open-multi-agent-kit 1.0.0 → 1.2.2

package/dist/core/verified-run/git-execution.js

@@ -0,0 +1,118 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync, lstatSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { devNull, tmpdir } from "node:os";
+import { join } from "node:path";
+import { performance } from "node:perf_hooks";
+import { VerifiedRunError } from "./storage.js";
+const COMMAND_TIMEOUT_MS = 30_000;
+const MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
+const ENV_NAMES = ["PATH", "SystemRoot", "SYSTEMROOT", "WINDIR", "TMPDIR", "TEMP", "TMP"];
+export class GitOperationBudget {
+    deadline;
+    clock;
+    signal;
+    counts = new Map();
+    constructor(options = {}) {
+        const timeout = options.timeoutMs ?? COMMAND_TIMEOUT_MS;
+        if (!Number.isFinite(timeout) || timeout <= 0)
+            throw new VerifiedRunError("deadline");
+        this.clock = options.clock ?? (() => performance.now());
+        this.deadline = this.clock() + timeout;
+        this.signal = options.signal;
+    }
+    remaining() {
+        return Math.min(COMMAND_TIMEOUT_MS, this.remainingWorkMs());
+    }
+    remainingWorkMs() {
+        if (this.signal?.aborted)
+            throw new VerifiedRunError("cancelled");
+        const remaining = this.deadline - this.clock();
+        if (!(remaining > 0))
+            throw new VerifiedRunError("deadline");
+        return Math.max(1, Math.ceil(remaining));
+    }
+    record(command) {
+        this.counts.set(command, (this.counts.get(command) ?? 0) + 1);
+    }
+    get commandCounts() {
+        return Object.freeze(Object.fromEntries(this.counts));
+    }
+}
+export function assertPrivateEmptyHooks(path) {
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() ||
+        stat.isSymbolicLink() ||
+        (stat.mode & 0o777) !== 0o700 ||
+        (process.getuid && stat.uid !== process.getuid()) ||
+        readdirSync(path).length !== 0)
+        throw new VerifiedRunError("git_hooks_boundary");
+}
+function gitEnvironment(write) {
+    const env = {};
+    for (const name of ENV_NAMES)
+        if (process.env[name] !== undefined)
+            env[name] = process.env[name];
+    return {
+        ...env,
+        GIT_CONFIG_NOSYSTEM: "1",
+        GIT_CONFIG_GLOBAL: devNull,
+        GIT_CONFIG_COUNT: "0",
+        GIT_TERMINAL_PROMPT: "0",
+        GIT_NO_REPLACE_OBJECTS: "1",
+        GIT_OPTIONAL_LOCKS: write ? "1" : "0",
+        LC_ALL: "C",
+        GIT_AUTHOR_NAME: "OMK verified-run",
+        GIT_AUTHOR_EMAIL: "omk-verified-run@localhost",
+        GIT_AUTHOR_DATE: "2000-01-01T00:00:00Z",
+        GIT_COMMITTER_NAME: "OMK verified-run",
+        GIT_COMMITTER_EMAIL: "omk-verified-run@localhost",
+        GIT_COMMITTER_DATE: "2000-01-01T00:00:00Z",
+    };
+}
+/** A private hooks directory belongs to this synchronous child, never to a predictable shared path. */
+export function runGit(root, args, options = {}) {
+    const budget = options.budget ?? new GitOperationBudget();
+    budget.remaining();
+    const hooks = mkdtempSync(join(tmpdir(), "omk-verified-git-"));
+    try {
+        chmodSync(hooks, 0o700);
+        assertPrivateEmptyHooks(hooks);
+        const isolated = [
+            "-c",
+            `core.hooksPath=${hooks}`,
+            "-c",
+            "core.fsmonitor=false",
+            "-c",
+            "gc.auto=0",
+            "-c",
+            "maintenance.auto=false",
+            "-c",
+            "commit.gpgsign=false",
+            "-C",
+            root,
+            ...args,
+        ];
+        const timeout = budget.remaining();
+        budget.record(args[0] ?? "unknown");
+        const result = spawnSync("git", isolated, {
+            env: gitEnvironment(options.write === true),
+            maxBuffer: MAX_OUTPUT_BYTES,
+            timeout,
+            killSignal: "SIGKILL",
+            stdio: [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+            input: options.input,
+            windowsHide: true,
+        });
+        if (result.error !== undefined)
+            throw new VerifiedRunError(options.write ? "git_outcome_unknown" : "git_plumbing");
+        const allowed = options.allowedExitCodes ?? [0];
+        if (result.status === null || !allowed.includes(result.status))
+            throw new VerifiedRunError("git_plumbing");
+        return { status: result.status, stdout: result.stdout };
+    }
+    finally {
+        // spawnSync has observed the direct child's exit, including SIGKILL on timeout.
+        rmSync(hooks, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=git-execution.js.map

package/dist/core/verified-run/git-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-execution.js","sourceRoot":"","sources":["../../../src/core/verified-run/git-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAE1F,MAAM,OAAO,kBAAkB;IACb,QAAQ,CAAS;IACjB,KAAK,CAAe;IACpB,MAAM,CAA0B;IAChC,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,YAAY,OAAO,GAAuE,EAAE,EAAE;QAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAAA,CAC7B;IACD,SAAS,GAAW;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IAAA,CAC5D;IACD,eAAe,GAAW;QACzB,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/C,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAAA,CACzC;IACD,MAAM,CAAC,OAAe,EAAQ;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAAA,CAC9D;IACD,IAAI,aAAa,GAAqC;QACrD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAAA,CACtD;CACD;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAQ;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IACC,CAAC,IAAI,CAAC,WAAW,EAAE;QACnB,IAAI,CAAC,cAAc,EAAE;QACrB,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;QAC7B,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACjD,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAE9B,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;AAAA,CAClD;AAED,SAAS,cAAc,CAAC,KAAc,EAAqB;IAC1D,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,SAAS;QAAE,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjG,OAAO;QACN,GAAG,GAAG;QACN,mBAAmB,EAAE,GAAG;QACxB,iBAAiB,EAAE,OAAO;QAC1B,gBAAgB,EAAE,GAAG;QACrB,mBAAmB,EAAE,GAAG;QACxB,sBAAsB,EAAE,GAAG;QAC3B,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QACrC,MAAM