create-principles-disciple 1.146.4 → 1.146.7

package/release-manager/dist/update/release-metadata-publisher.js

@@ -1,478 +0,0 @@
-/**
- * Release metadata publisher (PRI-727) — the production supply side of the
- * read contracts in release-metadata-source.ts / trust-metadata.ts.
- *
- * For one release this module emits EXACTLY the byte set ReleaseManager
- * already consumes (see apply-payload.ts and release-manager.ts):
- *
- *   root.json / timestamp.json / snapshot.json / targets.json       TUF chain
- *   targets/channels/<channel>.json                                 signed channel pointer payload
- *   targets/releases/<releaseId>/metadata.json                      release metadata payload
- *   targets/releases/<releaseId>/release-asset-<platform>-<arch>.tar.gz
- *
- * No second release identity: releaseId and the canonical digests come from
- * deriveReleaseId/buildReleaseMetadata, and both produced documents are
- * re-validated with the SAME strict parsers the ReleaseManager uses, so a
- * publisher-side defect fails here instead of at an install. Publication is
- * byte-deterministic: the same identity inputs, the same signing key and the
- * same previous-state TUF versions re-emit identical files (idempotent
- * re-publish of one release is a no-op, not a mutation).
- *
- * Advance discipline: the channel pointer is only produced together with the
- * artifact target whose sha256 is bound into the release metadata — there is
- * no API shape that advances the pointer without the verifiable artifact
- * existing in the same file set. Monotonicity against the currently
- * published channel pointer (`previous`) is enforced here, fail-loud, before
- * any bytes are emitted.
- *
- * Trust material: one ed25519 key signs all four TUF roles — the same
- * single-key shape the ReleaseManager test suite verifies against. The
- * install side pins root.json at install time, so this module never rotates
- * the root (root version stays 1; rotation is separate governance work).
- */
-import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign as cryptoSign } from 'node:crypto';
-import { gzipSync } from 'node:zlib';
-import { Key, Metadata, MetadataKind, MetaFile, Root, Signature, Snapshot, TargetFile, Targets, Timestamp, } from '@tufjs/models';
-import { parseChannelMetadata } from './channel-metadata.js';
-import { buildReleaseMetadata, } from './release-metadata.js';
-import { isReleaseChannelName, } from './product-identity.js';
-import { canonicalJson } from './release-identity.js';
-export const RELEASE_PUBLICATION_TUF_SPEC_VERSION = '1.0.31';
-export class ReleasePublicationError extends Error {
-    code;
-    field;
-    nextAction;
-    // eslint-disable-next-line @typescript-eslint/max-params -- (code, field, message, nextAction) mirrors the four fields of the consumer refusal contract (same shape as ReleaseManagerError / ReleaseTrustError)
-    constructor(code, field, message, nextAction) {
-        super(message);
-        this.name = 'ReleasePublicationError';
-        this.code = code;
-        this.field = field;
-        this.nextAction = nextAction;
-    }
-}
-const RFC3339_UTC_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
-function isPlainObject(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function requirePositiveInteger(value, field) {
-    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
-        throw new ReleasePublicationError('invalid_input', field, `${field} must be a positive safe integer, got: ${JSON.stringify(value)}`, 'Pass an explicit monotonic value and retry the publication.');
-    }
-    return value;
-}
-function requireExpiresAt(value) {
-    if (typeof value !== 'string' || !RFC3339_UTC_PATTERN.test(value) || Number.isNaN(Date.parse(value))) {
-        throw new ReleasePublicationError('invalid_input', 'expiresAt', `expiresAt must be an RFC3339 UTC timestamp ending in Z, got: ${JSON.stringify(value)}`, 'Pass an explicit expiry (for example 2026-12-01T00:00:00Z); implicit defaults would break reproducible re-publication.');
-    }
-    if (Date.parse(value) <= Date.now()) {
-        throw new ReleasePublicationError('expires_not_future', 'expiresAt', `expiresAt must be in the future, got: ${value}`, 'Publish with an expiry ahead of the release window; clients refuse expired metadata.');
-    }
-    return value;
-}
-function requireSigner(signingKeyPem) {
-    if (typeof signingKeyPem !== 'string' || signingKeyPem.trim().length === 0) {
-        throw new ReleasePublicationError('signing_key_invalid', 'signingKeyPem', 'The release signing key is empty.', 'Provide the ed25519 private key PEM (CI secret) that matches the pinned trust root.');
-    }
-    let privateKey;
-    try {
-        privateKey = createPrivateKey(signingKeyPem);
-    }
-    catch (error) {
-        throw new ReleasePublicationError('signing_key_invalid', 'signingKeyPem', `The release signing key is not a parseable private key: ${error instanceof Error ? error.message : String(error)}`, 'Provide a PEM-encoded ed25519 private key.');
-    }
-    if (privateKey.asymmetricKeyType !== 'ed25519') {
-        throw new ReleasePublicationError('signing_key_invalid', 'signingKeyPem', `The release signing key must be an ed25519 key, got: ${String(privateKey.asymmetricKeyType)}`, 'Generate an ed25519 key for the release trust material.');
-    }
-    const publicKeyPem = createPublicKey(privateKey).export({ type: 'spki', format: 'pem' }).toString();
-    // Deterministic key id derived from the public key material, so the same
-    // key always produces the same root.json bytes (reproducibility).
