easyeda-mcp-pro 0.35.2 → 0.35.4

package/README.md

@@ -42,8 +42,9 @@
   </a>
 </p>
 
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/oaslananka/easyeda-mcp-pro)
+
 <p>
-  <a href="https://deepwiki.com/oaslananka/easyeda-mcp-pro">Ask DeepWiki</a> ·
   <a href="docs/ROADMAP.md">Roadmap</a> ·
   <a href="docs/OPENSSF_BEST_PRACTICES.md">OpenSSF evidence</a> ·
   <a href="docs/SECURITY_ASSURANCE_CASE.md">Security assurance case</a>
@@ -110,7 +111,7 @@ For advanced configurations, manual instructions, and specific clients, see [Ins
 
 ## Overview
 
-easyeda-mcp-pro is a [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that bridges AI assistants with hardware design workflows in EasyEDA Pro. It exposes up to 60 profile-gated MCP tools for schematic inspection and editing, controlled EasyEDA Pro API calls, BOM management, design rule checks, PCB board analysis, fabrication exports, diagnostics, and supplier integration.
+easyeda-mcp-pro is a [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that bridges AI assistants with hardware design workflows in EasyEDA Pro. It exposes up to 115 profile-gated MCP tools for schematic inspection and editing, controlled EasyEDA Pro API calls, BOM management, design rule checks, PCB board analysis, fabrication exports, diagnostics, and supplier integration.
 
 The server connects to EasyEDA Pro via a WebSocket bridge extension, enabling real-time access to open project data. It integrates with JLCPCB, LCSC, Mouser, and DigiKey for BOM sourcing and pricing.
 
@@ -498,18 +499,23 @@ Enable suppliers by setting their credentials. All suppliers are disabled by def
 - **Mouser**: `MOUSER_ENABLED=true` + API key
 - **DigiKey**: `DIGIKEY_ENABLED=true` + OAuth2 client ID/secret
 
-### AI Assistance (experimental)
+### Reserved AI configuration
+
+No in-process AI provider client is currently implemented. The `AI_*` variables remain accepted for
+configuration compatibility but are reported as `reserved`, are always ineffective, and must not be
+used to infer that the server sends design data to an AI provider. Do not supply an API key.
 
-Configure an AI provider for LLM-assisted design review:
+| Variable                    | Default | Current behavior                                      |
+| --------------------------- | ------- | ----------------------------------------------------- |
+| `AI_PROVIDER`               | `none`  | Reserved; no provider client is invoked               |
+| `AI_MODEL`                  | `''`    | Reserved; no model is selected                        |
+| `AI_API_KEY`                | `''`    | Reserved; no credential consumer exists               |
+| `AI_MAX_TOKENS`             | `8000`  | Reserved compatibility setting                        |
+| `AI_TIMEOUT_MS`             | `60000` | Reserved compatibility setting                        |
+| `AI_ALLOW_DESIGN_MUTATIONS` | `false` | Reserved; cannot enable AI-originated design mutation |
 
-| Variable                    | Default | Description                                     |
-| --------------------------- | ------- | ----------------------------------------------- |
-| `AI_PROVIDER`               | `none`  | `anthropic`, `openai`, `openrouter`, or `local` |
-| `AI_MODEL`                  | `''`    | Model name (e.g., `claude-sonnet-4-20250514`)   |
-| `AI_API_KEY`                | `''`    | AI provider API key                             |
-| `AI_MAX_TOKENS`             | `8000`  | Max tokens per AI response                      |
-| `AI_TIMEOUT_MS`             | `60000` | AI request timeout in ms                        |
-| `AI_ALLOW_DESIGN_MUTATIONS` | `false` | Allow AI to modify schematic/board designs      |
+Use `easyeda_get_feature_flags` or `easyeda_get_capabilities` to inspect `configured`, `effective`,
+and `maturity` values for optional settings.
 
 ### HTTP transport
 
@@ -570,12 +576,19 @@ See `.env.example` for the complete list of configuration variables.
 
 ## MCP Tools
 
-The server currently registers up to 77 profile-gated tools. Tools are filtered by the active `TOOL_PROFILE`:
+The server registers profile-gated tools according to the active `TOOL_PROFILE`. The table below is generated from the same registry used at runtime:
+
+<!-- capability-counts:start -->
 
-- `core`: 48 tools
-- `pro`: 63 tools
-- `full`: 73 tools
-- `dev`: 77 tools
+| Profile        | Registered tools |
+| -------------- | ---------------: |
+| `core`         |               71 |
+| `pro`          |               98 |
+| `full`         |              110 |
+| `dev`          |              115 |
+| `experimental` |              115 |
+
+<!-- capability-counts:end -->
 
 `core` exposes the standard workflow tools, `pro` adds manufacturing exports, `full` adds controlled documented EasyEDA API calls, and `dev` adds runtime probes for debugging.
 