,EAAE,GAAG;QACX,eAAe,EAAE,kBAAkB;QACnC,gBAAgB,EAAE,4BAA4B;QAC9C,eAAe,EAAE,sBAAsB;QACvC,kBAAkB,EAAE,kBAAkB;QACtC,mBAAmB,EAAE,4BAA4B;QACjD,kBAAkB,EAAE,sBAAsB;KAC1C,CAAC;AAAA,CACF;AAED,uGAAuG;AACvG,MAAM,UAAU,MAAM,CACrB,IAAY,EACZ,IAAuB,EACvB,OAAO,GAA2G,EAAE,EAC/E;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;IAC1D,MAAM,CAAC,SAAS,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC;QACJ,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxB,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG;YAChB,IAAI;YACJ,kBAAkB,KAAK,EAAE;YACzB,IAAI;YACJ,sBAAsB;YACtB,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,wBAAwB;YACxB,IAAI;YACJ,sBAAsB;YACtB,IAAI;YACJ,IAAI;YACJ,GAAG,IAAI;SACP,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;YACzC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;YAC3C,SAAS,EAAE,gBAAgB;YAC3B,OAAO;YACP,UAAU,EAAE,SAAS;YACrB,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YACxE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAC7B,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAC3G,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;YAAS,CAAC;QACV,gFAAgF;QAChF,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AAAA,CACD","sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport { chmodSync, lstatSync, mkdtempSync, readdirSync, rmSync } from \"node:fs\";\nimport { devNull, tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst MAX_OUTPUT_BYTES = 16 * 1024 * 1024;\nconst ENV_NAMES = [\"PATH\", \"SystemRoot\", \"SYSTEMROOT\", \"WINDIR\", \"TMPDIR\", \"TEMP\", \"TMP\"];\n\nexport class GitOperationBudget {\n\tprivate readonly deadline: number;\n\tprivate readonly clock: () => number;\n\tprivate readonly signal: AbortSignal | undefined;\n\tprivate readonly counts = new Map<string, number>();\n\tconstructor(options: { timeoutMs?: number; signal?: AbortSignal; clock?: () => number } = {}) {\n\t\tconst timeout = options.timeoutMs ?? COMMAND_TIMEOUT_MS;\n\t\tif (!Number.isFinite(timeout) || timeout <= 0) throw new VerifiedRunError(\"deadline\");\n\t\tthis.clock = options.clock ?? (() => performance.now());\n\t\tthis.deadline = this.clock() + timeout;\n\t\tthis.signal = options.signal;\n\t}\n\tremaining(): number {\n\t\treturn Math.min(COMMAND_TIMEOUT_MS, this.remainingWorkMs());\n\t}\n\tremainingWorkMs(): number {\n\t\tif (this.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t\tconst remaining = this.deadline - this.clock();\n\t\tif (!(remaining > 0)) throw new VerifiedRunError(\"deadline\");\n\t\treturn Math.max(1, Math.ceil(remaining));\n\t}\n\trecord(command: string): void {\n\t\tthis.counts.set(command, (this.counts.get(command) ?? 0) + 1);\n\t}\n\tget commandCounts(): Readonly<Record<string, number>> {\n\t\treturn Object.freeze(Object.fromEntries(this.counts));\n\t}\n}\n\nexport function assertPrivateEmptyHooks(path: string): void {\n\tconst stat = lstatSync(path);\n\tif (\n\t\t!stat.isDirectory() ||\n\t\tstat.isSymbolicLink() ||\n\t\t(stat.mode & 0o777) !== 0o700 ||\n\t\t(process.getuid && stat.uid !== process.getuid()) ||\n\t\treaddirSync(path).length !== 0\n\t)\n\t\tthrow new VerifiedRunError(\"git_hooks_boundary\");\n}\n\nfunction gitEnvironment(write: boolean): NodeJS.ProcessEnv {\n\tconst env: NodeJS.ProcessEnv = {};\n\tfor (const name of ENV_NAMES) if (process.env[name] !== undefined) env[name] = process.env[name];\n\treturn {\n\t\t...env,\n\t\tGIT_CONFIG_NOSYSTEM: \"1\",\n\t\tGIT_CONFIG_GLOBAL: devNull,\n\t\tGIT_CONFIG_COUNT: \"0\",\n\t\tGIT_TERMINAL_PROMPT: \"0\",\n\t\tGIT_NO_REPLACE_OBJECTS: \"1\",\n\t\tGIT_OPTIONAL_LOCKS: write ? \"1\" : \"0\",\n\t\tLC_ALL: \"C\",\n\t\tGIT_AUTHOR_NAME: \"OMK verified-run\",\n\t\tGIT_AUTHOR_EMAIL: \"omk-verified-run@localhost\",\n\t\tGIT_AUTHOR_DATE: \"2000-01-01T00:00:00Z\",\n\t\tGIT_COMMITTER_NAME: \"OMK verified-run\",\n\t\tGIT_COMMITTER_EMAIL: \"omk-verified-run@localhost\",\n\t\tGIT_COMMITTER_DATE: \"2000-01-01T00:00:00Z\",\n\t};\n}\n\n/** A private hooks directory belongs to this synchronous child, never to a predictable shared path. */\nexport function runGit(\n\troot: string,\n\targs: readonly string[],\n\toptions: { write?: boolean; input?: Buffer; allowedExitCodes?: readonly number[]; budget?: GitOperationBudget } = {},\n): { status: number; stdout: Buffer } {\n\tconst budget = options.budget ?? new GitOperationBudget();\n\tbudget.remaining();\n\tconst hooks = mkdtempSync(join(tmpdir(), \"omk-verified-git-\"));\n\ttry {\n\t\tchmodSync(hooks, 0o700);\n\t\tassertPrivateEmptyHooks(hooks);\n\t\tconst isolated = [\n\t\t\t\"-c\",\n\t\t\t`core.hooksPath=${hooks}`,\n\t\t\t\"-c\",\n\t\t\t\"core.fsmonitor=false\",\n\t\t\t\"-c\",\n\t\t\t\"gc.auto=0\",\n\t\t\t\"-c\",\n\t\t\t\"maintenance.auto=false\",\n\t\t\t\"-c\",\n\t\t\t\"commit.gpgsign=false\",\n\t\t\t\"-C\",\n\t\t\troot,\n\t\t\t...args,\n\t\t];\n\t\tconst timeout = budget.remaining();\n\t\tbudget.record(args[0] ?? \"unknown\");\n\t\tconst result = spawnSync(\"git\", isolated, {\n\t\t\tenv: gitEnvironment(options.write === true),\n\t\t\tmaxBuffer: MAX_OUTPUT_BYTES,\n\t\t\ttimeout,\n\t\t\tkillSignal: \"SIGKILL\",\n\t\t\tstdio: [options.input === undefined ? \"ignore\" : \"pipe\", \"pipe\", \"pipe\"],\n\t\t\tinput: options.input,\n\t\t\twindowsHide: true,\n\t\t});\n\t\tif (result.error !== undefined)\n\t\t\tthrow new VerifiedRunError(options.write ? \"git_outcome_unknown\" : \"git_plumbing\");\n\t\tconst allowed = options.allowedExitCodes ?? [0];\n\t\tif (result.status === null || !allowed.includes(result.status)) throw new VerifiedRunError(\"git_plumbing\");\n\t\treturn { status: result.status, stdout: result.stdout };\n\t} finally {\n\t\t// spawnSync has observed the direct child's exit, including SIGKILL on timeout.\n\t\trmSync(hooks, { recursive: true, force: true });\n\t}\n}\n"]}

package/dist/core/verified-run/git-plumbing.d.ts

@@ -0,0 +1,37 @@
+import type { CandidateManifest } from "./candidate.ts";
+import { GitOperationBudget } from "./git-execution.ts";
+/** The single authoritative publication point; moved only by one old-OID CAS. */
+export declare const OMK_ACCEPTED_REF = "refs/omk/accepted";
+/**
+ * Fail closed unless `root` is exactly the git work-tree top level. Publishing is
+ * defined for a repository root only; subdirectory workspaces stay unsupported.
