fraim 2.0.346 → 2.0.349

package/dist/registry/scripts/learning/run-publication.js

@@ -0,0 +1,364 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publishRunFile = publishRunFile;
+exports.verifyCapabilityDelivery = verifyCapabilityDelivery;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const proposal_queue_1 = require("./proposal-queue");
+const owner_identity_1 = require("./owner-identity");
+const run_record_1 = require("./run-record");
+const { learningEntryBlocks } = require('./entry-format');
+function matchesLearningPublication(body, proof) {
+    body = body.replace(/\r\n/g, '\n');
+    if (/^<{7}/m.test(body))
+        return false;
+    const entries = learningEntryBlocks(body);
+    if (entries.some(entry => !entry.id) || new Set(entries.map(entry => entry.id)).size !== entries.length)
+        return false;
+    const matches = entries.filter(entry => entry.id === proof.entryId);
+    return proof.after === null ? matches.length === 0 : matches.length === 1 && matches[0].text === proof.after.replace(/\r\n/g, '\n');
+}
+/** Fetch a named remote snapshot; never infer effective delivery from local HEAD. */
+function fetchRemoteHead(root) {
+    const head = (0, node_child_process_1.spawnSync)('git', ['ls-remote', 'origin', 'HEAD'], { cwd: root, encoding: 'utf8', timeout: 30000, windowsHide: true });
+    const oid = head.status === 0 ? head.stdout.trim().match(/^([a-f0-9]{40,64})\s+HEAD$/)?.[1] : undefined;
+    if (!oid)
+        return undefined;
+    const fetched = (0, node_child_process_1.spawnSync)('git', ['fetch', 'origin', oid], { cwd: root, encoding: 'utf8', timeout: 30000, windowsHide: true });
+    return fetched.status === 0 ? oid : undefined;
+}
+/** A shared source capability is delivered only after its real project PR has merged with this content. */
+function verifySharedProjectPublication(projectPath, file, expectedHash, publicationRef, callers = []) {
+    if (!publicationRef)
+        return { published: false, reference: file };
+    const remote = (0, node_child_process_1.spawnSync)('git', ['config', '--get', 'remote.origin.url'], { cwd: projectPath, encoding: 'utf8', timeout: 10000, windowsHide: true });
+    if (remote.status !== 0 || !remote.stdout.trim())
+        throw new Error('project-publication-repository-unavailable');
+    const repository = new URL(remote.stdout.trim().replace(/^git@([^:]+):/, 'https://$1/').replace(/\.git$/, ''));
+    if (!/^\d+$/.test(publicationRef)) {
+        const reference = new URL(publicationRef);
+        if (reference.host !== repository.host || !reference.pathname.startsWith(repository.pathname.replace(/\/$/, '') + '/pull/') || !/\/pull\/\d+$/.test(reference.pathname))
+            throw new Error('publication-reference-owner-mismatch');
+    }
+    const found = (0, node_child_process_1.spawnSync)('gh', ['pr', 'view', publicationRef, '--repo', remote.stdout.trim(), '--json', 'state,url,mergeCommit'], { encoding: 'utf8', timeout: 30000, windowsHide: true });
+    if (found.status !== 0)
+        return { published: false, reference: publicationRef };
+    const pr = JSON.parse(found.stdout);
+    if (pr.state !== 'MERGED' || !/^[a-f0-9]{40,64}$/.test(pr.mergeCommit?.oid || ''))
+        return { published: false, reference: pr.url || publicationRef };
+    const fetched = (0, node_child_process_1.spawnSync)('git', ['fetch', 'origin', pr.mergeCommit.oid], { cwd: projectPath, encoding: 'utf8', timeout: 30000, windowsHide: true });
+    if (fetched.status !== 0)
+        return { published: false, reference: pr.url };
+    const effectiveHead = fetchRemoteHead(projectPath);
+    if (!effectiveHead)
+        return { published: false, reference: pr.url };
+    for (const artifact of [{ file, expectedHash }, ...callers]) {
+        const relative = node_path_1.default.relative(projectPath, artifact.file).replace(/\\/g, '/');
+        if (relative === '..' || relative.startsWith('../') || node_path_1.default.isAbsolute(relative))
+            throw new Error('publication-caller-outside-project');
+        const delivered = (0, node_child_process_1.spawnSync)('git', ['show', `${pr.mergeCommit.oid}:${relative}`], { cwd: projectPath, encoding: 'utf8', timeout: 30000, windowsHide: true });