@@ -677,7 +690,7 @@ The schematic write APIs use EasyEDA Pro extension APIs that EasyEDA currently m
 │  (via Plugin)    │     Protocol      │  └───────────────┘  │
 └─────────────────┘                    │  ┌───────────────┐  │
                                        │  │  ToolRegistry  │  │
-                                       │  │ (up to 60 tools) │ │
+                                       │  │ (up to 115 tools) │ │
                                        │  └───────────────┘  │
                                        │  ┌───────────────┐  │
                                        │  │    Storage     │──┼──► SQLite
@@ -712,6 +725,8 @@ required by EasyEDA Pro.
 
 Installation: Open EasyEDA Pro → **Settings** → **Extensions** → **Extension Manager...** → **Import Extension**, then select the `.eext` file. Make sure **Allow External Interaction** is enabled for the extension.
 
+For local bridge development, an experimental loopback-only CDP transport is documented in the [CDP Bridge guide](docs/guide/cdp-bridge.md). The extension remains the recommended transport for normal use. Public delivery targets and milestone lifecycle rules are maintained in the [roadmap](docs/ROADMAP.md).
+
 ---
 
 ## Agent plugin and skills
@@ -815,7 +830,7 @@ pnpm typecheck             # TypeScript
 pnpm lint                  # ESLint
 
 # Test
-pnpm test                  # Vitest (812 tests across 67 files)
+pnpm test                  # Vitest suite
 pnpm test:coverage         # With coverage report
 
 # Golden E2E fixture smoke tests are included in `pnpm test`
@@ -868,7 +883,7 @@ src/
 │       ├── http.ts                    # HTTP/Streamable HTTP transport
 │       └── oauth-resource-metadata.ts
 ├── storage/                 # Node.js sqlite storage (cache, artifacts)
-├── tools/                   # Up to 60 profile-gated MCP tool definitions
+├── tools/                   # Up to 115 profile-gated MCP tool definitions
 │   ├── register.ts, registry.ts, types.ts, transaction.ts
 │   ├── L0_diagnostics_core.ts, L0_diagnostics_api.ts
 │   ├── L1_schematic_read.ts, L1_schematic_write.ts
@@ -906,8 +921,8 @@ See [Security Architecture & Threat Model](docs/security-architecture.md) for th
 This repository uses automated workflows to manage dependencies and releases:
 
 - **Renovate**: Automatically scans and updates dependencies based on rules configured in [.github/renovate.json](.github/renovate.json). For details on PR policies and automerging, see [Repository Governance](docs/REPOSITORY_GOVERNANCE.md).
-- **Release Please**: Automatically bumps package versions, updates files (like `package.json`, `server.json`, `extension.json`), and generates `CHANGELOG.md` upon merging Release PRs. For the full release procedure and Conventional Commit conventions, see [Release Process](docs/RELEASE_PROCESS.md).
-- **Secure Publishing**: The release workflow builds all assets (including `easyeda-bridge-extension.eext`), publishes to the NPM registry with cryptographic provenance, and uploads assets directly to the GitHub release.
+- **Release Please**: Automates stable version bumps, release metadata, and `CHANGELOG.md`. Numbered `rc.N` candidates use the isolated prerelease path. See the [Release Policy](docs/RELEASE_POLICY.md) and [Release Process](docs/RELEASE_PROCESS.md).
+- **Secure Publishing**: The release workflow rebuilds and verifies all assets, publishes npm with provenance to channel-safe `latest` or `next` dist-tags, uploads the extension and SBOM to the matching GitHub Release, and keeps GHCR/MCP Registry promotion aligned with the selected channel.
 
