@svp-labs/talos 0.0.0 → 0.1.1

package/dist/version/launch.js

@@ -0,0 +1,104 @@
+import { spawn } from 'node:child_process';
+import { z } from 'zod';
+import { enforcedRelease } from './enforced.js';
+import { ensureVerified } from './install.js';
+import {} from './release.js';
+import { ownInstallMarker, ownVersion } from './self.js';
+import { exec as realExec } from '../exec/exec.js';
+import { currentRepository, isRepoName } from '../github/remote.js';
+/**
+ * The commands that act on a repository at the version it enforces. The rest run as they are:
+ * `version`, `help` and `self-test` need no repository; `doctor` reports a mismatch instead of
+ * fixing it; `status` and `why` only read GitHub; `central`, `org`, `govern` and `new` act on
+ * the organisation from Talos's own jobs or the owner's machine.
+ */
+export const LAUNCHED_COMMANDS = new Set([
+    'check',
+    'run',
+    'plan',
+    'verdict',
+    'debt',
+    'configs',
+    'adopt',
+    'ticket',
+    'job',
+]);
+/** Whether this invocation must run at the enforced version rather than as it is. */
+export function needsLaunch(argv, env) {
+    if ((env.TALOS_LAUNCHED ?? '') !== '' || env.TALOS_DEV === '1')
+        return false;
+    const [command] = argv;
+    return command !== undefined && LAUNCHED_COMMANDS.has(command);
+}
+/** The `--repo owner/name` a command was given, which then names the repository to look up. */
+export function repoArgument(argv) {
+    for (const [index, arg] of argv.entries()) {
+        const value = arg === '--repo' ? argv[index + 1] : /^--repo=(.+)$/.exec(arg)?.[1];
+        if (value !== undefined && isRepoName(value))
+            return value;
+    }
+    return undefined;
+}
+const markerSchema = z.object({ version: z.string(), sha: z.string() });
+/** Whether `marker` says the running code is the verified install of `release`. */
+export function isVerifiedInstall(marker, running, release) {
+    const parsed = markerSchema.safeParse(marker);
+    return (running === release.version &&
+        parsed.success &&
+        parsed.data.version === release.version &&
+        parsed.data.sha === release.sha);
+}
+/** Runs a Talos entry point with this Node, its output on this terminal; resolves its exit code. */
+export function runNode(bin, argv, env) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, [bin, ...argv], { stdio: 'inherit', env });
+        child.on('error', reject);
+        child.on('exit', (code) => {
+            resolve(code ?? 1);
+        });
+    });
+}
+function defaultDeps() {
+    const env = process.env;
+    const cwd = process.cwd();
+    return {
+        env,
+        err: (text) => process.stderr.write(text),
+        resolve: async (argv) => enforcedRelease({
+            env,
+            repo: repoArgument(argv) ?? (await currentRepository(env, cwd, realExec)),
+        }),
+        isRunning: async (release) => isVerifiedInstall(await ownInstallMarker(), ownVersion(), release),
+        install: (release) => ensureVerified(release, { exec: realExec, fetch, env }),
+        run: runNode,
+    };
+}
+/** `launch` with its effects passed in. */
+export async function launchWith(argv, deps) {
+    if (!needsLaunch(argv, deps.env))
+        return undefined;
+    try {
+        const release = await deps.resolve(argv);
+        if (await deps.isRunning(release))
+            return undefined;
+        const installed = await deps.install(release);
+        return await deps.run(installed.bin, argv, {
+            ...deps.env,
+            TALOS_LAUNCHED: '1',
+            TALOS_VERSION: release.version,
+            TALOS_SHA: release.sha,
+        });
+    }
+    catch (error) {
+        deps.err(`talos: ${error instanceof Error ? error.message : String(error)}\n`);
+        return 2;
+    }
+}
+/**
+ * Runs the Talos version the repository's rulesets enforce when this isn't it, and
+ * returns its exit code; `undefined` means this process is the right version and goes on.
+ */
+export function launch(argv) {
+    return launchWith(argv, defaultDeps());
+}
+//# sourceMappingURL=launch.js.map

