apphx 1.0.0 → 2.0.0

package/dist/mygo-build.js

@@ -0,0 +1,55 @@
+import { basename, posix } from "node:path";
+// src/mygo-build.ts
+/** Accept a direct, local MyGo build, never a wrapper that can add publishing flags. */
+function validateMyGoPackaging(config, screenshotsDir) {
+	const profile = config.packaging;
+	if (!profile || profile.provider !== "local" || profile.commands.length !== 1) throw Object.assign(/* @__PURE__ */ new Error("MyGo requires one direct local build command"), { code: "SETUP_REQUIRED" });
+	const argv = profile.commands[0];
+	let start;
+	if (basename(argv[0]) === "mygo" && argv[1] === "build") start = 2;
+	else if (basename(argv[0]) === "go" && argv[1] === "tool" && argv[2] === "mygo" && argv[3] === "build") start = 4;
+	else if (basename(argv[0]) === "go" && argv[1] === "run" && /^github\.com\/egoist\/mygo\/cmd\/mygo@v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(argv[2] ?? "") && argv[3] === "build") start = 4;
+	else throw Object.assign(/* @__PURE__ */ new Error("MyGo packaging must use a pinned go tool mygo build, installed mygo build, or version-pinned go run command"), { code: "SETUP_REQUIRED" });
+	const flags = /* @__PURE__ */ new Map();
+	for (let index = start; index < argv.length; index++) {
+		const flag = argv[index];
+		if (flags.has(flag)) throw Object.assign(/* @__PURE__ */ new Error(`Duplicate MyGo build flag: ${flag}`), { code: "SETUP_REQUIRED" });
+		if (flag === "-sign" || flag === "-platform" || flag === "-o") {
+			const value = argv[++index];
+			if (!value) throw Object.assign(/* @__PURE__ */ new Error(`Missing MyGo flag value: ${flag}`), { code: "SETUP_REQUIRED" });
+			flags.set(flag, value);
+		} else if (flag === "-skip-notarize" || flag === "-skip-dmg" || flag === "-skip-build-command") flags.set(flag, "true");
+		else throw Object.assign(/* @__PURE__ */ new Error(`MyGo local packaging does not permit ${flag}; upload, notarization and custom wrapper commands are out of scope`), { code: "SETUP_REQUIRED" });
+	}
+	if (flags.get("-sign") !== "-" || !flags.has("-skip-notarize")) throw Object.assign(/* @__PURE__ */ new Error("MyGo local builds require -sign - and -skip-notarize, even when project configuration enables signing/notarization"), { code: "SETUP_REQUIRED" });
+	const platform = flags.get("-platform");
+	if (!platform || !/^darwin\/(?:arm64|amd64|universal)$/.test(platform)) throw Object.assign(/* @__PURE__ */ new Error("MyGo packaging requires one explicit darwin/arm64, darwin/amd64 or darwin/universal target"), { code: "SETUP_REQUIRED" });
+	if (flags.get("-o") !== "build") throw Object.assign(/* @__PURE__ */ new Error("MyGo packaging requires -o build so output cannot replace project source"), { code: "SETUP_REQUIRED" });
+	const prefix = `build/${platform.replace("/", "-")}/`;
+	if (!profile.artifactPath.startsWith(prefix)) throw Object.assign(/* @__PURE__ */ new Error(`MyGo artifactPath must be inside ${prefix}`), { code: "SETUP_REQUIRED" });
+	if (screenshotsDir !== void 0) {
+		const screenshot = posix.normalize(screenshotsDir);
+		if (posix.isAbsolute(screenshot) || screenshot === ".." || screenshot.startsWith("../") || screenshot.includes("\\")) throw Object.assign(/* @__PURE__ */ new Error("MyGo screenshotsDir must stay within the selected project"), { code: "SETUP_REQUIRED" });
+		const outputDirectory = prefix.slice(0, -1);
+		if ([posix.relative(outputDirectory, screenshot), posix.relative(screenshot, outputDirectory)].some((path) => path === "" || path !== ".." && !path.startsWith("../") && !posix.isAbsolute(path))) throw Object.assign(/* @__PURE__ */ new Error("MyGo screenshotsDir must not overlap the platform output directory replaced during packaging"), { code: "SETUP_REQUIRED" });
+	}
+	if (config.packageTarget === "app" ? !flags.has("-skip-dmg") : flags.has("-skip-dmg")) throw Object.assign(/* @__PURE__ */ new Error("MyGo app builds require -skip-dmg; dmg builds must create the disk image"), { code: "SETUP_REQUIRED" });
+}
+/** Doctor and tracked execution share the same gate for every recognizable direct build. */
+function validateMyGoCommand(config, argv) {
+	const tool = basename(argv[0] ?? "");
+	const buildIndex = argv.indexOf("build");
+	if (buildIndex <= 0) return;
+	if (!(tool === "mygo" || tool === "go" && argv.slice(1, buildIndex).some((value) => value === "mygo" || value === "github.com/egoist/mygo/cmd/mygo" || value.startsWith("github.com/egoist/mygo/cmd/mygo@")))) return;
+	validateMyGoPackaging({
+		...config,
+		packageTarget: argv.includes("-skip-dmg") ? "app" : "dmg",
+		packaging: config.packaging ? {
+			...config.packaging,
+			commands: [argv]
+		} : void 0
+	});
+}
+export { validateMyGoCommand, validateMyGoPackaging };
+
+//# sourceMappingURL=mygo-build.js.map

