@uchibeke/gallivant 0.0.0-stage → 0.2.0

package/lib/plugin_package.mjs

@@ -0,0 +1,340 @@
+import { join, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { readFileSync, writeFileSync, mkdirSync, lstatSync, realpathSync, readdirSync, utimesSync, chmodSync, rmSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { canonicalPath } from "./fs.mjs";
+import { PNG } from "pngjs";
+import Ajv2020 from "ajv/dist/2020.js";
+import { CORE_VERSION, TASK_OPERATIONS, DELIVERY_VERSION, MAX_TASK_UI_BYTES, uiResourceConfiguration, deliveryError } from "./task_delivery_contract.mjs";
+import { NODE_RUNTIME_REQUIREMENTS } from "./runtime_node.mjs";
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const sha = bytes => createHash("sha256").update(bytes).digest("hex");
+const json = value => JSON.stringify(value, null, 2) + "\n";
+// APort's emitted, self-contained MCP resource includes the shared React UI and
+// its CSP-bound stylesheet. Match its bounded resource endpoint, not a tiny
+// fixture's size. Icons and screenshots retain their independent limits.
+const MAX_UI_BYTES = MAX_TASK_UI_BYTES;
+// APort advertises fixed-action controls over the core's generic dispatcher.
+// Accept those documented host names without accepting arbitrary task_* tools.
+const reviewTools = new Set([
+  ...TASK_OPERATIONS.map(operation => `task_${operation.name}`),
+  "task_recheck", "task_continue", "task_message", "task_interrupt", "task_cancel",
+]);
+// Main bundles its locked TOML parser for isolated Codex preparation. Keep the
+// dependency exception narrow; do not admit arbitrary node_modules contents.
+const bundledRuntimeFile = path => /^node_modules\/smol-toml\/(?:package\.json|README\.md|LICENSE|dist\/[A-Za-z0-9_-]+\.(?:js|cjs|d\.ts))$/.test(path);
+// npm applies nested ignore files independently of Git's tracked payload.
+export const packagingControl = path => /^(?:(?:bin|lib|templates)\/.*|docs\/)?\.(?:npmignore|gitignore|npmrc)$/.test(path);
+export const runtimeFile = path => !packagingControl(path) && (/^(?:bin\/.*\.mjs|lib\/.*\.mjs|templates\/[^.].*|docs\/[^/]+\.md|README\.md|CONTRIBUTING\.md|SECURITY\.md|LICENSE|package\.json|npm-shrinkwrap\.json)$/.test(path) || bundledRuntimeFile(path));
+export const payloadChange = path => runtimeFile(path) || packagingControl(path) || /^(?:bin|lib|templates)\/(?:.*\/)?$/.test(path);
+export function packagingControlInventory(sourceRoot, sourceCommit) {
+  try {
+    const paths = execFileSync("git", ["ls-tree", "-r", "-z", "--name-only", sourceCommit], { cwd: sourceRoot, encoding: "utf8", maxBuffer: 16777216 }).split("\0").filter(packagingControl).sort();
+    return Object.fromEntries(paths.map(path => [path, sha(execFileSync("git", ["show", `${sourceCommit}:${path}`], { cwd: sourceRoot, maxBuffer: 1048576 }))]));
+  } catch { throw deliveryError("PACKAGE_SOURCE", "Cannot inventory committed packaging controls; restore Git access and rebuild"); }
+}
+const ajv = new Ajv2020({ strict: true });
+const schemas = Object.fromEntries(["plugin", "mcp"].map(name => [name, JSON.parse(readFileSync(join(root, "templates/plugin/schemas", `${name}.schema.json`), "utf8"))]));
+// The portable MCP 1.0 schema predates the documented OpenAI auth extension.
+// Keep that vendored source intact and validate only this explicitly supported
+// overlay, rather than allowing arbitrary server fields or secret headers.