-    const keyId = createHash('sha256').update(publicKeyPem).digest('hex');
-    return { keyId, privateKey };
-}
-function signedTufMetadata(signed, signer) {
-    const metadata = new Metadata(signed);
-    metadata.sign((data) => new Signature({ keyID: signer.keyId, sig: cryptoSign(null, data, signer.privateKey).toString('hex') }), false);
-    return Buffer.from(JSON.stringify(metadata.toJSON()), 'utf8');
-}
-function deterministicJsonBytes(value) {
-    return Buffer.from(`${JSON.stringify(value, null, 2)}\n`, 'utf8');
-}
-function sha256Hex(bytes) {
-    return createHash('sha256').update(bytes).digest('hex');
-}
-function withFileDigests(files) {
-    return files.map((file) => ({ path: file.path, sha256: sha256Hex(file.bytes), sizeBytes: file.bytes.length }));
-}
-/**
- * Gzip wrapper for a built release archive. Node's zlib emits a deterministic
- * gzip header (no embedded mtime or file name), so the same archive bytes
- * always produce the same published artifact bytes — the CLI `gzip` would not
- * (it stores name + mtime in the header).
- */
-export function gzipReleaseArchive(archiveBytes) {
-    return gzipSync(archiveBytes);
-}
-/**
- * Parses a `sha256sum`-style digest file (`<hex>` or `<hex>  <name>`) into
- * the lowercase hex digest, failing loud on anything else.
- */
-export function parseSha256DigestFile(content) {
-    const firstToken = content.trim().split(/\s+/, 1)[0] ?? '';
-    if (!/^[a-f0-9]{64}$/i.test(firstToken)) {
-        throw new ReleasePublicationError('invalid_input', 'digestFile', `The release archive digest file does not contain a sha256 hex digest: ${JSON.stringify(firstToken.slice(0, 72))}`, 'Regenerate the release asset so its .sha256 sidecar exists, then retry.');
-    }
-    return firstToken.toLowerCase();
-}
-/**
- * True when the input is a syntactically valid RFC3339 UTC timestamp
- * (`...Z`). Exported for CLI argument validation before any IO happens.
- */
-export function isRfc3339UtcTimestamp(value) {
-    return typeof value === 'string' && RFC3339_UTC_PATTERN.test(value) && !Number.isNaN(Date.parse(value));
-}
-function resolvePreviousState(input, channelPayload) {
-    const { previous } = input;
-    if (previous === undefined || previous === null) {
-        return { previousChannel: null, versions: { root: 1, timestamp: 1, snapshot: 1, targets: 1 } };
-    }
-    if (previous.channelPayload !== undefined && previous.channelPayload !== null) {
-        if (!isPlainObject(previous.channelPayload)) {
-            throw new ReleasePublicationError('invalid_input', 'previous.channelPayload', 'The previously published channel payload is not a JSON object.', 'Inspect the published metadata repository; a corrupt pointer must be repaired before publishing.');
-        }
-        // A published pointer without its TUF versions would let this publication
-        // emit metadata versions the published repository already superseded —
-        // a rollback clients must reject. Require the full previous state.
-        const versions = previous.tufVersions;
-        if (versions === undefined || versions.root === undefined || versions.timestamp === undefined
-            || versions.snapshot === undefined || versions.targets === undefined) {
-            throw new ReleasePublicationError('invalid_input', 'previous.tufVersions', 'Publishing over an existing metadata repository requires the published TUF metadata versions (root/timestamp/snapshot/targets).', 'Read the versions from the currently published repository and pass them as the previous state.');
-        }
-        // Strict parse: a corrupt previous pointer fails the publication instead
-        // of being silently treated as absent (rc-3).
-        const previousChannel = parseChannelMetadata(previous.channelPayload);
-        if (previousChannel.channel !== input.channel) {
-            throw new ReleasePublicationError('invalid_input', 'previous.channelPayload', `The previously published pointer is for channel "${previousChannel.channel}", not "${input.channel}".`, 'Read the previous state of the channel being published.');
-        }
-        const sameRelease = previousChannel.releaseId === channelPayload.releaseId;
-        if (sameRelease) {
-            // Re-publishing one release is only legitimate as an exact no-op: any
-            // content change (sequence, pointer version, expiry) would mutate an
-            // immutable release identity. Equality is checked on the canonical
-            // channel payload so formatting cannot fake or break it.
-            if (canonicalJson(previous.channelPayload) !== canonicalJson(channelPayload)) {
-                throw new ReleasePublicationError('publication_conflict', 'releaseId', `Release ${channelPayload.releaseId.slice(0, 12)} is already published with different pointer content (publicationSequence ${previousChannel.publicationSequence} vs ${channelPayload.publicationSequence}, pointer version ${previousChannel.version} vs ${channelPayload.version}).`, 'Re-publish with the identical inputs that produced the published release, or publish a NEW release with a strictly higher publication sequence.');
-            }
-        }
-        else {
-            if (channelPayload.publicationSequence <= previousChannel.publicationSequence) {
-                throw new ReleasePublicationError('publication_not_monotonic', 'publicationSequence', `The new publicationSequence (${channelPayload.publicationSequence}) must be strictly greater than the published one (${previousChannel.publicationSequence}).`, 'Advance the publication sequence; the channel pointer must never move backwards.');
-            }
-            if (channelPayload.version <= previousChannel.version) {
-                throw new ReleasePublicationError('publication_not_monotonic', 'channelVersion', `The new channel pointer version (${channelPayload.version}) must be strictly greater than the published one (${previousChannel.version}).`, 'Advance the channel pointer version; signed pointer versions must never repeat or regress.');
-            }
-        }
-        return {
-            previousChannel,
-            versions: {
-                root: versions.root,
-                // An identical re-publish keeps the SAME TUF metadata versions (the
-                // emitted bytes must stay identical); an advance bumps every
-                // non-root role so clients see fresh metadata.
