@unbrained/pm-cli 2026.9.7 → 2026.9.8

package/dist/sdk/test/runs.js

@@ -1,194 +1,2 @@
-/**
- * @module sdk/test/runs
- *
- * Implements the pm test runs command surface and its agent-facing runtime behavior.
- */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1cbb3565-26d8-5657-b724-602658bec852")}catch(e){}}();
-import { assertInitializedTracker } from "../environment/tracker-preflight.js";
-import os from "node:os";
-import { EXIT_CODE } from "../../core/shared/constants.js";
-import { PmCliError } from "../../core/shared/errors.js";
-import { readAuthorEnvironment } from "../../core/shared/author.js";
-import { getBackgroundTestRunStatus, listBackgroundTestRuns, readBackgroundTestRunLogs, resumeBackgroundTestRun, runBackgroundTestRunWorker, spawnBackgroundTestRunWorker, startBackgroundTestRun, stopBackgroundTestRun, } from "../../core/test/background-runs.js";
-import { resolveGlobalPmRoot, resolvePmRoot, } from "../../core/store/paths.js";
-import { readSettings } from "../../core/store/settings.js";
-import { parseLimit } from "../../core/shared/numeric-parsers.js";
-const BACKGROUND_STATUS_VALUES = [
-    "queued",
-    "running",
-    "passed",
-    "failed",
-    "stopped",
-    "canceled",
-];
-const BACKGROUND_STREAM_VALUES = [
-    "stdout",
-    "stderr",
-    "both",
-];
-function normalizeStatus(value) {
-    if (value === undefined) {
-        return undefined;
-    }
-    const normalized = value.trim().toLowerCase();
-    if (BACKGROUND_STATUS_VALUES.includes(normalized)) {
-        return normalized;
-    }
-    throw new PmCliError(`Invalid --status value "${value}"`, EXIT_CODE.USAGE);
-}
-function normalizeStream(value) {
-    if (value === undefined || value.trim().length === 0) {
-        return "stderr";
-    }
-    const normalized = value.trim().toLowerCase();
-    if (BACKGROUND_STREAM_VALUES.includes(normalized)) {
-        return normalized;
-    }
-    throw new PmCliError(`Invalid --stream value "${value}"`, EXIT_CODE.USAGE);
-}
-function resolveWhoamiFallback() {
-    try {
-        const username = os.userInfo().username.trim();
-        if (username.length > 0) {
-            return username;
-        }
-    }
-    catch {
-        // Fall back to environment-derived attribution.
-    }
-    return undefined;
-}
-function resolveRequestedBy(author, fallback) {
-    const candidates = [
-        author,
-        readAuthorEnvironment(),
-        fallback,
-        process.env.USER,
-        process.env.LOGNAME,
-        process.env.USERNAME,
-        resolveWhoamiFallback(),
-    ];
-    for (const candidate of candidates) {
-        if (typeof candidate !== "string") {
-            continue;
-        }
-        const trimmed = candidate.trim();
-        if (trimmed.length > 0) {
-            return trimmed;
-        }
-    }
-    return "unknown";
-}
-async function ensureInitialized(pmRoot) {
-    await assertInitializedTracker(pmRoot);
-}
-/** Implements run start background run for the public runtime surface of this module. */
-export async function runStartBackgroundRun(options, global) {
-    const pmRoot = resolvePmRoot(process.cwd(), global.path);
-    const globalPmRoot = resolveGlobalPmRoot(process.cwd());
-    await ensureInitialized(pmRoot);
-    const settings = await readSettings(pmRoot);
-    const requestedBy = resolveRequestedBy(options.author, settings.author_default);
-    const started = await startBackgroundTestRun({
-        pmRoot,
-        globalPmRoot,
-        kind: options.kind,
-        commandArgs: options.commandArgs,
-        requestedBy,
-        targetId: options.targetId,
-        statusFilter: options.statusFilter,
-    });
-    if (!started.started) {
-        return {
-            started: false,
-            duplicate_of: started.duplicate_of,
-            run: started.run,
-        };
-    }
-    const spawned = await spawnBackgroundTestRunWorker({
-        pmRoot,
-        runId: started.run.id,
-        noExtensions: options.noExtensions === true,
-    });
-    return {
-        started: true,
-        run: spawned,
-    };
-}
-/** Implements run test runs list for the public runtime surface of this module. */