 ---
 

package/dist/config/feature-flags.js

@@ -1,15 +1,17 @@
+import { getFeatureMaturity } from './feature-maturity.js';
 export function loadFeatureFlags(config) {
+    const maturity = getFeatureMaturity(config);
     return {
-        mcpTasksEnabled: config.MCP_TASKS_ENABLED,
-        mcpAppsEnabled: config.MCP_APPS_ENABLED,
-        mcpV2Experimental: config.MCP_V2_EXPERIMENTAL,
+        mcpTasksEnabled: maturity.mcp_tasks.effective,
+        mcpAppsEnabled: maturity.mcp_apps.effective,
+        mcpV2Experimental: maturity.mcp_v2.effective,
         jlcpcbOrderingEnabled: config.JLCPCB_ENABLE_ORDERING,
         jlcsearchEnabled: config.JLCSEARCH_ENABLED,
         mouserEnabled: config.MOUSER_ENABLED,
         digikeyEnabled: config.DIGIKEY_ENABLED,
-        oauthEnabled: config.OAUTH_ENABLED,
-        otelEnabled: config.OTEL_ENABLED,
-        aiEnabled: config.AI_PROVIDER !== 'none',
+        oauthEnabled: maturity.oauth.effective,
+        otelEnabled: maturity.otel_export.effective,
+        aiEnabled: maturity.ai_provider.effective,
         devBridge: config.EASYEDA_DEV_BRIDGE,
         bridgeRawExecEnabled: config.BRIDGE_RAW_EXEC_ENABLED,
         rawExecExperimental: config.MCP_RAW_EXEC_EXPERIMENTAL,

package/dist/config/feature-flags.js.map

@@ -1 +1 @@
-{"version":3,"file":"feature-flags.js","sourceRoot":"","sources":["../../src/config/feature-flags.ts"],"names":[],"mappings":"AAkBA,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAChD,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,iBAAiB;QACzC,cAAc,EAAE,MAAM,CAAC,gBAAgB;QACvC,iBAAiB,EAAE,MAAM,CAAC,mBAAmB;QAC7C,qBAAqB,EAAE,MAAM,CAAC,sBAAsB;QACpD,gBAAgB,EAAE,MAAM,CAAC,iBAAiB;QAC1C,aAAa,EAAE,MAAM,CAAC,cAAc;QACpC,cAAc,EAAE,MAAM,CAAC,eAAe;QACtC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,SAAS,EAAE,MAAM,CAAC,WAAW,KAAK,MAAM;QACxC,SAAS,EAAE,MAAM,CAAC,kBAAkB;QACpC,oBAAoB,EAAE,MAAM,CAAC,uBAAuB;QACpD,mBAAmB,EAAE,MAAM,CAAC,yBAAyB;KACtD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"feature-flags.js","sourceRoot":"","sources":["../../src/config/feature-flags.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAkB3D,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO;QACL,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS;QAC7C,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS;QAC3C,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;QAC5C,qBAAqB,EAAE,MAAM,CAAC,sBAAsB;QACpD,gBAAgB,EAAE,MAAM,CAAC,iBAAiB;QAC1C,aAAa,EAAE,MAAM,CAAC,cAAc;QACpC,cAAc,EAAE,MAAM,CAAC,eAAe;QACtC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS;QACtC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,SAAS;QAC3C,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,SAAS;QACzC,SAAS,EAAE,MAAM,CAAC,kBAAkB;QACpC,oBAAoB,EAAE,MAAM,CAAC,uBAAuB;QACpD,mBAAmB,EAAE,MAAM,CAAC,yBAAyB;KACtD,CAAC;AACJ,CAAC"}

package/dist/config/feature-maturity.d.ts

@@ -0,0 +1,25 @@
+import { type EnvConfig } from './env.js';
+export type FeatureMaturity = 'implemented' | 'experimental' | 'reserved';
+export interface FeatureMaturityEntry {
+    maturity: FeatureMaturity;
+    configured: boolean;
+    effective: boolean;
+    note: string;
+}
+export interface FeatureMaturityReport {
+    mcp_tasks: FeatureMaturityEntry;
+    mcp_apps: FeatureMaturityEntry;
+    mcp_v2: FeatureMaturityEntry;
+    ai_provider: FeatureMaturityEntry;
+    otel_export: FeatureMaturityEntry;
+    remote_relay: FeatureMaturityEntry;
+    raw_execution: FeatureMaturityEntry;
+    oauth: FeatureMaturityEntry;
+    [key: string]: FeatureMaturityEntry;
+}
+/**
+ * Describe user-visible configuration independently from whether a value was set.
+ * Reserved settings remain parseable for compatibility but cannot be reported as
+ * active until a runtime implementation consumes them.
+ */
+export declare function getFeatureMaturity(config: EnvConfig): FeatureMaturityReport;