-                timestamp: sameRelease ? versions.timestamp : versions.timestamp + 1,
-                snapshot: sameRelease ? versions.snapshot : versions.snapshot + 1,
-                targets: sameRelease ? versions.targets : versions.targets + 1,
-            },
-        };
-    }
-    const versions = previous.tufVersions ?? {};
-    return {
-        previousChannel: null,
-        versions: { root: versions.root ?? 1, timestamp: (versions.timestamp ?? 0) + 1, snapshot: (versions.snapshot ?? 0) + 1, targets: (versions.targets ?? 0) + 1 },
-    };
-}
-/**
- * PRI-854: the content-addressed asset file name shared by the metadata url
- * stamping and the upload manifest (single naming truth — review P3).
- */
-export function contentAddressedAssetName(input) {
-    return `release-asset-${input.platform}-${input.arch}-abi${input.nodeAbi}-${input.digestHex.slice(0, 12)}.tar.gz`;
-}
-/**
- * Builds the complete signed release publication. Pure: no filesystem or
- * network IO — callers (the publish script / CI) own byte transport.
- */
-export function buildReleasePublication(input) {
-    if (!isReleaseChannelName(input.channel)) {
-        throw new ReleasePublicationError('invalid_input', 'channel', `channel must be "stable" or "candidate", got: ${JSON.stringify(input.channel)}`, 'Publish to a configured release channel.');
-    }
-    requirePositiveInteger(input.channelVersion, 'channelVersion');
-    requirePositiveInteger(input.publicationSequence, 'publicationSequence');
-    requireExpiresAt(input.expiresAt);
-    if (!Array.isArray(input.archives) || input.archives.length === 0) {
-        throw new ReleasePublicationError('invalid_input', 'archives', 'The release publication must declare at least one platform archive.', 'Build the self-contained release asset first; nothing is published without the artifact bytes.');
-    }
-    const PLATFORM_ARCH_PATTERN = /^[a-z0-9-]+$/;
-    const sortedArchives = [...input.archives].sort((a, b) => {
-        const keyA = `${a.platform}/${a.arch}/abi${a.nodeAbi}`;
-        const keyB = `${b.platform}/${b.arch}/abi${b.nodeAbi}`;
-        return keyA < keyB ? -1 : keyA > keyB ? 1 : 0;
-    });
-    // PRI-852 review fix: the duplicate key is the FULL asset identity —
-    // platform + arch + Node ABI. Two runtimes on one platform are DISTINCT
-    // assets with distinct target paths; only a true triple collision
-    // (same platform/arch/ABI twice) is a publication error.
-    const seenAssetTargets = new Set();
-    for (const [index, archive] of sortedArchives.entries()) {
-        for (const [field, value] of [['platform', archive.platform], ['arch', archive.arch]]) {
-            if (typeof value !== 'string' || value.length === 0 || !PLATFORM_ARCH_PATTERN.test(value)) {
-                throw new ReleasePublicationError('invalid_input', `archives[${index}].${field}`, `archives[${index}].${field} must be a non-empty lowercase identifier, got: ${JSON.stringify(value)}`, 'Pass the platform/arch triple the CI matrix job built the archive for.');
-            }
-        }
-        if (typeof archive.nodeAbi !== 'string' || !/^\d+$/.test(archive.nodeAbi)) {
-            throw new ReleasePublicationError('invalid_input', `archives[${index}].nodeAbi`, `archives[${index}].nodeAbi must be a numeric Node ABI string (e.g. "137"), got: ${JSON.stringify(archive.nodeAbi)}`, 'Pass the Node ABI the archive was built against.');
-        }
-        if (!Buffer.isBuffer(archive.bytes) || archive.bytes.length === 0) {
-            throw new ReleasePublicationError('invalid_input', `archives[${index}].bytes`, 'The release archive is empty or missing.', 'Build the self-contained release asset first; nothing is published without the artifact bytes.');
-        }
-        const assetTarget = `${archive.platform}/${archive.arch}/abi${archive.nodeAbi}`;
-        if (seenAssetTargets.has(assetTarget)) {
-            throw new ReleasePublicationError('invalid_input', `archives[${index}]`, `Duplicate asset identity: ${assetTarget} — two archives claim the same platform, architecture and Node ABI.`, 'Pass exactly one archive per platform/arch/ABI triple; different runtimes must publish their own ABI-qualified assets.');
-        }
-        seenAssetTargets.add(assetTarget);
-    }
-    const signer = requireSigner(input.signingKeyPem);
-    // Artifact bytes are finalized FIRST: the release metadata binds their
-    // digests, the channel binds the metadata digest. By construction the
-    // emitted channel pointer can never reference an artifact that is not part
-    // of the same publication.
