@tinkerlandai/indiana-iam 0.1.1 → 0.2.0

package/README.md

@@ -40,6 +40,13 @@ Point the visual SDK at the descriptor:
 
 `next dev` and other phases leave your config unchanged. Add `public/.well-known/indiana/` to `.gitignore`.
 
+No developer harness or business SDK npm dependency is needed. The public script above runs the visual runtime;
+Indiana owns authorization, immutable uploads and experiment publication.
+IAM does not discover or launch merchant harnesses, test scripts, agents, browsers or development servers. It does
+not import merchant modules to execute them. Source enumeration and optional Git commit labels use filesystem reads;
+the package starts no external commands and works without a Git executable. Developers' explicitly configured
+framework callbacks remain part of their normal build.
+
 ## Vite and React Router
 
 ```js
@@ -54,9 +61,28 @@ Server builds are skipped.
 
 ## Options
 
-Both integrations accept `{ enabled, name, strict, rootFont, omitSvgResources, logger, apiKey, baseUrl, upload }`;
+Both integrations accept `{ enabled, name, automaticAnchors, strict, rootFont, omitSvgResources, logger, apiKey, baseUrl, upload }`;
 `withIndianaIam` also takes `root`. By default a source the scanner cannot read prints a warning and the build continues without an IAM;
 `strict: true` fails the build instead. The same source always produces the same release ID and IAM bytes.
+If source changes during compilation, generation fails instead of publishing a descriptor for different code.
+
+## Target identity and release changes
+
+Framework builds reuse `id`, `data-testid`, `data-test`, `data-qa`, then `data-indiana-id`. When none is declared,
+the source loader adds a deterministic `data-indiana-id` to unambiguous native JSX in the build output and IAM.
+Source files stay unchanged; formatting, comments and unrelated sibling insertions preserve a leaf's marker.
+Set `automaticAnchors: false` to use only existing attributes.
+
+Repeated component instances, identical source sites, unknown props and duplicate DOM selectors cannot prove a
+unique target and remain read-only. React `key` contributes source evidence but is not a DOM selector or a global ID;
+dynamic keys are never evaluated a second time or exposed as customer identifiers. Supported routing and state
+coverage stays bounded and explicit.
+
+The visual runtime requests delivery for the page's exact IAM digest. Indiana rebinds saved changes only when the
+route, composition, target selector, element content and render uniqueness still match. Text changes also require
+unchanged subtree content. A failure excludes the whole experiment for that release; it does not renormalize
+variation weights or rewrite authored pins. Old deployments keep their own bindings during a rolling release.
+The Console reports incompatible references for review. Local extraction does not certify arbitrary runtime data.
 
 ## Other builds
 
@@ -67,8 +93,9 @@ indiana-iam prepare --root .
 indiana-iam anchor --root . --out <plan.json> [--apply]
 ```
 
-`anchor` adds reviewable `data-indiana-id` attributes to JSX elements so saved changes keep targeting the same elements
-across releases.
+Standalone generation uses existing attributes. Custom builds can pair `transformSourceForIam(code, relativeFile)`
+with `generateAppManifest({ root, automaticAnchors: true })`; use both on the same original source. `anchor` is an
+optional command for explicit source annotations. Next and Vite do not need that command or a harness.
 
 ## Scope
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinkerlandai/indiana-iam",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Build-time Indiana App Manifest (IAM) generator for Next.js and Vite apps: scans source after the production build and writes the IAM and its release descriptor.",
   "license": "UNLICENSED",
   "repository": {
@@ -46,6 +46,7 @@
     "ajv": "6.15.0",
     "css-tree": "3.2.1",
     "jsdom": "26.1.0",
+    "magic-string": "0.30.21",
     "tailwind-merge": "3.7.0",
     "tailwindcss": "4.3.3",
     "typescript": "5.9.3"