-export async function runTestRunsList(options, global) {
-    const pmRoot = resolvePmRoot(process.cwd(), global.path);
-    await ensureInitialized(pmRoot);
-    const status = normalizeStatus(options.status);
-    const limit = parseLimit(options.limit, "limit");
-    const runs = await listBackgroundTestRuns(pmRoot, { status, limit });
-    return {
-        runs,
-        count: runs.length,
-        filters: {
-            status,
-            limit,
-        },
-    };
-}
-/** Implements run test runs status for the public runtime surface of this module. */
-export async function runTestRunsStatus(runId, global) {
-    const pmRoot = resolvePmRoot(process.cwd(), global.path);
-    await ensureInitialized(pmRoot);
-    const status = await getBackgroundTestRunStatus(pmRoot, runId);
-    return {
-        run: status.run,
-        health: status.health,
-    };
-}
-/** Implements run test runs logs for the public runtime surface of this module. */
-export async function runTestRunsLogs(runId, options, global) {
-    const pmRoot = resolvePmRoot(process.cwd(), global.path);
-    await ensureInitialized(pmRoot);
-    const stream = normalizeStream(options.stream);
-    const tail = parseLimit(options.tail, "tail");
-    const logs = await readBackgroundTestRunLogs(pmRoot, runId, stream, tail);
-    return {
-        run: logs.run,
-        stream: logs.stream,
-        tail: logs.tail,
-        stdout: logs.stdout,
-        stderr: logs.stderr,
-    };
-}
-/** Implements run test runs stop for the public runtime surface of this module. */
-export async function runTestRunsStop(runId, options, global) {
-    const pmRoot = resolvePmRoot(process.cwd(), global.path);
-    await ensureInitialized(pmRoot);
-    const stopped = await stopBackgroundTestRun(pmRoot, runId, options.force === true);
-    return {
-        run: stopped.run,
-        signal_sent: stopped.signal_sent,
-    };
-}
-/** Implements run test runs resume for the public runtime surface of this module. */
-export async function runTestRunsResume(runId, options, global) {
-    const pmRoot = resolvePmRoot(process.cwd(), global.path);
-    await ensureInitialized(pmRoot);
-    const settings = await readSettings(pmRoot);
-    const requestedBy = resolveRequestedBy(options.author, settings.author_default);
-    const resumed = await resumeBackgroundTestRun(pmRoot, runId, requestedBy, options.noExtensions === true);
-    return {
-        resumed_from: runId,
-        run: resumed,
-    };
-}
-/** Implements run test runs worker for the public runtime surface of this module. */
-export async function runTestRunsWorker(runId, global) {
-    const pmRoot = resolvePmRoot(process.cwd(), global.path);
-    await ensureInitialized(pmRoot);
-    const finished = await runBackgroundTestRunWorker(pmRoot, runId, global.noExtensions === true);
-    return {
-        id: finished.id,
-        status: finished.status,
-        exit_code: finished.exit_code,
-    };
-}
+!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e7f8a7ea-3ec2-521b-ad52-45b655208f06")}catch(e2){}})();import{assertInitializedTracker}from"../environment/tracker-preflight.js";import os from"node:os";import{EXIT_CODE}from"../../core/shared/constants.js";import{PmCliError}from"../../core/shared/errors.js";import{readAuthorEnvironment}from"../../core/shared/author.js";import{getBackgroundTestRunStatus,listBackgroundTestRuns,readBackgroundTestRunLogs,resumeBackgroundTestRun,runBackgroundTestRunWorker,spawnBackgroundTestRunWorker,startBackgroundTestRun,stopBackgroundTestRun}from"../../core/test/background-runs.js";import{resolveGlobalPmRoot,resolvePmRoot}from"../../core/store/paths.js";import{readSettings}from"../../core/store/settings.js";import{parseLimit}from"../../core/shared/numeric-parsers.js";const BACKGROUND_STATUS_VALUES=["queued","running","passed","failed","stopped","canceled"];const BACKGROUND_STREAM_VALUES=["stdout","stderr","both"];function normalizeStatus(value){if(value===void 0){return void 0}const normalized=value.trim().toLowerCase();if(BACKGROUND_STATUS_VALUES.includes(normalized)){return