-    const artifacts = sortedArchives.map((archive) => ({
-        platform: archive.platform,
-        arch: archive.arch,
-        nodeAbi: archive.nodeAbi,
-        bytes: archive.bytes,
-        sha256: sha256Hex(archive.bytes),
-        ...(archive.url !== undefined ? { url: archive.url } : {}),
-    }));
-    const releaseMetadata = buildReleaseMetadata({
-        productVersion: input.productVersion,
-        sourceCommit: input.sourceCommit,
-        minBootstrapVersion: input.minBootstrapVersion,
-        publicationSequence: input.publicationSequence,
-        expiresAt: input.expiresAt,
-        assets: artifacts.map((artifact) => ({
-            platform: artifact.platform,
-            arch: artifact.arch,
-            nodeAbi: artifact.nodeAbi,
-            archiveSha256: artifact.sha256,
-            archiveSizeBytes: artifact.bytes.length,
-            ...(artifact.url !== undefined ? { url: artifact.url } : {}),
-        })),
-        dataSchemaForwardReadableFrom: input.dataSchemaForwardReadableFrom,
-    });
-    const channelPayload = {
-        schemaVersion: 1,
-        channel: input.channel,
-        version: input.channelVersion,
-        expiresAt: input.expiresAt,
-        releaseMetadataDigest: releaseMetadata.metadataDigest,
-        releaseId: releaseMetadata.releaseId,
-        productVersion: releaseMetadata.productVersion,
-        publicationSequence: releaseMetadata.publicationSequence,
-    };
-    // Consume-side strict re-validation: if the publisher ever produces a
-    // document the ReleaseManager would refuse, refuse here instead.
-    parseChannelMetadata(channelPayload);
-    const { versions } = resolvePreviousState(input, channelPayload);
-    const channelTargetPath = `channels/${input.channel}.json`;
-    const metadataTargetPath = `releases/${releaseMetadata.releaseId}/metadata.json`;
-    const channelPayloadBytes = deterministicJsonBytes(channelPayload);
-    const releaseMetadataBytes = deterministicJsonBytes(releaseMetadata);
-    const artifactTargets = {};
-    const artifactFiles = [];
-    const manifestArtifacts = artifacts.map((artifact) => {
-        // PRI-854 (option A): when the archive carries a delivery url, the bytes
-        // are served from that location (GitHub Release attachment) and are NOT
-        // written into the metadata repository — only their signed digest travels
-        // with the metadata. artifactTargetPath stays the conventional relative
-        // path shape in BOTH modes (single semantic, review P2); the actual byte
-        // carrier is artifactUrl when present. Without a url, the legacy in-repo
-        // target is used.
-        const conventionalPath = `releases/${releaseMetadata.releaseId}/release-asset-${artifact.platform}-${artifact.arch}-abi${artifact.nodeAbi}.tar.gz`;
-        if (artifact.url !== undefined) {
-            return {
-                platform: artifact.platform,
-                arch: artifact.arch,
-                nodeAbi: artifact.nodeAbi,
-                artifactSha256: artifact.sha256,
-                artifactSizeBytes: artifact.bytes.length,
-                artifactTargetPath: conventionalPath,
-                artifactUrl: artifact.url,
-            };
-        }
-        artifactTargets[conventionalPath] = new TargetFile({
-            path: conventionalPath,
-            length: artifact.bytes.length,
-            hashes: { sha256: artifact.sha256 },
-            unrecognizedFields: {
-                custom: { releaseId: releaseMetadata.releaseId, channel: input.channel, platform: artifact.platform },
-            },
-        });
-        artifactFiles.push({ path: `targets/${conventionalPath}`, bytes: artifact.bytes });
-        return {
-            platform: artifact.platform,
-            arch: artifact.arch,
-            nodeAbi: artifact.nodeAbi,
-            artifactSha256: artifact.sha256,
-            artifactSizeBytes: artifact.bytes.length,
-            artifactTargetPath: conventionalPath,
-        };
-    });
-    const targets = new Targets({
-        version: versions.targets,
-        specVersion: RELEASE_PUBLICATION_TUF_SPEC_VERSION,
-        expires: input.expiresAt,
-        targets: {
-            [channelTargetPath]: new TargetFile({
-                path: channelTargetPath,
-                length: channelPayloadBytes.length,
-                hashes: { sha256: sha256Hex(channelPayloadBytes) },
-                unrecognizedFields: {
-                    custom: { releaseId: releaseMetadata.releaseId, channel: input.channel, platform: 'metadata' },
-                },
-            }),
-            [metadataTargetPath]: new TargetFile({
-                path: metadataTargetPath,
-                length: releaseMetadataBytes.length,
-                hashes: { sha256: sha256Hex(releaseMetadataBytes) },
-                unrecognizedFields: {
-                    custom: { releaseId: releaseMetadata.releaseId, channel: input.channel, platform: 'metadata' },
-                },
-            }),
-            ...artifactTargets,
-        },
-    });
-    const root = new Root({
-        version: versions.root,
-        specVersion: RELEASE_PUBLICATION_TUF_SPEC_VERSION,
-        expires: input.expiresAt,
-        consistentSnapshot: false,
-    });
-    const signingKey = new Key({
-        keyID: signer.keyId,
-        keyType: 'ed25519',
-        scheme: 'ed25519',
-        keyVal: { public: createPublicKey(signer.privateKey).export({ type: 'spki', format: 'pem' }).toString() },
-    });
-    for (const role of ['root', 'timestamp', 'snapshot', 'targets'])
-        root.addKey(signingKey, role);
-    const files = [
-        { path: 'root.json', bytes: signedTufMetadata(root, signer) },
-        { path: 'timestamp.json', bytes: signedTufMetadata(new Timestamp({
-                version: versions.timestamp,
-                specVersion: RELEASE_PUBLICATION_TUF_SPEC_VERSION,
-                expires: input.expiresAt,
-                snapshotMeta: new MetaFile({ version: versions.snapshot }),
-            }), signer) },
-        { path: 'snapshot.json', bytes: signedTufMetadata(new Snapshot({
-                version: versions.snapshot,
-                specVersion: RELEASE_PUBLICATION_TUF_SPEC_VERSION,
-                expires: input.expiresAt,
-                meta: { 'targets.json': new MetaFile({ version: versions.targets }) },
-            }), signer) },
-        { path: 'targets.json', bytes: signedTufMetadata(targets, signer) },
-        { path: `targets/${channelTargetPath}`, bytes: channelPayloadBytes },
-        { path: `targets/${metadataTargetPath}`, bytes: releaseMetadataBytes },
-        ...artifactFiles,
-    ];
-    const manifest = {
-        releaseId: releaseMetadata.releaseId,
-        productVersion: releaseMetadata.productVersion,
-        channel: input.channel,
-        artifacts: manifestArtifacts,
-        sourceCommit: input.sourceCommit,
-        keyId: signer.keyId,
-        signingScheme: 'ed25519',
-        publicationSequence: input.publicationSequence,
-        channelVersion: input.channelVersion,
-        expiresAt: input.expiresAt,
-        files: withFileDigests(files),
-    };
-    // PRI-854 (option A): archives with a delivery url are uploaded to the
-    // release host by the workflow — the publisher hands the exact gzipped
-    // bytes back under their content-addressed names.