package/dist/mygo-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mygo-build.js","names":[],"sources":["../src/mygo-build.ts"],"sourcesContent":["import { basename, posix } from 'node:path';\nimport type { Config } from './schemas.js';\n\n/** Accept a direct, local MyGo build, never a wrapper that can add publishing flags. */\nexport function validateMyGoPackaging(config: Config, screenshotsDir?: string): void {\n  const profile = config.packaging;\n  if (!profile || profile.provider !== 'local' || profile.commands.length !== 1) throw Object.assign(new Error('MyGo requires one direct local build command'), { code: 'SETUP_REQUIRED' });\n  const argv = profile.commands[0]!;\n  let start: number;\n  if (basename(argv[0]!) === 'mygo' && argv[1] === 'build') start = 2;\n  else if (basename(argv[0]!) === 'go' && argv[1] === 'tool' && argv[2] === 'mygo' && argv[3] === 'build') start = 4;\n  else if (basename(argv[0]!) === 'go' && argv[1] === 'run' && /^github\\.com\\/egoist\\/mygo\\/cmd\\/mygo@v\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(argv[2] ?? '') && argv[3] === 'build') start = 4;\n  else throw Object.assign(new Error('MyGo packaging must use a pinned go tool mygo build, installed mygo build, or version-pinned go run command'), { code: 'SETUP_REQUIRED' });\n  const flags = new Map<string, string>();\n  for (let index = start; index < argv.length; index++) {\n    const flag = argv[index]!;\n    if (flags.has(flag)) throw Object.assign(new Error(`Duplicate MyGo build flag: ${flag}`), { code: 'SETUP_REQUIRED' });\n    if (flag === '-sign' || flag === '-platform' || flag === '-o') {\n      const value = argv[++index];\n      if (!value) throw Object.assign(new Error(`Missing MyGo flag value: ${flag}`), { code: 'SETUP_REQUIRED' });\n      flags.set(flag, value);\n    } else if (flag === '-skip-notarize' || flag === '-skip-dmg' || flag === '-skip-build-command') flags.set(flag, 'true');\n    else throw Object.assign(new Error(`MyGo local packaging does not permit ${flag}; upload, notarization and custom wrapper commands are out of scope`), { code: 'SETUP_REQUIRED' });\n  }\n  if (flags.get('-sign') !== '-' || !flags.has('-skip-notarize')) throw Object.assign(new Error('MyGo local builds require -sign - and -skip-notarize, even when project configuration enables signing/notarization'), { code: 'SETUP_REQUIRED' });\n  const platform = flags.get('-platform');\n  if (!platform || !/^darwin\\/(?:arm64|amd64|universal)$/.test(platform)) throw Object.assign(new Error('MyGo packaging requires one explicit darwin/arm64, darwin/amd64 or darwin/universal target'), { code: 'SETUP_REQUIRED' });\n  if (flags.get('-o') !== 'build') throw Object.assign(new Error('MyGo packaging requires -o build so output cannot replace project source'), { code: 'SETUP_REQUIRED' });\n  const prefix = `build/${platform.replace('/', '-')}/`;\n  if (!profile.artifactPath.startsWith(prefix)) throw Object.assign(new Error(`MyGo artifactPath must be inside ${prefix}`), { code: 'SETUP_REQUIRED' });\n  if (screenshotsDir !== undefined) {\n    const screenshot = posix.normalize(screenshotsDir);\n    if (posix.isAbsolute(screenshot) || screenshot === '..' || screenshot.startsWith('../') || screenshot.includes('\\\\')) throw Object.assign(new Error('MyGo screenshotsDir must stay within the selected project'), { code: 'SETUP_REQUIRED' });\n    const outputDirectory = prefix.slice(0, -1);\n    if ([posix.relative(outputDirectory, screenshot), posix.relative(screenshot, outputDirectory)].some(path => path === '' || path !== '..' && !path.startsWith('../') && !posix.isAbsolute(path))) throw Object.assign(new Error('MyGo screenshotsDir must not overlap the platform output directory replaced during packaging'), { code: 'SETUP_REQUIRED' });\n  }\n  if (config.packageTarget === 'app' ? !flags.has('-skip-dmg') : flags.has('-skip-dmg')) throw Object.assign(new Error('MyGo app builds require -skip-dmg; dmg builds must create the disk image'), { code: 'SETUP_REQUIRED' });\n}\n\n/** Doctor and tracked execution share the same gate for every recognizable direct build. */\nexport function validateMyGoCommand(config: Config, argv: string[]): void {\n  const tool = basename(argv[0] ?? '');\n  const buildIndex = argv.indexOf('build');\n  if (buildIndex <= 0) return;\n  const direct = tool === 'mygo' || tool === 'go' && argv.slice(1, buildIndex).some(value => value === 'mygo' || value === 'github.com/egoist/mygo/cmd/mygo' || value.startsWith('github.com/egoist/mygo/cmd/mygo@'));\n  if (!direct) return;\n  validateMyGoPackaging({ ...config, packageTarget: argv.includes('-skip-dmg') ? 'app' : 'dmg', packaging: config.packaging ? { ...config.packaging, commands: [argv] } : undefined });\n}\n"],"mappings":";;;AAIA,SAAgB,sBAAsB,QAAgB,gBAA+B;CACnF,MAAM,UAAU,OAAO;CACvB,IAAI,CAAC,WAAW,QAAQ,aAAa,WAAW,QAAQ,SAAS,WAAW,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,8CAA8C,GAAG,EAAE,MAAM,iBAAiB,CAAC;CACxL,MAAM,OAAO,QAAQ,SAAS;CAC9B,IAAI;CACJ,IAAI,SAAS,KAAK,EAAG,MAAM,UAAU,KAAK,OAAO,SAAS,QAAQ;MAC7D,IAAI,SAAS,KAAK,EAAG,MAAM,QAAQ,KAAK,OAAO,UAAU,KAAK,OAAO,UAAU,KAAK,OAAO,SAAS,QAAQ;MAC5G,IAAI,SAAS,KAAK,EAAG,MAAM,QAAQ,KAAK,OAAO,SAAS,4EAA4E,KAAK,KAAK,MAAM,EAAE,KAAK,KAAK,OAAO,SAAS,QAAQ;MACxL,MAAM,OAAO,uBAAO,IAAI,MAAM,6GAA6G,GAAG,EAAE,MAAM,iBAAiB,CAAC;CAC7K,MAAM,wBAAQ,IAAI,IAAoB;CACtC,KAAK,IAAI,QAAQ,OAAO,QAAQ,KAAK,QAAQ,SAAS;EACpD,MAAM,OAAO,KAAK;EAClB,IAAI,MAAM,IAAI,IAAI,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,8BAA8B,MAAM,GAAG,EAAE,MAAM,iBAAiB,CAAC;EACpH,IAAI,SAAS,WAAW,SAAS,eAAe,SAAS,MAAM;GAC7D,MAAM,QAAQ,KAAK,EAAE;GACrB,IAAI,CAAC,OAAO,MAAM,OAAO,uBAAO,IAAI,MAAM,4BAA4B,MAAM,GAAG,EAAE,MAAM,iBAAiB,CAAC;GACzG,MAAM,IAAI,MAAM,KAAK;EACvB,OAAO,IAAI,SAAS,oBAAoB,SAAS,eAAe,SAAS,uBAAuB,MAAM,IAAI,MAAM,MAAM;OACjH,MAAM,OAAO,uBAAO,IAAI,MAAM,wCAAwC,KAAK,oEAAoE,GAAG,EAAE,MAAM,iBAAiB,CAAC;CACnL;CACA,IAAI,MAAM,IAAI,OAAO,MAAM,OAAO,CAAC,MAAM,IAAI,gBAAgB,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,oHAAoH,GAAG,EAAE,MAAM,iBAAiB,CAAC;CAC/O,MAAM,WAAW,MAAM,IAAI,WAAW;CACtC,IAAI,CAAC,YAAY,CAAC,sCAAsC,KAAK,QAAQ,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,4FAA4F,GAAG,EAAE,MAAM,iBAAiB,CAAC;CAC/N,IAAI,MAAM,IAAI,IAAI,MAAM,SAAS,MAAM,OAAO,uBAAO,IAAI,MAAM,0EAA0E,GAAG,EAAE,MAAM,iBAAiB,CAAC;CACtK,MAAM,SAAS,SAAS,SAAS,QAAQ,KAAK,GAAG,EAAE;CACnD,IAAI,CAAC,QAAQ,aAAa,WAAW,MAAM,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,oCAAoC,QAAQ,GAAG,EAAE,MAAM,iBAAiB,CAAC;CACrJ,IAAI,mBAAmB,KAAA,GAAW;EAChC,MAAM,aAAa,MAAM,UAAU,cAAc;EACjD,IAAI,MAAM,WAAW,UAAU,KAAK,eAAe,QAAQ,WAAW,WAAW,KAAK,KAAK,WAAW,SAAS,IAAI,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,2DAA2D,GAAG,EAAE,MAAM,iBAAiB,CAAC;EAC5O,MAAM,kBAAkB,OAAO,MAAM,GAAG,EAAE;EAC1C,IAAI,CAAC,MAAM,SAAS,iBAAiB,UAAU,GAAG,MAAM,SAAS,YAAY,eAAe,CAAC,CAAC,CAAC,MAAK,SAAQ,SAAS,MAAM,SAAS,QAAQ,CAAC,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,WAAW,IAAI,CAAC,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,8FAA8F,GAAG,EAAE,MAAM,iBAAiB,CAAC;CAC5V;CACA,IAAI,OAAO,kBAAkB,QAAQ,CAAC,MAAM,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,GAAG,MAAM,OAAO,uBAAO,IAAI,MAAM,0EAA0E,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAC9N;;AAGA,SAAgB,oBAAoB,QAAgB,MAAsB;CACxE,MAAM,OAAO,SAAS,KAAK,MAAM,EAAE;CACnC,MAAM,aAAa,KAAK,QAAQ,OAAO;CACvC,IAAI,cAAc,GAAG;CAErB,IAAI,EADW,SAAS,UAAU,SAAS,QAAQ,KAAK,MAAM,GAAG,UAAU,CAAC,CAAC,MAAK,UAAS,UAAU,UAAU,UAAU,qCAAqC,MAAM,WAAW,kCAAkC,CAAC,IACrM;CACb,sBAAsB;EAAE,GAAG;EAAQ,eAAe,KAAK,SAAS,WAAW,IAAI,QAAQ;EAAO,WAAW,OAAO,YAAY;GAAE,GAAG,OAAO;GAAW,UAAU,CAAC,IAAI;EAAE,IAAI,KAAA;CAAU,CAAC;AACrL"}