package/src/analyze.mjs

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { execFileSync } from "node:child_process";
+import { automaticSourceAnchors, anchorAttributes } from "./anchors.mjs";
+import { sourceFiles } from "./source-files.mjs";
 import { dependency } from "./dependencies.mjs";
 import { assembleRouteTree, readVariables } from "./route-tree.mjs";
 import { frameworkRoutes, externalImport } from "./framework-routes.mjs";
@@ -26,6 +27,28 @@ const { JSDOM } = dependency("jsdom").value;
 const UNKNOWN = Symbol("unknown");
 import { sensitiveName, redactLiteral, privateUrl } from "./privacy.mjs";
 const isUnknown = (value) => value === UNKNOWN;
+// React numeric styles use px except for unitless properties and CSS variables.
+const unitlessStyles = new Set("animationIterationCount aspectRatio borderImageOutset borderImageSlice borderImageWidth boxFlex boxFlexGroup boxOrdinalGroup columnCount columns flex flexGrow flexPositive flexShrink flexNegative flexOrder gridArea gridRow gridRowEnd gridRowSpan gridRowStart gridColumn gridColumnEnd gridColumnSpan gridColumnStart fontWeight lineClamp lineHeight opacity order orphans scale tabSize widows zIndex zoom fillOpacity floodOpacity stopOpacity strokeDasharray strokeDashoffset strokeMiterlimit strokeOpacity strokeWidth".split(" "));
+function staticStyle(value, unsupported) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    unsupported();
+    return "";
+  }
+  return Object.entries(value).flatMap(([key, raw]) => {
+    if (raw == null || typeof raw === "boolean" || raw === "") return [];
+    if (!/^(?:[a-zA-Z][a-zA-Z0-9]*|--[a-zA-Z0-9_-]+)$/.test(key) ||
+        !["string", "number"].includes(typeof raw) ||
+        (typeof raw === "number" && !Number.isFinite(raw)) ||
+        /[;{}<>\\]|url\s*\(|expression\s*\(|@import/i.test(String(raw))) {
+      unsupported();
+      return [];
+    }
+    const name = key.startsWith("--") ? key : key.replace(/[A-Z]/g, letter => "-" + letter.toLowerCase()).replace(/^ms-/, "-ms-");
+    const unprefixed = key.replace(/^(?:Webkit|Moz|ms|O)(?=[A-Z])/, "").replace(/^[A-Z]/, letter => letter.toLowerCase());
+    const unit = typeof raw === "number" && raw !== 0 && !key.startsWith("--") && !unitlessStyles.has(unprefixed) ? "px" : "";
+    return [name + ":" + String(raw).trim() + unit];
+  }).join(";");
+}
 const allowedTags = new Set(
   "main section article aside header footer nav div span p h1 h2 h3 h4 h5 h6 a button form label input select option textarea ul ol li dl dt dd table thead tbody tr th td caption fieldset legend details summary pre code blockquote strong em b i small s u mark time br hr img picture source svg path circle rect line polyline polygon ellipse g title".split(
     " ",
@@ -133,52 +156,10 @@ export async function analyze({
   maxFiles = 5000,
   maxBytes = 100_000_000,
   navigationPaths = [],
+  automaticAnchors = false,
 }) {
   root = await fs.realpath(root);
-  let files;
-  try {
-    files = execFileSync("git", ["-C", root, "ls-files", "-z"], {
-      encoding: "utf8",
-      maxBuffer: 8_000_000,
-      stdio: ["ignore", "pipe", "pipe"],
-    })
-      .split("\0")
-      .filter(Boolean);
-  } catch {
-    files = [];
-  }
-  // An authorized copied app can sit inside another repository's ignored
-  // verification directory. git succeeds there with an empty index; it must
-  // not silently turn a complete application into a zero-route manifest.
-  if (!files.length) {
-    async function walk(dir) {
-      for (const item of await fs.readdir(dir, { withFileTypes: true })) {
-        if (
-          item.name.startsWith(".") ||
-          ["node_modules", "dist", "build", "coverage"].includes(item.name)
-        )
-          continue;
-        const p = path.join(dir, item.name);
-        if (item.isDirectory()) await walk(p);