normalized}throw new PmCliError(`Invalid --status value "${value}"`,EXIT_CODE.USAGE)}function normalizeStream(value){if(value===void 0||value.trim().length===0){return"stderr"}const normalized=value.trim().toLowerCase();if(BACKGROUND_STREAM_VALUES.includes(normalized)){return normalized}throw new PmCliError(`Invalid --stream value "${value}"`,EXIT_CODE.USAGE)}function resolveWhoamiFallback(){try{const username=os.userInfo().username.trim();if(username.length>0){return username}}catch{}return void 0}function resolveRequestedBy(author,fallback){const candidates=[author,readAuthorEnvironment(),fallback,process.env.USER,process.env.LOGNAME,process.env.USERNAME,resolveWhoamiFallback()];for(const candidate of candidates){if(typeof candidate!=="string"){continue}const trimmed=candidate.trim();if(trimmed.length>0){return trimmed}}return"unknown"}async function ensureInitialized(pmRoot){await assertInitializedTracker(pmRoot)}async function runStartBackgroundRun(options,global2){const pmRoot=resolvePmRoot(process.cwd(),global2.path);const globalPmRoot=resolveGlobalPmRoot(process.cwd());await ensureInitialized(pmRoot);const settings=await readSettings(pmRoot);const requestedBy=resolveRequestedBy(options.author,settings.author_default);const started=await startBackgroundTestRun({pmRoot,globalPmRoot,kind:options.kind,commandArgs:options.commandArgs,requestedBy,targetId:options.targetId,statusFilter:options.statusFilter});if(!started.started){return{started:false,duplicate_of:started.duplicate_of,run:started.run}}const spawned=await spawnBackgroundTestRunWorker({pmRoot,runId:started.run.id,noExtensions:options.noExtensions===true});return{started:true,run:spawned}}async function runTestRunsList(options,global2){const pmRoot=resolvePmRoot(process.cwd(),global2.path);await ensureInitialized(pmRoot);const status=normalizeStatus(options.status);const limit=parseLimit(options.limit,"limit");const runs=await listBackgroundTestRuns(pmRoot,{status,limit});return{runs,count:runs.length,filters:{status,limit}}}async function runTestRunsStatus(runId,global2){const pmRoot=resolvePmRoot(process.cwd(),global2.path);await ensureInitialized(pmRoot);const status=await getBackgroundTestRunStatus(pmRoot,runId);return{run:status.run,health:status.health}}async function runTestRunsLogs(runId,options,global2){const pmRoot=resolvePmRoot(process.cwd(),global2.path);await ensureInitialized(pmRoot);const stream=normalizeStream(options.stream);const tail=parseLimit(options.tail,"tail");const logs=await readBackgroundTestRunLogs(pmRoot,runId,stream,tail);return{run:logs.run,stream:logs.stream,tail:logs.tail,stdout:logs.stdout,stderr:logs.stderr}}async function runTestRunsStop(runId,options,global2){const pmRoot=resolvePmRoot(process.cwd(),global2.path);await ensureInitialized(pmRoot);const stopped=await stopBackgroundTestRun(pmRoot,runId,options.force===true);return{run:stopped.run,signal_sent:stopped.signal_sent}}async function runTestRunsResume(runId,options,global2){const pmRoot=resolvePmRoot(process.cwd(),global2.path);await ensureInitialized(pmRoot);const settings=await readSettings(pmRoot);const requestedBy=resolveRequestedBy(options.author,settings.author_default);const resumed=await resumeBackgroundTestRun(pmRoot,runId,requestedBy,options.noExtensions===true);return{resumed_from:runId,run:resumed}}async function runTestRunsWorker(runId,global2){const pmRoot=resolvePmRoot(process.cwd(),global2.path);await ensureInitialized(pmRoot);const finished=await runBackgroundTestRunWorker(pmRoot,runId,global2.noExtensions===true);return{id:finished.id,status:finished.status,exit_code:finished.exit_code}}export{runStartBackgroundRun,runTestRunsList,runTestRunsLogs,runTestRunsResume,runTestRunsStatus,runTestRunsStop,runTestRunsWorker};
 //# sourceMappingURL=runs.js.map
-//# debugId=1cbb3565-26d8-5657-b724-602658bec852

package/dist/sdk/test/trust.js

@@ -1,207 +1,3 @@
-/**
- * @module sdk/test/trust
- *
- * Provides provenance and clone-local trust decisions for stored linked-test
- * commands. Tracker items remain portable while execution acknowledgements stay
- * outside the merge-unioned project record.