+ */
+export declare function assertGitWorkspaceRoot(root: string, budget?: GitOperationBudget): void;
+/** `sha1` or `sha256`; determines the zero OID length used for unborn-ref CAS. */
+export declare function repoObjectFormat(root: string, budget?: GitOperationBudget): "sha1" | "sha256";
+export declare function zeroOid(format: "sha1" | "sha256"): string;
+/** Current commit OID of `ref`, or null when the ref does not resolve. */
+export declare function resolveRef(root: string, ref: string, budget?: GitOperationBudget): string | null;
+export declare function objectExists(root: string, oid: string, budget?: GitOperationBudget): boolean;
+export interface SealCandidateInput {
+    readonly manifest: CandidateManifest;
+    readonly contents: ReadonlyMap<string, Buffer>;
+    readonly parentOid: string;
+    readonly zeroOid: string;
+    readonly runId: string;
+    readonly candidateDigest: string;
+    readonly receiptDigest: string;
+}
+/**
+ * Seal the stored candidate bytes into a deterministic commit: same manifest,
+ * parent and binding fields always produce the same OID, so a replayed publish
+ * never creates a second object identity for the same candidate.
+ */
+export declare function sealCandidateCommit(root: string, input: SealCandidateInput, budget?: GitOperationBudget): string;
+export declare class GitRefCasError extends Error {
+    readonly ref: string;
+    constructor(ref: string);
+}
+/** One old-OID compare-and-swap on a single ref. Throws GitRefCasError on any rejection; callers re-resolve to classify. */
+export declare function casRef(root: string, ref: string, newOid: string, expectedOldOid: string, budget?: GitOperationBudget): void;
+//# sourceMappingURL=git-plumbing.d.ts.map

package/dist/core/verified-run/git-plumbing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-plumbing.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/git-plumbing.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAU,MAAM,oBAAoB,CAAC;AAGhE,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAUpD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAStF;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,QAAQ,CAI7F;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAEzD;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAMhG;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAE5F;AA+FD,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,kBAAkB,EACzB,MAAM,qBAA2B,GAC/B,MAAM,CAYR;AAED,qBAAa,cAAe,SAAQ,KAAK;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,YAAY,GAAG,EAAE,MAAM,EAItB;CACD;AAED,4HAA4H;AAC5H,wBAAgB,MAAM,CACrB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,MAAM,qBAA2B,GAC/B,IAAI,CAQN","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport type { CandidateManifest } from \"./candidate.ts\";\nimport { preflightGitCandidate } from \"./git-candidate-preflight.ts\";\nimport { GitOperationBudget, runGit } from \"./git-execution.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\n/** The single authoritative publication point; moved only by one old-OID CAS. */\nexport const OMK_ACCEPTED_REF = \"refs/omk/accepted\";\n/** Full SHA-1 or SHA-256 git object names. */\nconst GIT_OID_HEX = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;\n\nfunction oidOf(stdout: Buffer): string {\n\tconst oid = stdout.toString(\"utf8\").trim();\n\tif (!GIT_OID_HEX.test(oid)) throw new VerifiedRunError(\"git_plumbing\");\n\treturn oid;\n}\n\n/**\n * Fail closed unless `root` is exactly the git work-tree top level. Publishing is\n * defined for a repository root only; subdirectory workspaces stay unsupported.\n */\nexport function assertGitWorkspaceRoot(root: string, budget?: GitOperationBudget): void {\n\tlet toplevel = \"\";\n\ttry {\n\t\ttoplevel = runGit(root, [\"rev-parse\", \"--show-toplevel\"], { budget }).stdout.toString(\"utf8\").replace(/\\n$/, \"\");\n\t} catch (error) {\n\t\tif (error instanceof VerifiedRunError && error.code === \"git_plumbing\") throw new VerifiedRunError(\"unsupported\");\n\t\tthrow error;\n\t}\n\tif (!toplevel || realpathSync(toplevel) !== realpathSync(root)) throw new VerifiedRunError(\"unsupported\");\n}\n\n/** `sha1` or `sha256`; determines the zero OID length used for unborn-ref CAS. */\nexport function repoObjectFormat(root: string, budget?: GitOperationBudget): \"sha1\" | \"sha256\" {\n\tconst format = runGit(root, [\"rev-parse\", \"--show-object-format\"], { budget }).stdout.toString(\"utf8\").trim();\n\tif (format !== \"sha1\" && format !== \"sha256\") throw new VerifiedRunError(\"git_plumbing\");\n\treturn format;\n}\n\nexport function zeroOid(format: \"sha1\" | \"sha256\"): string {\n\treturn \"0\".repeat(format === \"sha1\" ? 40 : 64);\n}\n\n/** Current commit OID of `ref`, or null when the ref does not resolve. */\nexport function resolveRef(root: string, ref: string, budget?: GitOperationBudget): string | null {\n\tconst result = runGit(root, [\"rev-parse\", \"--verify\", \"--quiet\", `${ref}^{commit}`], {\n\t\tallowedExitCodes: [0, 1],\n\t\tbudget,\n\t});\n\treturn result.status === 0 ? oidOf(result.stdout) : null;\n}\n\nexport function objectExists(root: string, oid: string, budget?: GitOperationBudget): boolean {\n\treturn runGit(root, [\"cat-file\", \"-e\", `${oid}^{commit}`], { allowedExitCodes: [0, 1], budget }).status === 0;\n}\n\nfunction treeSortKey(name: string, directory: boolean): Buffer {\n\treturn Buffer.from(directory ? `${name}/` : name, \"utf8\");\n}\n\n/** Git trees only distinguish non-executable `100644` from executable `100755`. */\nfunction gitFileMode(mode: number): \"100644\" | \"100755\" {\n\tconst executable = (mode & 0o111) !== 0;\n\tif (executable ? mode !== 0o755 : mode !== 0o644) throw new VerifiedRunError(\"mode_unrepresentable\");\n\treturn executable ? \"100755\" : \"100644\";\n}\n\n/** Rebuild the manifest's exact directory hierarchy with `git mktree`; only regular files exist in candidates. */\nfunction buildTree(\n\troot: string,\n\tmanifest: CandidateManifest,\n\tcontents: ReadonlyMap<string, Buffer>,\n\tbudget: GitOperationBudget,\n): string {\n\tconst blobOids = new Map<string, string>();\n\tfor (const file of manifest.files) {\n\t\tif (blobOids.has(file.digest)) continue;\n\t\tconst bytes = contents.get(file.digest);\n\t\tif (!bytes || bytes.length !