@tetsuo-ai/agenc 0.11.2 → 0.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/generated/agenc-runtime-manifest-v2.json +110 -84
  2. package/lib/generated-wrapper.mjs +62 -1
  3. package/lib/runtime-release-contract.d.mts +41 -0
  4. package/lib/runtime-release-contract.mjs +143 -4
  5. package/package.json +1 -1
package/generated/agenc-runtime-manifest-v2.json CHANGED
@@ -1,41 +1,53 @@
1
1
  {
2
2
  "manifestVersion": 2,
3
- "runtimeVersion": "0.11.2",
3
+ "runtimeVersion": "0.14.0",
4
4
  "releaseRepository": "tetsuo-ai/agenc-releases",
5
- "releaseTag": "agenc-v0.11.2",
5
+ "releaseTag": "agenc-v0.14.0",
6
6
  "build": {
7
- "sourceCommit": "7f862dbb84e4bcf57e3b0e3e26ab8c5b70cb276d",
8
- "sourceRef": "refs/tags/agenc-v0.11.2",
9
- "sourceDateEpoch": 1785182285,
10
- "lockfileSha256": "4a7e3baea685b32774d62570d89c7d42e7b040329b05da178ecf21ec3a01a237",
7
+ "sourceCommit": "c0166ff5e140f6e86f8b26db8e95ba8bac910a15",
8
+ "sourceRef": "refs/tags/agenc-v0.14.0",
9
+ "sourceDateEpoch": 1785884794,
10
+ "lockfileSha256": "cb25aa61843a593585f5b20988e6c2c52e190642cb91a35845947a0e87c0e440",
11
11
  "nodeVersion": "v26.5.0",
12
12
  "nodeMajor": 26,
13
13
  "nodeModuleAbi": "147",
14
14
  "nodeApiVersion": "10",
15
15
  "npmVersion": "11.17.0",
16
- "artifactProfile": "release"
16
+ "artifactProfile": "release",
17
+ "releaseCandidate": {
18
+ "workflow": "release-runtime.yml",
19
+ "runId": 30960072029,
20
+ "runAttempt": 1,
21
+ "runUrl": "https://github.com/tetsuo-ai/agenc-core/actions/runs/30960072029",
22
+ "phase": "candidate",
23
+ "sourceRef": "refs/heads/main",
24
+ "evidenceSha256": "79131899ae8143e6db5d0fab463b52cf3c3d5e70ab587709c954042fdf507d64"
25
+ }
17
26
  },
18
27
  "artifacts": [
19
28
  {
20
29
  "platform": "darwin",
21
30
  "arch": "arm64",
22
- "runtimeVersion": "0.11.2",
31
+ "runtimeVersion": "0.14.0",
23
32
  "nodeMajor": 26,
24
33
  "nodeModuleAbi": "147",
25
34
  "nodeApiVersion": "10",
26
- "url": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.11.2/agenc-runtime-0.11.2-darwin-arm64-node26-abi147.tar.gz",
27
- "sha256": "daa200674c110b323d76e92b391864074b3b1b53fa4fbb2f99270ac47c788c78",
28
- "bytes": 109963910,
29
- "attestationUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.11.2/agenc-runtime-0.11.2-darwin-arm64-node26-abi147.tar.gz.sigstore.json",
30
- "attestationSha256": "a837af8d7312f52aedd6f5eccf7cd1cb174fb970d6de4b9ecb586d9951fd79e2",
31
- "attestationBytes": 11542,
32
- "metadataSha256": "a1522d50cc8e4444849c5b685d768e55a0b19c033bfde9ff3a038ada4760c12b",
35
+ "url": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-darwin-arm64-node26-abi147.tar.gz",
36
+ "sha256": "4d951292cffbef6bb8e6059c9c2d354c34f7827c2695ae49403fe0eb4f57eb13",
37
+ "bytes": 114693760,
38
+ "attestationUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-darwin-arm64-node26-abi147.tar.gz.sigstore.json",
39
+ "attestationSha256": "196d6d902b27312dfae7357558c96ada3bbbea8cb5ef86e95d712dad1b32a9bf",
40
+ "attestationBytes": 11080,
41
+ "buildProvenanceUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-darwin-arm64-node26-abi147.tar.gz.build.sigstore.json",
42
+ "buildProvenanceSha256": "83da62720f7bccf0936ad817c5b3cb06080e5ee2ed25e707071108f835fbce16",
43
+ "buildProvenanceBytes": 11248,
44
+ "metadataSha256": "9a68705c21582115001042565b7e8a2495e0dc3ff852c62ca68cc56e9eee1dfd",
33
45
  "nativeToolchain": {
34
46
  "schemaVersion": 1,
35
- "builder": "github-hosted:macos-15:macos15:20260715.0234.1:ARM64",
47
+ "builder": "github-hosted:macos-15:macos15:20260727.0256.1:ARM64",
36
48
  "runnerLabel": "macos-15",
37
49
  "runnerImage": "macos15",
38
- "runnerImageVersion": "20260715.0234.1",
50
+ "runnerImageVersion": "20260727.0256.1",
39
51
  "runnerArch": "ARM64",
40
52
  "cc": "Apple clang version 17.0.0 (clang-1700.0.13.5)",
41
53
  "cxx": "Apple clang version 17.0.0 (clang-1700.0.13.5)",
@@ -59,13 +71,13 @@
59
71
  "xcode": "Xcode 16.4\nBuild version 16F6",
60
72
  "sdk": "15.5"
61
73
  },
62
- "dependencyTreeSha256": "22693d4afd16c2581ff426e75ab3da04e1658732c6ce9a7c9c7faf5863e16ed1",
63
- "dependencyPackages": 459,
74
+ "dependencyTreeSha256": "e51b4d92a4f61f38f3f35387e8b16f4c1eda9cfdd902e3e1af13887154e2b93b",
75
+ "dependencyPackages": 467,
64
76
  "archiveFormat": "tar+gzip; portable; utf8-byte-order; normalized-mtime",
65
77
  "archiveValidation": {
66
78
  "policy": "agenc-runtime-archive-v1",
67
- "entries": 28856,
68
- "uncompressedBytes": 449232896
79
+ "entries": 29385,
80
+ "uncompressedBytes": 467685376
69
81
  },
70
82
  "minimumMacosVersion": "13.5",
71
83
  "bins": {
@@ -76,23 +88,26 @@
76
88
  {
77
89
  "platform": "darwin",
78
90
  "arch": "x64",
79
- "runtimeVersion": "0.11.2",
91
+ "runtimeVersion": "0.14.0",
80
92
  "nodeMajor": 26,
