knodin 0.8.3 → 0.8.5

package/dist/src/shared-index/manifest.js

@@ -0,0 +1,71 @@
+import crypto from "node:crypto";
+import path from "node:path";
+import { publicKeyFingerprint } from "./config.js";
+import { canonicalManifestBytes, canonicalRepositoryIdentity, encodeSharedIndexComponent, SHARED_INDEX_LIMITS, sha256Hex, sharedIndexCompatibility, sharedRepositoryPrefix, } from "./contract.js";
+import { SharedIndexError } from "./s3-client.js";
+function sameIdentity(left, right) {
+    return (JSON.stringify(canonicalRepositoryIdentity(left)) ===
+        JSON.stringify(canonicalRepositoryIdentity(right)));
+}
+export function branchPointerKey(config, branch) {
+    return `${sharedRepositoryPrefix(config.repository)}branches/${encodeSharedIndexComponent(branch)}.json`;
+}
+export function signatureKey(manifestKey) {
+    if (!manifestKey.endsWith("/manifest.json"))
+        throw new SharedIndexError("integrity", "shared-index manifest key has an invalid filename");
+    return `${manifestKey.slice(0, -"manifest.json".length)}manifest.sig`;
+}
+export function compatibilityFingerprint(compatibility) {
+    return sha256Hex(canonicalManifestBytes(compatibility));
+}
+export function validatePointerBinding(config, pointer) {
+    if (pointer.registrationId !== config.registrationId)
+        throw new SharedIndexError("integrity", "shared-index pointer registration does not match configuration");
+    if (!sameIdentity(pointer.repository, config.repository))
+        throw new SharedIndexError("integrity", "shared-index pointer repository does not match configuration");
+    const directory = `${sharedRepositoryPrefix(config.repository)}snapshots/${pointer.commit}/${pointer.inputFingerprint}/`;
+    if (pointer.manifestKey !== `${directory}manifest.json`)
+        throw new SharedIndexError("integrity", "shared-index manifest key escaped its immutable snapshot prefix");
+}
+function verifyConfiguredTrustRoot(config) {
+    let fingerprint;
+    try {
+        fingerprint = publicKeyFingerprint(config.signing.publicKeyPem);
+    }
+    catch {
+        throw new SharedIndexError("integrity", "shared-index configured signing key is invalid");
+    }
+    const expected = Buffer.from(config.signing.publicKeySha256, "hex");
+    const actual = Buffer.from(fingerprint, "hex");
+    if (expected.byteLength !== actual.byteLength || !crypto.timingSafeEqual(expected, actual))
+        throw new SharedIndexError("integrity", "shared-index configured signing-key fingerprint does not match");
+}
+export function verifyManifest(config, pointer, rawManifest, manifest, signature, clientCompatibility) {
+    if (signature.byteLength === 0 || signature.byteLength > SHARED_INDEX_LIMITS.signatureBytes)
+        throw new SharedIndexError("integrity", "shared-index signature exceeds its byte limit");
+    verifyConfiguredTrustRoot(config);
+    if (sha256Hex(rawManifest) !== pointer.manifestSha256)
+        throw new SharedIndexError("integrity", "shared-index manifest digest does not match pointer");
+    if (!Buffer.from(rawManifest).equals(canonicalManifestBytes(manifest)))
+        throw new SharedIndexError("integrity", "shared-index manifest bytes are not canonical JSON v1");
+    const verified = crypto.verify("sha256", rawManifest, {
+        key: config.signing.publicKeyPem,
+        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: 32,
+    }, signature);
+    if (!verified)
+        throw new SharedIndexError("integrity", "shared-index manifest signature is invalid");
+    if (manifest.registrationId !== config.registrationId ||
+        !sameIdentity(manifest.repository, config.repository))
+        throw new SharedIndexError("integrity", "shared-index signed identity does not match configuration");
+    if (manifest.commit !== pointer.commit)
+        throw new SharedIndexError("integrity", "shared-index signed commit does not match pointer");
+    if (compatibilityFingerprint(manifest.compatibility) !== pointer.inputFingerprint)
+        throw new SharedIndexError("integrity", "shared-index compatibility fingerprint does not match pointer");
+    const immutableDirectory = path.posix.dirname(pointer.manifestKey);
+    if (manifest.graph.key !== `${immutableDirectory}/graph.sqlite.zst`)
+        throw new SharedIndexError("integrity", "shared-index graph key escaped its immutable snapshot prefix");
+    const compatibility = sharedIndexCompatibility(clientCompatibility, manifest.compatibility);