package/dist/version/launch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.js","sourceRoot":"","sources":["../../src/version/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAkB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAgB,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,OAAO;IACP,KAAK;IACL,MAAM;IACN,SAAS;IACT,MAAM;IACN,SAAS;IACT,OAAO;IACP,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,GAAQ;IAC3D,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACvB,OAAO,OAAO,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,YAAY,CAAC,IAAuB;IAClD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAExE,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,MAAe,EAAE,OAAe,EAAE,OAAgB;IAClF,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,CACL,OAAO,KAAK,OAAO,CAAC,OAAO;QAC3B,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAChC,CAAC;AACJ,CAAC;AAWD,oGAAoG;AACpG,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,IAAuB,EAAE,GAAQ;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,OAAO;QACL,GAAG;QACH,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACtB,eAAe,CAAC;YACd,GAAG;YACH,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;SAC1E,CAAC;QACJ,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAC3B,iBAAiB,CAAC,MAAM,gBAAgB,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC;QACpE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC7E,GAAG,EAAE,OAAO;KACb,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAuB,EACvB,IAAgB;IAEhB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;YACzC,GAAG,IAAI,CAAC,GAAG;YACX,cAAc,EAAE,GAAG;YACnB,aAAa,EAAE,OAAO,CAAC,OAAO;YAC9B,SAAS,EAAE,OAAO,CAAC,GAAG;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAuB;IAC5C,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/version/pin.js

@@ -0,0 +1,121 @@
+import { z } from 'zod';
+import { readFileAt } from '../github/contents.js';
+import { getRepository, propertyOf } from '../github/repos.js';
+import { getRuleset, listRulesets, requiredWorkflows } from '../github/rulesets.js';
+const CHANNELS = ['evaluate', 'canary', 'stable'];
+const SHA = /^[0-9a-f]{40}$/;
+const CHANNELS_FILE = 'channels.json';
+const CHANNELS_BRANCH = 'channels';
+const channelsSchema = z.object({
+    evaluate: z.string().regex(SHA),
+    canary: z.string().regex(SHA),
+    stable: z.string().regex(SHA),
+});
+function notFound(reason) {
+    return { found: false, reason };
+}
+export function asChannel(value) {
+    return CHANNELS.find((channel) => channel === value) ?? null;
+}
+export function lookupMode(env) {
+    const value = env.TALOS_LOOKUP;
+    if (value === undefined || value === '' || value === 'rulesets')
+        return 'rulesets';
+    if (value === 'channels')
+        return 'channels';
+    throw new TypeError(`TALOS_LOOKUP must be "rulesets" or "channels", not "${value}"`);
+}
+/** The pin among the rulesets that apply to a repository, by the Talos repository's id. */
+export function selectPin(rulesets, talosRepositoryId) {
+    const matches = rulesets
+        .filter((ruleset) => ruleset.enforcement !== 'disabled')
+        .map((ruleset) => ({
+        ruleset,
+        workflows: requiredWorkflows(ruleset).filter((w) => w.repository_id === talosRepositoryId),
+    }))
+        .filter((match) => match.workflows.length > 0);
+    const [match] = matches;
+    if (match === undefined) {
+        return notFound('no ruleset that applies to this repository runs the Talos gate');
+    }
+    if (matches.length > 1) {
+        const names = matches.map((m) => m.ruleset.name).join(', ');
+        return notFound(`${matches.length} Talos rulesets apply (${names}); exactly one must`);
+    }
+    const { ruleset, workflows } = match;
+    const shas = new Set(workflows.map((w) => w.sha));
+    const [workflow] = workflows;
+    if (shas.size > 1 || workflow === undefined) {
+        return notFound(`ruleset ${ruleset.name} pins Talos at ${shas.size} different commits`);
+    }
+    if (workflow.sha === undefined || !SHA.test(workflow.sha)) {
+        return notFound(`ruleset ${ruleset.name} runs Talos at a ref, not a commit SHA`);
+    }
+    return {
+        found: true,
+        pin: {
+            sha: workflow.sha,
+            source: ruleset.name,
+            enforcement: ruleset.enforcement,
+            path: workflow.path,
+            channel: asChannel(/^talos-(\w+)$/.exec(ruleset.name)?.[1]),
+        },
+    };
+}
+/** The pin from `channels.json` for the channel a repository's `talos` property names. */
+export function selectChannelPin(property, channels) {
+    if (property === undefined)
+        return notFound('the repository has no `talos` property');
+    const channel = asChannel(property);
+    if (channel === null)
+        return notFound(`the \`talos\` property is "${property}", not a channel`);
+    const parsed = channelsSchema.safeParse(channels);
+    if (!parsed.success)
+        return notFound(`${CHANNELS_FILE} does not map every channel to a commit`);
+    return {
+        found: true,
+        pin: {
+            sha: parsed.data[channel],
+            source: CHANNELS_FILE,
+            enforcement: channel === 'evaluate' ? 'evaluate' : 'active',
+            path: null,
+            channel,
+        },
+    };
+}
+function parseJson(text) {
+    if (text === undefined)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function pinFinder(gh, talosRepo, mode) {
+    let talosId;
+    let channels;
+    // Each shared read is awaited alongside the call's own, so a failure in either is handled.
+    const byRulesets = async (repo) => {
+        talosId ??= getRepository(gh, talosRepo).then((r) => r.id);
+        const [id, summaries] = await Promise.all([talosId, listRulesets(gh, repo)]);
+        const live = summaries.filter((summary) => summary.enforcement !== 'disabled');
+        const details = await Promise.all(live.map((summary) => getRuleset(gh, repo, summary.id)));
+        return selectPin(details, id);
+    };
+    const byChannels = async (repo) => {
+        channels ??= readFileAt(gh, talosRepo, CHANNELS_FILE, CHANNELS_BRANCH).then(parseJson);
+        const [file, repository] = await Promise.all([
+            channels,
+            typeof repo === 'string' ? getRepository(gh, repo) : repo,
+        ]);
+        return selectChannelPin(propertyOf(repository, 'talos'), file);
+    };
+    return (repo) => {
+        if (mode === 'channels')
+            return byChannels(repo);
+        return byRulesets(typeof repo === 'string' ? repo : repo.fullName);
+    };
+}
+//# sourceMappingURL=pin.js.map