package/dist/config/feature-maturity.js

@@ -0,0 +1,60 @@
+/**
+ * Describe user-visible configuration independently from whether a value was set.
+ * Reserved settings remain parseable for compatibility but cannot be reported as
+ * active until a runtime implementation consumes them.
+ */
+export function getFeatureMaturity(config) {
+    return {
+        mcp_tasks: {
+            maturity: 'reserved',
+            configured: config.MCP_TASKS_ENABLED,
+            effective: false,
+            note: 'The setting is reserved; this server does not advertise or execute MCP Tasks.',
+        },
+        mcp_apps: {
+            maturity: 'reserved',
+            configured: config.MCP_APPS_ENABLED,
+            effective: false,
+            note: 'The setting is reserved; no MCP Apps UI/resource runtime is registered.',
+        },
+        mcp_v2: {
+            maturity: 'reserved',
+            configured: config.MCP_V2_EXPERIMENTAL,
+            effective: false,
+            note: 'The setting is reserved and does not change the negotiated MCP protocol.',
+        },
+        ai_provider: {
+            maturity: 'reserved',
+            configured: config.AI_PROVIDER !== 'none',
+            effective: false,
+            note: 'Provider/model settings are reserved; no in-process AI provider is invoked.',
+        },
+        otel_export: {
+            maturity: 'reserved',
+            configured: config.OTEL_ENABLED,
+            effective: false,
+            note: 'OTLP settings are reserved; the current observability path is local structured metrics.',
+        },
+        remote_relay: {
+            maturity: 'experimental',
+            configured: config.MCP_BRIDGE_BACKEND === 'remote_relay',
+            effective: config.MCP_BRIDGE_BACKEND === 'remote_relay',
+            note: 'The paired relay path is implemented behind explicit configuration and is not Beta.',
+        },
+        raw_execution: {
+            maturity: 'experimental',
+            configured: config.MCP_RAW_EXEC_EXPERIMENTAL || config.BRIDGE_RAW_EXEC_ENABLED,
+            effective: config.NODE_ENV !== 'production' &&
+                config.MCP_RAW_EXEC_EXPERIMENTAL &&
+                config.BRIDGE_RAW_EXEC_ENABLED,
+            note: 'Raw execution requires both development-only gates and remains quarantined.',
+        },
+        oauth: {
+            maturity: 'implemented',
+            configured: config.OAUTH_ENABLED,
+            effective: config.OAUTH_ENABLED,
+            note: 'OAuth/JWKS validation is implemented and mandatory for non-loopback HTTP.',
+        },
+    };
+}
+//# sourceMappingURL=feature-maturity.js.map

package/dist/config/feature-maturity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-maturity.js","sourceRoot":"","sources":["../../src/config/feature-maturity.ts"],"names":[],"mappings":"AAuBA;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAiB;IAClD,OAAO;QACL,SAAS,EAAE;YACT,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,+EAA+E;SACtF;QACD,QAAQ,EAAE;YACR,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM,CAAC,gBAAgB;YACnC,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,yEAAyE;SAChF;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM,CAAC,mBAAmB;YACtC,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,0EAA0E;SACjF;QACD,WAAW,EAAE;YACX,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM,CAAC,WAAW,KAAK,MAAM;YACzC,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,6EAA6E;SACpF;QACD,WAAW,EAAE;YACX,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM,CAAC,YAAY;YAC/B,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,yFAAyF;SAChG;QACD,YAAY,EAAE;YACZ,QAAQ,EAAE,cAAc;YACxB,UAAU,EAAE,MAAM,CAAC,kBAAkB,KAAK,cAAc;YACxD,SAAS,EAAE,MAAM,CAAC,kBAAkB,KAAK,cAAc;YACvD,IAAI,EAAE,qFAAqF;SAC5F;QACD,aAAa,EAAE;YACb,QAAQ,EAAE,cAAc;YACxB,UAAU,EAAE,MAAM,CAAC,yBAAyB,IAAI,MAAM,CAAC,uBAAuB;YAC9E,SAAS,EACP,MAAM,CAAC,QAAQ,KAAK,YAAY;gBAChC,MAAM,CAAC,yBAAyB;gBAChC,MAAM,CAAC,uBAAuB;YAChC,IAAI,EAAE,6EAA6E;SACpF;QACD,KAAK,EAAE;YACL,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,MAAM,CAAC,aAAa;YAChC,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,IAAI,EAAE,2EAA2E;SAClF;KACF,CAAC;AACJ,CAAC"}

package/dist/config/version.d.ts

@@ -1 +1 @@
-export declare const SERVER_VERSION = "0.35.2";
+export declare const SERVER_VERSION = "0.35.4";

package/dist/config/version.js

@@ -1,2 +1,2 @@
-export const SERVER_VERSION = '0.35.2'; // x-release-please-version
+export const SERVER_VERSION = '0.35.4'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/dist/live/schematic-transaction-smoke-report.d.ts