+    if (!compatibility.compatible)
+        throw new SharedIndexError("compatibility", `shared-index snapshot is incompatible (${compatibility.reasons.join(",")})`);
+}

package/dist/src/shared-index/opportunistic.js

@@ -0,0 +1,37 @@
+import fs from "node:fs";
+import { resolveDbPath } from "../engine/state-paths.js";
+import { currentSharedIndexCompatibility } from "./compatibility.js";
+import { loadSharedIndexConfig } from "./config.js";
+import { readSharedIndexProvenance, readSharedRestoreAttempt } from "./provenance.js";
+import { restoreSharedIndex } from "./restore.js";
+import { createSharedObjectStore } from "./s3-client.js";
+const FAILURE_BACKOFF_MS = 15 * 60 * 1000;
+export function shouldAttemptOpportunisticRestore(repo, now = Date.now()) {
+    const configuration = loadSharedIndexConfig(repo);
+    if (configuration.state !== "configured" || !configuration.config.enabled)
+        return false;
+    if (fs.existsSync(resolveDbPath(repo)) && readSharedIndexProvenance(repo))
+        return false;
+    const last = readSharedRestoreAttempt(repo);
+    if (last?.outcome === "failed" && now - Date.parse(last.attemptedAt) < FAILURE_BACKOFF_MS)
+        return false;
+    return true;
+}
+/** Safe cold-start optimization: every failure returns to the caller for local fallback. */
+export async function attemptOpportunisticSharedRestore(repo, engine) {
+    if (!shouldAttemptOpportunisticRestore(repo))
+        return null;
+    const configuration = loadSharedIndexConfig(repo);
+    if (configuration.state !== "configured")
+        return null;
+    const store = createSharedObjectStore(configuration.config);
+    if (!store)
+        return null;
+    return restoreSharedIndex({
+        repo,
+        config: configuration.config,
+        store,
+        engine,
+        clientCompatibility: currentSharedIndexCompatibility(),
+    });
+}

package/dist/src/shared-index/overlay.js

@@ -0,0 +1,98 @@
+import child_process from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { compareBytes } from "../compare.js";
+import { isIndexableSourcePath } from "../engine/source-policy.js";
+import { SharedIndexError } from "./s3-client.js";
+function split(output) {
+    return output.split("\0").filter(Boolean);
+}
+function gitPaths(repo, args) {
+    try {
+        return split(child_process.execFileSync("git", args, {
+            cwd: repo,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            maxBuffer: 64 * 1024 * 1024,
+        }));
+    }
+    catch {
+        throw new SharedIndexError("unavailable", "shared-index could not derive the local overlay");
+    }
+}
+function safeRelativePath(repo, value) {
+    const normalized = value.replaceAll("\\", "/").normalize("NFC");
+    const resolved = path.resolve(repo, normalized);
+    const relative = path.relative(path.resolve(repo), resolved);
+    if (!relative ||
+        relative.startsWith("..") ||
+        path.isAbsolute(relative) ||
+        normalized.includes("\0"))
+        throw new SharedIndexError("integrity", "shared-index Git overlay contains an unsafe path");
+    return relative.replaceAll("\\", "/");
+}
+function digestFile(target) {
+    const hash = crypto.createHash("sha256");
+    const descriptor = fs.openSync(target, "r");
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    try {
+        for (;;) {
+            const bytes = fs.readSync(descriptor, buffer, 0, buffer.byteLength, null);
+            if (bytes === 0)
+                break;
+            hash.update(buffer.subarray(0, bytes));
+        }
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    return hash.digest("hex");
+}
+export function deriveSharedOverlay(repo, snapshotCommit) {
+    const resolved = path.resolve(repo);
+    const committed = new Set(gitPaths(resolved, [
+        "diff",
+        "--name-only",
+        "--no-renames",
+        "-z",
+        snapshotCommit,
+        "HEAD",
+        "--",
+    ]).map((file) => safeRelativePath(resolved, file)));
+    const staged = new Set(gitPaths(resolved, ["diff", "--cached", "--name-only", "--no-renames", "-z", "HEAD", "--"]).map((file) => safeRelativePath(resolved, file)));
+    const working = new Set(gitPaths(resolved, ["diff", "--name-only", "--no-renames", "-z", "--"]).map((file) => safeRelativePath(resolved, file)));
+    const untracked = new Set(gitPaths(resolved, ["ls-files", "--others", "--exclude-standard", "-z", "--"])