- */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="30a61f26-5db8-50ba-af37-1990a4742ce8")}catch(e){}}();
-import { execFile } from "node:child_process";
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { promisify } from "node:util";
-import { ensureDir, writeFileAtomic, } from "../../core/fs/fs-utils.js";
-import { sha256Hex, stableStringify } from "../../core/shared/serialization.js";
-import { isTimestampLiteral } from "../../core/shared/time.js";
-import { getRuntimePath } from "../../core/store/paths.js";
-const execFileAsync = promisify(execFile);
-const LINKED_TEST_TRUST_LEDGER_VERSION = 1;
-const LINKED_TEST_TRUST_LEDGER_FILE = "linked-test-trust.json";
-function trustLedgerPath(pmRoot) {
-    return path.join(getRuntimePath(pmRoot), LINKED_TEST_TRUST_LEDGER_FILE);
-}
-function emptyTrustLedger() {
-    return { version: LINKED_TEST_TRUST_LEDGER_VERSION, acknowledged: {} };
-}
-async function readTrustLedger(pmRoot) {
-    try {
-        const parsed = JSON.parse(await readFile(trustLedgerPath(pmRoot), "utf8"));
-        if (parsed.version !== LINKED_TEST_TRUST_LEDGER_VERSION ||
-            typeof parsed.acknowledged !== "object" ||
-            parsed.acknowledged === null ||
-            Array.isArray(parsed.acknowledged)) {
-            return emptyTrustLedger();
-        }
-        return {
-            version: LINKED_TEST_TRUST_LEDGER_VERSION,
-            acknowledged: parsed.acknowledged,
-        };
-    }
-    catch {
-        // A missing, corrupt, or unreadable ledger grants no acknowledgements.
-        // The local/source-ref provenance checks remain independent of this file.
-        return emptyTrustLedger();
-    }
-}
-/** Resolve the current Git branch without invoking a shell. */
-export async function resolveLinkedTestSourceRef(cwd = process.cwd()) {
-    const hostedRef = process.env.GITHUB_HEAD_REF?.trim() || process.env.GITHUB_REF_NAME?.trim();
-    if (hostedRef && hostedRef !== "merge") {
-        return hostedRef;
-    }
-    try {
-        const { stdout } = await execFileAsync("git", ["symbolic-ref", "--quiet", "--short", "HEAD"], { cwd, encoding: "utf8", windowsHide: true, timeout: 10_000 });
-        const ref = stdout.trim();
-        /* c8 ignore start -- successful git symbolic-ref output is non-empty by contract */
-        if (ref.length === 0)
-            return undefined;
-        /* c8 ignore stop */
-        return ref;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** Resolve the source checkout shared by linked-test provenance and execution. */
-export function resolveLinkedTestSourceWorkspaceRoot(cwd = process.cwd()) {
-    return process.env.PM_SOURCE_WORKSPACE_ROOT?.trim() || cwd;
-}
-function hasValidLinkedTestProvenance(provenance) {
-    if (provenance === null || typeof provenance !== "object")
-        return false;
-    return (typeof provenance.author === "string" &&
-        provenance.author.trim().length > 0 &&
-        typeof provenance.created_at === "string" &&
-        isTimestampLiteral(provenance.created_at) &&
-        (provenance.source_kind === "local_mutation" ||
-            provenance.source_kind === "merge_union"));
-}
-/** Build the optional ref portion shared by clone-local trust decisions. */
-function linkedTestTrustRefs(sourceRef, currentSourceRef) {
-    return {
-        ...(sourceRef ? { source_ref: sourceRef } : {}),
-        ...(currentSourceRef ? { current_source_ref: currentSourceRef } : {}),
-    };
-}
-/** Attach immutable author/time/ref provenance to newly stored commands. */