81
93
  "nodeModuleAbi": "147",
82
94
  "nodeApiVersion": "10",
83
- "url": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.11.2/agenc-runtime-0.11.2-darwin-x64-node26-abi147.tar.gz",
84
- "sha256": "13ac533075de6ad5e9b5234f23a5e62bbecb77e18afc444d91192d63a6148258",
85
- "bytes": 111640948,
86
- "attestationUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.11.2/agenc-runtime-0.11.2-darwin-x64-node26-abi147.tar.gz.sigstore.json",
87
- "attestationSha256": "b2063412147d156e1583dc97f885c35891a6da389a1bb60d12a4c153852eefc4",
88
- "attestationBytes": 11546,
89
- "metadataSha256": "1c3393f40eb700aa024388a226db6b5588ba2cbf8ff5b3d638358673c49d0f69",
95
+ "url": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-darwin-x64-node26-abi147.tar.gz",
96
+ "sha256": "154a1dca5f6bca9f088f4311099ab5da7cdfabf007d9078b80560e1955ba3cf1",
97
+ "bytes": 116418843,
98
+ "attestationUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-darwin-x64-node26-abi147.tar.gz.sigstore.json",
99
+ "attestationSha256": "3982e946270f147599f6ad0049afa307e5224edb5da7731708524f856e9fd736",
100
+ "attestationBytes": 10982,
101
+ "buildProvenanceUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-darwin-x64-node26-abi147.tar.gz.build.sigstore.json",
102
+ "buildProvenanceSha256": "b2cdedeb736f0342884e4007a588e9f7d246987c4f4de6b29daa93576383d643",
103
+ "buildProvenanceBytes": 11103,
104
+ "metadataSha256": "91884ba99e8f3c1c64622551af9d94b521caacc8c736ea5e873ab42c74c25dd5",
90
105
  "nativeToolchain": {
91
106
  "schemaVersion": 1,
92
- "builder": "github-hosted:macos-15-intel:macos15:20260720.0353.1:X64",
107
+ "builder": "github-hosted:macos-15-intel:macos15:20260727.0377.1:X64",
93
108
  "runnerLabel": "macos-15-intel",
94
109
  "runnerImage": "macos15",
95
- "runnerImageVersion": "20260720.0353.1",
110
+ "runnerImageVersion": "20260727.0377.1",
96
111
  "runnerArch": "X64",
97
112
  "cc": "Apple clang version 17.0.0 (clang-1700.0.13.5)",
98
113
  "cxx": "Apple clang version 17.0.0 (clang-1700.0.13.5)",
@@ -116,13 +131,13 @@
116
131
  "xcode": "Xcode 16.4\nBuild version 16F6",
117
132
  "sdk": "15.5"
118
133
  },
119
- "dependencyTreeSha256": "f0e38ec7bd6fce4ce87e9ccfa82ba66b52693430bc9597991e4428aaf7567f4e",
120
- "dependencyPackages": 459,
134
+ "dependencyTreeSha256": "899047395e1e9b3a0b6f28d956ace8fbaaedb9af2228742d107876f20a56d699",
135
+ "dependencyPackages": 467,
121
136
  "archiveFormat": "tar+gzip; portable; utf8-byte-order; normalized-mtime",
122
137
  "archiveValidation": {
123
138
  "policy": "agenc-runtime-archive-v1",
124
- "entries": 28856,
125
- "uncompressedBytes": 453013504
139
+ "entries": 29385,
140
+ "uncompressedBytes": 471680512
126
141
  },
127
142
  "minimumMacosVersion": "13.5",
128
143
  "bins": {
@@ -133,20 +148,23 @@
133
148
  {
134
149
  "platform": "linux",
135
150
  "arch": "arm64",
136
- "runtimeVersion": "0.11.2",
151
+ "runtimeVersion": "0.14.0",
137
152
  "nodeMajor": 26,
138
153
  "nodeModuleAbi": "147",
139
154
  "nodeApiVersion": "10",
140
- "url": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.11.2/agenc-runtime-0.11.2-linux-arm64-node26-abi147.tar.gz",
141
- "sha256": "f3dc6bf5706ee27374759786998279670f20ee776e36956fa8f3227d6032592b",
142
- "bytes": 123368621,
143
- "attestationUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.11.2/agenc-runtime-0.11.2-linux-arm64-node26-abi147.tar.gz.sigstore.json",
144
- "attestationSha256": "ac319b5145384742aa0916b880246c3fa41f0e2293a8a58cf08e95fd2f900b6a",
145
- "attestationBytes": 11401,
146
- "metadataSha256": "8ff0b13e01ff446e614cf3c439b8cf224c35434904e3aa29d22b8a41822cc27f",
155
+ "url": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-linux-arm64-node26-abi147.tar.gz",
156
+ "sha256": "a5bf7e1459211041dec115ead808ff41e4c007a2d2d2745dfe4be2783a8eafa8",
157
+ "bytes": 128272502,
158
+ "attestationUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-linux-arm64-node26-abi147.tar.gz.sigstore.json",
159
+ "attestationSha256": "71c73e2fa017a531394dbd9eabbc994757e0112e61784190a07a1e3038598c6f",
160
+ "attestationBytes": 11029,
161
+ "buildProvenanceUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-linux-arm64-node26-abi147.tar.gz.build.sigstore.json",
162
+ "buildProvenanceSha256": "eefd83e4c0c1c11fcbb903cbfb4441d11def735553ed1d84fedeb195756fcf5a",
163
+ "buildProvenanceBytes": 11244,
164
+ "metadataSha256": "e3c795253ae27b5885b62a81ecdc652067faf6724a9cf2cd0c62bab42adbe361",
147
165
  "nativeToolchain": {
148
166
  "schemaVersion": 1,
149
- "builder": "rockylinux@sha256:9794037624aaa6212aeada1d28861ef5e0a935adaf93e4ef79837119f2a2d04c+rpm-content-sha256:3739ba86a1767e0ed5cc94eaf235ae3d1d9709ab45880c7dca366283068f8e19",
167