-        else if (item.isFile())
-          files.push(path.relative(root, p).split(path.sep).join("/"));
-      }
-    }
-    await walk(root);
-  }
-  files = files
-    .filter(
-      (file) =>
-        /\.(?:[cm]?[jt]sx?|css|mdx|json)$/.test(file) &&
-        !/(^|\/)(?:node_modules|\.next|\.git|\.indiana|api|server|secrets?)(\/|$)/.test(
-          file,
-        ) &&
-        !/(?:^|\/)(?:\.?env|credentials|secrets)(?:\.|\/)/i.test(file) &&
-        !file.startsWith('public/.well-known/indiana/')&&
-        !/(?:lock|package-lock)\.json$/.test(file),
-    )
-    .sort();
-  if (files.length > maxFiles) throw new Error("Source file budget exceeded");
+  const files = await sourceFiles(root, { maxFiles });
   const modules = new Map(),
     inventory = [],
     gaps = [],
@@ -238,6 +219,7 @@ export async function analyze({
       file,
       text,
       source,
+      anchors: automaticAnchors ? automaticSourceAnchors(file, source) : new Map(),
       bindings: new Map(),
       imports: new Map(),
       exports: new Map(),
@@ -968,6 +950,15 @@ export async function analyze({
       eventInputs(value);
       return { variableKey, value, payload };
     }
+    function unobservedValue(node, owner, instance) {
+      const source = sourceLocation(owner.module, node, owner.symbol);
+      const elementKey = identity("element", { component: owner.key, unobservedValue: node.getStart(owner.module.source) - owner.fn.getStart(owner.module.source) });
+      const nodeId = identity("node", { page: pageKey, element: elementKey, instance });
+      elements.set(elementKey, { elementKey, componentKey: owner.key, tag: "span", source, identityStrategy: "provisional_ast_ordinal", editableProperties: [], binding: "preview_only" });
+      record.set(nodeId, { elementKey, source, synthetic: true });
+      // Preserve an unknown child boundary. An empty projection must never prove that replacing text is safe.
+      return '<span data-iam-node="' + nodeId + '" hidden=""></span>';
+    }
     function renderExpr(node, owner, ctx, instance, depth) {
       node = unwrap(node);
       if (!node) return "";
@@ -1117,7 +1108,7 @@ export async function analyze({
             .join("");
         }
         gap("DYNAMIC_COLLECTION", m.file, node.expression.getText(m.source));
-        return "";
+        return unobservedValue(node, owner, instance);
       }
       if (!ts.isJsxElement(node) && !ts.isJsxSelfClosingElement(node)) {
         if (
@@ -1141,18 +1132,25 @@ export async function analyze({
           typeof value !== "boolean"
         )
           return escape(value);
-        if (isUnknown(value))
+        if (isUnknown(value)) {
           gap("DYNAMIC_VALUE", m.file, node.getText(m.source).slice(0, 100));
+          return unobservedValue(node, owner, instance);
+        }
         return "";
       }
       if (++renderedCount > 12000)
         throw new Error("Rendered node budget exceeded");
       const opening = ts.isJsxElement(node) ? node.openingElement : node,
         tag = opening.tagName.getText(m.source),
-        props = {}, uiHandlers = [], uiBindings = [], forwardedHandlers=[];
+        props = m.anchors.get(opening) ? { "data-indiana-id": m.anchors.get(opening) } : {}, uiHandlers = [], uiBindings = [], forwardedHandlers=[];
       for (const attr of opening.attributes.properties) {
         if (ts.isJsxSpreadAttribute(attr)) {
           const v = evalExpression(attr.expression, m, ctx);
+          if (isUnknown(v)) {
+            for (const attribute of anchorAttributes) delete props[attribute];
+            gap("UNKNOWN_ANCHOR_SPREAD", m.file, "Opaque spread may override element identity");
+            continue;
+          }
           if (v && typeof v === "object") {
             Object.assign(props, v);