package/dist/policy.js

@@ -0,0 +1,35 @@
+import { ResearchSchema } from "./schemas.js";
+// src/policy.ts
+function parseResearch(text, channel) {
+	const content = text.trim().replace(/^```(?:json)?\s*\n?/, "").replace(/\n?```$/, "");
+	let value;
+	try {
+		value = JSON.parse(content);
+	} catch {
+		throw new Error("Host did not return a JSON verdict; no approval was inferred from text or an exit code");
+	}
+	return ResearchSchema.parse(value);
+}
+/** Honest pre-delivery differentiation and quality checklist. Store submission and review stay manual. */
+function internalQaChecklist() {
+	return [
+		"Internal QA checklist for a normal, honest local package handoff. Store submission, account setup and platform review are manual human work outside this tool; nothing here bypasses, influences or pre-approves a store reviewer.",
+		"Real value: each package has its own genuine purpose, audience and functional behavior. Identical functionality with only renamed labels is not meaningful differentiation.",
+		"Visual identity: themes, layouts, colors and interaction flows are real product choices for this app, not templated reskins produced to look different.",
+		"Developer and identity metadata: app name, title, icon, bundle/package id, keywords and description truthfully describe this app and its actual developer. Never forge identities, accounts, locations or submission sources.",
+		"Functionality: every advertised feature works and is exercised by the frozen runtime acceptance; no hidden functionality for any audience and no fabricated screenshots or evidence.",
+		"Metadata: price, region, category and description reflect the actual product. Design rationale notes, if any, are the owner's honest answers, not scripted reply templates.",
+		"Code identity: project, folder, class, function and resource names follow this project's real conventions. Do not mutate hashes, names or resource bytes solely to defeat similarity checks; that would be deceptive.",
+		"Quality gate: source, dependency and runtime proofs must be current; independent review must cover every frozen acceptance requirement with observed evidence. Only then may the artifact be handed off to a human for store submission."
+	].join("\n");
+}
+function researchPrompt(job, portfolio) {
+	const siblings = `Other same-channel products ${JSON.stringify(portfolio)}; earlier versions of this same app are its source baseline, not competing products.`;
+	return `Research only with your own host tools. Preserve the requested ${job.spec.framework} ${job.spec.platform} project and its existing architecture. ${internalQaChecklist()} ${siblings} Assess technical feasibility, dependencies, licensing, privacy and real acceptance for this local package. Return typed JSON {"viable":boolean,"distinctness":"specific honest differentiation","risks":["..."],"plan":["concrete implementation and device acceptance step"]}. Do not promise store approval and do not add unrequested features.`;
+}
+function reviewInstructions(job) {
+	return `Use an independent reviewer with fresh context when supported; otherwise disclose the limitation. Review actual source and acceptance read-only. Verified source: ${job.verifiedDigest}; dependency resolution: ${job.verifiedDependencyDigest}; actual checks: ${JSON.stringify(job.config.verification)}. ${internalQaChecklist()} Reject incomplete requirements, data loss, fake screenshots, accessibility failures, placeholders, weak tests and hidden features. Return typed JSON {"approved":boolean,"findings":["blocking issue"],"acceptanceEvidence":[{"requirement":"exact acceptance string","evidence":"file/symbol + observed command or device scenario"}]}. Cover every acceptance requirement. Reviewer identity is advisory; the Harness gates typed results and unchanged execution evidence.`;
+}
+export { internalQaChecklist, parseResearch, researchPrompt, reviewInstructions };
+
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","names":[],"sources":["../src/policy.ts"],"sourcesContent":["import { ResearchSchema } from './schemas.js';\nimport type { Job, Spec } from './schemas.js';\n\nexport function parseResearch(text: string, channel: Spec['channel']) {\n  const content = text.trim().replace(/^```(?:json)?\\s*\\n?/, '').replace(/\\n?```$/, '');\n  let value: unknown;\n  try { value = JSON.parse(content); }\n  catch { throw new Error('Host did not return a JSON verdict; no approval was inferred from text or an exit code'); }\n  return ResearchSchema.parse(value);\n}\n\n/** Honest pre-delivery differentiation and quality checklist. Store submission and review stay manual. */\nexport function internalQaChecklist(): string {\n  return [\n    'Internal QA checklist for a normal, honest local package handoff. Store submission, account setup and platform review are manual human work outside this tool; nothing here bypasses, influences or pre-approves a store reviewer.',\n    'Real value: each package has its own genuine purpose, audience and functional behavior. Identical functionality with only renamed labels is not meaningful differentiation.',\n    'Visual identity: themes, layouts, colors and interaction flows are real product choices for this app, not templated reskins produced to look different.',\n    'Developer and identity metadata: app name, title, icon, bundle/package id, keywords and description truthfully describe this app and its actual developer. Never forge identities, accounts, locations or submission sources.',\n    'Functionality: every advertised feature works and is exercised by the frozen runtime acceptance; no hidden functionality for any audience and no fabricated screenshots or evidence.',\n    'Metadata: price, region, category and description reflect the actual product. Design rationale notes, if any, are the owner\\'s honest answers, not scripted reply templates.',\n    'Code identity: project, folder, class, function and resource names follow this project\\'s real conventions. Do not mutate hashes, names or resource bytes solely to defeat similarity checks; that would be deceptive.',\n    'Quality gate: source, dependency and runtime proofs must be current; independent review must cover every frozen acceptance requirement with observed evidence. Only then may the artifact be handed off to a human for store submission.',\n  ].join('\\n');\n}\n\nexport function researchPrompt(job: Job, portfolio: Array<Pick<Spec, 'id' | 'purpose' | 'audience' | 'differentiators'>>): string {\n  const siblings = `Other same-channel products ${JSON.stringify(portfolio)}; earlier versions of this same app are its source baseline, not competing products.`;\n  return `Research only with your own host tools. Preserve the requested ${job.spec.framework} ${job.spec.platform} project and its existing architecture. ${internalQaChecklist()} ${siblings} Assess technical feasibility, dependencies, licensing, privacy and real acceptance for this local package. Return typed JSON {\"viable\":boolean,\"distinctness\":\"specific honest differentiation\",\"risks\":[\"...\"],\"plan\":[\"concrete implementation and device acceptance step\"]}. Do not promise store approval and do not add unrequested features.`;\n}\n\nexport function reviewInstructions(job: Job): string {\n  return `Use an independent reviewer with fresh context when supported; otherwise disclose the limitation. Review actual source and acceptance read-only. Verified source: ${job.verifiedDigest}; dependency resolution: ${job.verifiedDependencyDigest}; actual checks: ${JSON.stringify(job.config.verification)}. ${internalQaChecklist()} Reject incomplete requirements, data loss, fake screenshots, accessibility failures, placeholders, weak tests and hidden features. Return typed JSON {\"approved\":boolean,\"findings\":[\"blocking issue\"],\"acceptanceEvidence\":[{\"requirement\":\"exact acceptance string\",\"evidence\":\"file/symbol + observed command or device scenario\"}]}. Cover every acceptance requirement. Reviewer identity is advisory; the Harness gates typed results and unchanged execution evidence.`;\n}\n"],"mappings":";;AAGA,SAAgB,cAAc,MAAc,SAA0B;CACpE,MAAM,UAAU,KAAK,KAAK,CAAC,CAAC,QAAQ,uBAAuB,EAAE,CAAC,CAAC,QAAQ,WAAW,EAAE;CACpF,IAAI;CACJ,IAAI;EAAE,QAAQ,KAAK,MAAM,OAAO;CAAG,QAC7B;EAAE,MAAM,IAAI,MAAM,wFAAwF;CAAG;CACnH,OAAO,eAAe,MAAM,KAAK;AACnC;;AAGA,SAAgB,sBAA8B;CAC5C,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAgB,eAAe,KAAU,WAAyF;CAChI,MAAM,WAAW,+BAA+B,KAAK,UAAU,SAAS,EAAE;CAC1E,OAAO,kEAAkE,IAAI,KAAK,UAAU,GAAG,IAAI,KAAK,SAAS,0CAA0C,oBAAoB,EAAE,GAAG,SAAS;AAC/L;AAEA,SAAgB,mBAAmB,KAAkB;CACnD,OAAO,qKAAqK,IAAI,eAAe,2BAA2B,IAAI,yBAAyB,mBAAmB,KAAK,UAAU,IAAI,OAAO,YAAY,EAAE,IAAI,oBAAoB,EAAE;AAC9U"}