+// https://developers.openai.com/plugins/build/plugins#configure-mcp-authentication
+const boundedText = { type: "string", minLength: 1, maxLength: 4000, pattern: "\\S" };
+const strictObject = (properties, required = Object.keys(properties)) => ({ type: "object", properties, required, additionalProperties: false });
+const scopeList = { type: "array", maxItems: 32, uniqueItems: true, items: { type: "string", minLength: 1, maxLength: 128, pattern: "^[\\x21\\x23-\\x5b\\x5d-\\x7e]+$" } };
+const oauthSchema = strictObject({
+  type: { const: "oauth" },
+  client: strictObject({ mode: { const: "provided" }, clientId: { type: "string", pattern: "^[A-Za-z0-9_-]{1,128}$" }, tokenEndpointAuthMethod: { const: "none" } }),
+  authorizationUrl: boundedText, tokenUrl: boundedText,
+  // OAuth scopes belong to the public authorization server, not Gallivant's
+  // internal delivery scope vocabulary. The deployer supplies its canonical
+  // discovery/tool scopes; validate RFC 6749 scope-token syntax without mapping.
+  baseScopes: { ...scopeList, minItems: 1 },
+  // An explicit empty list suppresses host/client defaults while baseScopes
+  // remains included on every request. Omitting this preserves host defaults.
+  defaultScopes: scopeList,
+}, ["type", "client", "baseScopes"]);
+const caseProperties = { description: boundedText, prompt: boundedText, tools_triggered: boundedText, expected_behavior: boundedText,
+  file_attachment_urls: { type: "array", maxItems: 10, items: boundedText }, expected_output_url: boundedText };
+const reviewSchema = strictObject({
+  test_cases: strictObject({
+    positive: { type: "array", minItems: 5, maxItems: 5, items: strictObject(caseProperties, ["description", "prompt", "tools_triggered", "expected_behavior"]) },
+    negative: { type: "array", minItems: 3, maxItems: 3, items: strictObject(caseProperties, ["description", "prompt"]) },
+  }), demo_recording_url: boundedText,
+});
+const publicationSchema = strictObject({ release_notes: boundedText });
+const listingSchema = strictObject({
+  longDescription: { ...boundedText, pattern: "^(?=[\\s\\S]*\\S)[^\\x00-\\x09\\x0b-\\x1f\\x7f]+$" },
+  // Use the exact category title offered by the current publisher dashboard.
+  category: { type: "string", minLength: 1, maxLength: 80, pattern: "^(?=.*\\S)[^\\x00-\\x1f\\x7f]+$" },
+});
+const submissionSchemas = { oauth: oauthSchema, review: reviewSchema, publication: publicationSchema, listing: listingSchema };
+const submissionChecks = Object.fromEntries(Object.entries(submissionSchemas).map(([name, schema]) => [name, ajv.compile(schema)]));
+const openaiMcpSchema = structuredClone(schemas.mcp);
+openaiMcpSchema.$defs.streamableHttpServer.properties.extensions = strictObject({ "com.openai": strictObject({ auth: oauthSchema }) });
+const check = { plugin: ajv.compile(schemas.plugin), mcp: ajv.compile(openaiMcpSchema) };
+// IANA special-purpose registries (2025-10-09). Fail closed for reserved,
+// multicast and transition space without an unambiguous global destination.
+// https://www.iana.org/assignments/iana-ipv4-special-registry
+// https://www.iana.org/assignments/iana-ipv6-special-registry
+const globalIpv4 = host => {
+  const [a, b, c, d] = host.split(".").map(Number);
+  if (a === 192 && b === 0 && c === 0 && [9, 10].includes(d)) return true;
+  return !(a === 0 || a === 10 || a === 127 || a >= 224 ||
+    a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 ||
+    a === 172 && b >= 16 && b <= 31 ||
+    a === 192 && (b === 168 || b === 0 && [0, 2].includes(c) || b === 88 && c === 99) ||
+    a === 198 && (b === 18 || b === 19 || b === 51 && c === 100) ||
+    a === 203 && b === 0 && c === 113);
+};
+const globalIpv6 = host => {
+  const [left, right] = host.slice(1, -1).split("::");
+  const head = left ? left.split(":") : [], tail = right ? right.split(":") : [];
+  const words = (right === undefined ? head : [...head, ...Array(8 - head.length - tail.length).fill("0"), ...tail]).map(x => parseInt(x, 16));
+  const [a, b, c] = words;
+  // Apply the IPv4 classification to mapped and well-known NAT64 addresses.