+        const effective = (0, node_child_process_1.spawnSync)('git', ['show', `${effectiveHead}:${relative}`], { cwd: projectPath, encoding: 'utf8', timeout: 30000, windowsHide: true });
+        const current = node_fs_1.default.readFileSync(artifact.file, 'utf8');
+        if (delivered.status !== 0 || effective.status !== 0 || (0, proposal_queue_1.hashContent)(current) !== artifact.expectedHash
+            || (0, proposal_queue_1.hashContent)(delivered.stdout.replace(/\r\n/g, '\n')) !== (0, proposal_queue_1.hashContent)(current.replace(/\r\n/g, '\n'))
+            || (0, proposal_queue_1.hashContent)(effective.stdout.replace(/\r\n/g, '\n')) !== (0, proposal_queue_1.hashContent)(current.replace(/\r\n/g, '\n')))
+            return { published: false, reference: pr.url };
+    }
+    return { published: true, reference: pr.url };
+}
+/** Existing publishers run in a bounded process. Cloud confirmation reads the actual pack without syncing it. */
+function publishRunFile(projectPath, file, home, operationKey, expectedHash, runtimeModulePath, entryProof) {
+    const relative = home.level === 'Project' && node_path_1.default.resolve(file) === node_path_1.default.join(home.root, 'config.json')
+        ? 'config.json' : node_path_1.default.relative(home.contentRoot, file).replace(/\\/g, '/');
+    if ((0, owner_identity_1.ownerArtifactPath)(home, relative) !== node_path_1.default.resolve(file))
+        throw new Error('invalid-publication-path');
+    if (!/^[a-f0-9]{64}$/.test(expectedHash) || (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(file, 'utf8')) !== expectedHash)
+        throw new Error('publication-content-conflict');
+    if (entryProof && (!/^L-[a-f0-9]{10}$/.test(entryProof.entryId) || (entryProof.after !== null && typeof entryProof.after !== 'string')
+        || !matchesLearningPublication(node_fs_1.default.readFileSync(file, 'utf8'), entryProof)))
+        throw new Error('publication-entry-conflict');
+    if (!/^[a-zA-Z0-9_.-]{1,240}$/.test(operationKey))
+        throw new Error('invalid-publication-operation');
+    if (!home.requiresPublish)
+        return { published: true, reference: file };
+    const layer = home.level.toLowerCase();
+    if (!['manager', 'org'].includes(layer))
+        throw new Error('project-publisher-unavailable');
+    const branchSuffix = `sleep-${operationKey}`;
+    if (home.backend === 'git' && home.gitUrl) {
+        const branch = `fraim-${layer}-update-${branchSuffix}`;
+        const found = (0, node_child_process_1.spawnSync)('gh', ['pr', 'view', branch, '--repo', home.gitUrl, '--json', 'state,url,mergeCommit'], { encoding: 'utf8', timeout: 30000, windowsHide: true });
+        if (found.status === 0) {
+            const pr = JSON.parse(found.stdout);
+            if (pr.state !== 'MERGED' || !/^[a-f0-9]{40,64}$/.test(pr.mergeCommit?.oid || ''))
+                return { published: false, reference: pr.url || branch };
+            const fetched = (0, node_child_process_1.spawnSync)('git', ['fetch', 'origin', pr.mergeCommit.oid], { cwd: home.root, encoding: 'utf8', timeout: 30000, windowsHide: true });
+            const packRelative = node_path_1.default.relative(home.root, file).replace(/\\/g, '/');
+            const delivered = (0, node_child_process_1.spawnSync)('git', ['show', `${pr.mergeCommit.oid}:${packRelative}`], { cwd: home.root, encoding: 'utf8', timeout: 30000, windowsHide: true });
+            const current = node_fs_1.default.readFileSync(file, 'utf8');
+            const matches = (body) => entryProof ? matchesLearningPublication(body, entryProof)
+                : (0, proposal_queue_1.hashContent)(body.replace(/\r\n/g, '\n')) === (0, proposal_queue_1.hashContent)(current.replace(/\r\n/g, '\n'));
+            if ((0, proposal_queue_1.hashContent)(current) !== expectedHash || fetched.status !== 0 || delivered.status !== 0 || !matches(delivered.stdout))
+                return { published: false, reference: pr.url };
+            // A merged snapshot proves this operation, but a later revert must
+            // not authorize retirement of a still-needed source.