package/dist/preflight.js

@@ -1,6 +1,6 @@
 import { toError } from "./schemas.js";
-import { run } from "./process.js";
 import { expandArgv } from "./config.js";
+import { run } from "./process.js";
 // src/preflight.ts
 function prerequisiteFailure(argv, reason, detail, cause) {
 	return Object.assign(new Error(`Prerequisite ${JSON.stringify(argv)} ${detail}. Restore the configured worker environment before retrying.`, { cause }), {

package/dist/process.js

@@ -1,8 +1,8 @@
 import { toError } from "./schemas.js";
-import { randomUUID } from "node:crypto";
-import { dirname } from "node:path";
-import { spawn, spawnSync } from "node:child_process";
 import { closeSync, mkdirSync, openSync, readFileSync, writeSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
+import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 // src/process.ts
 const COMMAND_TOKEN = "APPLE_APP_FACTORY_COMMAND_TOKEN";

package/dist/project-profiles.js

@@ -0,0 +1,163 @@
+import { inside } from "./config.js";
+import { parseGoManifest } from "./go-dependencies.js";
+import { generatedModulePaths, isGeneratedPath } from "./dependencies.js";
+import { lstatSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { parseDocument } from "yaml";
+// src/project-profiles.ts
+function file(root, path) {
+	const absolute = inside(root, path);
+	const stat = lstatSync(absolute, { throwIfNoEntry: false });
+	if (!stat) return void 0;
+	if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`Project manifest must be a regular source file: ${path}`);
+	return readFileSync(absolute, "utf8");
+}
+function json(root, path, comments = false) {
+	let text = file(root, path);
+	if (text === void 0) return void 0;
+	if (comments) text = text.replace(/"(?:\\.|[^"\\])*"|\/\*[\s\S]*?\*\/|\/\/[^\r\n]*/g, (token) => token.startsWith("/") ? "" : token);
+	const value = JSON.parse(text);
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`Expected a project manifest object: ${path}`);
+	return value;
+}
+function directories(root, framework, current = "", moduleOutputs = [...generatedModulePaths(root, framework)]) {
+	const result = [current];
+	for (const entry of readdirSync(join(root, current), { withFileTypes: true })) {
+		const path = current ? `${current}/${entry.name}` : entry.name;
+		if (isGeneratedPath(path, framework) || moduleOutputs.some((output) => path === output || path.startsWith(`${output}/`))) continue;
+		const stat = lstatSync(join(root, path));
+		if (stat.isSymbolicLink()) throw new Error(`Project source symlinks are not trusted: ${path}`);
+		if (stat.isDirectory()) result.push(...directories(root, framework, path, moduleOutputs));
+	}
+	return result;
+}
+/** The caller resolves project.directory; this function never generates or ejects a project. */
+function assertProject(root, spec) {
+	const fail = (manifest) => {
+		throw new Error(`${spec.framework} build completion requires ${manifest} in the project directory`);
+	};
+	if (spec.platform === "macos" && spec.framework !== "mygo") fail("an existing supported iOS or Android platform; macOS is supported only for MyGo");
+	if (spec.framework === "mygo") {
+		if (spec.platform !== "macos") fail("the macOS platform");
+		const mod = file(root, "go.mod");
+		if (mod === void 0 || !parseGoManifest(mod).requires.has("github.com/egoist/mygo")) fail("a go.mod requiring github.com/egoist/mygo");
+		const native = json(root, "mygo.json");
+		const web = file(root, "mygo.config.ts");
+		if (native === void 0 === (web === void 0)) fail("exactly one mygo.json or mygo.config.ts");
+		if (web !== void 0 && !json(root, "package.json") && !json(root, "frontend/package.json")) fail("the original package.json or frontend/package.json for mygo.config.ts");
+		return;
+	}
+	if (spec.framework === "flutter") {
+		const text = file(root, "pubspec.yaml");
+		if (!text) fail("a Flutter pubspec.yaml");
+		const document = parseDocument(text);
+		if (document.errors.length) throw new Error(`Invalid pubspec.yaml: ${document.errors.map((error) => error.message).join("; ")}`);
+		const value = document.toJS();
+		if (!value || typeof value.name !== "string" || value.dependencies?.flutter?.sdk !== "flutter") fail("a named pubspec.yaml with dependencies.flutter.sdk: flutter");
+		return;
+	}
+	if (spec.framework === "android-java") {
+		if (spec.platform !== "android") fail("the Android platform");
+		const settings = file(root, "settings.gradle") ?? file(root, "settings.gradle.kts");
+		const application = directories(root, spec.framework).some((directory) => {
+			const prefix = directory ? `${directory}/` : "";
+			if ((file(root, `${prefix}build.gradle`) ?? file(root, `${prefix}build.gradle.kts`)) === void 0) return false;
+			const manifest = file(root, `${prefix}src/main/AndroidManifest.xml`)?.replace(/<!--[\s\S]*?-->/g, "");
+			return !!manifest && /<manifest\b/.test(manifest) && /<application\b/.test(manifest) && /<\/manifest\s*>/.test(manifest);
+		});
+		if (settings === void 0 || !application) fail("Gradle settings/build files and an application module src/main/AndroidManifest.xml");
+		return;
+	}
+	if (spec.framework === "swift") {
+		if (spec.platform !== "ios") fail("the iOS platform");
+		const swift = file(root, "Package.swift");
+		if (swift && /swift-tools-version\s*:/.test(swift) && /\bPackage\s*\(/.test(swift)) return;
+		for (const directory of directories(root, spec.framework)) if (directory.endsWith(".xcodeproj")) {
+			const project = file(root, `${directory}/project.pbxproj`);
+			if (project && /\bPBXProject\b/.test(project)) return;
+		}
+		fail("a Swift Package.swift or an Xcode .xcodeproj/project.pbxproj");
+	}
+	const pkg = json(root, "package.json");
+	const dependencies = {
+		...pkg?.dependencies,
+		...pkg?.devDependencies
+	};
+	if (spec.framework === "uni-app") {
+		const source = json(root, "src/manifest.json", true) ? "src/" : "";
+		const manifest = json(root, `${source}manifest.json`, true);
+		const pages = json(root, `${source}pages.json`, true);
+		if (!manifest || !Array.isArray(pages?.pages) || !pages.pages.length) fail("manifest.json and nonempty pages.json at the root or under src/");
+		const cli = typeof dependencies["@dcloudio/uni-app"] === "string" && !!dependencies["@dcloudio/uni-app"];
+		const classic = !!file(root, `${source}App.vue`) && !!(file(root, `${source}main.js`) ?? file(root, `${source}main.ts`));
+		if (!cli && !classic) fail("a uni-app CLI package.json or HBuilderX App.vue and main.js/main.ts");
+		return;
+	}
+	const required = spec.framework === "react-native" ? "react-native" : "expo";
+	if (!pkg || typeof dependencies[required] !== "string" || !dependencies[required]) fail(`package.json declaring ${required}`);
+}
+function buildInstructions(spec) {
+	return `${`Build the ${spec.platform} application using the ${spec.framework} stack. ${spec.project?.sourceDir ? "Preserve the imported project and its existing native structure." : "Preserve any existing project, including a prepared predecessor; generate a real runnable project only when none exists in the designated project directory."}`}\n${{
+		flutter: "Use a Flutter pubspec.yaml, Dart sources and the selected platform runner. Resolve dependencies with flutter pub get; keep pubspec.lock. Do not modify the Flutter SDK.",
+		"android-java": "Use a Java Android application with Gradle settings/build files and AndroidManifest.xml. Keep the Gradle wrapper and dependency locks; use the existing application module rather than rewriting it.",
+		swift: "Use the existing Xcode project or Swift package, Swift sources and iOS application configuration. Keep Package.resolved and Podfile.lock when used. Do not replace an existing Xcode project with a package.",
+		"react-native": "Use package.json with react-native and the existing iOS/Android native projects. Keep the package-manager lockfile and native dependency locks. Do not migrate to Expo or regenerate native projects.",
+		expo: "Use package.json with expo and the existing Expo application configuration. Preserve managed or prebuilt structure; do not force expo prebuild or eject. Cloud builds require the owner-configured permission and packaging commands.",
+		"uni-app": "Preserve either the existing CLI package.json with @dcloudio/uni-app or the classic HBuilderX App.vue/main.js/main.ts project without requiring npm. Keep manifest.json/pages.json (root or src) and existing native structure; use the owner-configured HBuilderX/CLI Android/iOS packager, not a fabricated artifact.",
+		mygo: "Preserve native-UI Go-only projects with go.mod and mygo.json, or existing web projects with go.mod, mygo.config.ts and their original package.json (at the root or under frontend/) and package manager; keep exactly one MyGo config and require github.com/egoist/mygo in go.mod. Native projects need neither package.json nor Bun nor Xcode. Do not rewrite a web project or require Bun solely because its config is TypeScript; preserve its existing runtime and frontend scripts. Preserve the pinned MyGo tool/module version in go.mod; do not use @latest or install tools automatically. Prepare go.sum, any go.work/go.work.sum, frontend dependency locks and generated frontend bindings before proof, preserving the original frontend build process. Use Go vet/tests plus an owner-implemented real macOS desktop acceptance harness that launches and drives the actual app; go test or a headless view test alone is not desktop acceptance, and no iOS simulator is involved. Never generate a stub acceptance command. Packaging stays local-only through the frozen direct go tool mygo build command (or owner-configured pinned direct MyGo invocation), with -sign - and -skip-notarize; never upload, notarize or access signing keychains. Use the frozen output path, architecture and app/dmg target; do not replace the owner packaging profile."
+	}[spec.framework]}\nImplement the acceptance criteria, run the configured checks and runtime evidence commands, and leave packaging to the frozen owner command profile. Never replace checks with no-ops or claim unobserved SDK/build results.`;
+}
+function doctorCommands(framework, platform) {
+	const commands = [];
+	if (framework === "mygo") {
+		if (platform !== "macos") throw new Error("MyGo doctor supports only macOS");
+		return [
+			{
+				name: "Go",
+				argv: ["go", "version"]
+			},
+			{
+				name: "macOS code signing",
+				argv: ["/usr/bin/which", "codesign"]
+			},
+			{
+				name: "macOS disk images",
+				argv: ["hdiutil", "help"]
+			}
+		];
+	}
+	if (platform === "macos") throw new Error("macOS doctor supports only MyGo");
+	if (framework === "flutter") commands.push({
+		name: "Flutter",
+		argv: ["flutter", "--version"]
+	});
+	else if (framework === "swift") commands.push({
+		name: "Swift",
+		argv: ["swift", "--version"]
+	});
+	else if (framework === "react-native" || framework === "expo") commands.push({
+		name: "Node.js",
+		argv: ["node", "--version"]
+	}, {
+		name: "npm",
+		argv: ["npm", "--version"]
+	});
+	if (platform === "ios") commands.push({
+		name: "Xcode",
+		argv: ["xcodebuild", "-version"]
+	}, {
+		name: "Xcode tools",
+		argv: ["xcrun", "--version"]
+	});
+	else commands.push({
+		name: "Java",
+		argv: ["java", "-version"]
+	}, {
+		name: "Android platform tools",
+		argv: ["adb", "version"]
+	});
+	return commands;
+}
+export { assertProject, buildInstructions, doctorCommands };
+
+//# sourceMappingURL=project-profiles.js.map