-    const assetUploads = artifacts
-        .filter((artifact) => artifact.url !== undefined)
-        .map((artifact) => ({
-        name: contentAddressedAssetName({ platform: artifact.platform, arch: artifact.arch, nodeAbi: artifact.nodeAbi, digestHex: artifact.sha256 }),
-        bytes: artifact.bytes,
-    }));
-    return { manifest, releaseMetadata, channelPayload, files, assetUploads };
-}
-/** Ephemeral ed25519 key PEM for dry-run pipelines without configured trust material. */
-export function generateEphemeralSigningKeyPem() {
-    return generateKeyPairSync('ed25519')
-        .privateKey
-        .export({ type: 'pkcs8', format: 'pem' })
-        .toString();
-}
-/**
- * PRI-732 publish-side guard: a REAL publication must be verifiable by the
- * pinned trust root installs actually carry. The current publisher signs
- * root, timestamp, snapshot AND targets with the single signing key and emits
- * one signature per role, so the key must be authorized for ALL FOUR roles
- * under the current threshold-1 publishing contract — a key that can merely
- * sign root would produce timestamp/snapshot/targets metadata no existing
- * install can verify.
- * (Dry-run/ephemeral pipelines simply do not call this.)
- */
-export function verifySigningKeyMatchesPinnedRoot(signingKeyPem, pinnedRootJson) {
-    const signer = requireSigner(signingKeyPem);
-    const requiredRoles = ['root', 'timestamp', 'snapshot', 'targets'];
-    const missingRoleError = (roleName) => new ReleasePublicationError('signing_key_invalid', 'pinnedTrustRoot', `The pinned trust root carries no ${roleName} role — the publisher cannot produce ${roleName} metadata any pinned install can verify.`, 'Repair packages/create-principles-disciple/trust/root.json (re-run the trust root ceremony only as an explicit governance decision).');
-    // @tufjs/metadata refuses to deserialize a root that lacks any required
-    // top-level role, which would mask the precise diagnosis behind a generic
-    // parse refusal. Pre-scan the raw document so a missing role is reported
-    // as itself; everything else still goes through the full parse below.
-    const rawSignedRoles = (() => {
-        try {
-            const { signed } = JSON.parse(pinnedRootJson);
-            if (signed === null || typeof signed !== 'object' || !Object.hasOwn(signed, 'roles'))
-                return undefined;
-            const { roles } = signed;
-            return roles !== null && typeof roles === 'object' ? roles : undefined;
-        }
-        catch {
-            return undefined; // malformed JSON — the canonical parse error surfaces below
-        }
-    })();
-    if (rawSignedRoles !== undefined) {
-        for (const roleName of requiredRoles) {
-            if (!Object.hasOwn(rawSignedRoles, roleName))
-                throw missingRoleError(roleName);
-        }
-    }
-    let pinnedRoot;
-    try {
-        pinnedRoot = (Metadata.fromJSON(MetadataKind.Root, JSON.parse(pinnedRootJson))).signed;
-    }
-    catch {
-        throw new ReleasePublicationError('signing_key_invalid', 'pinnedTrustRoot', 'The pinned trust root is not a parseable TUF Root document.', 'Repair packages/create-principles-disciple/trust/root.json (re-run the trust root ceremony only as an explicit governance decision).');
-    }
-    for (const roleName of requiredRoles) {
-        const role = pinnedRoot.roles[roleName];
-        if (role === undefined)
-            throw missingRoleError(roleName);
-        if (role.threshold !== 1) {
-            throw new ReleasePublicationError('signing_key_invalid', 'pinnedTrustRoot', `The pinned trust root ${roleName} role has threshold ${role.threshold}; the current publisher emits a single signature per role and can only satisfy the threshold-1 publishing contract.`, 'Repair packages/create-principles-disciple/trust/root.json (re-run the trust root ceremony only as an explicit governance decision).');
-        }
-        if (!role.keyIDs.includes(signer.keyId)) {
-            throw new ReleasePublicationError('signing_key_invalid', 'signingKeyPem', `The signing key (${signer.keyId.slice(0, 16)}…) is not authorized for the pinned trust root ${roleName} role (authorized: ${role.keyIDs.map((keyId) => keyId.slice(0, 16)).join(', ')}…). The single publisher key must be authorized for root, timestamp, snapshot and targets alike.`, 'Set PD_RELEASE_SIGNING_KEY to the private key matching the pinned trust root (packages/create-principles-disciple/trust/root.json).');
-        }
-    }
-    const rootRole = pinnedRoot.roles.root;
-    if (rootRole === undefined)
-        throw missingRoleError('root'); // rc-3: fail loud (defensive; the loop above already enforces this for every required role)
-    return { keyId: signer.keyId, pinnedRootKeyIds: rootRole.keyIDs };
-}
-//# sourceMappingURL=release-metadata-publisher.js.map