package/dist/version/pin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin.js","sourceRoot":"","sources":["../../src/version/pin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAmB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAgB,MAAM,uBAAuB,CAAC;AAiBlG,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAkB3D,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAC7B,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;CAC9B,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAyB;IACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAiD;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACnF,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC5C,MAAM,IAAI,SAAS,CAAC,uDAAuD,KAAK,GAAG,CAAC,CAAC;AACvF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,SAAS,CAAC,QAA4B,EAAE,iBAAyB;IAC/E,MAAM,OAAO,GAAG,QAAQ;SACrB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,UAAU,CAAC;SACvD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjB,OAAO;QACP,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,iBAAiB,CAAC;KAC3F,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,0BAA0B,KAAK,qBAAqB,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC,WAAW,OAAO,CAAC,IAAI,kBAAkB,IAAI,CAAC,IAAI,oBAAoB,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC,WAAW,OAAO,CAAC,IAAI,wCAAwC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,GAAG,EAAE;YACH,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,OAAO,CAAC,IAAI;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,QAA4B,EAAE,QAAiB;IAC9E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,wCAAwC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,8BAA8B,QAAQ,kBAAkB,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC,GAAG,aAAa,yCAAyC,CAAC,CAAC;IAChG,OAAO;QACL,KAAK,EAAE,IAAI;QACX,GAAG,EAAE;YACH,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACzB,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YAC3D,IAAI,EAAE,IAAI;YACV,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAKD,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,SAAiB,EAAE,IAAgB;IACvE,IAAI,OAAoC,CAAC;IACzC,IAAI,QAAsC,CAAC;IAC3C,2FAA2F;IAC3F,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAsB,EAAE;QAC5D,OAAO,KAAK,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3F,OAAO,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,EAAE,IAAyB,EAAsB,EAAE;QACzE,QAAQ,KAAK,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,QAAQ;YACR,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;SAC1D,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC,CAAC;AACJ,CAAC"}