-export function attachLinkedTestProvenance(tests, author, createdAt, sourceRef) {
-    return tests?.map((test) => test.command && !test.provenance
-        ? {
-            ...test,
-            provenance: {
-                author,
-                created_at: createdAt,
-                source_kind: "local_mutation",
-                ...(sourceRef ? { source_ref: sourceRef } : {}),
-            },
-        }
-        : test);
-}
-/** Attach provenance while avoiding Git inspection for an empty mutation. */
-export async function attachLinkedTestMutationProvenance(tests, author, createdAt) {
-    if (!tests || tests.length === 0)
-        return tests;
-    const sourceWorkspaceRoot = resolveLinkedTestSourceWorkspaceRoot();
-    return attachLinkedTestProvenance(tests, author, createdAt, await resolveLinkedTestSourceRef(sourceWorkspaceRoot));
-}
-/** Produce the clone-local trust identity for one linked-test entry. */
-export function linkedTestTrustFingerprint(test) {
-    return sha256Hex(stableStringify({
-        command: test.command ?? null,
-        path: test.path ?? null,
-        scope: test.scope,
-        pm_context_mode: test.pm_context_mode ?? null,
-        workspace_context_mode: test.workspace_context_mode ?? null,
-        env_set: test.env_set ?? null,
-        env_clear: test.env_clear ?? null,
-        shared_host_safe: test.shared_host_safe ?? null,
-        provenance: test.provenance ?? null,
-        provenance_invalid: test.provenance_invalid ?? null,
-    }));
-}
-/** Resolve whether one stored command is trusted by this clone. */
-export async function resolveLinkedTestTrust(pmRoot, test, currentSourceRef) {
-    const ledger = await readTrustLedger(pmRoot);
-    return resolveLinkedTestTrustFromLedger(test, currentSourceRef, ledger);
-}
-function resolveLinkedTestTrustFromLedger(test, currentSourceRef, ledger) {
-    const fingerprint = linkedTestTrustFingerprint(test);
-    const sourceRef = test.provenance?.source_ref;
-    if (test.provenance === undefined &&
-        test.provenance_invalid !== true) {
-        return { fingerprint, trusted: true, reason: "legacy" };
-    }
-    const acknowledged = Object.hasOwn(ledger.acknowledged, fingerprint);
-    if (test.provenance_invalid === true ||
-        !hasValidLinkedTestProvenance(test.provenance)) {
-        if (acknowledged) {
-            return {
-                fingerprint,
-                trusted: true,
-                reason: "acknowledged",
-                ...linkedTestTrustRefs(undefined, currentSourceRef),
-            };
-        }
-        return {
-            fingerprint,
-            trusted: false,
-            reason: "invalid_provenance",
-            ...linkedTestTrustRefs(undefined, currentSourceRef),
-        };
-    }
-    if (test.provenance.source_kind === "local_mutation" &&
-        sourceRef === undefined) {
-        return {
-            fingerprint,
-            trusted: true,
-            reason: "local_mutation",
-            ...linkedTestTrustRefs(undefined, currentSourceRef),
-        };
-    }
-    if (test.provenance.source_kind === "local_mutation" &&
-        sourceRef !== undefined &&
-        sourceRef === currentSourceRef) {
-        return {
-            fingerprint,
-            trusted: true,
-            reason: "local_source_ref",
-            source_ref: sourceRef,
-            current_source_ref: currentSourceRef,
-        };
-    }
-    if (acknowledged) {
-        return {
-            fingerprint,
-            trusted: true,
-            reason: "acknowledged",