+ "builder": "rockylinux@sha256:9794037624aaa6212aeada1d28861ef5e0a935adaf93e4ef79837119f2a2d04c+rpm-content-sha256:98d1259fca66152fb91e739a15a4fa7f76b0a222369cb34ba853d7d72f02239f",
150
168
  "runnerArch": "ARM64",
151
169
  "cc": "gcc (GCC) 12.2.1 20221121 (Red Hat 12.2.1-7)",
152
170
  "cxx": "g++ (GCC) 12.2.1 20221121 (Red Hat 12.2.1-7)",
@@ -167,7 +185,7 @@
167
185
  "npmDistributionSha256": "b290bbb35b9e72c3ef84edbe041f28c4479c4d9ee79f555817b8caafe7ce4bba",
168
186
  "rpmContentInventorySchemaVersion": 1,
169
187
  "rpmContentInventoryFormat": "name|epoch|version|release|arch|sha256header|payloaddigest|payloaddigestalgo|rsaheader-pgpsig",
170
- "rpmContentInventorySha256": "3739ba86a1767e0ed5cc94eaf235ae3d1d9709ab45880c7dca366283068f8e19",
188
+ "rpmContentInventorySha256": "98d1259fca66152fb91e739a15a4fa7f76b0a222369cb34ba853d7d72f02239f",
171
189
  "rpmSigningKeyIds": [
172
190
  "15af5dac6d745a60"
173
191
  ],
@@ -176,6 +194,7 @@
176
194
  "gcc-toolset-12-gcc-c++-12.2.1-7.8.el8_10",
177
195
  "git-2.43.7-1.el8_10",
178
196
  "gzip-1.9-13.el8_5",
197
+ "kernel-headers-4.18.0-553.150.1.el8_10",
179
198
  "libatomic-8.5.0-28.el8_10",
180
199
  "libgcc-8.5.0-28.el8_10",
181
200
  "make-4.2.1-11.el8",
@@ -183,13 +202,13 @@
183
202
  "tar-1.30-11.el8_10"
184
203
  ]
185
204
  },
186
- "dependencyTreeSha256": "0c30dc09aaa3dcd95d71054fdff1d13976c4f6be8c8ef188ba31d67c33e60d58",
187
- "dependencyPackages": 461,
205
+ "dependencyTreeSha256": "6b0f710c9a21cd9feef017556bac964d83870a569027172fc8f9f120b38892e8",
206
+ "dependencyPackages": 469,
188
207
  "archiveFormat": "tar+gzip; portable; utf8-byte-order; normalized-mtime",
189
208
  "archiveValidation": {
190
209
  "policy": "agenc-runtime-archive-v1",
191
- "entries": 28875,
192
- "uncompressedBytes": 471250944
210
+ "entries": 29405,
211
+ "uncompressedBytes": 490029056
193
212
  },
194
213
  "libcFamily": "glibc",
195
214
  "minimumGlibcVersion": "2.28",
@@ -204,20 +223,23 @@
204
223
  {
205
224
  "platform": "linux",
206
225
  "arch": "x64",
207
- "runtimeVersion": "0.11.2",
226
+ "runtimeVersion": "0.14.0",
208
227
  "nodeMajor": 26,
209
228
  "nodeModuleAbi": "147",
210
229
  "nodeApiVersion": "10",
211
- "url": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.11.2/agenc-runtime-0.11.2-linux-x64-node26-abi147.tar.gz",
212
- "sha256": "f72a3dadf3f7bad44bfe952302a976e5b71f34fd8732879acb0db668b661e563",
213
- "bytes": 122720210,
214
- "attestationUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.11.2/agenc-runtime-0.11.2-linux-x64-node26-abi147.tar.gz.sigstore.json",
215
- "attestationSha256": "df8f6d55715bdb845442397d7cac94db59198d87186bd0466e5aede888b718c8",
216
- "attestationBytes": 11589,
217
- "metadataSha256": "59aa4021bae66b80972770f0ef1e517297d24b83ec8f8aead7426035788c8116",
230
+ "url": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-linux-x64-node26-abi147.tar.gz",
231
+ "sha256": "291645e4f6e70242b76a39b14b116ecca8ab53e048f3be823d1d691bbb720fac",
232
+ "bytes": 127882176,
233
+ "attestationUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-linux-x64-node26-abi147.tar.gz.sigstore.json",
234
+ "attestationSha256": "dbd20c73cf80531f96e8fa276f732cbd90a544039c345e886d5bc31e9507a2c5",
235
+ "attestationBytes": 11017,
236
+ "buildProvenanceUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-linux-x64-node26-abi147.tar.gz.build.sigstore.json",
237
+ "buildProvenanceSha256": "8325e4083edaeb6182205921574945d679890979d7f74ff2023d13392b788b7d",
238
+ "buildProvenanceBytes": 11228,
239
+ "metadataSha256": "6eab7f39a7e2f83a6183a2213cb69a2c42ef934c9a18cb5fb43401be7e21a239",
218
240
  "nativeToolchain": {
219
241
  "schemaVersion": 1,
220
- "builder": "rockylinux@sha256:9794037624aaa6212aeada1d28861ef5e0a935adaf93e4ef79837119f2a2d04c+rpm-content-sha256:0cf2f72faf2019701463fabc01a78c0cc893d51b2517fc7f4ce7cd65e76c2b02",
242
+ "builder": "rockylinux@sha256:9794037624aaa6212aeada1d28861ef5e0a935adaf93e4ef79837119f2a2d04c+rpm-content-sha256:20da0fd525fe8dbe596068bb896b949fe84c5ede3c2829e9481f6c2c97de0a5e",
221
243
  "runnerArch": "X64",
222
244
  "cc": "gcc (GCC) 12.2.1 20221121 (Red Hat 12.2.1-7)",
223
245
  "cxx": "g++ (GCC) 12.2.1 20221121 (Red Hat 12.2.1-7)",
@@ -238,7 +260,7 @@
238
260
  "npmDistributionSha256": "b290bbb35b9e72c3ef84edbe041f28c4479c4d9ee79f555817b8caafe7ce4bba",
239
261
  "rpmContentInventorySchemaVersion": 1,
240
262
  "rpmContentInventoryFormat": "name|epoch|version|release|arch|sha256header|payloaddigest|payloaddigestalgo|rsaheader-pgpsig",
241
- "rpmContentInventorySha256": "0cf2f72faf2019701463fabc01a78c0cc893d51b2517fc7f4ce7cd65e76c2b02",
263
+ "rpmContentInventorySha256": "20da0fd525fe8dbe596068bb896b949fe84c5ede3c2829e9481f6c2c97de0a5e",
242
264
  "rpmSigningKeyIds": [
243
265
  "15af5dac6d745a60"
244
266
  ],
@@ -247,6 +269,7 @@
247
269