+  if (words.slice(0, 5).every(x => x === 0) && words[5] === 0xffff || a === 0x64 && b === 0xff9b && words.slice(2, 6).every(x => x === 0)) {
+    return globalIpv4(`${words[6] >> 8}.${words[6] & 255}.${words[7] >> 8}.${words[7] & 255}`);
+  }
+  if (a < 0x2000 || a > 0x3fff || a === 0x2002 || a === 0x2001 && b === 0xdb8 || a === 0x3fff && b < 0x1000) return false;
+  if (a === 0x2001 && b < 0x200) {
+    return b === 1 && words.slice(2, 7).every(x => x === 0) && [1, 2, 3].includes(words[7]) ||
+      b === 3 || b === 4 && c === 0x112 || b >= 0x20 && b <= 0x3f;
+  }
+  return true;
+};
+const publicLocalHost = hostname => {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  // WHATWG URL parsing canonicalizes shorthand, decimal and hex IPv4, and IPv6.
+  if (host.startsWith("[")) return !globalIpv6(host);
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(host)) return !globalIpv4(host);
+  return !host.includes(".") || host.length > 253 || !host.split(".").every(label => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) || /(?:^|\.)(?:localhost|localhost\.localdomain|localhost6|localhost6\.localdomain6|ip6-localhost|ip6-loopback|localdomain|local|home\.arpa|onion|alt|internal|example|example\.(?:com|org|net)|invalid|test)$/.test(host);
+};
+function readAsset(name, path, limit, png = false) {
+  let stat;
+  try { stat = typeof path === "string" && path ? lstatSync(path) : null; } catch { /* report a bounded configuration error */ }
+  if (!stat?.isFile() || stat.isSymbolicLink()) throw deliveryError("PACKAGE_ASSET", `${name} must be a regular non-symlink file`);
+  const bytes = readFileSync(path);
+  if (bytes.length > limit || /\b(?:sk-[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,})\b|-----BEGIN .*PRIVATE KEY-----|Bearer\s+[A-Za-z0-9._-]+/.test(bytes.toString("utf8"))) throw deliveryError("PACKAGE_ASSET", `${name} exceeds its limit or contains credentials; remove secrets before packaging`);
+  if (png) {
+    try {
+      if (bytes.length < 33 || !bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])) || bytes.toString("ascii", 12, 16) !== "IHDR") throw new Error("PNG header");
+      const width = bytes.readUInt32BE(16), height = bytes.readUInt32BE(20);
+      if (!width || !height || width * height > 16777216) throw new Error("PNG dimensions");
+      PNG.sync.read(bytes, { checkCRC: true });
+    } catch { throw deliveryError("PACKAGE_ASSET", `${name} must decode as a valid PNG of at most 16777216 pixels; export the image as PNG`); }
+  }
+  return bytes;
+}
+function screenshots(config) {
+  const paths = config.assets?.screenshots ?? [];
+  if (!Array.isArray(paths) || paths.length > 8) throw deliveryError("PACKAGE_ASSET", "assets.screenshots must be an array of at most eight authentic screenshot files");
+  return Array.from(paths);
+}
+const httpsUrl = (value, name, publicMode, allowQuery = false) => {
+  let u; try { u = new URL(value); } catch { throw deliveryError("PACKAGE_CONFIG", `Configure ${name} as an HTTPS URL`); }
+  if (u.protocol !== "https:" || u.username || u.password || !allowQuery && u.search || u.hash || publicMode && publicLocalHost(u.hostname)) throw deliveryError("PACKAGE_CONFIG", `${name} must be a real HTTPS URL without credentials${allowQuery ? " or fragment" : ", query or fragment"}`);
+  return value;
+};
+
+function submissionConfiguration(config, publicMode) {
+  const result = {};
+  for (const [name, validate] of Object.entries(submissionChecks)) {
+    const value = config[name];
+    if (value === undefined && (!publicMode || name === "listing")) continue;
+    if (!validate(value)) throw deliveryError("PACKAGE_CONFIG", `Configure ${name} using the documented public submission shape; unknown fields, credentials and incomplete review cases are not accepted`);
+    // Do not echo supplied values in errors: these inputs must never carry a
+    // credential, including inside an otherwise well-formed review description.