             const inherited = forwarded.get(v);
@@ -1313,40 +1311,30 @@ export async function analyze({
         }
       }
       if (!allowedTags.has(htmlTag)) return children;
-      const anchor = ["data-indiana-id", "data-testid", "id", "name"]
+      const anchor = anchorAttributes
         .map((key) =>
           typeof props[key] === "string" ? key + "=" + props[key] : null,
         )
         .find(Boolean);
       const ordinal = owner.ordinals.get(node) ?? 0,
-        explicitAnchor = anchor && !anchor.startsWith('name='),
-        elementKey = identity("element", {
+        explicitAnchor = Boolean(anchor);
+      let elementKey = identity("element", {
           component: owner.key,
           tag,
           anchor: explicitAnchor ? anchor : "jsx:" + ordinal,
         });
+      const source = sourceLocation(m, node, owner.symbol);
+      const prior = elements.get(elementKey);
+      if (prior && (prior.source.file !== source.file || prior.source.line !== source.line || prior.source.column !== source.column)) {
+        // Keep both concrete source sites. The DOM uniqueness check makes duplicate anchors read-only.
+        elementKey = identity("element", { component: owner.key, tag, anchor, ordinal });
+        gap("AMBIGUOUS_ELEMENT_ANCHOR", m.file, tag);
+      }
       const nodeId = identity("node", {
           page: pageKey,
           element: elementKey,
           instance,
-        }),
-        source = sourceLocation(m, node, owner.symbol);
-      const prior = elements.get(elementKey);
-      if (
-        explicitAnchor &&
-        prior &&
-        (prior.source.file !== source.file ||
-          prior.source.line !== source.line ||
-          prior.source.column !== source.column)
-      )
-        throw new Error(
-          "Ambiguous explicit element anchor " +
-            anchor +
-            " in " +
-            m.file +
-            ":" +
-            source.line,
-        );
+        });
       elements.set(elementKey, {
         elementKey,
         componentKey: owner.key,
@@ -1380,6 +1368,12 @@ export async function analyze({
       }
       const attrs = { "data-iam-node": nodeId };
       for (const [key, value] of Object.entries(props)) {
+        if (key === "style") {
+          const css = staticStyle(value, () => gap("INLINE_STYLE_UNSUPPORTED", m.file,
+            "Inline style at line " + source.line + ": only static CSS values without resource URLs are reconstructed"));
+          if (css) attrs.style = css;
+          continue;
+        }
         if (isUnknown(value) || value == null || typeof value === "object")
           continue;
         if (["href", "src"].includes(key) && privateUrl(value)) {
@@ -1400,7 +1394,7 @@ export async function analyze({
             clipRule: "clip-rule",
           }[key] || key;
         if (
-          !/^(?:class|id|name|type|placeholder|value|title|alt|href|src|role|for|disabled|hidden|checked|width|height|viewBox|d|fill|stroke|stroke-width|stroke-linecap|stroke-linejoin|fill-rule|clip-rule|cx|cy|r|x|y|x1|x2|y1|y2|points|aria-[a-z-]+|data-indiana-id|data-testid|data-iam-(?:adapter|toggle))$/.test(
+          !/^(?:class|id|name|type|placeholder|value|title|alt|href|src|role|for|disabled|hidden|checked|width|height|viewBox|d|fill|stroke|stroke-width|stroke-linecap|stroke-linejoin|fill-rule|clip-rule|cx|cy|r|x|y|x1|x2|y1|y2|points|aria-[a-z-]+|data-indiana-id|data-testid|data-test|data-qa|data-iam-(?:adapter|toggle))$/.test(
             attr,
           )
         )
@@ -1712,7 +1706,7 @@ export async function analyze({
     schemaVersion: 2,
     producer: {
       name: "indiana-app-manifest-local",
-      version: "0.16.0",
+      version: "0.17.0",
       method: "typescript-ast-and-bounded-static-projection",
     },
     app: { name, platforms: ["web"] },