@@ -0,0 +1,96 @@
+export declare function sortUnknownForStableHash(value: unknown): unknown;
+export declare function extractPrimitiveId(value: unknown): string | undefined;
+export declare function primitiveDescriptorHash(snapshot: unknown): string;
+export declare function extractPrimitiveIds(value: unknown): string[];
+export interface SchematicTransactionFixtureIdentity {
+    project: string;
+    schematic: string;
+    page: string;
+    disposable: true;
+}
+export interface SchematicTransactionRuntimeIdentity {
+    projectInfo: unknown;
+    schematicInfo: unknown;
+    pageInfo: unknown;
+}
+export interface SchematicTransactionFixtureMismatch {
+    field: 'project' | 'schematic' | 'page';
+    expected: string;
+    actual?: string;
+}
+export declare function verifySchematicTransactionFixtureIdentity(expected: SchematicTransactionFixtureIdentity, runtime: SchematicTransactionRuntimeIdentity): {
+    ok: boolean;
+    actual: {
+        project?: string;
+        schematic?: string;
+        page?: string;
+    };
+    mismatches: SchematicTransactionFixtureMismatch[];
+};
+export interface SchematicTransactionStateDigest {
+    primitiveInventoryHash: string;
+    componentHash: string;
+    netHash: string;
+    ercAvailable: boolean;
+    ercHash?: string;
+}
+export interface SchematicTransactionOutcome {
+    passed: boolean;
+    rolledBack: boolean;
+    stateRestored: boolean;
+    details?: Record<string, unknown>;
+}
+export interface SchematicTransactionSmokeInput {
+    generatedAt?: string;
+    environment: {
+        operatingSystem: string;
+        architecture: string;
+        nodeVersion: string;
+    };
+    fixture: SchematicTransactionFixtureIdentity;
+    bridge: {
+        easyedaVersion?: string;
+        bridgeVersion?: string;
+        dispatcherBuildId?: string;
+        methodRegistryHash?: string;
+        activePort?: number;
+    };
+    outcomes: {
+        createRollback: SchematicTransactionOutcome;
+        modifyRollback: SchematicTransactionOutcome;
+        deleteRollback: SchematicTransactionOutcome;
+    };
+    cleanup: {
+        remainingIds: string[];
+        errors: string[];
+    };
+    baseline: SchematicTransactionStateDigest;
+    finalState: SchematicTransactionStateDigest;
+    error?: string;
+}
+export type SchematicTransactionSmokeCheckId = 'create-rollback' | 'modify-rollback' | 'delete-rollback' | 'final-state-restored';
+export interface SchematicTransactionSmokeCheck {
+    id: SchematicTransactionSmokeCheckId;
+    status: 'passed' | 'failed';
+    details: Record<string, unknown>;
+}
+export interface SchematicTransactionSmokeReport {
+    schemaVersion: 1;
+    status: 'passed' | 'failed';
+    generatedAt: string;
+    environment: SchematicTransactionSmokeInput['environment'];
+    fixture: SchematicTransactionFixtureIdentity;
+    bridge: SchematicTransactionSmokeInput['bridge'];
+    checks: SchematicTransactionSmokeCheck[];
+    cleanup: {
+        clean: boolean;
+        remainingIds: string[];
+        errors: string[];
+    };
+    baseline: SchematicTransactionStateDigest;
+    finalState: SchematicTransactionStateDigest;
+    error?: string;
+}
+export declare function compareSchematicTransactionState(baseline: SchematicTransactionStateDigest, finalState: SchematicTransactionStateDigest): Record<string, boolean>;
+export declare function buildSchematicTransactionSmokeReport(input: SchematicTransactionSmokeInput): SchematicTransactionSmokeReport;
+export declare function writeSchematicTransactionSmokeReport(path: string, report: SchematicTransactionSmokeReport): Promise<void>;