+    if (/\b(?:sk-[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,})\b|-----BEGIN .*PRIVATE KEY-----|Bearer\s+[A-Za-z0-9._-]+/.test(JSON.stringify(value))) throw deliveryError("PACKAGE_CONFIG", `Remove credentials from ${name}; use the secure portal for reviewer access`);
+    result[name] = value;
+  }
+  for (const name of ["authorizationUrl", "tokenUrl"]) if (result.oauth?.[name] !== undefined) httpsUrl(result.oauth[name], `oauth.${name}`, publicMode);
+  if (result.review) {
+    httpsUrl(result.review.demo_recording_url, "review.demo_recording_url", publicMode, true);
+    for (const group of ["positive", "negative"]) for (const item of result.review.test_cases[group]) {
+      for (const url of [...(item.file_attachment_urls || []), ...(item.expected_output_url ? [item.expected_output_url] : [])]) httpsUrl(url, "review case URL", publicMode, true);
+      if (item.tools_triggered) {
+        const tools = item.tools_triggered.split(",").map(value => value.trim());
+        if (tools.some(name => !reviewTools.has(name))) throw deliveryError("PACKAGE_CONFIG", "Review cases must name actual task tools separated by commas");
+      }
+    }
+  }
+  return result;
+}
+
+function pluginIdentity(config, internal) {
+  if (config.developmentIdentity === undefined) return { name: "aport-task-delivery", displayName: "APort Task Delivery" };
+  const value = config.developmentIdentity;
+  if (!internal || !value || typeof value !== "object" || Object.keys(value).some(key => !["name", "displayName"].includes(key)) ||
+    typeof value.name !== "string" || !/^[a-z][a-z0-9-]{0,48}-preview$/.test(value.name) ||
+    typeof value.displayName !== "string" || !/^[^\x00-\x1f\x7f]{1,64}$/.test(value.displayName) || !/preview/i.test(value.displayName)) {
+    throw deliveryError("PACKAGE_CONFIG", "developmentIdentity is only for internal builds and must use a distinct -preview name and Preview display name");
+  }
+  return value;
+}
+
+export function validatePublicRelease(config) {
+  const errors = [];
+  try { pluginIdentity(config, false); } catch (error) { errors.push(error.message); }
+  try { submissionConfiguration(config, true); } catch (error) { errors.push(error.message); }
+  if (config.publisher !== "APort") errors.push("Set publisher to APort");
+  if (!config.supportEmail || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(config.supportEmail)) errors.push("Configure the publisher's supportEmail");
+  for (const name of ["endpoint", "homepage", "supportUrl", "privacyUrl", "termsUrl", "licenseUrl"]) {
+    try { httpsUrl(config[name], name, true); } catch (e) { errors.push(e.message); }
+  }
+  try {
+    uiResourceConfiguration(config.resource || {});
+    for (const [i, value] of [config.resource.domain, ...(config.resource.connectDomains || []), ...(config.resource.resourceDomains || [])].entries()) httpsUrl(value, `resource origin ${i}`, true);
+  } catch (e) { errors.push(e.message); }
+  if (config.fixture) errors.push("Fixture assets cannot qualify a public release; provide the built APort UI and authentic assets");
+  for (const [name, limit] of [["ui", MAX_UI_BYTES], ["icon", 1048576]]) {
+    try { readAsset(`assets.${name}`, config.assets?.[name], limit, name === "icon"); }
+    catch (error) { errors.push(error.message); }
+  }
+  try {
+    const paths = screenshots(config);
+    if (!paths.length) errors.push("Provide authentic host screenshots at assets.screenshots");
+    paths.forEach((path, i) => {
+      try { readAsset(`assets.screenshots[${i}]`, path, 5242880, true); }
+      catch (error) { errors.push(error.message); }
+    });
+  } catch (error) { errors.push(error.message); }
+  return { ok: !errors.length, errors, submissionReady: false, qualification: "M6 live/deployment/host/publisher gates remain mandatory" };
+}
+
+export function buildPluginPackage({ config, out, coreVersion, sourceCommit, internal = false }) {
+  const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+  if (coreVersion !== pkg.version || coreVersion !== CORE_VERSION) throw deliveryError("PACKAGE_VERSION", "Pass the exact installed core version; build runtime and plugin from that same package");
+  if (!/^[a-f0-9]{40}$/.test(sourceCommit || "")) throw deliveryError("PACKAGE_SOURCE", "Supply the exact 40-character source commit");
+  let sourceVerified = false, sourceChanges = [];
+  try {
+    const actualRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    if (realpathSync(actualRoot) === realpathSync(root)) {
+      const actualCommit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
+      if (actualCommit !== sourceCommit) throw deliveryError("PACKAGE_SOURCE", "Source commit differs from HEAD; build from the exact selected checkout");
+      // Separate additions/deletions keep both sides of a rename observable.