package/src/anchors.mjs

@@ -0,0 +1,122 @@
+import { dependency } from "./dependencies.mjs";
+import { sha256 } from "./integrity.mjs";
+import { redactLiteral } from "./privacy.mjs";
+
+export const anchorAttributes = [
+  "id",
+  "data-testid",
+  "data-test",
+  "data-qa",
+  "data-indiana-id",
+];
+export function instrumentableSource(file, text) {
+  return (
+    typeof text === "string" &&
+    Buffer.byteLength(text) <= 1_000_000 &&
+    /\.[cm]?[jt]sx?$/.test(file) &&
+    !/(?:^|\/)(?:node_modules|\.next|\.git|\.indiana|api|server|secrets?)(?:\/|$)/.test(
+      file,
+    )
+  );
+}
+export const anchorSelectorPattern =
+  /^[a-z][a-z0-9-]*\[(?:id|data-testid|data-test|data-qa|data-indiana-id)="(?:[^"\\\x00-\x1f\x7f]|\\["\\])*"\]$/;
+
+export function anchorSelector(node) {
+  if (node.kind !== "element") return null;
+  for (const attribute of anchorAttributes) {
+    const value = node.attributes[attribute];
+    if (
+      typeof value !== "string" ||
+      !value ||
+      value.length > 256 ||
+      /[\x00-\x1f\x7f]/.test(value) ||
+      redactLiteral(value) !== value
+    )
+      continue;
+    const selector = `${node.tag}[${attribute}="${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"]`;
+    if (selector.length <= 512) return selector;
+  }
+  return null;
+}
+
+/** A semantic source fingerprint; never line numbers, absolute paths or sibling ordinals. */
+export function automaticSourceAnchors(file, source) {
+  if (!instrumentableSource(file, source.text)) return new Map();
+  const ts = dependency("typescript").value;
+  const candidates = [],
+    groups = new Map();
+  function owner(node) {
+    for (let parent = node.parent; parent; parent = parent.parent) {
+      if (!ts.isFunctionLike(parent)) continue;
+      if (parent.name && ts.isIdentifier(parent.name)) return parent.name.text;
+      if (
+        ts.isVariableDeclaration(parent.parent) &&
+        ts.isIdentifier(parent.parent.name)
+      )
+        return parent.parent.name.text;
+      if (
+        ts.isExportAssignment(parent.parent) ||
+        parent.modifiers?.some(
+          (modifier) => modifier.kind === ts.SyntaxKind.DefaultKeyword,
+        )
+      )
+        return "default";
+    }
+    return "module";
+  }
+  const shapes = new WeakMap();
+  function shape(node) {
+    if (shapes.has(node)) return shapes.get(node);
+    let value;
+    if (ts.isJsxText(node))
+      value = [node.kind, node.text.replace(/\s+/g, " ").trim()];
+    else if (
+      ts.isIdentifier(node) ||
+      ts.isStringLiteral(node) ||
+      ts.isNumericLiteral(node)
+    )
+      value = [node.kind, node.text];
+    else {
+      const children = [];
+      ts.forEachChild(node, (child) => {
+        if (!ts.isJsxText(child) || child.text.trim())
+          children.push(shape(child));
+      });
+      value = [node.kind, ...children];
+    }
+    const digest = sha256(JSON.stringify(value));
+    shapes.set(node, digest);
+    return digest;
+  }
+  function visit(node) {
+    if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node)) {
+      const opening = ts.isJsxElement(node) ? node.openingElement : node;
+      const tag = opening.tagName.getText(source);
+      if (
+        /^[a-z][a-z0-9-]*$/.test(tag) &&
+        !["html", "head", "script", "style", "link", "meta"].includes(tag) &&
+        !opening.attributes.properties.some(
+          (attribute) =>
+            ts.isJsxAttribute(attribute) &&
+            anchorAttributes.includes(attribute.name.getText(source)),
+        )
+      ) {
+        const signature =
+          file.replaceAll("\\", "/") + "\0" + owner(node) + "\0" + shape(node);
+        const anchor =
+          "iam_" + sha256("iam/build-anchor/v1\0" + signature).slice(0, 32);
+        candidates.push({ opening, anchor });
+        groups.set(anchor, (groups.get(anchor) ?? 0) + 1);
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(source);
+  // Identical source sites cannot be disambiguated by their position. Leave them read-only.
+  return new Map(
+    candidates
+      .filter((candidate) => groups.get(candidate.anchor) === 1)
+      .map(({ opening, anchor }) => [opening, anchor]),
+  );
+}