+            const oid = fetchRemoteHead(home.root);
+            if (!oid)
+                return { published: false, reference: pr.url };
+            const effective = (0, node_child_process_1.spawnSync)('git', ['show', `${oid}:${packRelative}`], { cwd: home.root, encoding: 'utf8', timeout: 30000, windowsHide: true });
+            return { published: effective.status === 0 && matches(effective.stdout)
+                    && (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(file, 'utf8')) === expectedHash, reference: pr.url };
+        }
+    }
+    const publisherPath = runtimeModulePath(projectPath, `cli/utils/${layer}-publish`);
+    const userConfigPath = runtimeModulePath(projectPath, 'cli/utils/user-config');
+    const script = `
+const fs=require('node:fs');
+const crypto=require('node:crypto');
+const hash=value=>crypto.createHash('sha256').update(value).digest('hex');
+const [publisherPath,userConfigPath,file,relative,layer,branchSuffix,expectedHash,backend,entryProofJson,entryFormatPath]=process.argv.slice(1);
+const entryProof=JSON.parse(entryProofJson);
+const {learningEntryBlocks}=require(entryFormatPath);
+const matchesLearningPublication=${matchesLearningPublication.toString()};
+const publisher=require(publisherPath);
+const readConfig=require(userConfigPath).readUserFraimConfig;
+const remote=(process.env.FRAIM_REMOTE_URL||'https://fraim.wellnessatwork.me').replace(/\\/$/,'');
+async function confirmedCloud(){
+  const key=readConfig().apiKey;if(!key)throw Error('api-key-unavailable');
+  const response=await fetch(remote+'/api/'+layer+'/pack',{headers:{'x-api-key':key},signal:AbortSignal.timeout(30000)});
+  if(!response.ok)throw Error('pack-read-failed');
+  const pack=await response.json();
+  const matches=Array.isArray(pack.files)?pack.files.filter(item=>item.relativePath===relative):[];
+  return {published:matches.length===1&&typeof matches[0].content==='string'&&(entryProof?matchesLearningPublication(matches[0].content,entryProof):hash(matches[0].content)===expectedHash),reference:remote+'/api/'+layer+'/pack#'+encodeURIComponent(relative)};
+}
+(async()=>{
+  if(hash(fs.readFileSync(file,'utf8'))!==expectedHash)throw Error('publication-content-conflict');
+  if(backend==='fraim-cloud'){
+    const existing=await confirmedCloud();
+    if(existing.published){console.log('FRAIM_PUBLISH_RESULT='+JSON.stringify(existing));return;}
+  }
+  const publish=layer==='manager'?publisher.publishManagerArtifacts:publisher.publishOrgArtifacts;
+  const result=await publish([{relativePath:relative,content:fs.readFileSync(file,'utf8')}],{branchSuffix});
+  const confirmed=backend==='fraim-cloud'?await confirmedCloud():{published:false,reference:result.prUrl||result.branch||file};
+  if(hash(fs.readFileSync(file,'utf8'))!==expectedHash)throw Error('publication-content-conflict');
+  console.log('FRAIM_PUBLISH_RESULT='+JSON.stringify(confirmed));
+})().catch(()=>{process.exitCode=1;});`;
+    const result = (0, node_child_process_1.spawnSync)(process.execPath, [...process.execArgv, '-e', script, publisherPath, userConfigPath, file, relative, layer, branchSuffix, expectedHash, home.backend, JSON.stringify(entryProof || null), require.resolve('./entry-format')], { cwd: projectPath, encoding: 'utf8', timeout: 120000, windowsHide: true });
+    const encoded = String(result.stdout || '').match(/^FRAIM_PUBLISH_RESULT=(.+)$/m)?.[1];
+    if (result.status !== 0 || !encoded)
+        throw new Error('publication-pending: delivery or read-back has not been confirmed');
+    if ((0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(file, 'utf8')) !== expectedHash)
+        throw new Error('publication-content-conflict');
+    return JSON.parse(encoded);
+}
+/** Verify actual resolver precedence and include traversal; a textual mention is not a loaded caller. */
+async function verifyCapabilityDelivery(action, input, options) {
+    if (!action.delivery || !/^[a-f0-9]{64}$/.test(action.delivery.expectedHash) || !Array.isArray(action.delivery.callers))
+        throw new Error('capability-delivery-review-required');