== file.size) throw new VerifiedRunError(\"integrity\");\n\t\tblobOids.set(\n\t\t\tfile.digest,\n\t\t\toidOf(runGit(root, [\"hash-object\", \"-w\", \"--stdin\"], { write: true, input: bytes, budget }).stdout),\n\t\t);\n\t}\n\tconst children = new Map<string, { files: CandidateManifest[\"files\"][number][]; dirs: string[] }>();\n\tchildren.set(\"\", { files: [], dirs: [] });\n\tfor (const directory of manifest.directories) children.set(directory, { files: [], dirs: [] });\n\tfor (const file of manifest.files) {\n\t\tconst parent = file.path.includes(\"/\") ? file.path.slice(0, file.path.lastIndexOf(\"/\")) : \"\";\n\t\tchildren.get(parent)?.files.push(file);\n\t}\n\tfor (const directory of manifest.directories) {\n\t\tconst parent = directory.includes(\"/\") ? directory.slice(0, directory.lastIndexOf(\"/\")) : \"\";\n\t\tchildren.get(parent)?.dirs.push(directory);\n\t}\n\tconst treeOids = new Map<string, string>();\n\tconst ordered = [...manifest.directories].sort((left, right) => right.length - left.length);\n\tfor (const directory of ordered) {\n\t\tconst entries = children.get(directory);\n\t\tif (!entries) throw new VerifiedRunError(\"integrity\");\n\t\ttreeOids.set(directory, mintTree(root, entries, treeOids, blobOids, budget));\n\t}\n\tconst top = children.get(\"\");\n\tif (!top) throw new VerifiedRunError(\"integrity\");\n\tconst tree = mintTree(root, top, treeOids, blobOids, budget);\n\tconst expected = [\n\t\t...manifest.files.map((file) => `${gitFileMode(file.mode)} blob ${blobOids.get(file.digest)}\\t${file.path}`),\n\t\t...manifest.directories.map((path) => `040000 tree ${treeOids.get(path)}\\t${path}`),\n\t].sort();\n\tconst output = runGit(root, [\"ls-tree\", \"-r\", \"-t\", \"-z\", tree], { budget }).stdout.toString(\"utf8\");\n\tconst observed = output.split(\"\\0\").filter(Boolean).sort();\n\tif (expected.length !== observed.length || expected.some((entry, i) => entry !== observed[i]))\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn tree;\n}\n\nfunction mintTree(\n\troot: string,\n\tentries: { files: CandidateManifest[\"files\"][number][]; dirs: string[] },\n\ttreeOids: ReadonlyMap<string, string>,\n\tblobOids: ReadonlyMap<string, string>,\n\tbudget: GitOperationBudget,\n): string {\n\tconst lines: { key: Buffer; line: string }[] = [];\n\tfor (const file of entries.files) {\n\t\tconst name = file.path.slice(file.path.lastIndexOf(\"/\") + 1);\n\t\tconst oid = blobOids.get(file.digest);\n\t\tif (!oid) throw new VerifiedRunError(\"integrity\");\n\t\tlines.push({\n\t\t\tkey: treeSortKey(name, false),\n\t\t\tline: `${gitFileMode(file.mode)} blob ${oid}\\t${name}`,\n\t\t});\n\t}\n\tfor (const directory of entries.dirs) {\n\t\tconst name = directory.slice(directory.lastIndexOf(\"/\") + 1);\n\t\tconst oid = treeOids.get(directory);\n\t\tif (!oid) throw new VerifiedRunError(\"integrity\");\n\t\tlines.push({ key: treeSortKey(name, true), line: `040000 tree ${oid}\\t${name}` });\n\t}\n\tlines.sort((left, right) => Buffer.compare(left.key, right.key));\n\treturn oidOf(\n\t\trunGit(root, [\"mktree\", \"-z\"], {\n\t\t\tbudget,\n\t\t\twrite: true,\n\t\t\tinput: Buffer.from(lines.map((entry) => `${entry.line}\\0`).join(\"\"), \"utf8\"),\n\t\t}).stdout,\n\t);\n}\n\nexport interface SealCandidateInput {\n\treadonly manifest: CandidateManifest;\n\treadonly contents: ReadonlyMap<string, Buffer>;\n\treadonly parentOid: string;\n\treadonly zeroOid: string;\n\treadonly runId: string;\n\treadonly candidateDigest: string;\n\treadonly receiptDigest: string;\n}\n\n/**\n * Seal the stored candidate bytes into a deterministic commit: same manifest,\n * parent and binding fields always produce the same OID, so a replayed publish\n * never creates a second object identity for the same candidate.\n */\nexport function sealCandidateCommit(\n\troot: string,\n\tinput: SealCandidateInput,\n\tbudget = new GitOperationBudget(),\n): string {\n\tbudget.remaining();\n\tpreflightGitCandidate(input.manifest, input.contents);\n\tif (digestObject(input.manifest) !== input.candidateDigest) throw new VerifiedRunError(\"integrity\");\n\tconst tree = buildTree(root, input.manifest, input.contents, budget);\n\tconst args = [\"commit-tree\", tree];\n\tif (input.parentOid !== input.zeroOid) args.push(\"-p\", input.parentOid);\n\targs.push(\n\t\t\"-m\",\n\t\t`omk: verified candidate\\n\\nrun: ${input.runId}\\ncandidate: ${input.candidateDigest}\\nreceipt: ${input.receiptDigest}\\n`,\n\t);\n\treturn oidOf(runGit(root, args, { write: true, budget }).stdout);\n}\n\nexport class GitRefCasError extends Error {\n\treadonly ref: string;\n\tconstructor(ref: string) {\n\t\tsuper(`git update-ref rejected ${ref}`);\n\t\tthis.name = \"GitRefCasError\";\n\t\tthis.ref = ref;\n\t}\n}\n\n/** One old-OID compare-and-swap on a single ref. Throws GitRefCasError on any rejection; callers re-resolve to classify. */\nexport function casRef(\n\troot: string,\n\tref: string,\n\tnewOid: string,\n\texpectedOldOid: string,\n\tbudget = new GitOperationBudget(),\n): void {\n\tbudget.remaining();\n\ttry {\n\t\trunGit(root, [\"update-ref\", ref, newOid, expectedOldOid], { write: true, budget });\n\t} catch (error) {\n\t\tif (error instanceof VerifiedRunError && error.code === \"git_plumbing\") throw new GitRefCasError(ref);\n\t\tthrow error;\n\t}\n}\n"]}

package/dist/core/verified-run/git-plumbing.js

@@ -0,0 +1,171 @@
+import { realpathSync } from "node:fs";
+import { preflightGitCandidate } from "./git-candidate-preflight.js";
+import { GitOperationBudget, runGit } from "./git-execution.js";
+import { digestObject, VerifiedRunError } from "./storage.js";
+/** The single authoritative publication point; moved only by one old-OID CAS. */
+export const OMK_ACCEPTED_REF = "refs/omk/accepted";
+/** Full SHA-1 or SHA-256 git object names. */
+const GIT_OID_HEX = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+function oidOf(stdout) {
+    const oid = stdout.toString("utf8").trim();
+    if (!GIT_OID_HEX.test(oid))
+        throw new VerifiedRunError("git_plumbing");
+    return oid;
+}
+/**
+ * Fail closed unless `root` is exactly the git work-tree top level. Publishing is
+ * defined for a repository root only; subdirectory workspaces stay unsupported.