  "gcc-toolset-12-gcc-c++-12.2.1-7.8.el8_10",
248
270
  "git-2.43.7-1.el8_10",
249
271
  "gzip-1.9-13.el8_5",
272
+ "kernel-headers-4.18.0-553.150.1.el8_10",
250
273
  "libatomic-8.5.0-28.el8_10",
251
274
  "libgcc-8.5.0-28.el8_10",
252
275
  "make-4.2.1-11.el8",
@@ -254,13 +277,13 @@
254
277
  "tar-1.30-11.el8_10"
255
278
  ]
256
279
  },
257
- "dependencyTreeSha256": "913b59c11c69d5cf76adf08344b197942979d544734998596866a6d8c8a1e852",
258
- "dependencyPackages": 461,
280
+ "dependencyTreeSha256": "2b13d923235dc0384202bf27f899ba0ed910ffbd13567d7dba1ddb2b3f2d1304",
281
+ "dependencyPackages": 469,
259
282
  "archiveFormat": "tar+gzip; portable; utf8-byte-order; normalized-mtime",
260
283
  "archiveValidation": {
261
284
  "policy": "agenc-runtime-archive-v1",
262
- "entries": 28875,
263
- "uncompressedBytes": 471467008
285
+ "entries": 29405,
286
+ "uncompressedBytes": 491147264
264
287
  },
265
288
  "libcFamily": "glibc",
266
289
  "minimumGlibcVersion": "2.28",
@@ -275,26 +298,29 @@
275
298
  {
276
299
  "platform": "win",
277
300
  "arch": "x64",
278
- "runtimeVersion": "0.11.2",
301
+ "runtimeVersion": "0.14.0",
279
302
  "nodeMajor": 26,
280
303
  "nodeModuleAbi": "147",
281
304
  "nodeApiVersion": "10",
282
- "url": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.11.2/agenc-runtime-0.11.2-win-x64-node26-abi147.tar.gz",
283
- "sha256": "a7733493f40b681600be2f9298eadcb3bf17bf9bb9d3884ae309b666d23fa0f6",
284
- "bytes": 105885523,
285
- "attestationUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.11.2/agenc-runtime-0.11.2-win-x64-node26-abi147.tar.gz.sigstore.json",
286
- "attestationSha256": "1692c6e39f38d10c7a9e6499dad107e20f81984f4058e2d14ae595203f8b5468",
287
- "attestationBytes": 11257,
288
- "metadataSha256": "60b7ad39481cd661349eebc00c3d197136ab502ff68d1bfc8d3353fcd9031925",
305
+ "url": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-win-x64-node26-abi147.tar.gz",
306
+ "sha256": "ffc91b19231166ced45116c113cebfe2a06fe1d27c3d5b3e245dbf66ed819209",
307
+ "bytes": 110807167,
308
+ "attestationUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-win-x64-node26-abi147.tar.gz.sigstore.json",
309
+ "attestationSha256": "a6fdaa70f3803371e53044688d9f00d37fa4033151c4e549dbde028e19ec4c6f",
310
+ "attestationBytes": 11068,
311
+ "buildProvenanceUrl": "https://github.com/tetsuo-ai/agenc-releases/releases/download/agenc-v0.14.0/agenc-runtime-0.14.0-win-x64-node26-abi147.tar.gz.build.sigstore.json",
312
+ "buildProvenanceSha256": "c1743c914b2c9c53a1f99dcb6d31704e5eb500e72782cbe4e8acdaa50701e942",
313
+ "buildProvenanceBytes": 11096,
314
+ "metadataSha256": "91d5c10d0c2f321c7ebcaf197e7583552eb86dbde83a5d508775a1d66893ec4f",
289
315
  "nativeToolchain": {
290
316
  "schemaVersion": 1,
291
- "builder": "github-hosted:windows-2025:win25-vs2026:20260714.173.1:X64",
292
- "runnerLabel": "windows-2025",
317
+ "builder": "github-hosted:windows-2025-vs2026:win25-vs2026:20260728.188.1:X64",
318
+ "runnerLabel": "windows-2025-vs2026",
293
319
  "runnerImage": "win25-vs2026",
294
- "runnerImageVersion": "20260714.173.1",
320
+ "runnerImageVersion": "20260728.188.1",
295
321
  "runnerArch": "X64",
296
- "cc": "Microsoft (R) C/C++ Optimizing Compiler Version 19.51.36248 for x64",
297
- "cxx": "Microsoft (R) C/C++ Optimizing Compiler Version 19.51.36248 for x64",
322
+ "cc": "Microsoft (R) C/C++ Optimizing Compiler Version 19.51.36252 for x64",
323
+ "cxx": "Microsoft (R) C/C++ Optimizing Compiler Version 19.51.36252 for x64",
298
324
  "linker": "link: missing operand after '/?'",
299
325
  "python": "Python 3.12.10",
300
326
  "make": "GNU Make 4.4.1",
@@ -319,21 +345,21 @@
319
345
  "nodeCommonGypiTransformation": "disable-debug-information-and-full-paths",
320
346
  "npmDistributionFile": "npm-11.17.0.tgz",
321
347
  "npmDistributionSha256": "b290bbb35b9e72c3ef84edbe041f28c4479c4d9ee79f555817b8caafe7ce4bba",
322
- "visualStudioVersion": "18.7.11925.98",
348
+ "visualStudioVersion": "18.8.12023.21",
323
349
  "visualStudioInstallPath": "C:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise",
324
350
  "msvcToolsVersion": "14.51.36231",
325
351
  "windowsSdkVersion": "10.0.26100.0",
326
- "compilerDetails": "Microsoft (R) C/C++ Optimizing Compiler Version 19.51.36248 for x64\nCopyright (C) Microsoft Corporation. All rights reserved.\nCompiler Passes:\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\cl.exe: Version 19.51.36248.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\c1.dll: Version 19.51.36248.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\c1xx.dll: Version 19.51.36248.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\c2.dll: Version 19.51.36248.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\c1xx.dll: Version 19.51.36248.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\link.exe: Version 14.51.36248.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\mspdb140.dll: Version 14.51.36248.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\1033\\clui.dll: Version 19.51.36248.0\ncl : Command line error D8003 : missing source filename",