package/dist/version/provenance.js

@@ -0,0 +1,118 @@
+import { z } from 'zod';
+/** The package every Talos release is published as. */
+export const PACKAGE = '@svp-labs/talos';
+export const SLSA_PROVENANCE_V1 = 'https://slsa.dev/provenance/v1';
+const STATEMENT_V1 = 'https://in-toto.io/Statement/v1';
+const STATEMENT_PAYLOAD = 'application/vnd.in-toto+json';
+const GITHUB = 'https://github.com/';
+export class ProvenanceError extends Error {
+    name = 'ProvenanceError';
+}
+const attestationsSchema = z.object({
+    attestations: z.array(z.object({ predicateType: z.string(), bundle: z.unknown() })),
+});
+const bundleSchema = z.object({
+    dsseEnvelope: z.object({ payload: z.string(), payloadType: z.string() }),
+});
+const digestSchema = z.record(z.string(), z.string());
+const statementSchema = z.object({
+    _type: z.literal(STATEMENT_V1),
+    subject: z.array(z.object({ name: z.string(), digest: digestSchema })).min(1),
+    predicateType: z.literal(SLSA_PROVENANCE_V1),
+    predicate: z.object({
+        buildDefinition: z.object({
+            externalParameters: z.object({
+                workflow: z.object({ repository: z.string(), ref: z.string(), path: z.string() }),
+            }),
+            resolvedDependencies: z.array(z.object({ uri: z.string(), digest: digestSchema })),
+        }),
+    }),
+});
+function repositoryOf(url) {
+    return url.toLowerCase().startsWith(GITHUB) ? url.slice(GITHUB.length) : url;
+}
+function payloadOf(response) {
+    const parsed = attestationsSchema.safeParse(response);
+    if (!parsed.success)
+        throw new ProvenanceError('the registry returned no readable attestations');
+    const provenance = parsed.data.attestations.filter((attestation) => attestation.predicateType === SLSA_PROVENANCE_V1);
+    const [only] = provenance;
+    if (only === undefined || provenance.length > 1) {
+        throw new ProvenanceError(`expected one SLSA provenance attestation, found ${provenance.length}`);
+    }
+    const bundle = bundleSchema.safeParse(only.bundle);
+    if (!bundle.success)
+        throw new ProvenanceError('the provenance bundle has no DSSE envelope');
+    const envelope = bundle.data.dsseEnvelope;
+    if (envelope.payloadType !== STATEMENT_PAYLOAD) {
+        throw new ProvenanceError(`the provenance envelope carries ${envelope.payloadType}`);
+    }
+    return Buffer.from(envelope.payload, 'base64').toString('utf8');
+}
+/**
+ * The SLSA provenance among a package version's attestations, as npm's registry serves them
+ * (`/-/npm/v1/attestations/<name>@<version>`), decoded from its DSSE envelope. It reads the
+ * statement only: `npm audit signatures` is what verifies the envelope's signature.
+ */
+export function decodeProvenance(response) {
+    let statement;
+    try {
+        statement = JSON.parse(payloadOf(response));
+    }
+    catch (error) {
+        if (error instanceof ProvenanceError)
+            throw error;
+        throw new ProvenanceError('the provenance payload is not JSON');
+    }
+    const parsed = statementSchema.safeParse(statement);
+    if (!parsed.success) {
+        throw new ProvenanceError('the provenance is not an in-toto statement of SLSA provenance v1');
+    }
+    const { subject, predicate } = parsed.data;
+    const { workflow } = predicate.buildDefinition.externalParameters;
+    const sourcePrefix = `git+${workflow.repository}@`.toLowerCase();
+    const source = predicate.buildDefinition.resolvedDependencies.find((dependency) => dependency.uri.toLowerCase().startsWith(sourcePrefix));
+    return {
+        repository: repositoryOf(workflow.repository),
+        ref: workflow.ref,
+        workflow: workflow.path,
+        commit: source?.digest.gitCommit,
+        subjects: subject.map((s) => ({ name: s.name, sha512: s.digest.sha512 })),
+    };
+}
+/** The package URL a provenance subject names: `pkg:npm/%40svp-labs/talos@1.2.0`. */
+export function packageUrl(name, version) {
+    return `pkg:npm/${name.replace(/^@/, '%40')}@${version}`;
+}
+/** The SHA-512 of a Subresource Integrity string (`sha512-<base64>`) as hex. */
+export function integrityHex(integrity) {
+    const entry = integrity.split(/\s/).find((part) => part.startsWith('sha512-'));
+    if (entry === undefined)
+        return undefined;
+    const bytes = Buffer.from(entry.slice('sha512-'.length), 'base64');
+    return bytes.length === 64 ? bytes.toString('hex') : undefined;
+}
+/**
+ * Every way a provenance fails to describe the expected build; empty when it names the source
+ * repository, the pinned commit, and the very tarball that was installed.
+ */
+export function provenanceProblems(provenance, expected) {
+    const problems = [];
+    if (provenance.repository.toLowerCase() !== expected.repository.toLowerCase()) {
+        problems.push(`it was built from ${provenance.repository}, not ${expected.repository}`);
+    }
+    if (provenance.commit?.toLowerCase() !== expected.commit.toLowerCase()) {
+        problems.push(`it was built from commit ${provenance.commit ?? '(none named)'}, not ${expected.commit}`);
+    }
+    const name = packageUrl(expected.name, expected.version);
+    const subject = provenance.subjects.find((s) => s.name === name);
+    const digest = integrityHex(expected.integrity);
+    if (subject === undefined) {
+        problems.push(`it attests no ${name}`);
+    }
+    else if (digest === undefined || subject.sha512?.toLowerCase() !== digest) {
+        problems.push('the digest it attests is not the installed tarball’s');
+    }
+    return problems;
+}
+//# sourceMappingURL=provenance.js.map