package/dist/project-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-profiles.js","names":[],"sources":["../src/project-profiles.ts"],"sourcesContent":["import { lstatSync, readFileSync, readdirSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { parseDocument } from 'yaml';\nimport { inside } from './config.js';\nimport { generatedModulePaths, isGeneratedPath } from './dependencies.js';\nimport { parseGoManifest } from './go-dependencies.js';\nimport type { Framework, Platform, Spec } from './schemas.js';\n\nfunction file(root: string, path: string): string | undefined {\n  const absolute = inside(root, path);\n  const stat = lstatSync(absolute, { throwIfNoEntry: false });\n  if (!stat) return undefined;\n  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`Project manifest must be a regular source file: ${path}`);\n  return readFileSync(absolute, 'utf8');\n}\n\nfunction json(root: string, path: string, comments = false): Record<string, unknown> | undefined {\n  let text = file(root, path);\n  if (text === undefined) return undefined;\n  if (comments) text = text.replace(/\"(?:\\\\.|[^\"\\\\])*\"|\\/\\*[\\s\\S]*?\\*\\/|\\/\\/[^\\r\\n]*/g, token => token.startsWith('/') ? '' : token);\n  const value: unknown = JSON.parse(text);\n  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`Expected a project manifest object: ${path}`);\n  return value as Record<string, unknown>;\n}\n\nfunction directories(root: string, framework: Framework, current = '', moduleOutputs = [...generatedModulePaths(root, framework)]): string[] {\n  const result = [current];\n  for (const entry of readdirSync(join(root, current), { withFileTypes: true })) {\n    const path = current ? `${current}/${entry.name}` : entry.name;\n    if (isGeneratedPath(path, framework) || moduleOutputs.some(output => path === output || path.startsWith(`${output}/`))) continue;\n    const stat = lstatSync(join(root, path));\n    if (stat.isSymbolicLink()) throw new Error(`Project source symlinks are not trusted: ${path}`);\n    if (stat.isDirectory()) result.push(...directories(root, framework, path, moduleOutputs));\n  }\n  return result;\n}\n\n/** The caller resolves project.directory; this function never generates or ejects a project. */\nexport function assertProject(root: string, spec: Spec): void {\n  const fail = (manifest: string): never => { throw new Error(`${spec.framework} build completion requires ${manifest} in the project directory`); };\n  if (spec.platform === 'macos' && spec.framework !== 'mygo') fail('an existing supported iOS or Android platform; macOS is supported only for MyGo');\n  if (spec.framework === 'mygo') {\n    if (spec.platform !== 'macos') fail('the macOS platform');\n    const mod = file(root, 'go.mod');\n    if (mod === undefined || !parseGoManifest(mod).requires.has('github.com/egoist/mygo')) fail('a go.mod requiring github.com/egoist/mygo');\n    const native = json(root, 'mygo.json');\n    const web = file(root, 'mygo.config.ts');\n    if ((native === undefined) === (web === undefined)) fail('exactly one mygo.json or mygo.config.ts');\n    if (web !== undefined && !json(root, 'package.json') && !json(root, 'frontend/package.json')) fail('the original package.json or frontend/package.json for mygo.config.ts');\n    return;\n  }\n  if (spec.framework === 'flutter') {\n    const text = file(root, 'pubspec.yaml');\n    if (!text) fail('a Flutter pubspec.yaml');\n    const document = parseDocument(text!);\n    if (document.errors.length) throw new Error(`Invalid pubspec.yaml: ${document.errors.map(error => error.message).join('; ')}`);\n    const value = document.toJS();\n    if (!value || typeof value.name !== 'string' || value.dependencies?.flutter?.sdk !== 'flutter') fail('a named pubspec.yaml with dependencies.flutter.sdk: flutter');\n    return;\n  }\n  if (spec.framework === 'android-java') {\n    if (spec.platform !== 'android') fail('the Android platform');\n    const settings = file(root, 'settings.gradle') ?? file(root, 'settings.gradle.kts');\n    const application = directories(root, spec.framework).some(directory => {\n      const prefix = directory ? `${directory}/` : '';\n      const build = file(root, `${prefix}build.gradle`) ?? file(root, `${prefix}build.gradle.kts`);\n      if (build === undefined) return false;\n      const manifest = file(root, `${prefix}src/main/AndroidManifest.xml`)?.replace(/<!--[\\s\\S]*?-->/g, '');\n      return !!manifest && /<manifest\\b/.test(manifest) && /<application\\b/.test(manifest) && /<\\/manifest\\s*>/.test(manifest);\n    });\n    if (settings === undefined || !application) fail('Gradle settings/build files and an application module src/main/AndroidManifest.xml');\n    return;\n  }\n  if (spec.framework === 'swift') {\n    if (spec.platform !== 'ios') fail('the iOS platform');\n    const swift = file(root, 'Package.swift');\n    if (swift && /swift-tools-version\\s*:/.test(swift) && /\\bPackage\\s*\\(/.test(swift)) return;\n    for (const directory of directories(root, spec.framework)) {\n      if (directory.endsWith('.xcodeproj')) {\n        const project = file(root, `${directory}/project.pbxproj`);\n        if (project && /\\bPBXProject\\b/.test(project)) return;\n      }\n    }\n    fail('a Swift Package.swift or an Xcode .xcodeproj/project.pbxproj');\n  }\n  const pkg = json(root, 'package.json');\n  const dependencies = { ...