+        .map((file) => safeRelativePath(resolved, file))
+        .filter((file) => isIndexableSourcePath(file)));
+    const changedPaths = [...new Set([...committed, ...staged, ...working, ...untracked])].sort(compareBytes);
+    const deletedPaths = changedPaths.filter((file) => !fs.existsSync(path.join(resolved, file))).length;
+    const fingerprint = crypto.createHash("sha256");
+    fingerprint.update(`snapshot\0${snapshotCommit}\0`);
+    for (const file of changedPaths) {
+        const absolute = path.join(resolved, file);
+        let digest = "deleted";
+        try {
+            const stat = fs.lstatSync(absolute);
+            if (stat.isFile() && !stat.isSymbolicLink())
+                digest = digestFile(absolute);
+            else
+                digest = "ineligible";
+        }
+        catch {
+            // Final disk truth is deletion even when a path changed in several layers.
+        }
+        fingerprint.update(`${Buffer.byteLength(file)}:${file}\0${digest}\0`);
+    }
+    return {
+        changedPaths,
+        counts: {
+            committedPaths: committed.size,
+            stagedPaths: staged.size,
+            workingTreePaths: working.size,
+            deletedPaths,
+            untrackedPaths: untracked.size,
+        },
+        effectiveTreeFingerprint: fingerprint.digest("hex"),
+    };
+}

package/dist/src/shared-index/provenance.js

@@ -0,0 +1,149 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { Database } from "../engine/sqlite.js";
+import { resolveDbPath, resolveStateDir } from "../engine/state-paths.js";
+const counts = z
+    .object({
+    committedPaths: z.number().int().nonnegative(),
+    stagedPaths: z.number().int().nonnegative(),
+    workingTreePaths: z.number().int().nonnegative(),
+    deletedPaths: z.number().int().nonnegative(),
+    untrackedPaths: z.number().int().nonnegative(),
+})
+    .strict();
+export const sharedIndexProvenanceSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    enabled: z.boolean(),
+    state: z.enum([
+        "disabled",
+        "not-configured",
+        "configuration-invalid",
+        "local-only",
+        "restore-pending",
+        "restored-and-verified",
+        "restore-failed",
+    ]),
+    registrationId: z.string().optional(),
+    baseCommit: z
+        .string()
+        .regex(/^[a-f0-9]{40,64}$/)
+        .optional(),
+    manifestDigest: z
+        .string()
+        .regex(/^[a-f0-9]{64}$/)
+        .optional(),
+    source: z.enum(["local-index", "shared-snapshot"]),
+    cache: z.enum(["not-used", "downloaded", "hit", "unavailable", "corrupt-refetched"]).optional(),
+    overlay: counts.optional(),
+    failureCategory: z
+        .enum([
+        "authentication",
+        "authorization",
+        "not-found",
+        "timeout",
+        "integrity",
+        "compatibility",
+        "configuration",
+        "unavailable",
+    ])
+        .optional(),
+    effectiveTreeFingerprint: z
+        .string()
+        .regex(/^[a-f0-9]{64}$/)
+        .optional(),
+    restoredAt: z.iso.datetime().optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.state === "restored-and-verified" &&
+        (!value.registrationId ||
+            !value.baseCommit ||
+            !value.manifestDigest ||
+            !value.cache ||
+            !value.overlay ||
+            !value.effectiveTreeFingerprint ||
+            !value.restoredAt))
+        context.addIssue({ code: "custom", message: "verified provenance is incomplete" });
+    if (value.state === "restore-failed" && !value.failureCategory)
+        context.addIssue({ code: "custom", message: "failed provenance has no category" });
+});
+export const EMPTY_OVERLAY = {
+    committedPaths: 0,
+    stagedPaths: 0,
+    workingTreePaths: 0,
+    deletedPaths: 0,
+    untrackedPaths: 0,
+};
+function atomicJson(target, value) {
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    const temporary = `${target}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { flag: "wx", mode: 0o600 });
+    const descriptor = fs.openSync(temporary, "r");
+    try {
+        fs.fsyncSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    fs.renameSync(temporary, target);
+}
+export function readSharedIndexProvenance(repo) {
+    // The active database is authoritative. A sidecar from an older restore must
+    // never survive a later local rebuild as misleading current provenance.