327
- "msvcCompilerSha256": "dc8426b8760d92cf757df3d10b9f0244a95b454ff43194a58161568a0ec70d53",
328
- "msvcLinkerSha256": "e8c524347b8bc87fba790d254c8a3b902bf1a4b63807093b816d992940af3791"
352
+ "compilerDetails": "Microsoft (R) C/C++ Optimizing Compiler Version 19.51.36252 for x64\nCopyright (C) Microsoft Corporation. All rights reserved.\nCompiler Passes:\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\cl.exe: Version 19.51.36252.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\c1.dll: Version 19.51.36252.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\c1xx.dll: Version 19.51.36252.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\c2.dll: Version 19.51.36252.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\c1xx.dll: Version 19.51.36252.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\link.exe: Version 14.51.36252.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\mspdb140.dll: Version 14.51.36252.0\nC:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Tools\\MSVC\\14.51.36231\\bin\\HostX64\\x64\\1033\\clui.dll: Version 19.51.36252.0\ncl : Command line error D8003 : missing source filename",
353
+ "msvcCompilerSha256": "c94cdac6a780142920110e5cb8b7339817029eead696e0e97700b45e03216a00",
354
+ "msvcLinkerSha256": "f233b8e337cec96a69868a8cde676808bfa81152493968d0b27b7cd0daac15be"
329
355
  },
330
- "dependencyTreeSha256": "53c3d983af300b03669839eb692c1b9807f1b95218a367242f5fe8a4689f7a3b",
331
- "dependencyPackages": 458,
356
+ "dependencyTreeSha256": "13b0890828cdb5d47af3aa6e734c122db0571f677b0e1fcafbde422865f041ff",
357
+ "dependencyPackages": 466,
332
358
  "archiveFormat": "tar+gzip; portable; utf8-byte-order; normalized-mtime",
333
359
  "archiveValidation": {
334
360
  "policy": "agenc-runtime-archive-v1",
335
- "entries": 28894,
336
- "uncompressedBytes": 412326912
361
+ "entries": 29424,
362
+ "uncompressedBytes": 431929856
337
363
  },
338
364
  "bins": {
339
365
  "agenc": "node_modules/@tetsuo-ai/runtime/bin/agenc",
package/lib/generated-wrapper.mjs CHANGED
@@ -136,6 +136,62 @@ export function renderGeneratedWrapperContent({
136
136
  ].join("\n");
137
137
  }
138
138
 
139
+ // Releases 0.6.2 through 0.10.0 emitted this immutable metadata-v1 shape
140
+ // before standalone installs carried a private Node runtime. Keep the renderer
141
+ // private: it exists only so ownership can be proven by exact full-file
142
+ // reconstruction, never by trusting the historical marker or metadata alone.
143
+ function renderPrePrivateNodeWrapperContent({
144
+ kind,
145
+ nodeBin,
146
+ runtimeBin,
147
+ agencHome,
148
+ }) {
149
+ if (kind !== "posix" && kind !== "cmd") {
150
+ throw new TypeError(`unsupported wrapper kind: ${String(kind)}`);
151
+ }
152
+ const values = { nodeBin, runtimeBin, agencHome };
153
+ validateValues(kind, values);
154
+ const metadata = Buffer.from(JSON.stringify({
155
+ nodeBin,
156
+ runtimeBin,
157
+ agencHome,
158
+ }), "utf8").toString("base64url");
159
+ if (kind === "cmd") {
160
+ const batch = (value) => value.replaceAll("%", "%%");
161
+ return [
162
+ "@echo off",
163
+ "setlocal DisableDelayedExpansion",
164
+ `rem ${CMD_WRAPPER_SIGNATURE} - rewritten on every install/upgrade.`,
165
+ `rem ${WRAPPER_METADATA_PREFIX} ${metadata}`,
166
+ `if not defined AGENC_HOME set "AGENC_HOME=${batch(agencHome)}"`,
167
+ `"${batch(nodeBin)}" "${batch(runtimeBin)}" %*`,
168
+ "",
169
+ ].join("\r\n");
170
+ }
171
+ const quote = (value) => `'${value.replaceAll("'", `'"'"'`)}'`;
172
+ return [
173
+ "#!/bin/sh",
174
+ `# ${POSIX_WRAPPER_SIGNATURE} — rewritten on every install/upgrade.`,
175
+ `# ${WRAPPER_METADATA_PREFIX} ${metadata}`,
176
+ 'if [ -z "${AGENC_HOME:-}" ]; then',
177
+ ` export AGENC_HOME=${quote(agencHome)}`,
178
+ "fi",
179
+ "# Capture one V8 near-heap-limit snapshot unless the operator already configured it.",
180
+ 'case " ${NODE_OPTIONS:-} " in',
181
+ " *heapsnapshot-near-heap-limit*)",
182
+ ` exec ${quote(nodeBin)} ${quote(runtimeBin)} "$@"`,
183
+ " ;;",
184
+ " *)",
185
+ ' mkdir -p "${AGENC_HOME}/oom-snapshots" 2>/dev/null || :',
186
+ ` exec ${quote(nodeBin)} --heapsnapshot-near-heap-limit=1 ` +
187
+ '--diagnostic-dir="${AGENC_HOME}/oom-snapshots" ' +
188
+ `${quote(runtimeBin)} "$@"`,
189
+ " ;;",
190
+ "esac",
191
+ "",
192
+ ].join("\n");
193
+ }
194
+
139
195
  function decodeCanonicalMetadata(encoded) {
140
196
  try {
141
197
  const bytes = Buffer.from(encoded, "base64url");