+      sourceChanges = execFileSync("git", ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--no-renames", "--ignored=matching"], { cwd: root, encoding: "utf8" }).split("\0").filter(Boolean).map(record => record.slice(3));
+      sourceVerified = true;
+    }
+  } catch (error) {
+    if (error.code === "PACKAGE_SOURCE") throw error;
+    if (!internal) throw deliveryError("PACKAGE_SOURCE", "Git source verification failed; make HEAD and git status succeed in the exact selected checkout before public packaging");
+  }
+  if (!internal && !sourceVerified) throw deliveryError("PACKAGE_SOURCE", "Build the public candidate from the exact merged source checkout; an installed tarball cannot attest its supplied commit");
+  if (!internal) {
+    const verdict = validatePublicRelease(config);
+    if (!verdict.ok) throw deliveryError("PACKAGE_RELEASE", verdict.errors.join("\n"));
+  }
+  const submission = submissionConfiguration(config, !internal);
+  const identity = pluginIdentity(config, internal);
+  const endpoint = httpsUrl(config.endpoint, "endpoint", !internal), resource = uiResourceConfiguration(config.resource);
+  if (config.publisher !== "APort") throw deliveryError("PACKAGE_CONFIG", "APort is the publisher");
+  if (!config.assets?.ui) throw deliveryError("PACKAGE_ASSET", "Provide built APort UI HTML; --internal may use an explicitly labeled fixture");
+  out = canonicalPath(out);
+  const packageRoot = realpathSync(root);
+  if (out === packageRoot || out.startsWith(packageRoot + "/")) throw deliveryError("PACKAGE_OUTPUT", "Package output must be outside the source package root");
+  mkdirSync(out, { recursive: true });
+  if (readdirSync(out).length) throw deliveryError("PACKAGE_OUTPUT", "Use one empty bounded output directory; preserve older artifacts for rollback");
+  const stage = join(out, "plugin"); mkdirSync(stage);
+  try {
+  const hashes = {};
+  const emit = (path, bytes) => {
+    const file = join(stage, path); mkdirSync(dirname(file), { recursive: true }); writeFileSync(file, bytes, { mode: 0o644 });
+    hashes[path] = sha(bytes); utimesSync(file, 946684800, 946684800);
+  };
+  const asset = (name, path, limit) => {
+    // Preflight and emission share file, size and secret constraints.
+    emit(name, readAsset(name, path, limit, name.endsWith(".png")));
+  };
+  asset("assets/task-ui.html", config.assets.ui, MAX_UI_BYTES);
+  if (config.assets.icon) asset("assets/icon.png", config.assets.icon, 1048576);
+  for (const [i, path] of screenshots(config).entries()) { asset(`assets/screenshot-${i + 1}.png`, path, 5242880); }
+  const plugin = { $schema: schemas.plugin.$id, name: identity.name, version: coreVersion,
+    description: "Prepare scoped tasks, follow implementation and review the resulting pull request.", author: { name: "APort", ...(config.supportEmail ? { email: config.supportEmail } : {}), ...(config.homepage ? { url: httpsUrl(config.homepage, "homepage", !internal) } : {}) },
+    ...(config.homepage ? { homepage: config.homepage } : {}), license: "Apache-2.0", keywords: ["tasks", "pull-request", "aport"],
+    extensions: { "com.openai": { interface: { displayName: identity.displayName, developerName: "APort", shortDescription: "Describe work and review a PR", longDescription: "Prepare scoped requirements, choose a configured harness, follow saved progress and review a pull request. Repository access and paid execution allowance require an authorized account.", category: "Productivity", ...submission.listing, capabilities: ["Read", "Write"],