-            ...linkedTestTrustRefs(sourceRef, currentSourceRef),
-        };
-    }
-    return {
-        fingerprint,
-        trusted: false,
-        reason: "foreign_source_ref",
-        ...linkedTestTrustRefs(sourceRef, currentSourceRef),
-    };
-}
-/** Resolve a collection with one ledger read for validation and batch runs. */
-export async function resolveLinkedTestTrustBatch(pmRoot, tests, currentSourceRef) {
-    const ledger = await readTrustLedger(pmRoot);
-    return tests.map((test) => resolveLinkedTestTrustFromLedger(test, currentSourceRef, ledger));
-}
-/** Persist explicit clone-local acknowledgement for selected linked tests. */
-export async function acknowledgeLinkedTests(pmRoot, tests, acknowledgedAt) {
-    const ledger = await readTrustLedger(pmRoot);
-    const fingerprints = tests
-        .filter((test) => typeof test.command === "string" && test.command.length > 0)
-        .map(linkedTestTrustFingerprint);
-    for (const fingerprint of fingerprints) {
-        ledger.acknowledged[fingerprint] = { acknowledged_at: acknowledgedAt };
-    }
-    await ensureDir(path.dirname(trustLedgerPath(pmRoot)));
-    await writeFileAtomic(trustLedgerPath(pmRoot), `${JSON.stringify(ledger, null, 2)}\n`);
-    return { acknowledged: fingerprints.length, fingerprints };
-}
+!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="eeb9bc22-b9e1-5449-9ad0-fbb1a14fb09d")}catch(e2){}})();import{execFile}from"node:child_process";import{readFile}from"node:fs/promises";import path from"node:path";import{promisify}from"node:util";import{ensureDir,writeFileAtomic}from"../../core/fs/fs-utils.js";import{sha256Hex,stableStringify}from"../../core/shared/serialization.js";import{isTimestampLiteral}from"../../core/shared/time.js";import{getRuntimePath}from"../../core/store/paths.js";const execFileAsync=promisify(execFile);const LINKED_TEST_TRUST_LEDGER_VERSION=1;const LINKED_TEST_TRUST_LEDGER_FILE="linked-test-trust.json";function trustLedgerPath(pmRoot){return path.join(getRuntimePath(pmRoot),LINKED_TEST_TRUST_LEDGER_FILE)}function emptyTrustLedger(){return{version:LINKED_TEST_TRUST_LEDGER_VERSION,acknowledged:{}}}async function readTrustLedger(pmRoot){try{const parsed=JSON.parse(await readFile(trustLedgerPath(pmRoot),"utf8"));if(parsed.version!==LINKED_TEST_TRUST_LEDGER_VERSION||typeof parsed.acknowledged!=="object"||parsed.acknowledged===null||Array.isArray(parsed.acknowledged)){return emptyTrustLedger()}return{version:LINKED_TEST_TRUST_LEDGER_VERSION,acknowledged:parsed.acknowledged}}catch{return emptyTrustLedger()}}async function resolveLinkedTestSourceRef(cwd=process.cwd()){const hostedRef=process.env.GITHUB_HEAD_REF?.trim()||process.env.GITHUB_REF_NAME?.trim();if(hostedRef&&hostedRef!=="merge"){return hostedRef}try{const{stdout}=await execFileAsync("git",["symbolic-ref","--quiet","--short","HEAD"],{cwd,encoding:"utf8",windowsHide:true,timeout:1e4});const ref=stdout.trim();if(ref.length===0)return void 0;return ref}catch{return void 0}}function resolveLinkedTestSourceWorkspaceRoot(cwd=process.cwd()){return process.env.PM_SOURCE_WORKSPACE_ROOT?.trim()||cwd}function hasValidLinkedTestProvenance(provenance){if(provenance===null||typeof provenance!=="object")return false;return typeof provenance.author==="string"&&provenance.author.trim().length>0&&typeof provenance.created_at==="string"&&isTimestampLiteral(provenance.created_at)&&(provenance.source_kind==="local_mutation"||provenance.source_kind==="merge_union")}function linkedTestTrustRefs(sourceRef,currentSourceRef){return{...sourceRef?