package/src/build-options.d.ts

@@ -4,6 +4,8 @@ import type { BuildLogger } from "./index.js";
 export type IndianaIamBuildOptions = {
   /** Set false to build without generating an IAM. */
   enabled?: boolean;
+  /** Reuse existing UI IDs and add build-only anchors for unambiguous native JSX (default: true). */
+  automaticAnchors?: boolean;
   /** App name recorded in the IAM; defaults to the root folder name. */
   name?: string;
   /** Fail the build when the IAM cannot be generated (default: warn and continue). */

package/src/build.mjs

@@ -8,7 +8,6 @@ import { buildLabel, uploadAppManifest, uploadSettings } from "./upload.mjs";
 const MAX_BUILD_CSS = 16;
 // Shared with build workers that re-evaluate the build configuration.
 const STATE = "INDIANA_IAM_BUILD_RELEASE";
-const analyses = new Map();
 
 const prefix = "[indiana-iam] ";
 const report = (logger, level, message) => logger[level](prefix + message);
@@ -28,28 +27,16 @@ async function guarded({ strict, logger }, action, what) {
  * Before compilation: scans source once per build and returns its release ID.
  * The same source and producer always get the same ID, so the page can embed its descriptor URL before the IAM exists.
  */
-export async function prepareBuildRelease({ root, name, strict = false, logger = console }) {
+export async function prepareBuildRelease({ root, name, automaticAnchors = true, strict = false, logger = console }) {
   return guarded({ strict, logger }, async () => {
     root = await fs.realpath(root);
-    const shared = parseState(process.env[STATE]);
-    if (shared?.root === root) return { releaseId: shared.releaseId };
-    const analysis = await analyzeSource({ root, name });
+    const analysis = await analyzeSource({ root, name, automaticAnchors });
     const releaseId = deriveReleaseId(analysis);
-    analyses.set(root + "\0" + releaseId, analysis);
-    process.env[STATE] = JSON.stringify({ root, releaseId });
+    process.env[STATE] = JSON.stringify({ root, releaseId, automaticAnchors });
     return { releaseId };
   }, "IAM generation");
 }
 
-function parseState(value) {
-  try {
-    const state = value ? JSON.parse(value) : null;
-    return typeof state?.root === "string" && typeof state?.releaseId === "string" ? state : null;
-  } catch {
-    return null;
-  }
-}
-
 async function compiledCss(root, directory) {
   let entries;
   try {
@@ -72,6 +59,7 @@ export async function finishBuildRelease({
   root,
   releaseId,
   name,
+  automaticAnchors = true,
   cssDirectory,
   mounts,
   publicDirectory,
@@ -83,7 +71,8 @@ export async function finishBuildRelease({
 }) {
   root = await fs.realpath(root);
   return guarded({ strict, logger }, async () => {
-    const analysis = analyses.get(root + "\0" + releaseId) ?? (await analyzeSource({ root, name }));
+    const analysis = await analyzeSource({ root, name, automaticAnchors });
+    if (deriveReleaseId(analysis) !== releaseId) throw new Error("Source changed during the build; rebuild before publishing IAM");
     const css = cssDirectory ? await compiledCss(root, cssDirectory) : [];
     const plain = () => generateAppManifest({ root, analysis, releaseId });
     let result;
@@ -130,6 +119,5 @@ export async function finishBuildRelease({
 