(pkg?.dependencies as Record<string, unknown> | undefined), ...(pkg?.devDependencies as Record<string, unknown> | undefined) };\n  if (spec.framework === 'uni-app') {\n    const source = json(root, 'src/manifest.json', true) ? 'src/' : '';\n    const manifest = json(root, `${source}manifest.json`, true);\n    const pages = json(root, `${source}pages.json`, true);\n    if (!manifest || !Array.isArray(pages?.pages) || !pages.pages.length) fail('manifest.json and nonempty pages.json at the root or under src/');\n    const cli = typeof dependencies['@dcloudio/uni-app'] === 'string' && !!dependencies['@dcloudio/uni-app'];\n    const classic = !!file(root, `${source}App.vue`) && !!(file(root, `${source}main.js`) ?? file(root, `${source}main.ts`));\n    if (!cli && !classic) fail('a uni-app CLI package.json or HBuilderX App.vue and main.js/main.ts');\n    return;\n  }\n  const required = spec.framework === 'react-native' ? 'react-native' : 'expo';\n  if (!pkg || typeof dependencies[required] !== 'string' || !dependencies[required]) fail(`package.json declaring ${required}`);\n}\n\nexport function buildInstructions(spec: Spec): string {\n  const context = `Build the ${spec.platform} application using the ${spec.framework} stack. ${spec.project?.sourceDir ? 'Preserve the imported project and its existing native structure.' : 'Preserve any existing project, including a prepared predecessor; generate a real runnable project only when none exists in the designated project directory.'}`;\n  const guidance: Record<Framework, string> = {\n    flutter: 'Use a Flutter pubspec.yaml, Dart sources and the selected platform runner. Resolve dependencies with flutter pub get; keep pubspec.lock. Do not modify the Flutter SDK.',\n    'android-java': 'Use a Java Android application with Gradle settings/build files and AndroidManifest.xml. Keep the Gradle wrapper and dependency locks; use the existing application module rather than rewriting it.',\n    swift: 'Use the existing Xcode project or Swift package, Swift sources and iOS application configuration. Keep Package.resolved and Podfile.lock when used. Do not replace an existing Xcode project with a package.',\n    'react-native': 'Use package.json with react-native and the existing iOS/Android native projects. Keep the package-manager lockfile and native dependency locks. Do not migrate to Expo or regenerate native projects.',\n    expo: 'Use package.json with expo and the existing Expo application configuration. Preserve managed or prebuilt structure; do not force expo prebuild or eject. Cloud builds require the owner-configured permission and packaging commands.',\n    'uni-app': 'Preserve either the existing CLI package.json with @dcloudio/uni-app or the classic HBuilderX App.vue/main.js/main.ts project without requiring npm. Keep manifest.json/pages.json (root or src) and existing native structure; use the owner-configured HBuilderX/CLI Android/iOS packager, not a fabricated artifact.',\n    mygo: 'Preserve native-UI Go-only projects with go.mod and mygo.json, or existing web projects with go.mod, mygo.config.ts and their original package.json (at the root or under frontend/) and package manager; keep exactly one MyGo config and require github.com/egoist/mygo in go.mod. Native projects need neither package.json nor Bun nor Xcode. Do not rewrite a web project or require Bun solely because its config is TypeScript; preserve its existing runtime and frontend scripts. Preserve the pinned MyGo tool/module version in go.mod; do not use @latest or install tools automatically. Prepare go.sum, any go.work/go.work.sum, frontend dependency locks and generated frontend bindings before proof, preserving the original frontend build process. Use Go vet/tests plus an owner-implemented real macOS desktop acceptance harness that launches and drives the actual app; go test or a headless view test alone is not desktop acceptance, and no iOS simulator is involved. Never generate a stub acceptance command. Packaging stays local-only through the frozen direct go tool mygo build command (or owner-configured pinned direct MyGo invocation), with -sign - and -skip-notarize; never upload, notarize or access signing keychains. Use the frozen output path, architecture and app/dmg target; do not replace the owner packaging profile.',\n  };\n  return `${context}\\n${guidance[spec.framework]}\\nImplement the acceptance criteria, run the configured checks and runtime evidence commands, and leave packaging to the frozen owner command profile. Never replace checks with no-ops or claim unobserved SDK/build results.`;\n}\n\nexport function doctorCommands(framework: Framework, platform: Platform): Array<{ name: string; argv: string[] }> {\n  const commands: Array<{ name: string; argv: string[] }> = [];\n  if (framework === 'mygo') {\n    if (platform !