+      ...(config.homepage ? { websiteURL: config.homepage } : {}), ...(config.privacyUrl ? { privacyPolicyURL: config.privacyUrl } : {}), ...(config.termsUrl ? { termsOfServiceURL: config.termsUrl } : {}),
+      ...(config.supportUrl ? { supportURL: config.supportUrl } : {}), ...(config.assets.icon ? { logo: "./assets/icon.png", composerIcon: "./assets/icon.png" } : {}),
+      ...(config.assets.screenshots?.length ? { screenshots: config.assets.screenshots.map((_, i) => `./assets/screenshot-${i + 1}.png`) } : {}), defaultPrompt: ["Prepare a task in my connected repository."] },
+      ...(submission.review ? { review: submission.review } : {}), ...(submission.publication ? { publication: submission.publication } : {}) } } };
+  const mcp = { $schema: schemas.mcp.$id, mcpServers: { "task-delivery": { type: "streamable-http", url: endpoint,
+    ...(submission.oauth ? { extensions: { "com.openai": { auth: submission.oauth } } } : {}) } } };
+  if (!check.plugin(plugin) || !check.mcp(mcp)) throw deliveryError("PACKAGE_SCHEMA", json(check.plugin.errors || check.mcp.errors));
+  emit("plugin.json", json(plugin)); emit("mcp.json", json(mcp)); emit("LICENSE", readFileSync(join(root, "LICENSE")));
+  emit("skills/task-delivery/SKILL.md", readFileSync(join(root, "templates/plugin/task-delivery.SKILL.md")));
+  const contracts = { coreVersion, operationVersion: DELIVERY_VERSION, taskVersion: 1, executionVersion: 1 };
+  const lock = readFileSync(join(root, "npm-shrinkwrap.json"));
+  // npm's allowlist is the runtime payload; tests install this emitted tarball.
+  const packed = JSON.parse(execFileSync("npm", ["pack", "--ignore-scripts", "--json", "--pack-destination", out], { cwd: root, encoding: "utf8", maxBuffer: 1048576 }))[0];
+  for (const file of packed.files) {
+    if (!runtimeFile(file.path) || /(?:^|\/)(?:\.env|auth\.json|credentials|config\.json)$/.test(file.path)) throw deliveryError("PACKAGE_CONTENT", `Unexpected runtime file ${file.path}; fix the package allowlist`);
+  }
+  // Packing runs outside Git's snapshot. Recheck both identity and dirtiness
+  // before attesting the tarball; a late edit must not inherit a clean claim.
+  if (sourceVerified) {
+    try {
+      if (execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim() !== sourceCommit) throw new Error("HEAD changed during packing");
+      const after = execFileSync("git", ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--no-renames", "--ignored=matching"], { cwd: root, encoding: "utf8" }).split("\0").filter(Boolean).map(record => record.slice(3));
+      sourceChanges = [...new Set([...sourceChanges, ...after])];
+    } catch {
+      sourceVerified = false;
+      if (!internal) throw deliveryError("PACKAGE_SOURCE", "Git source verification failed after packing; rebuild from an unchanged selected checkout");
+    }
+  }
+  // Removed payload files are absent from npm's current file list but still
+  // invalidate the claimed source commit. Use the same runtime payload policy.
+  const payloadChanges = sourceChanges.filter(payloadChange);
+  if (!internal && payloadChanges.length) throw deliveryError("PACKAGE_SOURCE", "Commit the package payload before public packaging; executable, recipe, asset or npm packaging-control changes invalidate candidate evidence");
+  // Keep control contents out of public artifacts; persist only paths and hashes.
+  const packagingControlHashes = sourceVerified ? packagingControlInventory(root, sourceCommit) : null;
+  // Hash the emitted bytes, never a checkout that can change during packing.
