,QAAQ,EACR,UAAU,CAAC,OAAO,EAClB,GAAG,KAAK,UAAU,CACnB,CAAC;IACF,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,qBAAqB,CAClC,YAAY,EACZ,UAAU,CAAC,SAAS,CACrB,CAAC,IAAI,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,KAAK,+BAA+B,UAAU,CAAC,SAAS,GAAG,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC;QACpD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG,KAAK,wBAAwB,UAAU,CAAC,SAAS,GAAG,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,QAAgB,EAChB,UAAyB,EACzB,KAAK,GAAG,YAAY;IAEpB,MAAM,QAAQ,GAAG,cAAc,CAC7B,WAAW,EACX,QAAQ,EACR,UAAU,CAAC,OAAO,EAClB,GAAG,KAAK,UAAU,CACnB,CAAC;IACF,MAAM,OAAO,GACX,UAAU,CAAC,IAAI,KAAK,MAAM;QACxB,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC;QAChC,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,8BAA8B,UAAU,CAAC,OAAO,GAAG,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QACpC,OAAO,GAAG,KAAK,aAAa,UAAU,CAAC,OAAO,GAAG,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAC9B,cAAkC;IAElC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QAChD,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAO,kBAAkB,KAAK,yGAAyG,CAAC;QAC1I,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAiBD,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,SAAS,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5C,UAAU,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,CAAC;aAAM,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7B,UAAU,IAAI,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,UAAU,IAAI,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,UAAU,GAAG,CAAC;AAC1B,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAwB,EACxB,IAAY,EACZ,QAAgB;IAEhB,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,OAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3B,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAChC,CACF,CAAC;IACF,OAAO,SAAS,CACd,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACtD,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,MAAc,EACd,OAAqB,EACrB,IAAqB;IAErB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;QAClC,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,GAAG;gBACT,UAAU,EAAE,mBAAmB,CAC7B,MAAM,EACN,GAAG,EACH,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAC9C;aACF,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,YAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5D,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,mBAAmB,CAC7B,SAAS,EACT,YAAY,EACZ,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CACvB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC"}

package/dist/pin-generate.d.ts

@@ -0,0 +1,46 @@
+import { type PinExternalInput, type PinLinkTarget, type PinProducer, type PinRecord, type PinRuntimeDependency } from './pins.js';
+/** The committed inputs that produced one compiled phase, to pin (DR-007). */
+export interface PinSpec {
+    /** Pipeline-dir-relative path to the phase definition. */
+    definition: string;
+    /** Pipeline-dir-relative path to the compiled `.playbook.ts` entry module. */
+    artifact: string;
+    /** Pipeline-dir-relative directory containing the reviewed artifact and its local modules/tests. */
+    artifactBundle: string;
+    /** The link target the artifact was linked against. */
+    linkTarget: {
+        kind: PinLinkTarget['kind'];
+        locator: string;
+        provenance?: string;
+    };
+    /** Descriptive roles for semantic-input files, keyed by their pipeline-relative path. */
+    roles?: Readonly<Record<string, string>>;
+    /** Immutable content-addressed external inputs, if any. */
+    externalInputs?: readonly PinExternalInput[];
+    /** Local executable dependencies loaded by the compiled artifact. */
+    runtimeDependencies?: readonly Omit<PinRuntimeDependency, 'identity'>[];
+    /** Provenance of the producing run; never a currency input. */
+    producer?: PinProducer;
+}
+/** Options for pin generation (PIN-15). */
+export interface PinGenerateOptions {
+    /**
+     * The recorded path boundary, a relative POSIX path from the pipeline
+     * directory; defaults to `.`. A wider boundary (e.g. `../..`) lets a pin
+     * record a link target outside the pipeline directory, such as the installed
+     * package module the artifacts were linked against.
+     */
+    boundary?: string;
+}
+/**
+ * Generates a current {@link PinRecord} for one phase from its committed inputs
+ * (PIN-15). The definition is recorded separately; the rest of its `## Pin Inputs`
+ * closure becomes the enumerated `semanticInputs`.
+ */
+export declare function generatePinRecord(pipelineDir: string, spec: PinSpec, opts?: PinGenerateOptions): Promise<PinRecord>;
+/**
+ * Writes the pin index `<pipelineDir>/slc.pins.json` for the given phase records
+ * and returns its path (PIN-15).
+ */
+export declare function writePinFile(pipelineDir: string, pins: Readonly<Record<string, PinRecord>>, opts?: PinGenerateOptions): Promise<string>;
+//# sourceMappingURL=pin-generate.d.ts.map

package/dist/pin-generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-generate.d.ts","sourceRoot":"","sources":["../src/pin-generate.ts"],"names":[],"mappings":"AAyBA,OAAO,EAKL,KAAK,gBAAgB,EAErB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,oBAAoB,EAC1B,MAAM,WAAW,CAAC;AAGnB,8EAA8E;AAC9E,MAAM,WAAW,OAAO;IACtB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,cAAc,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,UAAU,EAAE;QACV,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,yFAAyF;IACzF,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzC,2DAA2D;IAC3D,cAAc,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC7C,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,SAAS,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,EAAE,CAAC;IACxE,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAKD,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,OAAO,EACb,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,SAAS,CAAC,CAoIpB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EACzC,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAUjB"}