+    const reader = action.delivery.reader;
+    if (action.target.owner.level === 'Project' && action.target.relativePath === 'config.json' && reader?.kind !== 'workspace-config')
+        throw new Error('workspace-config-reader-required');
+    if (reader) {
+        (0, run_record_1.validateDeliveryReader)(reader);
+        if (action.delivery.callers.length)
+            throw new Error('invalid-capability-reader-callers');
+    }
+    else if (!action.delivery.callers.length)
+        throw new Error('capability-delivery-review-required');
+    if ((input.expectedHash !== undefined && input.expectedHash !== action.delivery.expectedHash)
+        || (input.reader !== undefined && (0, run_record_1.canonical)(input.reader) !== (0, run_record_1.canonical)(action.delivery.reader))
+        || (input.callers !== undefined && (0, run_record_1.canonical)(input.callers) !== (0, run_record_1.canonical)(action.delivery.callers)))
+        throw new Error('capability-delivery-review-mismatch');
+    input = { ...input, ...action.delivery };
+    const home = options.resolveHome(action.target.owner);
+    (0, owner_identity_1.assertSameOwner)(action.target.owner, home.owner);
+    const target = (0, owner_identity_1.ownerArtifactPath)(home, action.target.relativePath);
+    if (!/^[a-f0-9]{64}$/.test(input?.expectedHash || '') || !Array.isArray(input.callers) || !node_fs_1.default.existsSync(target))
+        throw new Error('capability-verification-required');
+    const contentHash = (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(target, 'utf8'));
+    if (contentHash !== input.expectedHash)
+        return { published: false, reference: target, contentHash, reachable: false };
+    const load = (relative) => options.runtimeModule(options.projectPath, relative);
+    if (reader) {
+        const snapshots = new Map();
+        const capture = (file) => {
+            file = node_path_1.default.resolve(file);
+            let stat;
+            try {
+                stat = node_fs_1.default.lstatSync(file);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                snapshots.set(file, { file, realPath: null, sha256: null });
+                return;
+            }
+            if (!stat.isFile() && !stat.isSymbolicLink())
+                throw new Error('invalid-capability-reader-file');
+            snapshots.set(file, { file, realPath: node_fs_1.default.realpathSync(file), sha256: (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(file, 'utf8')) });
+        };
+        const paths = load('core/utils/project-fraim-paths');
+        capture(target);
+        capture(paths.getWorkspaceConfigPath(options.projectPath));
+        if (reader.kind === 'workspace-config') {
+            if (home.level !== 'Project' || action.target.relativePath !== 'config.json'
+                || node_path_1.default.resolve(paths.getWorkspaceConfigPath(options.projectPath)) !== target)
+                throw new Error('invalid-workspace-config-target');
+            // Parse independently: the runtime readers intentionally fall back on malformed JSON.
+            // A malformed delivered file must never be certified solely because its fallback matches.
+            const raw = JSON.parse(node_fs_1.default.readFileSync(target, 'utf8'));
+            if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+                throw new Error('invalid-workspace-config');
+            const value = reader.key === 'learning.scoreThreshold'
+                ? load('local-mcp-server/learning-context-builder').getScoreThreshold(options.projectPath)
+                : load('local-mcp-server/learning-usage-store').resolveUsageLimits(options.projectPath)[reader.key.split('.').pop()];
+            if (value !== reader.expectedValue)
+                return { published: false, reference: target, contentHash, reachable: false };
+        }
+        else {
+            capture(node_path_1.default.join(paths.getUserFraimDirPath(), 'config.json'));
+            // Capture absent overrides too: creating one after verification invalidates delivery.
