@tinkerlandai/indiana-iam 0.1.1 → 0.2.0

package/src/index.d.ts

@@ -20,6 +20,7 @@ export type ValidationCounts = Record<string, unknown>;
 
 export type GenerateOptions = {
   root: string;
+  automaticAnchors?: boolean;
   /** A previous {@link analyzeSource} result; scanned again when omitted. */
   analysis?: AppManifest;
   name?: string;
@@ -46,18 +47,23 @@ export type GeneratedAppManifest = {
 export declare const IAM_MAX_BYTES: 8388608;
 export declare function analyzeSource(options: {
   root: string;
+  automaticAnchors?: boolean;
   name?: string;
   repository?: string;
   commit?: string;
   navigationPaths?: string[][];
 }): Promise<AppManifest>;
-export declare function generateAppManifest(options: GenerateOptions): Promise<GeneratedAppManifest>;
+export declare function generateAppManifest(
+  options: GenerateOptions,
+): Promise<GeneratedAppManifest>;
 export declare function writeAppManifestOutput(options: {
   root: string;
   out: string;
   result: GeneratedAppManifest;
 }): Promise<{ out: string; file: string; receipt: Record<string, unknown> }>;
-export declare function validateAppManifest(manifest: AppManifest): Promise<ValidationCounts>;
+export declare function validateAppManifest(
+  manifest: AppManifest,
+): Promise<ValidationCounts>;
 export declare function parseAppManifest(text: string): AppManifest;
 export declare function deriveReleaseId(manifest: AppManifest): string;
 export declare function releasePath(releaseId: string): string;
@@ -67,10 +73,17 @@ export declare function writePublicRelease(
   releaseId: string,
   publicDirectory?: string,
 ): Promise<{ path: string; bytes: number }>;
-export declare function nextStaticMounts(distDir?: string, basePath?: string): StaticMount[];
+export declare function nextStaticMounts(
+  distDir?: string,
+  basePath?: string,
+): StaticMount[];
 
 export type BuildLogger = Pick<Console, "log" | "warn">;
-export type BuildReleaseOptions = { strict?: boolean; logger?: BuildLogger };
+export type BuildReleaseOptions = {
+  strict?: boolean;
+  logger?: BuildLogger;
+  automaticAnchors?: boolean;
+};
 export declare function prepareBuildRelease(
   options: { root: string; name?: string } & BuildReleaseOptions,
 ): Promise<{ releaseId: string } | null>;
@@ -84,7 +97,12 @@ export declare function finishBuildRelease(
     publicDirectory: string;
     rootFont?: string;
     omitSvgResources?: boolean;
-    upload?: { apiKey?: string; baseUrl?: string; upload?: "production" | "always" | false; fetch?: typeof globalThis.fetch };
+    upload?: {
+      apiKey?: string;
+      baseUrl?: string;
+      upload?: "production" | "always" | false;
+      fetch?: typeof globalThis.fetch;
+    };
   } & BuildReleaseOptions,
 ): Promise<{
   releaseId: string;
@@ -103,14 +121,88 @@ export declare function uploadAppManifest(options: {
   apiKey: string;
   baseUrl?: string;
   fetch?: typeof globalThis.fetch;
-}): Promise<{ version: { id: string; state: string; isCurrent: boolean } & Record<string, unknown>; uploaded: boolean }>;
+}): Promise<{
+  version: { id: string; state: string; isCurrent: boolean } & Record<
+    string,
+    unknown
+  >;
+  uploaded: boolean;
+}>;
 export declare function uploadSettings(
-  options?: { apiKey?: string; baseUrl?: string; upload?: "production" | "always" | false | true },
+  options?: {
+    apiKey?: string;
+    baseUrl?: string;
+    upload?: "production" | "always" | false | true;
+  },
   env?: Record<string, string | undefined>,
 ): { enabled: boolean; apiKey: string; baseUrl: string; missingKey: boolean };
-export declare function buildLabel(root: string, env?: Record<string, string | undefined>): string;
+export declare function buildLabel(
+  root: string,
+  env?: Record<string, string | undefined>,
+): string;
 export declare function planAnchors(
   root: string,
-  options?: { primitives?: { module: string; exports: string[] }[]; publicLabels?: boolean; forwardAnchors?: boolean },
-): Promise<{ root: string; changes: { file: string; anchors: number }[] } & Record<string, unknown>>;
-export declare function applyAnchors(plan: Awaited<ReturnType<typeof planAnchors>>): Promise<{ files: number; anchors: number }>;
+  options?: {
+    primitives?: { module: string; exports: string[] }[];
+    publicLabels?: boolean;
+    forwardAnchors?: boolean;
+  },
+): Promise<
+  { root: string; changes: { file: string; anchors: number }[] } & Record<
+    string,
+    unknown
+  >
+>;
+export declare function applyAnchors(
+  plan: Awaited<ReturnType<typeof planAnchors>>,
+): Promise<{ files: number; anchors: number }>;
+export type IamSourceTransform = {
+  code: string;
+  map: {
+    version: 3;
+    file?: string;
+    sources: string[];
+    sourcesContent: string[];
+    names: string[];
+    mappings: string;
+    toString(): string;
+  };
+};
+export declare function transformSourceForIam(
+  code: string,
+  file: string,
+): IamSourceTransform | null;
+
+export type IamBindingSource = {
+  versionId: string;
+  manifestDigest: string;
+  sourceGraphDigest: string;
+  pageKey: string;
+  stateKey: string;
+  documentKey: string;
+  documentHash: string;
+  renderKey: string;
+  patches: {
+    nodeId: string;
+    elementKey: string;
+    expectedContentHash: string;
+    property: "text" | "fontSize" | "color";
+    value: string | number;
+  }[];
+};
+/** Facts must come from fully validated immutable IAM artifacts in the same App/environment. */
+export declare function rebindIamSource(
+  previous: {
+    id: string;
+    sha256: string;
+    sourceGraphDigest: string;
+    routeTree: unknown;
+  },
+  next: {
+    id: string;
+    sha256: string;
+    sourceGraphDigest: string;
+    routeTree: unknown;
+  },
+  source: IamBindingSource,
+): { ok: true; source: IamBindingSource } | { ok: false; reason: string };