@@ -178,7 +234,12 @@ function parseModern(path, content) {
178
234
  if (values === undefined) return undefined;
179
235
  try {
180
236
  const wrapper = { kind, path, ...values };
181
- return renderGeneratedWrapperContent(wrapper) === content ? wrapper : undefined;
237
+ if (renderGeneratedWrapperContent(wrapper) === content) return wrapper;
238
+ if (
239
+ values.nodeLibraryPath === undefined &&
240
+ renderPrePrivateNodeWrapperContent(wrapper) === content
241
+ ) return wrapper;
242
+ return undefined;
182
243
  } catch {
183
244
  return undefined;
184
245
  }
package/lib/runtime-release-contract.d.mts CHANGED
@@ -13,6 +13,9 @@ export interface RuntimeReleaseArtifact {
13
13
  readonly attestationUrl?: string;
14
14
  readonly attestationSha256?: string;
15
15
  readonly attestationBytes?: number;
16
+ readonly buildProvenanceUrl?: string;
17
+ readonly buildProvenanceSha256?: string;
18
+ readonly buildProvenanceBytes?: number;
16
19
  readonly bins?: {
17
20
  readonly agenc?: string;
18
21
  readonly node?: string;
@@ -38,6 +41,7 @@ export const OFFICIAL_RELEASE_REPOSITORY: string;
38
41
  export const OFFICIAL_SOURCE_REPOSITORY: string;
39
42
  export const FROZEN_LEGACY_RUNTIME_VERSION: "0.7.2";
40
43
  export const MINIMUM_PRIVATE_NODE_RUNTIME_VERSION: "0.11.2";
44
+ export const MINIMUM_DUAL_PROVENANCE_RUNTIME_VERSION: "0.13.0";
41
45
  export const PRIVATE_NODE_BOOTSTRAP_RELEASE_TAG: "agenc-v0.11.2";
42
46
  export const OFFICIAL_RELEASE_WORKFLOW: string;
43
47
  export const RUNTIME_ATTESTATION_POLICY: Readonly<{
@@ -47,6 +51,14 @@ export const RUNTIME_ATTESTATION_POLICY: Readonly<{
47
51
  oidcIssuer: string;
48
52
  predicateType: string;
49
53
  }>;
54
+ export const RUNTIME_BUILD_PROVENANCE_POLICY: Readonly<{
55
+ repository: string;
56
+ signerWorkflow: string;
57
+ hostname: string;
58
+ oidcIssuer: string;
59
+ predicateType: string;
60
+ sourceRef: "refs/heads/main";
61
+ }>;
50
62
  export const PINNED_GITHUB_CLI_VERSION: string;
51
63
  export const PINNED_GITHUB_CLI_ARTIFACTS: Readonly<Record<string, Readonly<{
52
64
  file: string;
@@ -54,6 +66,8 @@ export const PINNED_GITHUB_CLI_ARTIFACTS: Readonly<Record<string, Readonly<{
54
66
  sha256: string;
55
67
  bytes: number;
56
68
  executable: string;
69
+ executableSha256: string;
70
+ executableBytes: number;
57
71
  }>>>;
58
72
  export const RUNTIME_MANIFEST_TRUST_MODES: readonly RuntimeManifestTrustMode[];
59
73
 
@@ -64,6 +78,13 @@ export function canonicalRuntimeAttestationVerificationArgs(options: {
64
78
  readonly sourceRef: string;
65
79
  }): readonly string[];
66
80
 
81
+ export function canonicalRuntimeBuildProvenanceVerificationArgs(options: {
82
+ readonly subjectPath: string;
83
+ readonly bundlePath: string;
84
+ readonly sourceCommit: string;
85
+ readonly sourceRef?: "refs/heads/main";
86
+ }): readonly string[];
87
+
67
88
  export type LocalFileUrlPlatform =
68
89
  | "win"
69
90
  | "win32"
@@ -92,6 +113,26 @@ export function canonicalRuntimeNodeLibrary(platform: string): string | undefine
92
113
 
93
114
  export function requireSupportedRuntimeVersion(version: string): string;
94
115
 
116
+ export function runtimeVersionRequiresDualProvenance(version: string): boolean;
117
+
118
+ export interface RuntimeReleaseCandidateIdentity {
119
+ readonly workflow: "release-runtime.yml";
120
+ readonly runId: number;
121
+ readonly runAttempt: number;
122
+ readonly runUrl: string;
123
+ readonly phase: "candidate";
124
+ readonly sourceRef: "refs/heads/main";
125
+ readonly evidenceSha256: string;
126
+ }
127
+
128
+ export function validateRuntimeReleaseCandidateIdentity<
129
+ T extends RuntimeReleaseCandidateIdentity,
130
+ >(
131
+ value: T | undefined,
132
+ sourceCommit: unknown,
133
+ options?: { readonly required?: boolean },
134
+ ): T | undefined;
135
+
95
136
  export function canonicalLocalFileUrlToPath(
96
137
  value: string,
97
138
  platform?: LocalFileUrlPlatform,
package/lib/runtime-release-contract.mjs CHANGED
@@ -12,6 +12,7 @@ export const OFFICIAL_RELEASE_REPOSITORY = "tetsuo-ai/agenc-releases";
12
12
  export const OFFICIAL_SOURCE_REPOSITORY = "tetsuo-ai/agenc-core";
13
13
  export const FROZEN_LEGACY_RUNTIME_VERSION = "0.7.2";
14
14
  export const MINIMUM_PRIVATE_NODE_RUNTIME_VERSION = "0.11.2";
15
+ export const MINIMUM_DUAL_PROVENANCE_RUNTIME_VERSION = "0.13.0";
15
16
  export const PRIVATE_NODE_BOOTSTRAP_RELEASE_TAG =
16
17
  `agenc-v${MINIMUM_PRIVATE_NODE_RUNTIME_VERSION}`;
17
18
  export const OFFICIAL_RELEASE_WORKFLOW =
@@ -23,6 +24,10 @@ export const RUNTIME_ATTESTATION_POLICY = Object.freeze({
23
24
  oidcIssuer: "https://token.actions.githubusercontent.com",
24
25
  predicateType: "https://slsa.dev/provenance/v1",
25
26
  });
27