+ */
+export function assertGitWorkspaceRoot(root, budget) {
+    let toplevel = "";
+    try {
+        toplevel = runGit(root, ["rev-parse", "--show-toplevel"], { budget }).stdout.toString("utf8").replace(/\n$/, "");
+    }
+    catch (error) {
+        if (error instanceof VerifiedRunError && error.code === "git_plumbing")
+            throw new VerifiedRunError("unsupported");
+        throw error;
+    }
+    if (!toplevel || realpathSync(toplevel) !== realpathSync(root))
+        throw new VerifiedRunError("unsupported");
+}
+/** `sha1` or `sha256`; determines the zero OID length used for unborn-ref CAS. */
+export function repoObjectFormat(root, budget) {
+    const format = runGit(root, ["rev-parse", "--show-object-format"], { budget }).stdout.toString("utf8").trim();
+    if (format !== "sha1" && format !== "sha256")
+        throw new VerifiedRunError("git_plumbing");
+    return format;
+}
+export function zeroOid(format) {
+    return "0".repeat(format === "sha1" ? 40 : 64);
+}
+/** Current commit OID of `ref`, or null when the ref does not resolve. */
+export function resolveRef(root, ref, budget) {
+    const result = runGit(root, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], {
+        allowedExitCodes: [0, 1],
+        budget,
+    });
+    return result.status === 0 ? oidOf(result.stdout) : null;
+}
+export function objectExists(root, oid, budget) {
+    return runGit(root, ["cat-file", "-e", `${oid}^{commit}`], { allowedExitCodes: [0, 1], budget }).status === 0;
+}
+function treeSortKey(name, directory) {
+    return Buffer.from(directory ? `${name}/` : name, "utf8");
+}
+/** Git trees only distinguish non-executable `100644` from executable `100755`. */
+function gitFileMode(mode) {
+    const executable = (mode & 0o111) !== 0;
+    if (executable ? mode !== 0o755 : mode !== 0o644)
+        throw new VerifiedRunError("mode_unrepresentable");
+    return executable ? "100755" : "100644";
+}
+/** Rebuild the manifest's exact directory hierarchy with `git mktree`; only regular files exist in candidates. */
+function buildTree(root, manifest, contents, budget) {
+    const blobOids = new Map();
+    for (const file of manifest.files) {
+        if (blobOids.has(file.digest))
+            continue;
+        const bytes = contents.get(file.digest);
+        if (!bytes || bytes.length !== file.size)
+            throw new VerifiedRunError("integrity");
+        blobOids.set(file.digest, oidOf(runGit(root, ["hash-object", "-w", "--stdin"], { write: true, input: bytes, budget }).stdout));
+    }
+    const children = new Map();
+    children.set("", { files: [], dirs: [] });
+    for (const directory of manifest.directories)
+        children.set(directory, { files: [], dirs: [] });
+    for (const file of manifest.files) {
+        const parent = file.path.includes("/") ? file.path.slice(0, file.path.lastIndexOf("/")) : "";
+        children.get(parent)?.files.push(file);
+    }
+    for (const directory of manifest.directories) {
+        const parent = directory.includes("/") ? directory.slice(0, directory.lastIndexOf("/")) : "";
+        children.get(parent)?.dirs.push(directory);
+    }
+    const treeOids = new Map();
+    const ordered = [...manifest.directories].sort((left, right) => right.length - left.length);
+    for (const directory of ordered) {
+        const entries = children.get(directory);
+        if (!entries)
+            throw new VerifiedRunError("integrity");
+        treeOids.set(directory, mintTree(root, entries, treeOids, blobOids, budget));
+    }
+    const top = children.get("");
+    if (!top)
+        throw new VerifiedRunError("integrity");
+    const tree = mintTree(root, top, treeOids, blobOids, budget);
+    const expected = [
+        ...manifest.files.map((file) => `${gitFileMode(file.mode)} blob ${blobOids.get(file.digest)}\t${file.path}`),
+        ...manifest.directories.map((path) => `040000 tree ${treeOids.get(path)}\t${path}`),
+    ].sort();
+    const output = runGit(root, ["ls-tree", "-r", "-t", "-z", tree], { budget }).stdout.toString("utf8");
+    const observed = output.split("\0").filter(Boolean).sort();
+    if (expected.length !== observed.length || expected.some((entry, i) => entry !== observed[i]))
+        throw new VerifiedRunError("integrity");
+    return tree;
+}
+function mintTree(root, entries, treeOids, blobOids, budget) {
+    const lines = [];
+    for (const file of entries.files) {
+        const name = file.path.slice(file.path.lastIndexOf("/") + 1);
+        const oid = blobOids.get(file.digest);
+        if (!oid)
+            throw new VerifiedRunError("integrity");
+        lines.push({
+            key: treeSortKey(name, false),
+            line: `${gitFileMode(file.mode)} blob ${oid}\t${name}`,
+        });
+    }
+    for (const directory of entries.dirs) {
+        const name = directory.slice(directory.lastIndexOf("/") + 1);
+        const oid = treeOids.get(directory);
+        if (!oid)
+            throw new VerifiedRunError("integrity");
+        lines.push({ key: treeSortKey(name, true), line: `040000 tree ${oid}\t${name}` });
+    }
+    lines.sort((left, right) => Buffer.compare(left.key, right.key));
+    return oidOf(runGit(root, ["mktree", "-z"], {
+        budget,
+        write: true,
+        input: Buffer.from(lines.map((entry) => `${entry.line}\0`).join(""), "utf8"),
+    }).stdout);
+}
+/**
+ * Seal the stored candidate bytes into a deterministic commit: same manifest,
+ * parent and binding fields always produce the same OID, so a replayed publish
+ * never creates a second object identity for the same candidate.