package/src/index.mjs

@@ -3,5 +3,7 @@ export { validate as validateAppManifest, parseManifest as parseAppManifest } fr
 export { deriveReleaseId, releasePath, writePublicRelease } from "./release-metadata.mjs";
 export { finishBuildRelease, prepareBuildRelease } from "./build.mjs";
 export { nextStaticMounts } from "./build-styles.mjs";
+export { transformSourceForIam } from "./transform.mjs";
+export { rebindIamSource } from "./rebind.mjs";
 export { planAnchors, applyAnchors } from "./instrument.mjs";
 export { uploadAppManifest, uploadSettings, buildLabel, DEFAULT_BASE_URL } from "./upload.mjs";

package/src/instrument.mjs

@@ -1,6 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { execFileSync } from "node:child_process";
+import { sourceFiles } from "./source-files.mjs";
 import { dependency } from "./dependencies.mjs";
 import { sha256 } from "./integrity.mjs";
 import{redactLiteral}from'./privacy.mjs';
@@ -10,7 +10,7 @@ export async function planAnchors(root,options={}) {
   const primitives=options.primitives??[];
   if(!Array.isArray(primitives)||primitives.length>32||primitives.some(p=>typeof p.module!=='string'||p.module.length>256||!Array.isArray(p.exports)||p.exports.length>64||p.exports.some(e=>typeof e!=='string'||!/^default$|^[A-Z][\w]*$/.test(e))))throw Error('Invalid reviewed primitive map');
   root = await fs.realpath(root);
-  const files = execFileSync("git", ["-C", root, "ls-files", "-z"], { encoding: "utf8", maxBuffer: 8_000_000 }).split("\0").filter(file => /\.[jt]sx$/.test(file) && !/(^|\/)(?:node_modules|\.next|\.git|\.indiana|dist|build|api|server|secrets?)(\/|$)/.test(file));
+  const files = await sourceFiles(root, { maxFiles: 3000, include: file => /\.[jt]sx$/.test(file) });
   if (files.length > 3000) throw new Error("Instrumentation file budget exceeded");
   const changes = [];
   for (const file of files.sort()) {

package/src/library-entry.mjs

@@ -8,6 +8,7 @@ import{renderGuardFor}from'./render-index.mjs';
 import { documentScript } from "./shared-scripts.mjs";
 import { documentNodes } from './node-hashes.mjs';
 export { documentNodes as iamDocumentNodes } from './node-hashes.mjs';
+export { rebindIamSource } from './rebind.mjs';
 export const parseIamJson = parseManifest;
 export async function isReviewedIamScript(value) {
   return typeof value === "string" && (await loadTrustedRuntimes()).includes(value);