 /** Clears the per-build state; build tools call this only from tests. */
 export function resetBuildRelease() {
-  analyses.clear();
   delete process.env[STATE];
 }

package/src/generate.mjs

@@ -11,9 +11,9 @@ import { refreshRenderHashes } from "./render-index.mjs";
 export const IAM_MAX_BYTES = 8_388_608;
 
 /** Scans the source checkout. The result is the input of {@link generateAppManifest}. */
-export async function analyzeSource({ root, name, repository = "", commit = "", navigationPaths = [] }) {
+export async function analyzeSource({ root, name, repository = "", commit = "", navigationPaths = [], automaticAnchors = false }) {
   root = await fs.realpath(root);
-  return analyze({ root, name: name || path.basename(root), repository, commit, navigationPaths });
+  return analyze({ root, name: name || path.basename(root), repository, commit, navigationPaths, automaticAnchors });
 }
 
 /**
@@ -27,6 +27,7 @@ export async function generateAppManifest({
   repository,
   commit,
   navigationPaths,
+  automaticAnchors = false,
   releaseId,
   buildCss = [],
   publicAssets = [],
@@ -38,7 +39,7 @@ export async function generateAppManifest({
   root = await fs.realpath(root);
   const manifest = analysis
     ? structuredClone(analysis)
-    : await analyzeSource({ root, name, repository, commit, navigationPaths });
+    : await analyzeSource({ root, name, repository, commit, navigationPaths, automaticAnchors });
   if (releaseId) {
     releasePath(releaseId);
     manifest.release.runtimeBinding = { schemaVersion: 1, releaseId };

package/src/git-metadata.mjs

@@ -0,0 +1,61 @@
+import { readFileSync, statSync } from "node:fs";
+import path from "node:path";
+
+const commit = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/i;
+function read(file, max = 4096) {
+  try {
+    if (statSync(file).size <= max) return readFileSync(file, "utf8").trim();
+  } catch {
+    /* Metadata is optional. */
+  }
+  return "";
+}
+
+/** An optional display label only. No executable, hook, config or credential helper is loaded. */
+export function repositoryCommit(root) {
+  let directory = path.resolve(root);
+  while (true) {
+    const entry = path.join(directory, ".git");
+    let git;
+    try {
+      const stat = statSync(entry);
+      if (stat.isDirectory()) git = entry;
+      else if (stat.isFile()) {
+        const match = /^gitdir: (.+)$/.exec(read(entry));
+        if (match) git = path.resolve(directory, match[1]);
+      }
+    } catch {
+      /* Look for a containing repository. */
+    }
+    if (git) {
+      const head = read(path.join(git, "HEAD"));
+      if (commit.test(head)) return head;
+      const match = /^ref: (refs\/[A-Za-z0-9._/-]+)$/.exec(head);
+      if (
+        !match ||
+        match[1]
+          .split("/")
+          .some((part) => !part || part === "." || part === "..")
+      )
+        return "";
+      const common = read(path.join(git, "commondir"));
+      for (const metadata of [
+        ...new Set([git, ...(common ? [path.resolve(git, common)] : [])]),
+      ]) {
+        const loose = read(path.join(metadata, match[1]));
+        if (commit.test(loose)) return loose;
+        for (const line of read(
+          path.join(metadata, "packed-refs"),
+          1_000_000,
+        ).split(/\r?\n/)) {
+          const [hash, ref] = line.split(" ");
+          if (ref === match[1] && commit.test(hash)) return hash;
+        }
+      }
+      return "";
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) return "";
+    directory = parent;
+  }
+}