package/dist/version/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/version/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,uDAAuD;AACvD,MAAM,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAEzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AACnE,MAAM,YAAY,GAAG,iCAAiC,CAAC;AACvD,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AACzD,MAAM,MAAM,GAAG,qBAAqB,CAAC;AAErC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACtB,IAAI,GAAG,iBAAiB,CAAC;CAC5C;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;CACpF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACzE,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAEtD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC;gBAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;aAClF,CAAC;YACF,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;SACnF,CAAC;KACH,CAAC;CACH,CAAC,CAAC;AAcH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,QAAiB;IAClC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,gDAAgD,CAAC,CAAC;IACjG,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAChD,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,aAAa,KAAK,kBAAkB,CAClE,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACvB,mDAAmD,UAAU,CAAC,MAAM,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,4CAA4C,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;IAC1C,IAAI,QAAQ,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC/C,MAAM,IAAI,eAAe,CAAC,mCAAmC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,kEAAkE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3C,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,eAAe,CAAC,kBAAkB,CAAC;IAClE,MAAM,YAAY,GAAG,OAAO,QAAQ,CAAC,UAAU,GAAG,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAChF,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CACtD,CAAC;IACF,OAAO;QACL,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7C,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS;QAChC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe;IACtD,OAAO,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAsB,EAAE,QAAuB;IAChF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9E,QAAQ,CAAC,IAAI,CAAC,qBAAqB,UAAU,CAAC,UAAU,SAAS,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CACX,4BAA4B,UAAU,CAAC,MAAM,IAAI,cAAc,SAAS,QAAQ,CAAC,MAAM,EAAE,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC5E,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/version/release.js