+ export const RUNTIME_BUILD_PROVENANCE_POLICY = Object.freeze({
28
+ ...RUNTIME_ATTESTATION_POLICY,
29
+ sourceRef: "refs/heads/main",
30
+ });
26
31
  export const PINNED_GITHUB_CLI_VERSION = "2.96.0";
27
32
  export const PINNED_GITHUB_CLI_ARTIFACTS = Object.freeze({
28
33
  "linux-x64": Object.freeze({
@@ -31,6 +36,8 @@ export const PINNED_GITHUB_CLI_ARTIFACTS = Object.freeze({
31
36
  sha256: "83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60",
32
37
  bytes: 14652560,
33
38
  executable: "gh_2.96.0_linux_amd64/bin/gh",
39
+ executableSha256: "56b8bbbb27b066ecb33dbef9a256dc9d1314adaeff0908a752feba6c34053b40",
40
+ executableBytes: 40722594,
34
41
  }),
35
42
  "linux-arm64": Object.freeze({
36
43
  file: "gh_2.96.0_linux_arm64.tar.gz",
@@ -38,6 +45,8 @@ export const PINNED_GITHUB_CLI_ARTIFACTS = Object.freeze({
38
45
  sha256: "06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909",
39
46
  bytes: 13321232,
40
47
  executable: "gh_2.96.0_linux_arm64/bin/gh",
48
+ executableSha256: "f903d2fa04ae78ee8f8df0186364d0b92f078d2720053941a47e0a3beaef54f0",
49
+ executableBytes: 37879970,
41
50
  }),
42
51
  "darwin-x64": Object.freeze({
43
52
  file: "gh_2.96.0_macOS_amd64.zip",
@@ -45,6 +54,8 @@ export const PINNED_GITHUB_CLI_ARTIFACTS = Object.freeze({
45
54
  sha256: "4bd449df9ad639391bc62b8032546f0fe9edcd8526e06682a4f88abd8c5d163c",
46
55
  bytes: 15298430,
47
56
  executable: "gh_2.96.0_macOS_amd64/bin/gh",
57
+ executableSha256: "49380b19e758c14ce5509afe0ced58777fe45cfbcd5989941f7314d5f7e468c8",
58
+ executableBytes: 41773632,
48
59
  }),
49
60
  "darwin-arm64": Object.freeze({
50
61
  file: "gh_2.96.0_macOS_arm64.zip",
@@ -52,6 +63,8 @@ export const PINNED_GITHUB_CLI_ARTIFACTS = Object.freeze({
52
63
  sha256: "f23a0c37d963aacc3bed703ccbd59b41c5ca22101fab7f00eb2b7cad23aba463",
53
64
  bytes: 13950131,
54
65
  executable: "gh_2.96.0_macOS_arm64/bin/gh",
66
+ executableSha256: "b1d6c442fde99ca27c04e1e74d624895abe37785f4a3e9e9b684bf7586ce4bc8",
67
+ executableBytes: 38817216,
55
68
  }),
56
69
  "win-x64": Object.freeze({
57
70
  file: "gh_2.96.0_windows_amd64.zip",
@@ -59,6 +72,8 @@ export const PINNED_GITHUB_CLI_ARTIFACTS = Object.freeze({
59
72
  sha256: "c2d6acc935cd2f00e2144d7e036d5cd82e6b6bd5594e8c75aa75ef2a4ed6aac3",
60
73
  bytes: 14821821,
61
74
  executable: "gh_2.96.0_windows_amd64/bin/gh.exe",
75
+ executableSha256: "cd79f16203f1fbe56937c4c96e2b6eadd10549418dcb241d91576ac77af0ac8b",
76
+ executableBytes: 41504056,
62
77
  }),
63
78
  });
64
79
  export const RUNTIME_MANIFEST_TRUST_MODES = Object.freeze([
@@ -69,17 +84,19 @@ export const RUNTIME_MANIFEST_TRUST_MODES = Object.freeze([
69
84
 
70
85
  const TRUST_MODES = new Set(RUNTIME_MANIFEST_TRUST_MODES);
71
86
 
72
- export function canonicalRuntimeAttestationVerificationArgs({
87
+ function canonicalRuntimeProvenanceVerificationArgs({
73
88
  subjectPath,
74
89
  bundlePath,
75
90
  sourceCommit,
76
91
  sourceRef,
92
+ sourceRefPattern,
93
+ sourceRefError,
77
94
  }) {
78
95
  if (!/^[0-9a-f]{40,64}$/.test(sourceCommit ?? "")) {
79
96
  throw new Error("runtime attestation policy requires an exact source commit");
80
97
  }
81
- if (typeof sourceRef !== "string" || !sourceRef.startsWith("refs/tags/agenc-v")) {
82
- throw new Error("runtime attestation policy requires the canonical release source ref");
98
+ if (typeof sourceRef !== "string" || !sourceRefPattern.test(sourceRef)) {
99
+ throw new Error(sourceRefError);
83
100
  }
84
101
  return [
85
102
  "attestation",
@@ -107,6 +124,40 @@ export function canonicalRuntimeAttestationVerificationArgs({
107
124
  ];
108
125
  }
109
126
 
127
+ export function canonicalRuntimeAttestationVerificationArgs({
128
+ subjectPath,
129
+ bundlePath,
130
+ sourceCommit,
131
+ sourceRef,
132
+ }) {
133
+ return canonicalRuntimeProvenanceVerificationArgs({
134
+ subjectPath,
135
+ bundlePath,
136
+ sourceCommit,
137
+ sourceRef,
138
+ sourceRefPattern: /^refs\/tags\/agenc-v[0-9]+\.[0-9]+\.[0-9]+$/,
139
+ sourceRefError:
140
+ "runtime attestation policy requires the canonical release source ref",
141
+ });
142
+ }
143
+
144
+ export function canonicalRuntimeBuildProvenanceVerificationArgs({
145
+ subjectPath,
146
+ bundlePath,
147
+ sourceCommit,
148
+ sourceRef = RUNTIME_BUILD_PROVENANCE_POLICY.sourceRef,
149
+ }) {
150
+ return canonicalRuntimeProvenanceVerificationArgs({
151
+ subjectPath,
152
+ bundlePath,
153
+ sourceCommit,
154
+ sourceRef,
155
+ sourceRefPattern: /^refs\/heads\/main$/,
156
+ sourceRefError:
157
+ "runtime build provenance policy requires the canonical main source ref",
158
+ });
159
+ }
160
+
110
161
  export function requireRuntimeManifestTrustMode(trustMode) {
111
162
  if (!TRUST_MODES.has(trustMode)) {
112
163
  throw new Error(`agenc: unsupported runtime manifest trust mode ${String(trustMode)}`);