package/dist/live/schematic-transaction-smoke-report.js

@@ -0,0 +1,160 @@
+import { mkdir, rename, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { stableHash } from '../transactions/stable.js';
+export function sortUnknownForStableHash(value) {
+    if (Array.isArray(value)) {
+        return value
+            .map(sortUnknownForStableHash)
+            .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, nested]) => [key, sortUnknownForStableHash(nested)]));
+    }
+    return value;
+}
+const PRIMITIVE_ID_KEYS = ['primitiveId', 'primitiveUuid', 'id', 'uuid'];
+const PRIMITIVE_NESTED_KEYS = ['result', 'data', 'text', 'rectangle'];
+export function extractPrimitiveId(value) {
+    if (typeof value === 'string')
+        return value.trim() || undefined;
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            const id = extractPrimitiveId(item);
+            if (id)
+                return id;
+        }
+        return undefined;
+    }
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const record = value;
+    for (const key of PRIMITIVE_ID_KEYS) {
+        const id = extractPrimitiveId(record[key]);
+        if (id)
+            return id;
+    }
+    for (const key of PRIMITIVE_NESTED_KEYS) {
+        const id = extractPrimitiveId(record[key]);
+        if (id)
+            return id;
+    }
+    return undefined;
+}
+export function primitiveDescriptorHash(snapshot) {
+    if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot)) {
+        return stableHash(snapshot);
+    }
+    const copy = structuredClone(snapshot);
+    delete copy.primitiveId;
+    return stableHash(copy);
+}
+export function extractPrimitiveIds(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return [];
+    const primitiveIds = value.primitiveIds;
+    return Array.isArray(primitiveIds)
+        ? primitiveIds
+            .filter((id) => typeof id === 'string' && id.length > 0)
+            .sort((a, b) => a.localeCompare(b))
+        : [];
+}
+function recordString(value, keys) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const record = value;
+    for (const key of keys) {
+        const candidate = record[key];
+        if (typeof candidate === 'string' && candidate.trim())
+            return candidate.trim();
+    }
+    return undefined;
+}
+export function verifySchematicTransactionFixtureIdentity(expected, runtime) {
+    const actual = {
+        project: recordString(runtime.projectInfo, ['friendlyName', 'name']),
+        schematic: recordString(runtime.schematicInfo, ['name']),
+        page: recordString(runtime.pageInfo, ['name']),
+    };
+    const mismatches = [];
+    for (const field of ['project', 'schematic', 'page']) {
+        if (actual[field] !== expected[field]) {
+            mismatches.push({
+                field,
+                expected: expected[field],
+                ...(actual[field] ? { actual: actual[field] } : {}),
+            });
+        }
+    }
+    return { ok: mismatches.length === 0, actual, mismatches };
+}
+function outcomeCheck(id, outcome) {
+    const passed = outcome.passed && outcome.rolledBack && outcome.stateRestored;
+    return {
+        id,
+        status: passed ? 'passed' : 'failed',
+        details: {
+            passed: outcome.passed,
+            rolledBack: outcome.rolledBack,
+            stateRestored: outcome.stateRestored,
+            ...(outcome.details ?? {}),
+        },
+    };
+}
+export function compareSchematicTransactionState(baseline, finalState) {
+    const ercComparable = baseline.ercAvailable && finalState.ercAvailable;
+    return {
+        primitiveInventoryHashEqual: baseline.primitiveInventoryHash === finalState.primitiveInventoryHash,
+        componentHashEqual: baseline.componentHash === finalState.componentHash,
+        netHashEqual: baseline.netHash === finalState.netHash,
+        ercComparable,
+        ercStateEqual: !ercComparable || baseline.ercHash === finalState.ercHash,
+    };
+}
+export function buildSchematicTransactionSmokeReport(input) {
+    const finalComparison = compareSchematicTransactionState(input.baseline, input.finalState);
+    const finalStatePassed = finalComparison.primitiveInventoryHashEqual &&
+        finalComparison.componentHashEqual &&
+        finalComparison.netHashEqual &&
+        finalComparison.ercStateEqual;
+    const checks = [
+        outcomeCheck('create-rollback', input.outcomes.createRollback),
+        outcomeCheck('modify-rollback', input.outcomes.modifyRollback),
+        outcomeCheck('delete-rollback', input.outcomes.deleteRollback),
+        {
+            id: 'final-state-restored',
+            status: finalStatePassed ? 'passed' : 'failed',
+            details: finalComparison,
+        },
+    ];
+    const cleanup = {
+        clean: input.cleanup.remainingIds.length === 0 && input.cleanup.errors.length === 0,
+        remainingIds: [...input.cleanup.remainingIds],
+        errors: [...input.cleanup.errors],
+    };
+    const status = checks.every((check) => check.status === 'passed') && cleanup.clean && !input.error
+        ? 'passed'
+        : 'failed';
+    return {
+        schemaVersion: 1,
+        status,
+        generatedAt: input.generatedAt ?? new Date().toISOString(),
+        environment: input.environment,
+        fixture: input.fixture,
+        bridge: input.bridge,
+        checks,
+        cleanup,
+        baseline: input.baseline,
+        finalState: input.finalState,
+        ...(input.error ? { error: input.error } : {}),
+    };
+}
+export async function writeSchematicTransactionSmokeReport(path, report) {
+    const absolutePath = resolve(path);
+    await mkdir(dirname(absolutePath), { recursive: true });
+    const temporaryPath = `${absolutePath}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(temporaryPath, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+    await rename(temporaryPath, absolutePath);
+}
+//# sourceMappingURL=schematic-transaction-smoke-report.js.map

