humanish 0.32.0 → 0.34.0

package/dist/run.js

@@ -4625,6 +4625,9 @@ function isRunBundle(value) {
         // Optional, adapter-namespaced product score (the extension seam). When present, validate only
         // its SHAPE; core never reads the adapter's `data` payload.
         && (value.adapterScore === undefined || isRunAdapterScore(value.adapterScore))
+        // Optional + additive scorer provenance (#316). Tolerated-absent so pre-#316 and library-caller
+        // bundles still verify; when present it must be well-shaped.
+        && (value.scorerProvenance === undefined || isRunScorerProvenance(value.scorerProvenance))
         && (value.adapterArtifacts === undefined
             || (Array.isArray(value.adapterArtifacts) && value.adapterArtifacts.every(isRunAdapterArtifact)))
         && (value.providerResources === undefined
@@ -4711,6 +4714,23 @@ function isDesktopBrowserEvidence(value) {
         && (value.requested === "default" || value.requested === "chrome" || value.requested === "chromium" || value.requested === "firefox")
         && (value.resolved === undefined || typeof value.resolved === "string");
 }
+/** Short lowercase-hex content digest (digestText default is 12 chars; tolerate longer future digests). */
+const SCORER_DIGEST_PATTERN = /^[a-f0-9]{12,64}$/;
+/** Shape guard for RunScorerProvenance (#316), mirroring isRunSubjectProvenance: tolerated-absent in
+ *  isRunBundle, well-shaped when present. Semantics (does the digest still match the file) are not a
+ *  verify concern — the block is core-stamped evidence of what was loaded, not a re-execution proof. */
+function isRunScorerProvenance(value) {
+    return isRecord(value)
+        && value.schema === "humanish.scorer-provenance.v1"
+        && typeof value.ref === "string"
+        && value.ref.trim().length > 0
+        && typeof value.digest === "string"
+        && SCORER_DIGEST_PATTERN.test(value.digest)
+        && (value.source === "manifest" || value.source === "cli-flag")
+        && Array.isArray(value.exports)
+        && value.exports.length > 0
+        && value.exports.every((name) => name === "score" || name === "deriveFeedback" || name === "deriveArtifacts");
+}
 function isRunAdapterScore(value) {
     return isRecord(value)
         && value.schema === "humanish.adapter-score.v1"