package/src/next-loader.cjs

@@ -0,0 +1,30 @@
+const path = require("node:path");
+const fs = require("node:fs/promises");
+
+module.exports = function indianaIamLoader(source, inputMap) {
+  this.cacheable?.();
+  const done = this.async();
+  const { root } = this.getOptions();
+  Promise.all([
+    import("./transform.mjs"),
+    fs.realpath(this.resourcePath),
+    fs.realpath(root),
+  ])
+    .then(([{ transformSourceForIam }, resource, directory]) => {
+      const file = path.relative(directory, resource).split(path.sep).join("/");
+      if (file.startsWith("../") || path.isAbsolute(file))
+        return done(null, source, inputMap);
+      // A pre-loader sees original source; refusing an upstream map prevents silently corrupting diagnostics.
+      if (inputMap)
+        throw new Error(
+          "Indiana IAM source loader must run before source transforms",
+        );
+      const result = transformSourceForIam(source, file);
+      done(
+        null,
+        result?.code ?? source,
+        result ? JSON.parse(result.map.toString()) : inputMap,
+      );
+    })
+    .catch(done);
+};

package/src/next.mjs

@@ -1,9 +1,11 @@
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { finishBuildRelease, prepareBuildRelease } from "./build.mjs";
 import { nextStaticMounts } from "./build-styles.mjs";
 import { releasePath } from "./release-metadata.mjs";
 
 const PRODUCTION_BUILD = "phase-production-build";
+const sourceLoader = fileURLToPath(new URL("./next-loader.cjs", import.meta.url));
 
 /**
  * Wraps a Next.js config so each production build generates the App's IAM.
@@ -15,16 +17,35 @@ const PRODUCTION_BUILD = "phase-production-build";
  * for production deployments). Development servers and other phases get the config unchanged.
  */
 export function withIndianaIam(nextConfig = {}, options = {}) {
-  const { enabled = true, root, name, strict = false, rootFont, omitSvgResources, logger = console, apiKey, baseUrl, upload, fetch } = options;
+  const { enabled = true, root, name, automaticAnchors = true, strict = false, rootFont, omitSvgResources, logger = console, apiKey, baseUrl, upload, fetch } = options;
   return async (phase, context) => {
     const config = typeof nextConfig === "function" ? await nextConfig(phase, context) : nextConfig;
     if (phase !== PRODUCTION_BUILD || !enabled) return config;
-    const prepared = await prepareBuildRelease({ root: root ?? process.cwd(), name, strict, logger });
+    const directory = path.resolve(root ?? process.cwd());
+    const prepared = await prepareBuildRelease({ root: directory, name, automaticAnchors, strict, logger });
     if (!prepared) return config;
     const { releaseId } = prepared;
     const previous = config.compiler?.runAfterProductionCompile;
+    const pattern = "*.{js,jsx,ts,tsx,mjs,cjs,mts,cts}";
+    const existingRules = config.turbopack?.rules ?? {};
+    const rule = { loaders: [{ loader: sourceLoader, options: { root: directory } }] };
+    const matching = existingRules[pattern];
     return {
       ...config,
+      ...(automaticAnchors ? {
+        turbopack: { ...config.turbopack, rules: {
+          [pattern]: matching ? [rule, ...(Array.isArray(matching) ? matching : [matching])] : rule,
+          ...Object.fromEntries(Object.entries(existingRules).filter(([key]) => key !== pattern)),
+        } },
+        webpack(webpackConfig, context) {
+          const result = config.webpack ? config.webpack(webpackConfig, context) : webpackConfig;
+          if (result?.then) throw new Error("Next.js webpack hooks must return a synchronous config");
+          result.module ??= {};
+          result.module.rules ??= [];
+          result.module.rules.unshift({ test: /\.[cm]?[jt]sx?$/, include: directory, exclude: /node_modules/, enforce: "pre", use: [{ loader: sourceLoader, options: { root: directory } }] });
+          return result;
+        },
+      } : {}),
       env: { ...config.env, INDIANA_IAM_RELEASE_URL: releasePath(releaseId) },
       compiler: {
         ...config.compiler,
@@ -35,6 +56,7 @@ export function withIndianaIam(nextConfig = {}, options = {}) {
             root: build.projectDir,
             releaseId,
             name,
+            automaticAnchors,
             cssDirectory: distDir + "/static",
             mounts: nextStaticMounts(distDir, config.basePath ?? ""),
             publicDirectory: "public",