package/dist/live/schematic-transaction-smoke-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schematic-transaction-smoke-report.js","sourceRoot":"","sources":["../../src/live/schematic-transaction-smoke-report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,GAAG,CAAC,wBAAwB,CAAC;aAC7B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAU,CAAC;AAClF,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAU,CAAC;AAE/E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;QACpB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,QAAmC,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,WAAW,CAAC;IACxB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,YAAY,GAAI,KAAoC,CAAC,YAAY,CAAC;IACxE,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAChC,CAAC,CAAC,YAAY;aACT,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;aACrE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAqBD,SAAS,YAAY,CAAC,KAAc,EAAE,IAAuB;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE;YAAE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,QAA6C,EAC7C,OAA4C;IAM5C,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACpE,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;KAC/C,CAAC;IACF,MAAM,UAAU,GAA0C,EAAE,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAU,EAAE,CAAC;QAC9D,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC;gBACd,KAAK;gBACL,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC7D,CAAC;AAyED,SAAS,YAAY,CACnB,EAAqE,EACrE,OAAoC;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;IAC7E,OAAO;QACL,EAAE;QACF,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACpC,OAAO,EAAE;YACP,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,QAAyC,EACzC,UAA2C;IAE3C,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,IAAI,UAAU,CAAC,YAAY,CAAC;IACvE,OAAO;QACL,2BAA2B,EACzB,QAAQ,CAAC,sBAAsB,KAAK,UAAU,CAAC,sBAAsB;QACvE,kBAAkB,EAAE,QAAQ,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa;QACvE,YAAY,EAAE,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;QACrD,aAAa;QACb,aAAa,EAAE,CAAC,aAAa,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;KACzE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,KAAqC;IAErC,MAAM,eAAe,GAAG,gCAAgC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GACpB,eAAe,CAAC,2BAA2B;QAC3C,eAAe,CAAC,kBAAkB;QAClC,eAAe,CAAC,YAAY;QAC5B,eAAe,CAAC,aAAa,CAAC;IAChC,MAAM,MAAM,GAAqC;QAC/C,YAAY,CAAC,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC9D,YAAY,CAAC,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC9D,YAAY,CAAC,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC9D;YACE,EAAE,EAAE,sBAAsB;YAC1B,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC9C,OAAO,EAAE,eAAe;SACzB;KACF,CAAC;IACF,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QACnF,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAC7C,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;KAClC,CAAC;IACF,MAAM,MAAM,GACV,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;QACjF,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC;IAEf,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM;QACN,OAAO;QACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,IAAY,EACZ,MAAuC;IAEvC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IACzE,MAAM,SAAS,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC"}

package/dist/release/published-release-verifier.d.ts

@@ -0,0 +1,56 @@
+export type ReleaseChannel = 'stable' | 'prerelease';
+export type ProvenanceObservation = 'passed' | 'failed' | 'unverified';
+export type ReleaseVerificationCheckStatus = 'passed' | 'failed';
+export interface ReleaseVerificationExpectation {
+    repository: string;
+    packageName: string;
+    mcpName: string;
+    version: string;
+    tag: string;
+    channel: ReleaseChannel;
+    npmDistTag: string;
+    commitSha: string;
+    requiredAssets: string[];
+    requiredGhcrTags: string[];
+}
+export interface ReleaseAssetObservation {
+    name: string;
+    digest?: string;
+}
+export interface ReleaseVerificationObservation {
+    npm: {
+        version?: string;
+        distTags: Record<string, string | undefined>;
+        provenance: ProvenanceObservation;
+        workflowContextProof?: boolean;
+    };
+    github: {
+        tag?: string;
+        tagCommitSha?: string;
+        isDraft?: boolean;
+        isPrerelease?: boolean;
+        assets: ReleaseAssetObservation[];
+    };
+    ghcr: {
+        digest?: string;
+        tags: string[];
+    };
+    mcpRegistry: {
+        version?: string;
+        isLatest?: boolean;
+    } | null;
+}
+export type ReleaseVerificationCheckId = 'npm-version' | 'npm-dist-tag' | 'npm-provenance' | 'github-tag' | 'github-tag-commit' | 'github-classification' | 'github-assets' | 'ghcr-tags' | 'mcp-registry';
+export interface ReleaseVerificationCheck {
+    id: ReleaseVerificationCheckId;
+    status: ReleaseVerificationCheckStatus;
+    expected: unknown;
+    actual: unknown;
+    message?: string;
+}
+export interface ReleaseVerificationReport {
+    ok: boolean;
+    checks: ReleaseVerificationCheck[];
+    failures: ReleaseVerificationCheck[];
+}
+export declare function verifyPublishedReleaseObservation(expectation: ReleaseVerificationExpectation, observation: ReleaseVerificationObservation): ReleaseVerificationReport;