{source_ref:sourceRef}:{},...currentSourceRef?{current_source_ref:currentSourceRef}:{}}}function attachLinkedTestProvenance(tests,author,createdAt,sourceRef){return tests?.map(test=>test.command&&!test.provenance?{...test,provenance:{author,created_at:createdAt,source_kind:"local_mutation",...sourceRef?{source_ref:sourceRef}:{}}}:test)}async function attachLinkedTestMutationProvenance(tests,author,createdAt){if(!tests||tests.length===0)return tests;const sourceWorkspaceRoot=resolveLinkedTestSourceWorkspaceRoot();return attachLinkedTestProvenance(tests,author,createdAt,await resolveLinkedTestSourceRef(sourceWorkspaceRoot))}function linkedTestTrustFingerprint(test){return sha256Hex(stableStringify({command:test.command??null,path:test.path??null,scope:test.scope,pm_context_mode:test.pm_context_mode??null,workspace_context_mode:test.workspace_context_mode??null,env_set:test.env_set??null,env_clear:test.env_clear??null,shared_host_safe:test.shared_host_safe??null,provenance:test.provenance??null,provenance_invalid:test.provenance_invalid??null}))}async function resolveLinkedTestTrust(pmRoot,test,currentSourceRef){const ledger=await readTrustLedger(pmRoot);return resolveLinkedTestTrustFromLedger(test,currentSourceRef,ledger)}function resolveLinkedTestTrustFromLedger(test,currentSourceRef,ledger){const fingerprint=linkedTestTrustFingerprint(test);const sourceRef=test.provenance?.source_ref;if(test.provenance===void 0&&test.provenance_invalid!==true){return{fingerprint,trusted:true,reason:"legacy"}}const acknowledged=Object.hasOwn(ledger.acknowledged,fingerprint);if(test.provenance_invalid===true||!hasValidLinkedTestProvenance(test.provenance)){if(acknowledged){return{fingerprint,trusted:true,reason:"acknowledged",...linkedTestTrustRefs(void 0,currentSourceRef)}}return{fingerprint,trusted:false,reason:"invalid_provenance",...linkedTestTrustRefs(void 0,currentSourceRef)}}if(test.provenance.source_kind==="local_mutation"&&sourceRef===void 0){return{fingerprint,trusted:true,reason:"local_mutation",...linkedTestTrustRefs(void 0,currentSourceRef)}}if(test.provenance.source_kind==="local_mutation"&&sourceRef!==void 0&&sourceRef===currentSourceRef){return{fingerprint,trusted:true,reason:"local_source_ref",source_ref:sourceRef,current_source_ref:currentSourceRef}}if(acknowledged){return{fingerprint,trusted:true,reason:"acknowledged",...linkedTestTrustRefs(sourceRef,currentSourceRef)}}return{fingerprint,trusted:false,reason:"foreign_source_ref",...linkedTestTrustRefs(sourceRef,currentSourceRef)}}async function resolveLinkedTestTrustBatch(pmRoot,tests,currentSourceRef){const ledger=await readTrustLedger(pmRoot);return tests.map(test=>resolveLinkedTestTrustFromLedger(test,currentSourceRef,ledger))}async function acknowledgeLinkedTests(pmRoot,tests,acknowledgedAt){const ledger=await readTrustLedger(pmRoot);const fingerprints=tests.filter(test=>typeof test.command==="string"&&test.command.length>0).map(linkedTestTrustFingerprint);for(const fingerprint of fingerprints){ledger.acknowledged[fingerprint]={acknowledged_at:acknowledgedAt}}await ensureDir(path.dirname(trustLedgerPath(pmRoot)));await writeFileAtomic(trustLedgerPath(pmRoot),`${JSON.stringify(ledger,null,2)}
+`);return{acknowledged:fingerprints.length,fingerprints}}export{acknowledgeLinkedTests,attachLinkedTestMutationProvenance,attachLinkedTestProvenance,linkedTestTrustFingerprint,resolveLinkedTestSourceRef,resolveLinkedTestSourceWorkspaceRoot,resolveLinkedTestTrust,resolveLinkedTestTrustBatch};
 //# sourceMappingURL=trust.js.map
-//# debugId=30a61f26-5db8-50ba-af37-1990a4742ce8