package/src/rebind.mjs

@@ -0,0 +1,116 @@
+/** Match admitted immutable route indexes. Neither line numbers nor DOM order prove identity. */
+export function rebindIamSource(previous, next, source) {
+  const fail = (reason) => ({ ok: false, reason });
+  const a = previous.routeTree,
+    b = next.routeTree;
+  if (
+    source.versionId !== previous.id ||
+    source.manifestDigest !== previous.sha256 ||
+    source.sourceGraphDigest !== previous.sourceGraphDigest ||
+    a?.schemaVersion !== 3 ||
+    b?.schemaVersion !== 3
+  )
+    return fail("source_mismatch");
+  if (
+    !Array.isArray(source.patches) ||
+    source.patches.length < 1 ||
+    source.patches.length > 200
+  )
+    return fail("invalid_patches");
+  const route = a.routes.find((row) => row.routeKey === source.pageKey);
+  const render = a.renders.find(
+    (row) =>
+      row.routeKey === source.pageKey && row.renderKey === source.renderKey,
+  );
+  if (
+    !route ||
+    !render ||
+    render.documentKey !== source.documentKey ||
+    render.documentHash !== source.documentHash ||
+    render.stateKey !== source.stateKey
+  )
+    return fail("source_mismatch");
+  const routes = b.routes.filter((row) => row.path === route.path);
+  if (routes.length !== 1) return fail("route_changed");
+  const seen = new Set(),
+    targets = [];
+  for (const patch of source.patches) {
+    const key = patch.nodeId + "\0" + patch.property;
+    const old = a.targets.filter(
+      (row) =>
+        row.routeKey === source.pageKey &&
+        row.renderKey === render.renderKey &&
+        row.nodeId === patch.nodeId &&
+        row.elementKey === patch.elementKey &&
+        row.contentHash === patch.expectedContentHash,
+    );
+    if (seen.has(key) || old.length !== 1) return fail("source_mismatch");
+    seen.add(key);
+    targets.push(old[0]);
+  }
+  const candidates = [];
+  for (const candidate of b.renders) {
+    if (
+      candidate.routeKey !== routes[0].routeKey ||
+      candidate.entryMode !== render.entryMode ||
+      candidate.compositionKey !== render.compositionKey
+    )
+      continue;
+    if (
+      !candidate.match.present.length ||
+      b.renders.filter(
+        (other) =>
+          other.routeKey === candidate.routeKey &&
+          JSON.stringify(other.match) === JSON.stringify(candidate.match),
+      ).length !== 1
+    )
+      continue;
+    const patches = [];
+    for (const [index, patch] of source.patches.entries()) {
+      const old = targets[index];
+      const matches = b.targets.filter(
+        (row) =>
+          row.routeKey === candidate.routeKey &&
+          row.renderKey === candidate.renderKey &&
+          row.selector === old.selector &&
+          row.tag === old.tag,
+      );
+      if (matches.length !== 1) break;
+      const target = matches[0];
+      if (
+        target.contentHash !== old.contentHash ||
+        (patch.property === "text" &&
+          (!old.leaf ||
+            !target.leaf ||
+            !old.subtreeHash ||
+            target.subtreeHash !== old.subtreeHash))
+      )
+        break;
+      patches.push({
+        ...patch,
+        nodeId: target.nodeId,
+        elementKey: target.elementKey,
+        expectedContentHash: target.contentHash,
+      });
+    }
+    if (patches.length === source.patches.length)
+      candidates.push({ candidate, patches });
+  }
+  if (candidates.length !== 1)
+    return fail(candidates.length ? "render_ambiguous" : "target_changed");
+  const { candidate, patches } = candidates[0];
+  return {
+    ok: true,
+    source: {
+      versionId: next.id,
+      manifestDigest: next.sha256,
+      sourceGraphDigest: next.sourceGraphDigest,
+      pageKey: candidate.routeKey,
+      stateKey: candidate.stateKey,
+      documentKey: candidate.documentKey,
+      documentHash: candidate.documentHash,
+      renderKey: candidate.renderKey,
+      patches,
+    },
+  };
+}