== 'macos') throw new Error('MyGo doctor supports only macOS');\n    return [\n      { name: 'Go', argv: ['go', 'version'] },\n      { name: 'macOS code signing', argv: ['/usr/bin/which', 'codesign'] },\n      { name: 'macOS disk images', argv: ['hdiutil', 'help'] },\n    ];\n  }\n  if (platform === 'macos') throw new Error('macOS doctor supports only MyGo');\n  if (framework === 'flutter') commands.push({ name: 'Flutter', argv: ['flutter', '--version'] });\n  else if (framework === 'swift') commands.push({ name: 'Swift', argv: ['swift', '--version'] });\n  else if (framework === 'react-native' || framework === 'expo') commands.push({ name: 'Node.js', argv: ['node', '--version'] }, { name: 'npm', argv: ['npm', '--version'] });\n  if (platform === 'ios') commands.push({ name: 'Xcode', argv: ['xcodebuild', '-version'] }, { name: 'Xcode tools', argv: ['xcrun', '--version'] });\n  else commands.push({ name: 'Java', argv: ['java', '-version'] }, { name: 'Android platform tools', argv: ['adb', 'version'] });\n  return commands;\n}\n"],"mappings":";;;;;;;AAQA,SAAS,KAAK,MAAc,MAAkC;CAC5D,MAAM,WAAW,OAAO,MAAM,IAAI;CAClC,MAAM,OAAO,UAAU,UAAU,EAAE,gBAAgB,MAAM,CAAC;CAC1D,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,IAAI,CAAC,KAAK,OAAO,KAAK,KAAK,eAAe,GAAG,MAAM,IAAI,MAAM,mDAAmD,MAAM;CACtH,OAAO,aAAa,UAAU,MAAM;AACtC;AAEA,SAAS,KAAK,MAAc,MAAc,WAAW,OAA4C;CAC/F,IAAI,OAAO,KAAK,MAAM,IAAI;CAC1B,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;CAC/B,IAAI,UAAU,OAAO,KAAK,QAAQ,qDAAoD,UAAS,MAAM,WAAW,GAAG,IAAI,KAAK,KAAK;CACjI,MAAM,QAAiB,KAAK,MAAM,IAAI;CACtC,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,uCAAuC,MAAM;CAC9H,OAAO;AACT;AAEA,SAAS,YAAY,MAAc,WAAsB,UAAU,IAAI,gBAAgB,CAAC,GAAG,qBAAqB,MAAM,SAAS,CAAC,GAAa;CAC3I,MAAM,SAAS,CAAC,OAAO;CACvB,KAAK,MAAM,SAAS,YAAY,KAAK,MAAM,OAAO,GAAG,EAAE,eAAe,KAAK,CAAC,GAAG;EAC7E,MAAM,OAAO,UAAU,GAAG,QAAQ,GAAG,MAAM,SAAS,MAAM;EAC1D,IAAI,gBAAgB,MAAM,SAAS,KAAK,cAAc,MAAK,WAAU,SAAS,UAAU,KAAK,WAAW,GAAG,OAAO,EAAE,CAAC,GAAG;EACxH,MAAM,OAAO,UAAU,KAAK,MAAM,IAAI,CAAC;EACvC,IAAI,KAAK,eAAe,GAAG,MAAM,IAAI,MAAM,4CAA4C,MAAM;EAC7F,IAAI,KAAK,YAAY,GAAG,OAAO,KAAK,GAAG,YAAY,MAAM,WAAW,MAAM,aAAa,CAAC;CAC1F;CACA,OAAO;AACT;;AAGA,SAAgB,cAAc,MAAc,MAAkB;CAC5D,MAAM,QAAQ,aAA4B;EAAE,MAAM,IAAI,MAAM,GAAG,KAAK,UAAU,6BAA6B,SAAS,0BAA0B;CAAG;CACjJ,IAAI,KAAK,aAAa,WAAW,KAAK,cAAc,QAAQ,KAAK,iFAAiF;CAClJ,IAAI,KAAK,cAAc,QAAQ;EAC7B,IAAI,KAAK,aAAa,SAAS,KAAK,oBAAoB;EACxD,MAAM,MAAM,KAAK,MAAM,QAAQ;EAC/B,IAAI,QAAQ,KAAA,KAAa,CAAC,gBAAgB,GAAG,CAAC,CAAC,SAAS,IAAI,wBAAwB,GAAG,KAAK,2CAA2C;EACvI,MAAM,SAAS,KAAK,MAAM,WAAW;EACrC,MAAM,MAAM,KAAK,MAAM,gBAAgB;EACvC,IAAK,WAAW,KAAA,OAAgB,QAAQ,KAAA,IAAY,KAAK,yCAAyC;EAClG,IAAI,QAAQ,KAAA,KAAa,CAAC,KAAK,MAAM,cAAc,KAAK,CAAC,KAAK,MAAM,uBAAuB,GAAG,KAAK,uEAAuE;EAC1K;CACF;CACA,IAAI,KAAK,cAAc,WAAW;EAChC,MAAM,OAAO,KAAK,MAAM,cAAc;EACtC,IAAI,CAAC,MAAM,KAAK,wBAAwB;EACxC,MAAM,WAAW,cAAc,IAAK;EACpC,IAAI,SAAS,OAAO,QAAQ,MAAM,IAAI,MAAM,yBAAyB,SAAS,OAAO,KAAI,UAAS,MAAM,OAAO,CAAC,CAAC,KAAK,IAAI,GAAG;EAC7H,MAAM,QAAQ,SAAS,KAAK;EAC5B,IAAI,CAAC,SAAS,OAAO,MAAM,SAAS,YAAY,MAAM,cAAc,SAAS,QAAQ,WAAW,KAAK,6DAA6D;EAClK;CACF;CACA,IAAI,KAAK,cAAc,gBAAgB;EACrC,IAAI,KAAK,aAAa,WAAW,KAAK,sBAAsB;EAC5D,MAAM,WAAW,KAAK,MAAM,iBAAiB,KAAK,KAAK,MAAM,qBAAqB;EAClF,MAAM,cAAc,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,MAAK,cAAa;GACtE,MAAM,SAAS,YAAY,GAAG,UAAU,KAAK;GAE7C,KADc,KAAK,MAAM,GAAG,OAAO,aAAa,KAAK,KAAK,MAAM,GAAG,OAAO,iBAAiB,OAC7E,KAAA,GAAW,OAAO;GAChC,MAAM,WAAW,KAAK,MAAM,GAAG,OAAO,6BAA6B,CAAC,EAAE,QAAQ,oBAAoB,EAAE;GACpG,OAAO,CAAC,CAAC,YAAY,cAAc,KAAK,QAAQ,KAAK,iBAAiB,KAAK,QAAQ,KAAK,kBAAkB,KAAK,QAAQ;EACzH,CAAC;EACD,IAAI,aAAa,KAAA,KAAa,CAAC,aAAa,KAAK,oFAAoF;EACrI;CACF;CACA,IAAI,KAAK,cAAc,SAAS;EAC9B,IAAI,KAAK,aAAa,OAAO,KAAK,kBAAkB;EACpD,MAAM,QAAQ,KAAK,MAAM,eAAe;EACxC,IAAI,SAAS,0BAA0B,KAAK,KAAK,KAAK,iBAAiB,KAAK,KAAK,GAAG;EACpF,KAAK,MAAM,aAAa,YAAY,MAAM,KAAK,SAAS,GACtD,IAAI,UAAU,SAAS,YAAY,GAAG;GACpC,MAAM,UAAU,KAAK,MAAM,GAAG,UAAU,iBAAiB;GACzD,IAAI,WAAW,iBAAiB,KAAK,OAAO,GAAG;EACjD;EAEF,KAAK,8DAA8D;CACrE;CACA,MAAM,MAAM,KAAK,MAAM,cAAc;CACrC,MAAM,eAAe;EAAE,GAAI,KAAK;EAAsD,GAAI,KAAK;CAAwD;CACvJ,IAAI,KAAK,cAAc,WAAW;EAChC,MAAM,SAAS,KAAK,MAAM,qBAAqB,IAAI,IAAI,SAAS;EAChE,MAAM,WAAW,KAAK,MAAM,GAAG,OAAO,gBAAgB,IAAI;EAC1D,MAAM,QAAQ,KAAK,MAAM,GAAG,OAAO,aAAa,IAAI;EACpD,IAAI,CAAC,YAAY,CAAC,MAAM,QAAQ,OAAO,KAAK,KAAK,CAAC,MAAM,MAAM,QAAQ,KAAK,iEAAiE;EAC5I,MAAM,MAAM,OAAO,aAAa,yBAAyB,YAAY,CAAC,CAAC,aAAa;EACpF,MAAM,UAAU,CAAC,CAAC,KAAK,MAAM,GAAG,OAAO,QAAQ,KAAK,CAAC,EAAE,KAAK,MAAM,GAAG,OAAO,QAAQ,KAAK,KAAK,MAAM,GAAG,OAAO,QAAQ;EACtH,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,qEAAqE;EAChG;CACF;CACA,MAAM,WAAW,KAAK,cAAc,iBAAiB,iBAAiB;CACtE,IAAI,CAAC,OAAO,OAAO,aAAa,cAAc,YAAY,CAAC,aAAa,WAAW,KAAK,0BAA0B,UAAU;AAC9H;AAEA,SAAgB,kBAAkB,MAAoB;CAWpD,OAAO,GAAG,aAVmB,KAAK,SAAS,yBAAyB,KAAK,UAAU,UAAU,KAAK,SAAS,YAAY,qEAAqE,iKAU1K,IAAI;EARpB,SAAS;EACT,gBAAgB;EAChB,OAAO;EACP,gBAAgB;EAChB,MAAM;EACN,WAAW;EACX,MAAM;CAEqB,EAAE,KAAK,WAAW;AACjD;AAEA,SAAgB,eAAe,WAAsB,UAA6D;CAChH,MAAM,WAAoD,CAAC;CAC3D,IAAI,cAAc,QAAQ;EACxB,IAAI,aAAa,SAAS,MAAM,IAAI,MAAM,iCAAiC;EAC3E,OAAO;GACL;IAAE,MAAM;IAAM,MAAM,CAAC,MAAM,SAAS;GAAE;GACtC;IAAE,MAAM;IAAsB,MAAM,CAAC,kBAAkB,UAAU;GAAE;GACnE;IAAE,MAAM;IAAqB,MAAM,CAAC,WAAW,MAAM;GAAE;EACzD;CACF;CACA,IAAI,aAAa,SAAS,MAAM,IAAI,MAAM,iCAAiC;CAC3E,IAAI,cAAc,WAAW,SAAS,KAAK;EAAE,MAAM;EAAW,MAAM,CAAC,WAAW,WAAW;CAAE,CAAC;MACzF,IAAI,cAAc,SAAS,SAAS,KAAK;EAAE,MAAM;EAAS,MAAM,CAAC,SAAS,WAAW;CAAE,CAAC;MACxF,IAAI,cAAc,kBAAkB,cAAc,QAAQ,SAAS,KAAK;EAAE,MAAM;EAAW,MAAM,CAAC,QAAQ,WAAW;CAAE,GAAG;EAAE,MAAM;EAAO,MAAM,CAAC,OAAO,WAAW;CAAE,CAAC;CAC1K,IAAI,aAAa,OAAO,SAAS,KAAK;EAAE,MAAM;EAAS,MAAM,CAAC,cAAc,UAAU;CAAE,GAAG;EAAE,MAAM;EAAe,MAAM,CAAC,SAAS,WAAW;CAAE,CAAC;MAC3I,SAAS,KAAK;EAAE,MAAM;EAAQ,MAAM,CAAC,QAAQ,UAAU;CAAE,GAAG;EAAE,MAAM;EAA0B,MAAM,CAAC,OAAO,SAAS;CAAE,CAAC;CAC7H,OAAO;AACT"}