+    const databasePath = resolveDbPath(repo);
+    if (!fs.existsSync(databasePath))
+        return null;
+    try {
+        const db = new Database(databasePath, { readonly: true });
+        try {
+            const get = (key) => db.query("SELECT value FROM meta WHERE key = ?").get(key)
+                ?.value ?? null;
+            const registrationId = get("sharedIndexRegistrationId");
+            const baseCommit = get("sharedIndexBaseCommit");
+            const manifestDigest = get("sharedIndexManifestDigest");
+            if (!registrationId || !baseCommit || !manifestDigest)
+                return null;
+            return sharedIndexProvenanceSchema.parse({
+                schemaVersion: 1,
+                enabled: true,
+                state: "restored-and-verified",
+                registrationId,
+                baseCommit,
+                manifestDigest,
+                source: "shared-snapshot",
+                cache: get("sharedIndexCache") ?? "unavailable",
+                overlay: JSON.parse(get("sharedIndexOverlay") ?? "null"),
+                effectiveTreeFingerprint: get("sharedIndexEffectiveTreeFingerprint") ?? undefined,
+                restoredAt: get("sharedIndexRestoredAt") ?? undefined,
+            });
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSharedIndexProvenance(repo, value) {
+    atomicJson(path.join(resolveStateDir(repo), "shared-index-provenance.json"), sharedIndexProvenanceSchema.parse(value));
+}
+export function readSharedRestoreAttempt(repo) {
+    try {
+        const value = JSON.parse(fs.readFileSync(path.join(resolveStateDir(repo), "shared-index-last-attempt.json"), "utf8"));
+        if (value.schemaVersion !== 1 ||
+            (value.outcome !== "restored" && value.outcome !== "failed") ||
+            !Number.isFinite(Date.parse(value.attemptedAt)))
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSharedRestoreAttempt(repo, value) {
+    atomicJson(path.join(resolveStateDir(repo), "shared-index-last-attempt.json"), value);
+}

package/dist/src/shared-index/publisher.js

@@ -0,0 +1,198 @@
+import child_process from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createZstdCompress } from "node:zlib";
+import { Database } from "../engine/sqlite.js";
+import { resolveDbPath } from "../engine/state-paths.js";
+import { currentSharedIndexCompatibility } from "./compatibility.js";
+import { canonicalManifestBytes, SHARED_INDEX_LIMITS, sha256Hex, sharedBranchMatches, sharedRepositoryPrefix, } from "./contract.js";
+import { branchPointerKey, compatibilityFingerprint, signatureKey, validatePointerBinding, verifyManifest, } from "./manifest.js";
+import { SharedIndexError } from "./s3-client.js";
+import { parseBranchPointer, parseManifest } from "./schemas.js";
+/** Stamp the exact compatibility fingerprint into the checkpointed publisher DB. */
+export function prepareSharedPublisherDatabase(repo) {
+    const databasePath = resolveDbPath(repo);
+    if (!fs.existsSync(databasePath))
+        throw new SharedIndexError("configuration", "shared-index publisher database is missing");
+    const compatibility = currentSharedIndexCompatibility();
+    const inputFingerprint = compatibilityFingerprint(compatibility);
+    const db = new Database(databasePath);
+    try {
+        const commit = db.query("SELECT value FROM meta WHERE key='lastIndexedHead'").get()
+            ?.value ?? "";
+        if (!/^[a-f0-9]{40,64}$/.test(commit))
+            throw new SharedIndexError("integrity", "shared-index publisher database has no valid indexed commit");
+        const schema = db
+            .query("PRAGMA user_version")
+            .get()?.user_version;
+        if (schema !== compatibility.databaseSchemaVersion)
+            throw new SharedIndexError("compatibility", "shared-index publisher database schema is incompatible");
+        db.run("INSERT INTO meta(key, value) VALUES ('sharedIndexInputFingerprint', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value", [inputFingerprint]);