+ */
+export function sealCandidateCommit(root, input, budget = new GitOperationBudget()) {
+    budget.remaining();
+    preflightGitCandidate(input.manifest, input.contents);
+    if (digestObject(input.manifest) !== input.candidateDigest)
+        throw new VerifiedRunError("integrity");
+    const tree = buildTree(root, input.manifest, input.contents, budget);
+    const args = ["commit-tree", tree];
+    if (input.parentOid !== input.zeroOid)
+        args.push("-p", input.parentOid);
+    args.push("-m", `omk: verified candidate\n\nrun: ${input.runId}\ncandidate: ${input.candidateDigest}\nreceipt: ${input.receiptDigest}\n`);
+    return oidOf(runGit(root, args, { write: true, budget }).stdout);
+}
+export class GitRefCasError extends Error {
+    ref;
+    constructor(ref) {
+        super(`git update-ref rejected ${ref}`);
+        this.name = "GitRefCasError";
+        this.ref = ref;
+    }
+}
+/** One old-OID compare-and-swap on a single ref. Throws GitRefCasError on any rejection; callers re-resolve to classify. */
+export function casRef(root, ref, newOid, expectedOldOid, budget = new GitOperationBudget()) {
+    budget.remaining();
+    try {
+        runGit(root, ["update-ref", ref, newOid, expectedOldOid], { write: true, budget });
+    }
+    catch (error) {
+        if (error instanceof VerifiedRunError && error.code === "git_plumbing")
+            throw new GitRefCasError(ref);
+        throw error;
+    }
+}
+//# sourceMappingURL=git-plumbing.js.map

package/dist/core/verified-run/git-plumbing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-plumbing.js","sourceRoot":"","sources":["../../../src/core/verified-run/git-plumbing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE9D,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACpD,8CAA8C;AAC9C,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAEtD,SAAS,KAAK,CAAC,MAAc,EAAU;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AAAA,CACX;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,MAA2B,EAAQ;IACvF,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAClH,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;AAAA,CAC1G;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAA2B,EAAqB;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9G,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC;AAAA,CACd;AAED,MAAM,UAAU,OAAO,CAAC,MAAyB,EAAU;IAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAAA,CAC/C;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,MAA2B,EAAiB;IACjG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,GAAG,WAAW,CAAC,EAAE;QACpF,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM;KACN,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACzD;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,GAAW,EAAE,MAA2B,EAAW;IAC7F,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAAA,CAC9G;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,SAAkB,EAAU;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAAA,CAC1D;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,IAAY,EAAuB;IACvD,MAAM,UAAU,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACrG,OAAO,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AAAA,CACxC;AAED,kHAAkH;AAClH,SAAS,SAAS,CACjB,IAAY,EACZ,QAA2B,EAC3B,QAAqC,EACrC,MAA0B,EACjB;IACT,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAClF,QAAQ,CAAC,GAAG,CACX,IAAI,CAAC,MAAM,EACX,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CACnG,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2E,CAAC;IACpG,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,WAAW;QAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/F,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5F,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACtD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG;QAChB,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5G,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;KACnF,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,QAAQ,CAChB,IAAY,EACZ,OAAwE,EACxE,QAAqC,EACrC,QAAqC,EACrC,MAA0B,EACjB;IACT,MAAM,KAAK,GAAoC,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;YAC7B,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,KAAK,IAAI,EAAE;SACtD,CAAC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,KAAK,CACX,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE;QAC9B,MAAM;QACN,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;KAC5E,CAAC,CAAC,MAAM,CACT,CAAC;AAAA,CACF;AAYD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAClC,IAAY,EACZ,KAAyB,EACzB,MAAM,GAAG,IAAI,kBAAkB,EAAE,EACxB;IACT,MAAM,CAAC,SAAS,EAAE,CAAC;IACnB,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,eAAe;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CACR,IAAI,EACJ,mCAAmC,KAAK,CAAC,KAAK,gBAAgB,KAAK,CAAC,eAAe,cAAc,KAAK,CAAC,aAAa,IAAI,CACxH,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;AAAA,CACjE;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC/B,GAAG,CAAS;IACrB,YAAY,GAAW,EAAE;QACxB,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IAAA,CACf;CACD;AAED,4HAA4H;AAC5H,MAAM,UAAU,MAAM,CACrB,IAAY,EACZ,GAAW,EACX,MAAc,EACd,cAAsB,EACtB,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAC1B;IACP,MAAM,CAAC,SAAS,EAAE,CAAC;IACnB,IAAI,CAAC;QACJ,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;QACtG,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport type { CandidateManifest } from \"./candidate.ts\";\nimport { preflightGitCandidate } from \"./git-candidate-preflight.ts\";\nimport { GitOperationBudget, runGit } from \"./git-execution.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\n/** The single authoritative publication point; moved only by one old-OID CAS. */\nexport const OMK_ACCEPTED_REF = \"refs/omk/accepted\";\n/** Full SHA-1 or SHA-256 git object names. */\nconst GIT_OID_HEX = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;\n\nfunction oidOf(stdout: Buffer): string {\n\tconst oid = stdout.toString(\"utf8\").trim();\n\tif (!GIT_OID_HEX.test(oid)) throw new VerifiedRunError(\"git_plumbing\");\n\treturn oid;\n}\n\n/**\n * Fail closed unless `root` is exactly the git work-tree top level. Publishing is\n * defined for a repository root only; subdirectory workspaces stay unsupported.\n */\nexport function assertGitWorkspaceRoot(root: string, budget?: GitOperationBudget): void {\n\tlet toplevel = \"\";\n\ttry {\n\t\ttoplevel = runGit(root, [\"rev-parse\", \"--show-toplevel\"], { budget }).stdout.toString(\"utf8\").replace(/\\n$/, \"\");\n\t} catch (error) {\n\t\tif (error instanceof VerifiedRunError && error.code === \"git_plumbing\") throw new VerifiedRunError(\"unsupported\");\n\t\tthrow error;\n\t}\n\tif (!toplevel || realpathSync(toplevel) !== realpathSync(root)) throw new VerifiedRunError(\"unsupported\");\n}\n\n/** `sha1` or `sha256`; determines the zero OID length used for unborn-ref CAS. */\nexport function repoObjectFormat(root: string, budget?: GitOperationBudget): \"sha1\" | \"sha256\" {\n\tconst format = runGit(root, [\"rev-parse\", \"--show-object-format\"], { budget }).stdout.toString(\"utf8\").trim();\n\tif (format !== \"sha1\" && format !== \"sha256\") throw new VerifiedRunError(\"git_plumbing\");\n\treturn format;\n}\n\nexport function zeroOid(format: \"sha1\" | \"sha256\"): string {\n\treturn \"0\".repeat(format === \"sha1\" ? 