package/src/release-metadata.mjs

@@ -7,6 +7,6 @@ async function directory(root,parts){let folder=root;for(const part of parts){fo
 /** Before the native build: embed this immutable URL in the installed SDK. */
 export async function prepareRelease(root){root=await fs.realpath(root);const folder=await directory(root,['.indiana']),target=path.join(folder,'iam-release-input.json'),releaseId=randomUUID(),value={releaseId,manifestUrl:releasePath(releaseId)};try{if((await fs.lstat(target)).isSymbolicLink())throw Error('Release input cannot be a symlink');}catch(error){if(error.code!=='ENOENT')throw error;}const temporary=target+'.'+randomUUID();await fs.writeFile(temporary,JSON.stringify(value)+'\n',{flag:'wx'});await fs.rename(temporary,target);return value;}
 /** Build plugins: the same source and producer always get the same release ID, so an unchanged rebuild reproduces the same IAM bytes. */
-export function deriveReleaseId(manifest){const digest=manifest?.release?.sourceGraphDigest,version=manifest?.producer?.version;if(typeof digest!=='string'||!digest||typeof version!=='string'||!version)throw Error('Release identity needs an analyzed source graph');const h=createHash('sha256').update('indiana-iam-release/v1\0'+version+'\0'+digest).digest('hex');return h.slice(0,8)+'-'+h.slice(8,12)+'-4'+h.slice(13,16)+'-'+(8|(parseInt(h[16],16)&3)).toString(16)+h.slice(17,20)+'-'+h.slice(20,32);}
+export function deriveReleaseId(manifest){const digest=manifest?.release?.sourceGraphDigest,version=manifest?.producer?.version;if(typeof digest!=='string'||!digest||typeof version!=='string'||!version)throw Error('Release identity needs an analyzed source graph');const h=createHash('sha256').update('indiana-iam-release/v1\0'+version+'\0'+digest+'\0'+JSON.stringify({app:manifest.app,routing:manifest.routing,routeTreeDigest:manifest.integrity?.routeTreeDigest})).digest('hex');return h.slice(0,8)+'-'+h.slice(8,12)+'-4'+h.slice(13,16)+'-'+(8|(parseInt(h[16],16)&3)).toString(16)+h.slice(17,20)+'-'+h.slice(20,32);}
 /** Explicit post-build write into a served folder under root. Reusing an ID for different bytes fails closed. */
 export async function writePublicRelease(root,manifestDigest,releaseId,publicDirectory='public'){root=await fs.realpath(root);const url=releasePath(releaseId);if(!/^[a-f0-9]{64}$/.test(manifestDigest))throw Error('Invalid release digest');const parts=publicDirectory.split('/');if(parts.some(part=>!/^[A-Za-z0-9_.-]+$/.test(part)||part==='.'||part==='..'))throw Error('Invalid release directory');const folder=await directory(root,[...parts,'.well-known','indiana','releases']),target=path.join(folder,releaseId+'.json'),bytes=JSON.stringify({format:'indiana-app-manifest-release',schemaVersion:2,releaseId,manifestDigest})+'\n';try{await fs.writeFile(target,bytes,{flag:'wx'});}catch(error){if(error.code!=='EEXIST')throw error;if((await fs.lstat(target)).isSymbolicLink())throw Error('Release metadata cannot be a symlink');if(await fs.readFile(target,'utf8')!==bytes)throw Error('Immutable release ID is occupied');}return{path:url,bytes:Buffer.byteLength(bytes)};}

package/src/render-index.mjs

@@ -1,3 +1,4 @@
+import { anchorSelector, anchorSelectorPattern } from "./anchors.mjs";
 import { canonical, hashObject, identity } from "./integrity.mjs";
 