+        db.run("PRAGMA wal_checkpoint(TRUNCATE)");
+        return { schemaVersion: 1, compatibility, inputFingerprint, commit };
+    }
+    finally {
+        db.close();
+        for (const suffix of ["-wal", "-shm"])
+            fs.rmSync(`${databasePath}${suffix}`, { force: true });
+    }
+}
+function safeOutputDirectory(target) {
+    const resolved = path.resolve(target);
+    if (fs.existsSync(resolved)) {
+        const stat = fs.lstatSync(resolved);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || fs.readdirSync(resolved).length > 0)
+            throw new SharedIndexError("configuration", "shared-index publisher output must be a new or empty non-symlink directory");
+    }
+    else
+        fs.mkdirSync(resolved, { recursive: true, mode: 0o700 });
+    fs.chmodSync(resolved, 0o700);
+    return resolved;
+}
+function countingHash(hash, count) {
+    return new Transform({
+        transform(chunk, _encoding, callback) {
+            count.bytes += chunk.byteLength;
+            hash.update(chunk);
+            callback(null, chunk);
+        },
+    });
+}
+export async function createSharedPublisherBundle(options) {
+    if (!options.config.enabled)
+        throw new SharedIndexError("configuration", "shared-index publishing is disabled");
+    if (!options.config.branches.some((pattern) => sharedBranchMatches(pattern, options.branch)))
+        throw new SharedIndexError("configuration", "shared-index publishing branch is not configured");
+    const metadata = prepareSharedPublisherDatabase(options.repo);
+    const head = child_process
+        .execFileSync("git", ["rev-parse", "--verify", "HEAD"], {
+        cwd: options.repo,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    })
+        .trim();
+    if (head !== metadata.commit)
+        throw new SharedIndexError("integrity", "shared-index publisher graph does not match repository HEAD");
+    const output = safeOutputDirectory(options.outputDirectory);
+    const graphFile = path.join(output, "graph.sqlite.zst");
+    const manifestFile = path.join(output, "manifest.json");
+    const signatureFile = path.join(output, "manifest.sig");
+    const pointerFile = path.join(output, "branch-pointer.json");
+    const databasePath = resolveDbPath(options.repo);
+    const uncompressedHash = crypto.createHash("sha256");
+    const compressedHash = crypto.createHash("sha256");
+    const uncompressed = { bytes: 0 };
+    const compressed = { bytes: 0 };
+    await pipeline(fs.createReadStream(databasePath), countingHash(uncompressedHash, uncompressed), createZstdCompress(), countingHash(compressedHash, compressed), fs.createWriteStream(graphFile, { flags: "wx", mode: 0o600 }));
+    if (uncompressed.bytes <= 0 ||
+        uncompressed.bytes > SHARED_INDEX_LIMITS.uncompressedBytes ||
+        compressed.bytes <= 0 ||
+        compressed.bytes > SHARED_INDEX_LIMITS.compressedBytes)
+        throw new SharedIndexError("integrity", "shared-index publisher graph exceeds contract bounds");
+    const immutable = `${sharedRepositoryPrefix(options.config.repository)}snapshots/${metadata.commit}/${metadata.inputFingerprint}`;
+    const graphKey = `${immutable}/graph.sqlite.zst`;
+    const manifestKey = `${immutable}/manifest.json`;
+    const manifest = {
+        schemaVersion: 1,
+        registrationId: options.config.registrationId,
+        repository: options.config.repository,
+        commit: metadata.commit,
+        generatedAt: new Date().toISOString(),
+        compatibility: metadata.compatibility,
+        graph: {
+            key: graphKey,
+            compressedSha256: compressedHash.digest("hex"),
+            compressedBytes: compressed.bytes,
+            uncompressedSha256: uncompressedHash.digest("hex"),
+            uncompressedBytes: uncompressed.bytes,
+        },
+    };
+    const manifestBytes = canonicalManifestBytes(manifest);
+    fs.writeFileSync(manifestFile, manifestBytes, { flag: "wx", mode: 0o600 });
+    const bundle = {
+        schemaVersion: 1,