+  const payloadHashes = {};
+  let bundledProof;
+  if (sourceVerified && !payloadChanges.length) {
+    try { bundledProof = JSON.parse(execFileSync("git", ["show", `${sourceCommit}:templates/plugin/bundled-runtime.json`], { cwd: root, encoding: "utf8" })); }
+    catch { throw deliveryError("PACKAGE_SOURCE", "Selected commit lacks bundled runtime byte evidence; rebuild with its committed dependency manifest"); }
+    const dependency = JSON.parse(lock).packages["node_modules/smol-toml"];
+    if (bundledProof.version !== dependency.version || bundledProof.integrity !== dependency.integrity) throw deliveryError("PACKAGE_SOURCE", "Bundled runtime evidence differs from the dependency lock; regenerate and commit both together");
+  }
+  if (bundledProof) {
+    const proven = Object.keys(bundledProof.files).sort();
+    const included = packed.files.filter(file => bundledRuntimeFile(file.path)).map(file => file.path).sort();
+    if (JSON.stringify(included) !== JSON.stringify(proven)) throw deliveryError("PACKAGE_SOURCE", "Bundled runtime archive paths differ from the complete committed proof; reinstall the locked dependency before rebuilding");
+  }
+  if (sourceVerified && !payloadChanges.length) {
+    let expected;
+    try {
+      expected = execFileSync("git", ["ls-tree", "-r", "-z", "--name-only", sourceCommit], { cwd: root, encoding: "utf8", maxBuffer: 16777216 })
+        .split("\0").filter(path => runtimeFile(path) && !bundledRuntimeFile(path)).sort();
+    } catch { throw deliveryError("PACKAGE_SOURCE", "Cannot enumerate the selected commit payload; restore Git access and rebuild"); }
+    const included = packed.files.filter(file => !bundledRuntimeFile(file.path)).map(file => file.path).sort();
+    if (JSON.stringify(included) !== JSON.stringify(expected)) throw deliveryError("PACKAGE_SOURCE", "First-party archive paths differ from the complete selected commit payload; restore the checkout and package allowlist before rebuilding");
+  }
+  for (const file of packed.files) {
+    const bytes = execFileSync("tar", ["-xOf", join(out, packed.filename), `package/${file.path}`], { maxBuffer: 16777216 });
+    payloadHashes[file.path] = sha(bytes);
+    if (bundledProof && bundledRuntimeFile(file.path)) {
+      if (bundledProof.files[file.path] !== payloadHashes[file.path]) throw deliveryError("PACKAGE_SOURCE", `Packed dependency bytes differ from the selected commit: ${file.path}`);
+    } else if (sourceVerified && !payloadChanges.length) {
+      let committed;
+      try { committed = execFileSync("git", ["show", `${sourceCommit}:${file.path}`], { cwd: root, maxBuffer: 16777216 }); }
+      catch { throw deliveryError("PACKAGE_SOURCE", `Packed path is absent from the selected commit: ${file.path}`); }
+      if (sha(committed) !== payloadHashes[file.path]) throw deliveryError("PACKAGE_SOURCE", `Packed bytes differ from the selected commit: ${file.path}; rebuild from unchanged sources`);
+    }
+  }
+  const archive = join(out, "aport-task-delivery.zip");
+  execFileSync("zip", ["-X", "-q", archive, ...Object.keys(hashes).sort()], { cwd: stage });
+  const runtime = { ...contracts, sourceCommit, sourceVerified, uncommittedPayload: payloadChanges, requirements: NODE_RUNTIME_REQUIREMENTS, exports: pkg.exports, endpoint, resource,
+    coreArtifact: packed.filename, coreSha256: sha(readFileSync(join(out, packed.filename))), dependencyLockSha256: sha(lock), assetHashes: hashes };
+  writeFileSync(join(out, "runtime.json"), json(runtime));
+  writeFileSync(join(out, "operations.json"), json(TASK_OPERATIONS));
+  writeFileSync(join(out, "RUNTIME.md"), readFileSync(join(root, "docs/task-delivery.md")));
+  const manifest = { format: 1, publisher: "APort", classification: internal ? "internal-development-fixture; not-installed-host-evidence" : "public-candidate-unqualified",
+    submissionReady: false, ...runtime, hashes: { plugin: sha(readFileSync(archive)), runtime: sha(readFileSync(join(out, "runtime.json"))), operations: sha(readFileSync(join(out, "operations.json"))) },
+    payloadHashes, packagingControlHashes, submissionSchemaSha256: sha(json(submissionSchemas)), schemaHashes: Object.fromEntries(Object.keys(schemas).map(n => [schemas[n].$id, sha(readFileSync(join(root, "templates/plugin/schemas", `${n}.schema.json`)))])) };
+  writeFileSync(join(out, "manifest.json"), json(manifest));
+  for (const name of readdirSync(out)) if (lstatSync(join(out, name)).isFile()) chmodSync(join(out, name), 0o644);
+  return manifest;
+  } catch (error) { rmSync(out, { recursive: true, force: true }); throw error; }
+}