 export function flattenComposition(root) {
@@ -70,10 +71,9 @@ export function attachRenderIndex(graph, manifest, definitions, navigation=[]) {
       if (field === "transitions") row.fromStateKey = row.toStateKey = renders.find(render => render.renderKey === row.renderKey).stateKey;
     }
   const sets = new Map(renders.map(render => [render.renderKey, stableSelectors(graph, manifest.documents.find(doc => doc.documentKey === render.documentKey), render.renderKey)]));
-  const selectorPool = [...new Set([...sets.values()].flatMap(set => [...set]))].sort();
-  if (selectorPool.length > 512) throw new Error("Render discriminator budget exceeded");
   const rawSets = new Map(renders.map(render => [render.renderKey, rawSelectors(manifest.documents.find(doc => doc.documentKey === render.documentKey))]));
   const negativeProofs=routerSelectors({...graph,compositions:[...compositions.values()]},manifest);
+  const selectorPool = discriminatorPool(graph.routes, renders, sets, rawSets, negativeProofs);
   const guards = graph.routes.map(route => ({ routeKey: route.routeKey, selectorKeys: guardKeys(renders.filter(render => render.routeKey === route.routeKey), selectorPool, sets, rawSets,negativeProofs) }));
   for (const render of renders) guards.find(guard => guard.routeKey === render.routeKey).selectorKeys.forEach((poolKey, key) => render.match[sets.get(render.renderKey).has(selectorPool[poolKey]) ? "present" : "absent"].push(key));
   const renderNavigation=navigation.map(edge=>{
@@ -130,10 +130,10 @@ export function validateRenderIndex(graph, manifest) {
   }
   for (const variable of graph.variables) if (renders.get(variable.renderKey)?.routeKey !== variable.routeKey) throw new Error("Cross-render variable");
   const sets = new Map(graph.renders.map(render => [render.renderKey, stableSelectors(graph, documents.get(render.documentKey), render.renderKey)]));
-  const expectedPool = [...new Set([...sets.values()].flatMap(set => [...set]))].sort();
-  if (canonical(expectedPool) !== canonical(graph.selectorPool)) throw new Error("Render discriminator mismatch");
   const rawSets = new Map(graph.renders.map(render => [render.renderKey, rawSelectors(documents.get(render.documentKey))]));
   const negativeProofs=routerSelectors(graph,manifest);
+  const expectedPool = discriminatorPool(graph.routes, graph.renders, sets, rawSets, negativeProofs);
+  if (canonical(expectedPool) !== canonical(graph.selectorPool)) throw new Error("Render discriminator mismatch");
   for (const route of graph.routes) {
     const candidates = graph.renders.filter(row => row.routeKey === route.routeKey);
     const expectedKeys = guardKeys(candidates, expectedPool, sets, rawSets,negativeProofs);
@@ -152,13 +152,32 @@ export function validateRenderIndex(graph, manifest) {
 
 function rawSelectors(document) {
   return new Set(document.nodes.flatMap(node => {
-    const anchor = node.kind === "element" && node.attributes["data-indiana-id"];
-    return anchor ? [node.tag + '[data-indiana-id="' + anchor.replaceAll("\\", "\\\\").replaceAll('"', '\\"') + '"]'] : [];
+    const selector = anchorSelector(node);
+    return selector && anchorSelectorPattern.test(selector) ? [selector] : [];
   }));
 }
 function guardKeys(candidates, pool, stable, raw,negativeProofs) {
   return pool.flatMap((selector, key) => (!negativeProofs.has(selector)&&!candidates.some(render=>stable.get(render.renderKey).has(selector)))||candidates.some(render => raw.get(render.renderKey).has(selector) && !stable.get(render.renderKey).has(selector)) ? [] : [key]);
 }
+/** Editable targets do not all need to be render discriminators. Retain positive proof and every distinguishable pair. */
+function discriminatorPool(routes, renders, stable, raw, negative) {
+  const all = [...new Set([...stable.values()].flatMap(set => [...set]))].sort();
+  if (all.length <= 512) return all;
+  const selected = new Set();
+  const add = selector => { if (selector) selected.add(selector); if (selected.size > 512) throw new Error("Render discriminator budget exceeded"); };
+  for (const route of routes) {
+    const candidates = renders.filter(render => render.routeKey === route.routeKey);
+    const eligible = guardKeys(candidates, all, stable, raw, negative).map(key => all[key]);
+    const allowed = new Set(eligible);
+    for (const render of candidates) add(eligible.find(selector => stable.get(render.renderKey).has(selector)));
+    for (let i = 0; i < candidates.length; i++) for (let j = i + 1; j < candidates.length; j++) {
+      const a = stable.get(candidates[i].renderKey), b = stable.get(candidates[j].renderKey);
+      if ([...selected].some(selector => allowed.has(selector) && a.has(selector) !== b.has(selector))) continue;
+      add(eligible.find(selector => a.has(selector) !== b.has(selector)));
+    }
+  }
+  return [...selected].sort();
+}
 /** Shared UI may appear in unresolved lists elsewhere: it can prove presence locally, never absence globally. */
 function routerSelectors(graph,manifest){
   const files=new Set(graph.compositions.flatMap(composition=>composition.entries.flatMap(entry=>[entry.file,...entry.layers.map(layer=>layer.file)])));
@@ -182,7 +201,7 @@ function stableSelectors(graph, document, renderKey) {
     }
     return true;
   }
-  return new Set(graph.targets.filter(target => target.renderKey === renderKey && /^[a-z][a-z0-9-]*\[data-indiana-id="/.test(target.selector) && stable(nodes.get(target.nodeId))).map(target => target.selector));
+  return new Set(graph.targets.filter(target => target.renderKey === renderKey && anchorSelectorPattern.test(target.selector) && stable(nodes.get(target.nodeId))).map(target => target.selector));
 }
 