package/dist/release/published-release-verifier.js

@@ -0,0 +1,63 @@
+function check(id, passed, expected, actual, message) {
+    return {
+        id,
+        status: passed ? 'passed' : 'failed',
+        expected,
+        actual,
+        ...(message ? { message } : {}),
+    };
+}
+function sortedUnique(values) {
+    return [...new Set(values)].sort((left, right) => left.localeCompare(right));
+}
+function sameStringSet(expected, actual) {
+    const normalizedExpected = sortedUnique(expected);
+    const normalizedActual = sortedUnique(actual);
+    return (normalizedExpected.length === normalizedActual.length &&
+        normalizedExpected.every((value, index) => value === normalizedActual[index]));
+}
+export function verifyPublishedReleaseObservation(expectation, observation) {
+    const expectedPrerelease = expectation.channel === 'prerelease';
+    const assetByName = new Map(observation.github.assets.map((asset) => [asset.name, asset]));
+    const missingOrUndigestedAssets = expectation.requiredAssets.filter((name) => {
+        const asset = assetByName.get(name);
+        return !asset || typeof asset.digest !== 'string' || asset.digest.trim().length === 0;
+    });
+    const provenancePassed = observation.npm.provenance === 'passed' || observation.npm.workflowContextProof === true;
+    const provenanceActual = {
+        registry: observation.npm.provenance,
+        workflowContextProof: observation.npm.workflowContextProof === true,
+    };
+    const ghcrDigestPresent = typeof observation.ghcr.digest === 'string' && observation.ghcr.digest.trim().length > 0;
+    const ghcrTagsMatch = sameStringSet(expectation.requiredGhcrTags, observation.ghcr.tags);
+    const mcpPassed = expectation.channel === 'stable'
+        ? observation.mcpRegistry?.version === expectation.version &&
+            observation.mcpRegistry?.isLatest === true
+        : observation.mcpRegistry === null;
+    const checks = [
+        check('npm-version', observation.npm.version === expectation.version, expectation.version, observation.npm.version, 'The exact npm package version must match the release version.'),
+        check('npm-dist-tag', observation.npm.distTags[expectation.npmDistTag] === expectation.version, { [expectation.npmDistTag]: expectation.version }, { [expectation.npmDistTag]: observation.npm.distTags[expectation.npmDistTag] }, 'The channel-specific npm dist-tag must point to the exact release version.'),
+        check('npm-provenance', provenancePassed, 'registry provenance passed or workflow-context proof present', provenanceActual, 'The npm package must have registry provenance or verified workflow-context proof.'),
+        check('github-tag', observation.github.tag === expectation.tag, expectation.tag, observation.github.tag, 'The GitHub Release tag must match the expected immutable release tag.'),
+        check('github-tag-commit', observation.github.tagCommitSha === expectation.commitSha, expectation.commitSha, observation.github.tagCommitSha, 'The release tag must resolve to the expected candidate commit.'),
+        check('github-classification', observation.github.isDraft === false &&
+            observation.github.isPrerelease === expectedPrerelease, { isDraft: false, isPrerelease: expectedPrerelease }, {
+            isDraft: observation.github.isDraft,
+            isPrerelease: observation.github.isPrerelease,
+        }, 'The GitHub Release draft/prerelease classification must match the channel.'),
+        check('github-assets', missingOrUndigestedAssets.length === 0, expectation.requiredAssets, observation.github.assets, missingOrUndigestedAssets.length > 0
+            ? `Missing or undigested assets: ${missingOrUndigestedAssets.join(', ')}`
+            : undefined),
+        check('ghcr-tags', ghcrDigestPresent && ghcrTagsMatch, { digest: 'non-empty', tags: sortedUnique(expectation.requiredGhcrTags) }, { digest: observation.ghcr.digest, tags: sortedUnique(observation.ghcr.tags) }, 'All exact and moving GHCR tags must resolve to one non-empty image digest.'),
+        check('mcp-registry', mcpPassed, expectation.channel === 'stable' ? { version: expectation.version, isLatest: true } : null, observation.mcpRegistry, expectation.channel === 'stable'
+            ? 'Stable releases must be present in the MCP Registry and marked latest.'
+            : 'Prereleases must not be published to the MCP Registry.'),
+    ];
+    const failures = checks.filter((item) => item.status === 'failed');
+    return {
+        ok: failures.length === 0,
+        checks,
+        failures,
+    };
+}
+//# sourceMappingURL=published-release-verifier.js.map