@@ -162,6 +213,57 @@ export function requireSupportedRuntimeVersion(version) {
162
213
  return version;
163
214
  }
164
215
 
216
+ export function runtimeVersionRequiresDualProvenance(version) {
217
+ requireSupportedRuntimeVersion(version);
218
+ if (version === FROZEN_LEGACY_RUNTIME_VERSION) return false;
219
+ const actual = version.split("-", 1)[0].split(".").map(Number);
220
+ const minimum = MINIMUM_DUAL_PROVENANCE_RUNTIME_VERSION.split(".").map(Number);
221
+ for (let index = 0; index < minimum.length; index += 1) {
222
+ if (actual[index] > minimum[index]) return true;
223
+ if (actual[index] < minimum[index]) return false;
224
+ }
225
+ return true;
226
+ }
227
+
228
+ const RUNTIME_RELEASE_CANDIDATE_KEYS = Object.freeze([
229
+ "workflow",
230
+ "runId",
231
+ "runAttempt",
232
+ "runUrl",
233
+ "phase",
234
+ "sourceRef",
235
+ "evidenceSha256",
236
+ ]);
237
+
238
+ export function validateRuntimeReleaseCandidateIdentity(
239
+ value,
240
+ sourceCommit,
241
+ { required = false } = {},
242
+ ) {
243
+ if (value === undefined && !required) return undefined;
244
+ if (
245
+ value === null ||
246
+ typeof value !== "object" ||
247
+ Array.isArray(value) ||
248
+ Object.keys(value).sort().join("\0") !==
249
+ [...RUNTIME_RELEASE_CANDIDATE_KEYS].sort().join("\0") ||
250
+ value.workflow !== "release-runtime.yml" ||
251
+ !Number.isSafeInteger(value.runId) ||
252
+ value.runId <= 0 ||
253
+ !Number.isSafeInteger(value.runAttempt) ||
254
+ value.runAttempt <= 0 ||
255
+ value.runUrl !==
256
+ `https://github.com/tetsuo-ai/agenc-core/actions/runs/${value.runId}` ||
257
+ value.phase !== "candidate" ||
258
+ value.sourceRef !== RUNTIME_BUILD_PROVENANCE_POLICY.sourceRef ||
259
+ !/^[0-9a-f]{64}$/.test(value.evidenceSha256 ?? "") ||
260
+ !/^[0-9a-f]{40}$/.test(sourceCommit ?? "")
261
+ ) {
262
+ throw new Error("agenc: runtime release candidate identity is invalid");
263
+ }
264
+ return value;
265
+ }
266
+
165
267
  function localFileUrlUsesWindowsPaths(platform) {
166
268
  if (platform === "win" || platform === "win32") return true;
167
269
  if (
@@ -281,7 +383,10 @@ function validateArtifactUrl(manifest, artifact, trustMode) {
281
383
  if (
282
384
  artifact.attestationUrl !== undefined ||
283
385
  artifact.attestationSha256 !== undefined ||
284
- artifact.attestationBytes !== undefined
386
+ artifact.attestationBytes !== undefined ||
387
+ artifact.buildProvenanceUrl !== undefined ||
388
+ artifact.buildProvenanceSha256 !== undefined ||
389
+ artifact.buildProvenanceBytes !== undefined
285
390
  ) {
286
391
  throw new Error("agenc: explicit local runtime artifacts must not declare remote attestations");
287
392
  }
@@ -315,6 +420,31 @@ function validateArtifactUrl(manifest, artifact, trustMode) {
315
420
  throw new Error("agenc: runtime artifact attestation size is invalid");
316
421
  }
317
422
  }
423
+ const hasBuildProvenance =
424
+ artifact.buildProvenanceUrl !== undefined ||
425
+ artifact.buildProvenanceSha256 !== undefined ||
426
+ artifact.buildProvenanceBytes !== undefined;
427
+ if (
428
+ (
429
+ trustMode === "official" &&
430
+ runtimeVersionRequiresDualProvenance(manifest.runtimeVersion)
431
+ ) ||
432
+ hasBuildProvenance
433
+ ) {
434
+ if (artifact.buildProvenanceUrl !== `${artifact.url}.build.sigstore.json`) {
435
+ throw new Error("agenc: runtime artifact build provenance URL is not canonical");
436
+ }
437
+ if (!/^[0-9a-f]{64}$/.test(artifact.buildProvenanceSha256 ?? "")) {
438
+ throw new Error("agenc: runtime artifact build provenance digest is invalid");
439
+ }
440
+ if (
441
+ !Number.isSafeInteger(artifact.buildProvenanceBytes) ||
442
+ artifact.buildProvenanceBytes <= 0 ||
443
+ artifact.buildProvenanceBytes > MAX_RUNTIME_ATTESTATION_BYTES
444
+ ) {
445
+ throw new Error("agenc: runtime artifact build provenance size is invalid");
446
+ }
447
+ }
318
448
  }
319
449
 
320
450
  export function validateRuntimeReleaseManifest(
@@ -427,6 +557,15 @@ export function validateRuntimeReleaseManifest(
427
557
  ) {
428
558
  throw new Error("agenc: runtime manifest build provenance is invalid");
429
559
  }
560
+ validateRuntimeReleaseCandidateIdentity(
561
+ build.releaseCandidate,
562
+ build.sourceCommit,
563
+ {
564
+ required:
565
+ trustMode === "official" &&
566
+ runtimeVersionRequiresDualProvenance(manifest.runtimeVersion),
567
+ },
568
+ );
430
569
  for (const artifact of manifest.artifacts) {
431
570
  if (
432
571
  artifact.nodeMajor !== build.nodeMajor ||
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@tetsuo-ai/agenc",
3
- "version": "0.11.2",
3
+ "version": "0.14.0",
4
4
  "description": "Public AgenC CLI launcher package",
5
5
  "license": "MIT",
6
6
  "type": "module",