package/release-manager/dist/update/release-metadata-publisher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"release-metadata-publisher.js","sourceRoot":"","sources":["../../src/update/release-metadata-publisher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AACrH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACL,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,UAAU,EACV,OAAO,EACP,SAAS,GACV,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAwB,MAAM,uBAAuB,CAAC;AACnF,OAAO,EACL,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,MAAM,CAAC,MAAM,oCAAoC,GAAG,QAAQ,CAAC;AAS7D,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAA8B;IAClC,KAAK,CAAS;IACd,UAAU,CAAS;IAE5B,gNAAgN;IAChN,YAAY,IAAiC,EAAE,KAAa,EAAE,OAAe,EAAE,UAAkB;QAC/F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAmHD,MAAM,mBAAmB,GAAG,gDAAgD,CAAC;AAE7E,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,KAAK,EACL,GAAG,KAAK,0CAA0C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EACzE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,WAAW,EACX,gEAAgE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EACvF,wHAAwH,CACzH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,WAAW,EACX,yCAAyC,KAAK,EAAE,EAChD,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,aAAqB;IAC1C,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,eAAe,EACf,mCAAmC,EACnC,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,UAA+C,CAAC;IACpD,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,eAAe,EACf,2DAA2D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACnH,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,eAAe,EACf,wDAAwD,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,EAC9F,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpG,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CAAkD,MAAS,EAAE,MAAqB;IAC1G,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,CACX,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAChH,KAAK,CACN,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,KAAiC;IACxD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACjH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACrD,OAAO,QAAQ,CAAC,YAAY,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,YAAY,EACZ,yEAAyE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAClH,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1G,CAAC;AAOD,SAAS,oBAAoB,CAAC,KAA8B,EAAE,cAA+B;IAC3F,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAC9E,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yBAAyB,EACzB,gEAAgE,EAChE,kGAAkG,CACnG,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;eACxF,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,sBAAsB,EACtB,iIAAiI,EACjI,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,eAAe,GAAG,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,eAAe,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yBAAyB,EACzB,oDAAoD,eAAe,CAAC,OAAO,WAAW,KAAK,CAAC,OAAO,IAAI,EACvG,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,KAAK,cAAc,CAAC,SAAS,CAAC;QAC3E,IAAI,WAAW,EAAE,CAAC;YAChB,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,yDAAyD;YACzD,IAAI,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,EACtB,WAAW,EACX,WAAW,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,6EAA6E,eAAe,CAAC,mBAAmB,OAAO,cAAc,CAAC,mBAAmB,qBAAqB,eAAe,CAAC,OAAO,OAAO,cAAc,CAAC,OAAO,IAAI,EACtR,iJAAiJ,CAClJ,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,cAAc,CAAC,mBAAmB,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC;gBAC9E,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,EAC3B,qBAAqB,EACrB,gCAAgC,cAAc,CAAC,mBAAmB,sDAAsD,eAAe,CAAC,mBAAmB,IAAI,EAC/J,kFAAkF,CACnF,CAAC;YACJ,CAAC;YACD,IAAI,cAAc,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;gBACtD,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,EAC3B,gBAAgB,EAChB,oCAAoC,cAAc,CAAC,OAAO,sDAAsD,eAAe,CAAC,OAAO,IAAI,EAC3I,4FAA4F,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,eAAe;YACf,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,oEAAoE;gBACpE,6DAA6D;gBAC7D,+CAA+C;gBAC/C,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC;gBACpE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC;gBACjE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC;aAC/D;SACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;IAC5C,OAAO;QACL,eAAe,EAAE,IAAI;QACrB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE;KAC/J,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAKzC;IACC,OAAO,iBAAiB,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC;AACpH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA8B;IACpE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,SAAS,EACT,iDAAiD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAChF,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,sBAAsB,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC/D,sBAAsB,CAAC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IACzE,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,UAAU,EACV,qEAAqE,EACrE,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,GAAG,cAAc,CAAC;IAC7C,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,qEAAqE;IACrE,wEAAwE;IACxE,kEAAkE;IAClE,yDAAyD;IACzD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAU,EAAE,CAAC;YAC/F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1F,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,YAAY,KAAK,KAAK,KAAK,EAAE,EAC7B,YAAY,KAAK,KAAK,KAAK,mDAAmD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EACrG,wEAAwE,CACzE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,YAAY,KAAK,WAAW,EAC5B,YAAY,KAAK,kEAAkE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EACpH,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,YAAY,KAAK,SAAS,EAC1B,0CAA0C,EAC1C,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAChF,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,YAAY,KAAK,GAAG,EACpB,6BAA6B,WAAW,qEAAqE,EAC7G,wHAAwH,CACzH,CAAC;QACJ,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAElD,uEAAuE;IACvE,sEAAsE;IACtE,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;QAChC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,oBAAoB,CAAC;QAC3C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;YACvC,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QACH,6BAA6B,EAAE,KAAK,CAAC