 export function refreshRenderHashes(manifest) {

package/src/route-tree.mjs

@@ -1,3 +1,5 @@
+import { anchorSelector } from "./anchors.mjs";
+export { anchorSelector } from "./anchors.mjs";
 import { dependency } from "./dependencies.mjs";
 import { canonical } from "./integrity.mjs";
 import { documentNodes } from './node-hashes.mjs';
@@ -32,6 +34,7 @@ const routeTreeShape = obj({
   targets: arr(obj({ routeKey: str, nodeId: str, elementKey: str, contentHash: { type: "string", pattern: "^[a-f0-9]{64}$" }, selector: str, tag: str, leaf: { type: "boolean" }, source })),
 });
 routeTreeShape.properties.targets.items.required=routeTreeShape.properties.targets.items.required.filter(key=>key!=='source');
+routeTreeShape.properties.targets.items.properties.subtreeHash = { type: "string", pattern: "^[a-f0-9]{64}$" };
 export const routeTreeSchema = renderTreeSchema(routeTreeShape);
 const Ajv = dependency("ajv").value;
 const check = new Ajv({ allErrors: true }).compile({ ...routeTreeSchema, definitions: { uiExpression } });
@@ -110,7 +113,7 @@ export function validateRouteTree(graph, manifest, verifiedSelectors, concreteDo
   try {
     for (const target of graph.targets) {
       const node = mapped(target);
-      if (targetIds.has(target.nodeId) || node.synthetic || target.contentHash !== node.contentHash || target.tag !== node.tag || target.selector !== anchorSelector(node) || target.leaf !== !node.children.some(id => nodes.get(id).kind === "element")) throw new Error("Invalid SDK target binding");
+      if (targetIds.has(target.nodeId) || node.synthetic || target.contentHash !== node.contentHash || target.subtreeHash !== undefined && target.subtreeHash !== node.subtreeHash || target.tag !== node.tag || target.selector !== anchorSelector(node) || target.leaf !== !node.children.some(id => nodes.get(id).kind === "element")) throw new Error("Invalid SDK target binding");
       targetIds.add(target.nodeId);
       let count = verifiedSelectors?.get(node.documentKey)?.get(target.selector);
       if (count === undefined) {
@@ -137,7 +140,7 @@ export function assembleRouteTree(manifest, extracted, renderDefinitions, render
     try { for (const node of doc.nodes) {
       const selector = anchorSelector(node);
       if (!selector || node.synthetic || dom.window.document.querySelectorAll(selector).length !== 1) continue;
-      targets.push({ routeKey: doc.pageKey, nodeId: node.nodeId, elementKey: node.elementKey, contentHash: node.contentHash, selector, tag: node.tag, leaf: !node.children.some(id => doc.nodes.find(n => n.nodeId === id).kind === "element"), source: node.source });
+      targets.push({ routeKey: doc.pageKey, nodeId: node.nodeId, elementKey: node.elementKey, contentHash: node.contentHash, subtreeHash: node.subtreeHash, selector, tag: node.tag, leaf: !node.children.some(id => doc.nodes.find(n => n.nodeId === id).kind === "element"), source: node.source });
     } } finally { dom.window.close(); }
   }
   const graph = { format: "indiana-route-state-index", schemaVersion: 3, profile: "bounded-web-preview", roots: routes.filter(r => r.parentKey === null).map(r => r.routeKey), routes,
@@ -149,16 +152,6 @@ export function assembleRouteTree(manifest, extracted, renderDefinitions, render
   return attachRenderIndex(graph, manifest, renderDefinitions, renderNavigation);
 }
 
-export function anchorSelector(node) {
-  if (node.kind !== "element") return null;
-  for (const key of ["data-indiana-id", "id", "data-testid", "name"]) {
-    const value = node.attributes[key];
-    if (!value || value.length > 256 || Array.from(value).some(char => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127)) continue;
-    return node.tag + '[' + key + '="' + value.replaceAll("\\", "\\\\").replaceAll('"', '\\"') + '"]';
-  }
-  return null;
-}
-
 export function readVariables(expression, result = new Set()) {
   if (expression.op === "var") result.add(expression.key);
   for (const child of [expression.arg, expression.left, expression.right, ...(expression.args || []),...(expression.parts||[]).map(part=>part.when)]) if (child) readVariables(child, result);