+        branch: options.branch,
+        commit: metadata.commit,
+        inputFingerprint: metadata.inputFingerprint,
+        manifestKey,
+        manifestSha256: sha256Hex(manifestBytes),
+        signatureKey: signatureKey(manifestKey),
+        pointerKey: branchPointerKey(options.config, options.branch),
+        graphKey,
+        region: options.config.aws.region,
+        bucket: options.config.aws.bucket,
+        keyId: options.config.signing.keyId,
+        files: {
+            graph: graphFile,
+            manifest: manifestFile,
+            signature: signatureFile,
+            pointer: pointerFile,
+        },
+    };
+    fs.writeFileSync(path.join(output, "bundle.json"), `${JSON.stringify(bundle)}\n`, {
+        flag: "wx",
+        mode: 0o600,
+    });
+    return bundle;
+}
+export function finalizeSharedPublisherBundle(options) {
+    const bundle = options.bundle;
+    const directory = path.dirname(path.resolve(bundle.files?.manifest ?? ""));
+    const expectedFiles = {
+        graph: "graph.sqlite.zst",
+        manifest: "manifest.json",
+        signature: "manifest.sig",
+        pointer: "branch-pointer.json",
+    };
+    if (bundle.schemaVersion !== 1 ||
+        !/^[a-f0-9]{40,64}$/.test(bundle.commit) ||
+        !/^[a-f0-9]{64}$/.test(bundle.inputFingerprint) ||
+        !/^[a-f0-9]{64}$/.test(bundle.manifestSha256) ||
+        bundle.region !== options.config.aws.region ||
+        bundle.bucket !== options.config.aws.bucket ||
+        bundle.keyId !== options.config.signing.keyId ||
+        Object.entries(expectedFiles).some(([name, filename]) => path.resolve(bundle.files[name] ?? "") !==
+            path.join(directory, filename)))
+        throw new SharedIndexError("integrity", "shared-index publisher bundle descriptor is invalid");
+    const manifestBytes = fs.readFileSync(options.bundle.files.manifest);
+    const signature = fs.readFileSync(options.bundle.files.signature);
+    const manifest = parseManifest(manifestBytes);
+    if (!options.config.branches.some((pattern) => sharedBranchMatches(pattern, bundle.branch)) ||
+        bundle.graphKey !== manifest.graph.key ||
+        bundle.signatureKey !== signatureKey(bundle.manifestKey) ||
+        sha256Hex(manifestBytes) !== bundle.manifestSha256)
+        throw new SharedIndexError("integrity", "shared-index publisher bundle bindings are invalid");
+    const pointer = parseBranchPointer(canonicalManifestBytes({
+        schemaVersion: 1,
+        registrationId: options.config.registrationId,
+        repository: options.config.repository,
+        branch: options.bundle.branch,
+        commit: options.bundle.commit,
+        inputFingerprint: options.bundle.inputFingerprint,
+        manifestKey: options.bundle.manifestKey,
+        manifestSha256: options.bundle.manifestSha256,
+        updatedAt: new Date().toISOString(),
+    }));
+    validatePointerBinding(options.config, pointer);
+    verifyManifest(options.config, pointer, manifestBytes, manifest, signature, manifest.compatibility);
+    const pointerBytes = canonicalManifestBytes(pointer);
+    fs.writeFileSync(options.bundle.files.pointer, pointerBytes, { flag: "wx", mode: 0o600 });
+    return pointerBytes;
+}
+export function guardPublisherPointer(options) {
+    const pointer = parseBranchPointer(options.existingPointerBytes);
+    if (pointer.branch !== options.branch)
+        throw new SharedIndexError("integrity", "shared-index existing pointer branch is invalid");
+    validatePointerBinding(options.config, pointer);
+    if (pointer.commit === options.newCommit)
+        return;
+    const relation = child_process.spawnSync("git", ["merge-base", "--is-ancestor", pointer.commit, options.newCommit], { cwd: options.repo, stdio: "ignore" });
+    if (relation.status !== 0)
+        throw new SharedIndexError("compatibility", "shared-index publisher refuses a backward or diverged pointer update");
+}
+export function publisherPointerKey(config, branch) {
+    return branchPointerKey(config, branch);
+}