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+import { VersionError } from './errors.js';
+import { PACKAGE } from './provenance.js';
+import { readFileAt } from '../github/contents.js';
+/** An exact `X.Y.Z` with an optional pre-release: what a release tag's `package.json` holds. */
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const COMMIT = /^[0-9a-f]{40}$/;
+const manifestSchema = z.object({ name: z.literal(PACKAGE), version: z.string().regex(VERSION) });
+/** The version in a `package.json`'s text, if it is Talos's. */
+export function versionOf(text) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    const parsed = manifestSchema.safeParse(raw);
+    return parsed.success ? parsed.data.version : undefined;
+}
+/**
+ * The version a pin enforces: pins only point at release-tag commits, so `package.json` at the
+ * pinned commit names the release.
+ */
+export async function versionAt(gh, talosRepo, sha) {
+    const text = await readFileAt(gh, talosRepo, 'package.json', sha);
+    const version = text === undefined ? undefined : versionOf(text);
+    if (version === undefined) {
+        throw new VersionError(`${talosRepo} has no ${PACKAGE} package.json at ${sha.slice(0, 12)}`);
+    }
+    return version;
+}
+/** `TALOS_VERSION` and `TALOS_SHA`, which Thea's hub hands to tasks that hold no credentials. */
+export function releaseFromEnvironment(env) {
+    const version = env.TALOS_VERSION ?? '';
+    const sha = env.TALOS_SHA ?? '';
+    if (version === '' && sha === '')
+        return undefined;
+    if (!VERSION.test(version) || !COMMIT.test(sha)) {
+        throw new VersionError('TALOS_VERSION and TALOS_SHA must be set together: a release version and its 40-hex commit');
+    }
+    return { version, sha };
+}
+//# sourceMappingURL=release.js.map

package/dist/version/release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.js","sourceRoot":"","sources":["../../src/version/release.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,gGAAgG;AAChG,MAAM,OAAO,GAAG,qCAAqC,CAAC;AACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAIhC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAElG,gEAAgE;AAChE,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAU,EAAE,SAAiB,EAAE,GAAW;IACxE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CAAC,GAAG,SAAS,WAAW,OAAO,oBAAoB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,GAAiD;IAEjD,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IAChC,IAAI,OAAO,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CACpB,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1B,CAAC"}

package/dist/version/self.js

@@ -0,0 +1,55 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { z } from 'zod';
+/** The version of the Talos package this code was published as. */
+export function ownVersion() {
+    const text = readFileSync(new URL('../../package.json', import.meta.url), 'utf8');
+    const parsed = JSON.parse(text);
+    return typeof parsed.version === 'string' ? parsed.version : '0.0.0';
+}
+/**
+ * A digest of the code this runs from, every file of the build beside it: what tells one build of
+ * a version from the next while Talos itself is changed.
+ */
+export async function ownBuild() {
+    const root = fileURLToPath(new URL('../', import.meta.url));
+    const entries = await readdir(root, { recursive: true, withFileTypes: true });
+    const files = entries
+        .filter((entry) => entry.isFile())
+        .map((entry) => relative(root, join(entry.parentPath, entry.name)))
+        .sort((a, b) => a.localeCompare(b));
+    const hash = createHash('sha256');
+    for (const file of files)
+        hash.update(`${file}\0`).update(await readFile(join(root, file)));
+    return hash.digest('hex').slice(0, 12);
+}
+/** Where Talos's shipped assets (templates, generated-file sources, prompts) live. */
+export function assetsDir() {
+    return new URL('../../assets/', import.meta.url);
+}
+/**
+ * The verification marker of the cache entry this code runs from (`<entry>/node_modules/
+ * @svp-labs/talos/dist/version/self.js`), or `undefined` when it runs from anywhere else.
+ */
+export async function ownInstallMarker() {
+    try {
+        const marker = new URL('../../../../../talos-verified.json', import.meta.url);
+        return JSON.parse(await readFile(marker, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+const enginesSchema = z.object({
+    engines: z.object({ node: z.string().default('*') }).default({ node: '*' }),
+});
+/** The Node range Talos's `package.json` asks for (`engines.node`). */
+export function requiredNode() {
+    const text = readFileSync(new URL('../../package.json', import.meta.url), 'utf8');
+    const parsed = enginesSchema.safeParse(JSON.parse(text));
+    return parsed.success ? parsed.data.engines.node : '*';
+}
+//# sourceMappingURL=self.js.map

package/dist/version/self.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self.js","sourceRoot":"","sources":["../../src/version/self.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,mEAAmE;AACnE,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;IACzD,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,OAAO;SAClB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;SACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,oCAAoC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;CAC5E,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC"}