package/src/source-files.mjs

@@ -0,0 +1,53 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+
+export function sourcePath(file) {
+  return (
+    /\.(?:[cm]?[jt]sx?|css|mdx|json)$/.test(file) &&
+    !/(?:^|\/)(?:api|server|secrets?)(?:\/|$)/.test(file) &&
+    !/(?:^|\/)(?:\.?env|credentials|secrets)(?:\.|\/)/i.test(file) &&
+    !/(?:lock|package-lock)\.json$/.test(file)
+  );
+}
+
+/** Source enumeration needs no Git executable, lifecycle script or merchant tooling. */
+export async function sourceFiles(
+  root,
+  { maxFiles = 5000, include = sourcePath } = {},
+) {
+  const files = [],
+    pending = [root];
+  let directories = 0;
+  while (pending.length) {
+    if (++directories > 20_000)
+      throw new Error("Source directory budget exceeded");
+    const directory = pending.pop();
+    for (const entry of await fs.readdir(directory, { withFileTypes: true })) {
+      if (
+        entry.name.startsWith(".") ||
+        [
+          "node_modules",
+          "dist",
+          "build",
+          "coverage",
+          "api",
+          "server",
+          "secret",
+          "secrets",
+        ].includes(entry.name)
+      )
+        continue;
+      const absolute = path.join(directory, entry.name);
+      if (entry.isDirectory()) pending.push(absolute);
+      else if (entry.isFile()) {
+        const file = path.relative(root, absolute).split(path.sep).join("/");
+        if (!sourcePath(file) || !include(file)) continue;
+        files.push(file);
+        if (files.length > maxFiles)
+          throw new Error("Source file budget exceeded");
+      }
+      // Symlinks never expand the authorized source root.
+    }
+  }
+  return files.sort();
+}

package/src/transform.mjs

@@ -0,0 +1,32 @@
+import MagicString from "magic-string";
+import { dependency } from "./dependencies.mjs";
+import { automaticSourceAnchors, instrumentableSource } from "./anchors.mjs";
+
+/** Adds build-only anchors without editing merchant source or evaluating any expression. */
+export function transformSourceForIam(code, file) {
+  file = file.replaceAll("\\", "/");
+  if (!instrumentableSource(file, code)) return null;
+  const ts = dependency("typescript").value;
+  const source = ts.createSourceFile(
+    file,
+    code,
+    ts.ScriptTarget.Latest,
+    true,
+    /\.jsx?$/.test(file) ? ts.ScriptKind.JSX : ts.ScriptKind.TSX,
+  );
+  if (source.parseDiagnostics.length)
+    throw new Error("IAM cannot instrument invalid source: " + file);
+  const anchors = automaticSourceAnchors(file, source);
+  if (!anchors.size) return null;
+  const output = new MagicString(code);
+  for (const [opening, anchor] of anchors)
+    output.appendLeft(opening.tagName.end, ` data-indiana-id="${anchor}"`);
+  return {
+    code: output.toString(),
+    map: output.generateMap({
+      source: file,
+      includeContent: true,
+      hires: true,
+    }),
+  };
+}

package/src/upload.mjs

@@ -1,4 +1,4 @@
-import { execFileSync } from "node:child_process";
+import { repositoryCommit } from "./git-metadata.mjs";
 import { randomUUID } from "node:crypto";
 
 export const DEFAULT_BASE_URL = "https://tinker.cash";
@@ -18,19 +18,11 @@ export function uploadSettings({ apiKey, baseUrl, upload = "production" } = {},
 
 /** A short version label: the commit being built when the CI or git exposes it. */
 export function buildLabel(root, env = process.env) {
-  const commit = env.VERCEL_GIT_COMMIT_SHA || env.GITHUB_SHA || env.CI_COMMIT_SHA || gitHead(root);
+  const commit = env.VERCEL_GIT_COMMIT_SHA || env.GITHUB_SHA || env.CI_COMMIT_SHA || repositoryCommit(root);
   if (commit && /^[0-9a-f]{7,64}$/i.test(commit)) return commit.slice(0, 12).toLowerCase();
   return "build " + new Date().toISOString().slice(0, 16).replace("T", " ");
 }
 
-function gitHead(root) {
-  try {
-    return execFileSync("git", ["-C", root, "rev-parse", "HEAD"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-  } catch {
-    return "";
-  }
-}
-
 async function failure(response, step) {
   let message = response.statusText;
   try {