,6BAA6B;KACnE,CAAC,CAAC;IAEH,MAAM,cAAc,GAAoB;QACtC,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,cAAc;QAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,qBAAqB,EAAE,eAAe,CAAC,cAAc;QACrD,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;KACzD,CAAC;IACF,sEAAsE;IACtE,iEAAiE;IACjE,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAErC,MAAM,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAEjE,MAAM,iBAAiB,GAAG,YAAY,KAAK,CAAC,OAAO,OAAO,CAAC;IAC3D,MAAM,kBAAkB,GAAG,YAAY,eAAe,CAAC,SAAS,gBAAgB,CAAC;IACjF,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;IAErE,MAAM,eAAe,GAA+B,EAAE,CAAC;IACvD,MAAM,aAAa,GAAsB,EAAE,CAAC;IAC5C,MAAM,iBAAiB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACnD,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,kBAAkB;QAClB,MAAM,gBAAgB,GAAG,YAAY,eAAe,CAAC,SAAS,kBAAkB,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,OAAO,SAAS,CAAC;QACnJ,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,cAAc,EAAE,QAAQ,CAAC,MAAM;gBAC/B,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;gBACxC,kBAAkB,EAAE,gBAAgB;gBACpC,WAAW,EAAE,QAAQ,CAAC,GAAG;aAC1B,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,gBAAgB,CAAC,GAAG,IAAI,UAAU,CAAC;YACjD,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;YAC7B,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;YACnC,kBAAkB,EAAE;gBAClB,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;aACtG;SACF,CAAC,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,cAAc,EAAE,QAAQ,CAAC,MAAM;YAC/B,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;YACxC,kBAAkB,EAAE,gBAAgB;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,KAAK,CAAC,SAAS;QACxB,OAAO,EAAE;YACP,CAAC,iBAAiB,CAAC,EAAE,IAAI,UAAU,CAAC;gBAClC,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,mBAAmB,CAAC,MAAM;gBAClC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,mBAAmB,CAAC,EAAE;gBAClD,kBAAkB,EAAE;oBAClB,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE;iBAC/F;aACF,CAAC;YACF,CAAC,kBAAkB,CAAC,EAAE,IAAI,UAAU,CAAC;gBACnC,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,oBAAoB,CAAC,MAAM;gBACnC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,oBAAoB,CAAC,EAAE;gBACnD,kBAAkB,EAAE;oBAClB,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE;iBAC/F;aACF,CAAC;YACF,GAAG,eAAe;SACnB;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,KAAK,CAAC,SAAS;QACxB,kBAAkB,EAAE,KAAK;KAC1B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE;KAC1G,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE/F,MAAM,KAAK,GAAsB;QAC/B,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;QAC7D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,SAAS,CAAC;gBAC/D,OAAO,EAAE,QAAQ,CAAC,SAAS;gBAC3B,WAAW,EAAE,oCAAoC;gBACjD,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,YAAY,EAAE,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;aAC3D,CAAC,EAAE,MAAM,CAAC,EAAE;QACb,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,QAAQ,CAAC;gBAC7D,OAAO,EAAE,QAAQ,CAAC,QAAQ;gBAC1B,WAAW,EAAE,oCAAoC;gBACjD,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE;aACtE,CAAC,EAAE,MAAM,CAAC,EAAE;QACb,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE;QACnE,EAAE,IAAI,EAAE,WAAW,iBAAiB,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE;QACpE,EAAE,IAAI,EAAE,WAAW,kBAAkB,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;QACtE,GAAG,aAAa;KACjB,CAAC;IAEF,MAAM,QAAQ,GAA+B;QAC3C,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,iBAAiB;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,SAAS;QACxB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,uEAAuE;IACvE,kDAAkD;IAClD,MAAM,YAAY,GAAG,SAAS;SAC3B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC;SAChD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClB,IAAI,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5I,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC,CAAC;IAEN,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AAC5E,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,8BAA8B;IAC5C,OAAO,mBAAmB,CAAC,SAAS,CAAC;SAClC,UAAU;SACV,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACxC,QAAQ,EAAE,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,aAAqB,EACrB,cAAsB;IAEtB,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAU,CAAC;IAC5E,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAA2B,EAAE,CACrE,IAAI,uBAAuB,CACzB,qBAAqB,EACrB,iBAAiB,EACjB,oCAAoC,QAAQ,wCAAwC,QAAQ,0CAA0C,EACtI,sIAAsI,CACvI,CAAC;IACJ,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,EAAC,MAAM,EAAC,GAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAA0B,CAAC;YACtE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC;YACvG,MAAM,EAAC,KAAK,EAAC,GAAI,MAA8B,CAAC;YAChD,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,CAAC,4DAA4D;QAChF,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC;gBAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,IAAI,UAAgB,CAAC;IACrB,IAAI,CAAC;QACH,UAAU,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,iBAAiB,EACjB,6DAA6D,EAC7D,sIAAsI,CACvI,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,QAAQ,uBAAuB,IAAI,CAAC,SAAS,qHAAqH,EAC3L,sIAAsI,CACvI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,eAAe,EACf,oBAAoB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kDAAkD,QAAQ,sBAAsB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kGAAkG,EACxR,qIAAqI,CACtI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,4FAA4F;IACxJ,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AACpE,CAAC"}

package/release-manager/dist/update/release-metadata-source.d.ts

@@ -1,85 +0,0 @@
-/**
- * Release metadata source contract (PRI-709 P0-1).