40 : 64);\n}\n\n/** Current commit OID of `ref`, or null when the ref does not resolve. */\nexport function resolveRef(root: string, ref: string, budget?: GitOperationBudget): string | null {\n\tconst result = runGit(root, [\"rev-parse\", \"--verify\", \"--quiet\", `${ref}^{commit}`], {\n\t\tallowedExitCodes: [0, 1],\n\t\tbudget,\n\t});\n\treturn result.status === 0 ? oidOf(result.stdout) : null;\n}\n\nexport function objectExists(root: string, oid: string, budget?: GitOperationBudget): boolean {\n\treturn runGit(root, [\"cat-file\", \"-e\", `${oid}^{commit}`], { allowedExitCodes: [0, 1], budget }).status === 0;\n}\n\nfunction treeSortKey(name: string, directory: boolean): Buffer {\n\treturn Buffer.from(directory ? `${name}/` : name, \"utf8\");\n}\n\n/** Git trees only distinguish non-executable `100644` from executable `100755`. */\nfunction gitFileMode(mode: number): \"100644\" | \"100755\" {\n\tconst executable = (mode & 0o111) !== 0;\n\tif (executable ? mode !== 0o755 : mode !== 0o644) throw new VerifiedRunError(\"mode_unrepresentable\");\n\treturn executable ? \"100755\" : \"100644\";\n}\n\n/** Rebuild the manifest's exact directory hierarchy with `git mktree`; only regular files exist in candidates. */\nfunction buildTree(\n\troot: string,\n\tmanifest: CandidateManifest,\n\tcontents: ReadonlyMap<string, Buffer>,\n\tbudget: GitOperationBudget,\n): string {\n\tconst blobOids = new Map<string, string>();\n\tfor (const file of manifest.files) {\n\t\tif (blobOids.has(file.digest)) continue;\n\t\tconst bytes = contents.get(file.digest);\n\t\tif (!bytes || bytes.length !== file.size) throw new VerifiedRunError(\"integrity\");\n\t\tblobOids.set(\n\t\t\tfile.digest,\n\t\t\toidOf(runGit(root, [\"hash-object\", \"-w\", \"--stdin\"], { write: true, input: bytes, budget }).stdout),\n\t\t);\n\t}\n\tconst children = new Map<string, { files: CandidateManifest[\"files\"][number][]; dirs: string[] }>();\n\tchildren.set(\"\", { files: [], dirs: [] });\n\tfor (const directory of manifest.directories) children.set(directory, { files: [], dirs: [] });\n\tfor (const file of manifest.files) {\n\t\tconst parent = file.path.includes(\"/\") ? file.path.slice(0, file.path.lastIndexOf(\"/\")) : \"\";\n\t\tchildren.get(parent)?.files.push(file);\n\t}\n\tfor (const directory of manifest.directories) {\n\t\tconst parent = directory.includes(\"/\") ? directory.slice(0, directory.lastIndexOf(\"/\")) : \"\";\n\t\tchildren.get(parent)?.dirs.push(directory);\n\t}\n\tconst treeOids = new Map<string, string>();\n\tconst ordered = [...manifest.directories].sort((left, right) => right.length - left.length);\n\tfor (const directory of ordered) {\n\t\tconst entries = children.get(directory);\n\t\tif (!entries) throw new VerifiedRunError(\"integrity\");\n\t\ttreeOids.set(directory, mintTree(root, entries, treeOids, blobOids, budget));\n\t}\n\tconst top = children.get(\"\");\n\tif (!top) throw new VerifiedRunError(\"integrity\");\n\tconst tree = mintTree(root, top, treeOids, blobOids, budget);\n\tconst expected = [\n\t\t...manifest.files.map((file) => `${gitFileMode(file.mode)} blob ${blobOids.get(file.digest)}\\t${file.path}`),\n\t\t...manifest.directories.map((path) => `040000 tree ${treeOids.get(path)}\\t${path}`),\n\t].sort();\n\tconst output = runGit(root, [\"ls-tree\", \"-r\", \"-t\", \"-z\", tree], { budget }).stdout.toString(\"utf8\");\n\tconst observed = output.split(\"\\0\").filter(Boolean).sort();\n\tif (expected.length !== observed.length || expected.some((entry, i) => entry !== observed[i]))\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn tree;\n}\n\nfunction mintTree(\n\troot: string,\n\tentries: { files: CandidateManifest[\"files\"][number][]; dirs: string[] },\n\ttreeOids: ReadonlyMap<string, string>,\n\tblobOids: ReadonlyMap<string, string>,\n\tbudget: GitOperationBudget,\n): string {\n\tconst lines: { key: Buffer; line: string }[] = [];\n\tfor (const file of entries.files) {\n\t\tconst name = file.path.slice(file.path.lastIndexOf(\"/\") + 1);\n\t\tconst oid = blobOids.get(file.digest);\n\t\tif (!oid) throw new VerifiedRunError(\"integrity\");\n\t\tlines.push({\n\t\t\tkey: treeSortKey(name, false),\n\t\t\tline: `${gitFileMode(file.mode)} blob ${oid}\\t${name}`,\n\t\t});\n\t}\n\tfor (const directory of entries.dirs) {\n\t\tconst name = directory.slice(directory.lastIndexOf(\"/\") + 1);\n\t\tconst oid = treeOids.get(directory);\n\t\tif (!oid) throw new VerifiedRunError(\"integrity\");\n\t\tlines.push({ key: treeSortKey(name, true), line: `040000 tree ${oid}\\t${name}` });\n\t}\n\tlines.sort((left, right) => Buffer.compare(left.key, right.key));\n\treturn oidOf(\n\t\trunGit(root, [\"mktree\", \"-z\"], {\n\t\t\tbudget,\n\t\t\twrite: true,\n\t\t\tinput: Buffer.from(lines.map((entry) => `${entry.line}\\0`).join(\"\"), \"utf8\"),\n\t\t}).stdout,\n\t);\n}\n\nexport interface SealCandidateInput {\n\treadonly manifest: CandidateManifest;\n\treadonly contents: ReadonlyMap<string, Buffer>;\n\treadonly parentOid: string;\n\treadonly zeroOid: string;\n\treadonly runId: string;\n\treadonly candidateDigest: string;\n\treadonly receiptDigest: string;\n}\n\n/**\n * Seal the stored candidate bytes into a deterministic commit: same manifest,\n * parent and binding fields always produce the same OID, so a replayed publish\n * never creates a second object identity for the same candidate.\n */\nexport function sealCandidateCommit(\n\troot: string,\n\tinput: SealCandidateInput,\n\tbudget = new GitOperationBudget(),\n): string {\n\tbudget.remaining();\n\tpreflightGitCandidate(input.manifest, input.contents);\n\tif (digestObject(input.manifest) !== input.candidateDigest) throw new VerifiedRunError(\"integrity\");\n\tconst tree = buildTree(root, input.manifest, input.contents, budget);\n\tconst args = [\"commit-tree\", tree];\n\tif (input.parentOid !== input.zeroOid) args.push(\"-p\", input.parentOid);\n\targs.push(\n\t\t\"-m\",\n\t\t`omk: verified candidate\\n\\nrun: ${input.runId}\\ncandidate: ${input.candidateDigest}\\nreceipt: ${input.receiptDigest}\\n`,\n\t);\n\treturn oidOf(runGit(root, args, { write: true, budget }).stdout);\n}\n\nexport class GitRefCasError extends Error {\n\treadonly ref: string;\n\tconstructor(ref: string) {\n\t\tsuper(`git update-ref rejected ${ref}`);\n\t\tthis.name = \"GitRefCasError\";\n\t\tthis.ref = ref;\n\t}\n}\n\n/** One old-OID compare-and-swap on a single ref. Throws GitRefCasError on any rejection; callers re-resolve to classify. */\nexport function casRef(\n\troot: string,\n\tref: string,\n\tnewOid: string,\n\texpectedOldOid: string,\n\tbudget = new GitOperationBudget(),\n): void {\n\tbudget.remaining();\n\ttry {\n\t\trunGit(root, [\"update-ref\", ref, newOid, expectedOldOid], { write: true, budget });\n\t} catch (error) {\n\t\tif (error instanceof VerifiedRunError && error.code === \"git_plumbing\") throw new GitRefCasError(ref);\n\t\tthrow error;\n\t}\n}\n"]}

package/dist/core/verified-run/git-publication-worker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=git-publication-worker.d.ts.map