package/dist/proof.js

@@ -0,0 +1,33 @@
+// src/proof.ts
+function verificationContract(config) {
+	return {
+		verification: config.verification,
+		executionEnv: config.executionEnv,
+		toolchain: config.toolchain,
+		packaging: config.packaging,
+		apple: config.apple,
+		packageTarget: config.packageTarget,
+		allowCloudBuild: config.allowCloudBuild,
+		isolation: config.isolation,
+		obfuscation: config.obfuscation
+	};
+}
+function verificationConfigChanged(job, config) {
+	return JSON.stringify(verificationContract(job.config)) !== JSON.stringify(verificationContract(config)) || job.verifiedDigest != null && !job.verifiedDependencyDigest;
+}
+function invalidateVerification() {
+	return {
+		verifiedDigest: null,
+		verifiedDependencyDigest: null,
+		screenshotDigest: null,
+		verifiedAt: void 0,
+		review: null,
+		reviewPolicyContextDigest: null,
+		artifact: null,
+		ipaPath: null,
+		archiveDigest: null
+	};
+}
+export { invalidateVerification, verificationConfigChanged };
+
+//# sourceMappingURL=proof.js.map

package/dist/proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.js","names":[],"sources":["../src/proof.ts"],"sourcesContent":["import type { Config, Job } from './schemas.js';\n\nfunction verificationContract(config: Config) {\n  return {\n    verification: config.verification, executionEnv: config.executionEnv, toolchain: config.toolchain,\n    packaging: config.packaging, apple: config.apple, packageTarget: config.packageTarget, allowCloudBuild: config.allowCloudBuild,\n    isolation: config.isolation, obfuscation: config.obfuscation,\n  };\n}\n\nexport function verificationConfigChanged(job: Job, config: Config): boolean {\n  return JSON.stringify(verificationContract(job.config)) !== JSON.stringify(verificationContract(config))\n    || (job.verifiedDigest != null && !job.verifiedDependencyDigest);\n}\n\nexport function invalidateVerification(): Partial<Job> {\n  return {\n    verifiedDigest: null, verifiedDependencyDigest: null, screenshotDigest: null, verifiedAt: undefined,\n    review: null, reviewPolicyContextDigest: null, artifact: null, ipaPath: null, archiveDigest: null,\n  };\n}\n"],"mappings":";AAEA,SAAS,qBAAqB,QAAgB;CAC5C,OAAO;EACL,cAAc,OAAO;EAAc,cAAc,OAAO;EAAc,WAAW,OAAO;EACxF,WAAW,OAAO;EAAW,OAAO,OAAO;EAAO,eAAe,OAAO;EAAe,iBAAiB,OAAO;EAC/G,WAAW,OAAO;EAAW,aAAa,OAAO;CACnD;AACF;AAEA,SAAgB,0BAA0B,KAAU,QAAyB;CAC3E,OAAO,KAAK,UAAU,qBAAqB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,qBAAqB,MAAM,CAAC,KACjG,IAAI,kBAAkB,QAAQ,CAAC,IAAI;AAC3C;AAEA,SAAgB,yBAAuC;CACrD,OAAO;EACL,gBAAgB;EAAM,0BAA0B;EAAM,kBAAkB;EAAM,YAAY,KAAA;EAC1F,QAAQ;EAAM,2BAA2B;EAAM,UAAU;EAAM,SAAS;EAAM,eAAe;CAC/F;AACF"}

package/dist/remote.js

@@ -2,8 +2,8 @@ import { toError } from "./schemas.js";
 import { loadJSON } from "./config.js";
 import { parseRequirement } from "./requirements.js";
 import { z } from "zod";
-import { posix } from "node:path";
 import { spawn } from "node:child_process";
+import { posix } from "node:path";
 // src/remote.ts
 const remotePath = z.string().min(1).refine((value) => posix.isAbsolute(value) && !value.includes("\0") && !/[\r\n]/.test(value), "Use an absolute path on the Mac worker");
 const RemoteSchema = z.strictObject({