+            capture(node_path_1.default.join(paths.getWorkspaceFraimPath(options.projectPath), 'personalized-employee', action.target.relativePath));
+            const location = load('local-mcp-server/learning-context-builder').resolveTeamContextFile(options.projectPath, reader.key, { migrateLegacy: false });
+            if (!location.present || node_path_1.default.resolve(location.readPath) !== target || node_fs_1.default.realpathSync(location.readPath) !== node_fs_1.default.realpathSync(target))
+                return { published: false, reference: target, contentHash, reachable: false };
+        }
+        const localFiles = [...snapshots.values()].sort((a, b) => a.file.localeCompare(b.file));
+        const verifySnapshots = () => {
+            const currentHome = options.resolveHome(action.target.owner);
+            (0, owner_identity_1.assertSameOwner)(action.target.owner, currentHome.owner);
+            if ((0, owner_identity_1.ownerArtifactPath)(currentHome, action.target.relativePath) !== target)
+                throw new Error('capability-owner-home-changed');
+            for (const item of localFiles) {
+                if (item.sha256 === null) {
+                    try {
+                        node_fs_1.default.lstatSync(item.file);
+                    }
+                    catch (error) {
+                        if (error.code === 'ENOENT')
+                            continue;
+                        throw error;
+                    }
+                    throw new Error('capability-local-content-changed');
+                }
+                if (node_fs_1.default.realpathSync(item.file) !== item.realPath || (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(item.file, 'utf8')) !== item.sha256)
+                    throw new Error('capability-local-content-changed');
+            }
+        };
+        if (snapshots.get(target)?.sha256 !== contentHash)
+            throw new Error('capability-local-content-changed');
+        verifySnapshots();
+        if (home.requiresPublish && (!options.runtimeModulePath || !input.operationKey))
+            throw new Error('capability-publication-required');
+        const publication = home.requiresPublish ? publishRunFile(options.projectPath, target, home, input.operationKey, contentHash, options.runtimeModulePath) : { published: true, reference: target };
+        verifySnapshots();
+        return { ...publication, contentHash, reachable: true, localFiles };
+    }
+    const { LocalRegistryResolver } = load('core/utils/local-registry-resolver');
+    const { resolvePackHome } = load('cli/utils/pack-home');
+    const manager = resolvePackHome('manager', { migrateLegacy: false });
+    const org = resolvePackHome('org', { migrateLegacy: false });
+    const resolver = new LocalRegistryResolver({ workspaceRoot: options.projectPath,
+        managerLocalRoot: manager.contentRoot, managerCacheRoot: manager.contentRoot, orgCacheRoot: org.contentRoot,
+        remoteContentResolver: async () => { throw new Error('capability-not-available-locally'); },
+    });
+    const originalResolve = resolver.resolveFile.bind(resolver);
+    const snapshots = new Map();
+    const snapshot = (file, expectedContent) => {
+        const absolute = node_path_1.default.resolve(file);
+        const body = node_fs_1.default.readFileSync(absolute, 'utf8');
+        if (expectedContent !== undefined && (0, proposal_queue_1.hashContent)(body) !== (0, proposal_queue_1.hashContent)(expectedContent))
+            throw new Error('capability-local-content-changed');
+        const current = { file: absolute, realPath: node_fs_1.default.realpathSync(absolute), sha256: (0, proposal_queue_1.hashContent)(body) };
+        const prior = snapshots.get(absolute);
+        if (prior && (prior.sha256 !== current.sha256 || prior.realPath !== current.realPath))
+            throw new Error('capability-local-content-changed');
+        snapshots.set(absolute, current);
+    };
+    const snapshotResolvedInclude = (relative, resolved) => {
+        if (resolved.source !== 'local')
+            return;
+        const normalized = relative.replace(/\\/g, '/');
+        if (node_path_1.default.isAbsolute(normalized) || normalized.split('/').some(part => !part || part === '..' || part === '.'))