- *
- * PRI-698 Phase 0 Audit finding F-4: `PD_RELEASE_METADATA_URL` had no supply
- * side anywhere in the repository — every consumer read the process env
- * directly, so a ReleaseManager install could only ever become ready inside
- * the single shell that exported the variable. There was no durable,
- * installer-owned answer to "where does signed release metadata come from?".
- *
- * This module is that answer. It is a READ-SIDE contract only: it resolves
- * the base URL of the signed release metadata repository and refuses to guess
- * one. It does not publish, sign, mirror or cache metadata (scope boundary —
- * the publishing pipeline is out of scope for PRI-709).
- *
- * Resolution order (highest precedence first):
- *
- *   1. `explicit`        — caller-supplied override. The Console passes the
- *                          operator's process-level env value here, so an
- *                          operator override always wins over install state.
- *   2. `env`             — `PD_RELEASE_METADATA_URL` read by this module.
- *   3. `install_config`  — `~/.pd/install.json` → `releaseMetadataUrl`,
- *                          written by the installer at install time. This is
- *                          the durable tier: it survives new shells, new
- *                          processes and Console restarts.
- *   4. `unconfigured`    — no source exists. `metadataBaseUrl` is `undefined`
- *                          and the caller's fallback semantics are UNCHANGED
- *                          (ADR-0024 §2.4 — refusal with a stable reason, never
- *                          a guessed endpoint).
- *
- * `invalid` short-circuits: a candidate source that exists but is not a usable
- * http(s) base URL is reported, never silently skipped in favour of a lower
- * tier. An operator who misconfigures the override must see the
- * misconfiguration, not a surprising fallback to install state.
- *
- * This module deliberately imports nothing from `install-layout.js`: callers
- * pass the already-read install config in. That keeps the layering one-way
- * (install-layout → this module) with no cycle.
- */
-/** Operator override environment variable for the metadata repository base URL. */
-export declare const RELEASE_METADATA_URL_ENV = "PD_RELEASE_METADATA_URL";
-export type ReleaseMetadataSourceKind = 
-/** Caller-supplied override (Console passes the process-level env value). */
-'explicit'
-/** `PD_RELEASE_METADATA_URL` resolved by this module. */
- | 'env'
-/** Durable install-time source: `~/.pd/install.json` → `releaseMetadataUrl`. */
- | 'install_config'
-/** A candidate source exists but is not a usable http(s) base URL. */
- | 'invalid'
-/** No source configured; fallback semantics unchanged. */
- | 'unconfigured';
-export interface ReleaseMetadataSource {
-    readonly kind: ReleaseMetadataSourceKind;
-    /** `undefined` for `invalid` and `unconfigured` — never a guessed URL. */
-    readonly metadataBaseUrl: string | undefined;
-    /** Stable machine-readable detail for `invalid`; null otherwise. */
-    readonly detail: string | null;
-}
-export interface ResolveReleaseMetadataSourceOptions {
-    /** Caller-supplied override; empty string is treated as absent. */
-    readonly explicit?: string | undefined;
-    /** Defaults to `process.env.PD_RELEASE_METADATA_URL`. */
-    readonly env?: string | undefined;
-    /** Already-read install config; null when install state is corrupt. */
-    readonly installConfig?: {
-        readonly releaseMetadataUrl?: string;
-    } | null;
-}
-/**
- * Strict validator for a metadata repository base URL.
- *
- * Returns the trimmed URL, or `null` when the value is not a non-empty
- * `http(s)` URL. Whitespace-only input is absent, not valid — the ReleaseManager
- * must never be handed a URL it would have to repair.
- */
-export declare function normalizeReleaseMetadataUrl(raw: unknown): string | null;
-/** True when the value is a usable metadata repository base URL. */
-export declare function isReleaseMetadataUrl(raw: unknown): raw is string;
-/**
- * Resolve the release metadata source. Never throws: an unusable source is a
- * reported outcome (`invalid` / `unconfigured`), so readiness probing stays
- * side-effect free and observable.
- */
-export declare function resolveReleaseMetadataSource(options?: ResolveReleaseMetadataSourceOptions): ReleaseMetadataSource;
-//# sourceMappingURL=release-metadata-source.d.ts.map

package/release-manager/dist/update/release-metadata-source.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"release-metadata-source.d.ts","sourceRoot":"","sources":["../../src/update/release-metadata-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAElE,MAAM,MAAM,yBAAyB;AACnC,6EAA6E;AAC3E,UAAU;AACZ,yDAAyD;GACvD,KAAK;AACP,gFAAgF;GAC9E,gBAAgB;AAClB,sEAAsE;GACpE,SAAS;AACX,0DAA0D;GACxD,cAAc,CAAC;AAEnB,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,yDAAyD;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,uEAAuE;IACvE,QAAQ,CAAC,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYvE;AAED,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,mCAAwC,GAChD,qBAAqB,CA4BvB"}

package/release-manager/dist/update/release-metadata-source.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"release-metadata-source.js","sourceRoot":"","sources":["../../src/update/release-metadata-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AA+BlE;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,2BAA2B,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAO,GAAwC,EAAE;IAEjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS;QACnC,CAAC,CAAC,OAAO,CAAC,GAAG;QACb,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAE1C,MAAM,UAAU,GAA+F;QAC7G,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC3C,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE;QACzB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,kBAAkB,EAAE;KAC3E,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,IAAI;YAAE,SAAS;QACpE,IAAI,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACrF,MAAM,UAAU,GAAG,2BAA2B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,uEAAuE;YACvE,gDAAgD;YAChD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,cAAc;aACxC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7E,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5E,CAAC"}