+            throw new Error('invalid-capability-include');
+        let candidates;
+        if (resolved.scope === 'manager')
+            candidates = [node_path_1.default.join(manager.contentRoot, normalized)];
+        else if (resolved.scope === 'org')
+            candidates = [node_path_1.default.join(org.contentRoot, normalized)];
+        else if (resolved.scope === 'project')
+            candidates = [node_path_1.default.join(options.projectPath, 'fraim/personalized-employee', normalized)];
+        else {
+            const parts = normalized.split('/');
+            const rolePath = ['jobs', 'workflows'].includes(parts[0]) && ['ai-employee', 'ai-manager'].includes(parts[1])
+                ? node_path_1.default.join(parts[1], parts[0], ...parts.slice(2)) : undefined;
+            candidates = [...(rolePath ? [node_path_1.default.join(options.projectPath, 'fraim', rolePath)] : []),
+                node_path_1.default.join(options.projectPath, 'fraim/ai-employee', normalized), node_path_1.default.join(options.projectPath, 'fraim/ai-manager', normalized),
+                node_path_1.default.join(options.projectPath, 'fraim', normalized), node_path_1.default.join(options.projectPath, 'registry', normalized)];
+        }
+        const source = candidates.find(file => node_fs_1.default.existsSync(file) && node_fs_1.default.statSync(file).isFile() && (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(file, 'utf8')) === (0, proposal_queue_1.hashContent)(resolved.content));
+        if (source)
+            snapshot(source, resolved.content);
+    };
+    snapshot(target);
+    const shared = action.target.owner.level === 'Project' && action.target.relativePath.startsWith('registry/');
+    const targetPath = shared ? action.target.relativePath.slice('registry/'.length) : action.target.relativePath;
+    const targetScope = shared ? undefined : action.target.owner.level.toLowerCase();
+    const loadedTarget = await originalResolve(targetPath, { includeMetadata: false, stripMcpHeader: true });
+    if (loadedTarget.scope !== targetScope || (0, proposal_queue_1.hashContent)(loadedTarget.content) !== contentHash)
+        return { published: false, reference: target, contentHash, reachable: false };
+    let reachable = true;
+    const sharedCallers = [];
+    for (const caller of input.callers) {
+        const callerHome = options.resolveHome(caller.owner);
+        (0, owner_identity_1.assertSameOwner)(caller.owner, callerHome.owner);
+        const callerFile = (0, owner_identity_1.ownerArtifactPath)(callerHome, caller.relativePath);
+        const sharedCaller = caller.owner.level === 'Project' && caller.relativePath.startsWith('registry/');
+        const callerPath = sharedCaller ? caller.relativePath.slice('registry/'.length) : caller.relativePath;
+        const loadedCaller = await originalResolve(callerPath, { includeMetadata: false, stripMcpHeader: true });
+        if (!node_fs_1.default.existsSync(callerFile) || loadedCaller.scope !== (sharedCaller ? undefined : caller.owner.level.toLowerCase())
+            || (0, proposal_queue_1.hashContent)(loadedCaller.content) !== (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(callerFile, 'utf8'))) {
+            reachable = false;
+            break;
+        }
+        snapshot(callerFile, loadedCaller.content);
+        if (sharedCaller)
+            sharedCallers.push({ file: callerFile, expectedHash: (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(callerFile, 'utf8')) });
+        let traversed = false;
+        resolver.resolveFile = async (relative, resolveOptions) => {
+            const resolved = await originalResolve(relative, resolveOptions);
+            snapshotResolvedInclude(relative, resolved);
+            if (relative === targetPath && resolved.scope === targetScope && (0, proposal_queue_1.hashContent)(resolved.content) === contentHash)
+                traversed = true;
+            return resolved;
+        };
+        const hydrated = await resolver.resolveIncludes(loadedCaller.content);
+        if (!traversed || /\{\{include:[^}]+\}\}/.test(hydrated)) {
+            reachable = false;
+            break;
+        }
+    }
+    resolver.resolveFile = originalResolve;
+    if (!reachable || (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(target, 'utf8')) !== contentHash)
+        return { published: false, reference: target, contentHash, reachable: false };
+    const localFiles = [...snapshots.values()].sort((a, b) => a.file.localeCompare(b.file));
+    const verifySnapshots = () => {
+        for (const item of localFiles)
+            if (node_fs_1.default.realpathSync(item.file) !== item.realPath || (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(item.file, 'utf8')) !== item.sha256)
+                throw new Error('capability-local-content-changed');
+    };
+    if (shared) {
+        const publication = verifySharedProjectPublication(options.projectPath, target, contentHash, input.publicationRef, sharedCallers);
+        verifySnapshots();
+        return { ...publication, contentHash, reachable, localFiles };
+    }
+    if (home.requiresPublish && (!options.runtimeModulePath || !input.operationKey))
+        throw new Error('capability-publication-required');
+    const publication = home.requiresPublish ? publishRunFile(options.projectPath, target, home, input.operationKey, contentHash, options.runtimeModulePath) : { published: true, reference: target };
+    verifySnapshots();
+    return { ...publication, contentHash, reachable, localFiles };
+}