package/dist/core/verified-run/git-publication-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-publication-worker.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/git-publication-worker.ts"],"names":[],"mappings":"","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport { GitOperationBudget } from \"./git-execution.ts\";\nimport { casRef, GitRefCasError, OMK_ACCEPTED_REF, resolveRef, sealCandidateCommit } from \"./git-plumbing.ts\";\nimport { readGitNotice, readGitRequest, readGitStartGate, writeGitControl } from \"./git-worker-protocol.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nasync function waitFor(path: string, budget: GitOperationBudget): Promise<void> {\n\twhile (!existsSync(path)) {\n\t\tbudget.remaining();\n\t\tawait delay(5);\n\t}\n\tbudget.remaining();\n}\n\n/** Fixed trusted worker. Request bytes are data; no plugin, model or tool discovery is performed. */\nasync function main(): Promise<void> {\n\tconst path = process.argv[2];\n\tif (!path || !/^\\/workspace\\/\\.git\\/omk-publish-[A-Za-z0-9_-]+\\/request\\.json$/.test(path))\n\t\tthrow new VerifiedRunError(\"git_worker_protocol\");\n\tconst stage = dirname(path);\n\tconst request = readGitRequest(path);\n\tconst remaining = Number((BigInt(request.deadlineNs) - process.hrtime.bigint()) / 1_000_000n);\n\tconst budget = new GitOperationBudget({ timeoutMs: Math.min(request.timeoutMs, remaining) });\n\tconst candidateOid = sealCandidateCommit(\"/workspace\", request.input, budget);\n\twriteGitControl(join(stage, \"prepared.json\"), { kind: \"prepared\", candidateOid });\n\tawait waitFor(join(stage, \"cas-go.json\"), budget);\n\tconst go = readGitStartGate(join(stage, \"cas-go.json\"));\n\tif (go.kind !== \"prepared\" || go.candidateOid !== candidateOid) throw new VerifiedRunError(\"git_worker_protocol\");\n\tlet kind: \"committed\" | \"ref-rejected\" = \"committed\";\n\ttry {\n\t\tcasRef(\"/workspace\", OMK_ACCEPTED_REF, candidateOid, request.input.parentOid, budget);\n\t} catch (error) {\n\t\tif (!(error instanceof GitRefCasError)) throw error;\n\t\tif (resolveRef(\"/workspace\", OMK_ACCEPTED_REF) !== candidateOid) kind = \"ref-rejected\";\n\t}\n\twriteGitControl(join(stage, \"result.json\"), { kind, candidateOid });\n\t// Keep the namespace owned while the host observes CAS and persists its result.\n\tawait waitFor(join(stage, \"finish.json\"), budget);\n\tconst finish = readGitNotice(join(stage, \"finish.json\"));\n\tif (finish.kind !== kind || finish.candidateOid !== candidateOid) throw new VerifiedRunError(\"git_worker_protocol\");\n}\n\ntry {\n\tawait main();\n} catch {\n\tprocess.stderr.write(\"git_worker_failed\\n\");\n\tprocess.exitCode = 1;\n}\n"]}

package/dist/core/verified-run/git-publication-worker.js

@@ -0,0 +1,54 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { GitOperationBudget } from "./git-execution.js";
+import { casRef, GitRefCasError, OMK_ACCEPTED_REF, resolveRef, sealCandidateCommit } from "./git-plumbing.js";
+import { readGitNotice, readGitRequest, readGitStartGate, writeGitControl } from "./git-worker-protocol.js";
+import { VerifiedRunError } from "./storage.js";
+async function waitFor(path, budget) {
+    while (!existsSync(path)) {
+        budget.remaining();
+        await delay(5);
+    }
+    budget.remaining();
+}
+/** Fixed trusted worker. Request bytes are data; no plugin, model or tool discovery is performed. */
+async function main() {
+    const path = process.argv[2];
+    if (!path || !/^\/workspace\/\.git\/omk-publish-[A-Za-z0-9_-]+\/request\.json$/.test(path))
+        throw new VerifiedRunError("git_worker_protocol");
+    const stage = dirname(path);
+    const request = readGitRequest(path);
+    const remaining = Number((BigInt(request.deadlineNs) - process.hrtime.bigint()) / 1000000n);
+    const budget = new GitOperationBudget({ timeoutMs: Math.min(request.timeoutMs, remaining) });
+    const candidateOid = sealCandidateCommit("/workspace", request.input, budget);
+    writeGitControl(join(stage, "prepared.json"), { kind: "prepared", candidateOid });
+    await waitFor(join(stage, "cas-go.json"), budget);
+    const go = readGitStartGate(join(stage, "cas-go.json"));
+    if (go.kind !== "prepared" || go.candidateOid !== candidateOid)
+        throw new VerifiedRunError("git_worker_protocol");
+    let kind = "committed";
+    try {
+        casRef("/workspace", OMK_ACCEPTED_REF, candidateOid, request.input.parentOid, budget);
+    }
+    catch (error) {
+        if (!(error instanceof GitRefCasError))
+            throw error;
+        if (resolveRef("/workspace", OMK_ACCEPTED_REF) !== candidateOid)
+            kind = "ref-rejected";
+    }
+    writeGitControl(join(stage, "result.json"), { kind, candidateOid });
+    // Keep the namespace owned while the host observes CAS and persists its result.
+    await waitFor(join(stage, "finish.json"), budget);
+    const finish = readGitNotice(join(stage, "finish.json"));
+    if (finish.kind !== kind || finish.candidateOid !== candidateOid)
+        throw new VerifiedRunError("git_worker_protocol");
+}
+try {
+    await main();
+}
+catch {
+    process.stderr.write("git_worker_failed\n");
+    process.exitCode = 1;
+}
+//# sourceMappingURL=git-publication-worker.js.map

package/dist/core/verified-run/git-publication-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-publication-worker.js","sourceRoot":"","sources":["../../../src/core/verified-run/git-publication-worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC5G,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAA0B,EAAiB;IAC/E,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,CAAC;AAAA,CACnB;AAED,qGAAqG;AACrG,KAAK,UAAU,IAAI,GAAkB;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,CAAC,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC;QACzF,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,QAAU,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,YAAY,GAAG,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9E,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IACxD,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,EAAE,CAAC,YAAY,KAAK,YAAY;QAAE,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IAClH,IAAI,IAAI,GAAiC,WAAW,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;YAAE,MAAM,KAAK,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,EAAE,gBAAgB,CAAC,KAAK,YAAY;YAAE,IAAI,GAAG,cAAc,CAAC;IACxF,CAAC;IACD,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACpE,gFAAgF;IAChF,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY;QAAE,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;AAAA,CACpH;AAED,IAAI,CAAC;IACJ,MAAM,IAAI,EAAE,CAAC;AACd,CAAC;AAAC,MAAM,CAAC;IACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC5C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtB,CAAC","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport { GitOperationBudget } from \"./git-execution.ts\";\nimport { casRef, GitRefCasError, OMK_ACCEPTED_REF, resolveRef, sealCandidateCommit } from \"./git-plumbing.ts\";\nimport { readGitNotice, readGitRequest, readGitStartGate, writeGitControl } from \"./git-worker-protocol.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nasync function waitFor(path: string, budget: GitOperationBudget): Promise<void> {\n\twhile (!existsSync(path)) {\n\t\tbudget.remaining();\n\t\tawait delay(5);\n\t}\n\tbudget.remaining();\n}\n\n/** Fixed trusted worker. Request bytes are data; no plugin, model or tool discovery is performed. */\nasync function main(): Promise<void> {\n\tconst path = process.argv[2];\n\tif (!path || !/^\\/workspace\\/\\.git\\/omk-publish-[A-Za-z0-9_-]+\\/request\\.json$/.test(path))\n\t\tthrow new VerifiedRunError(\"git_worker_protocol\");\n\tconst stage = dirname(path);\n\tconst request = readGitRequest(path);\n\tconst remaining = Number((BigInt(request.deadlineNs) - process.hrtime.bigint()) / 1_000_000n);\n\tconst budget = new GitOperationBudget({ timeoutMs: Math.min(request.timeoutMs, remaining) });\n\tconst candidateOid = sealCandidateCommit(\"/workspace\", request.input, budget);\n\twriteGitControl(join(stage, \"prepared.json\"), { kind: \"prepared\", candidateOid });\n\tawait waitFor(join(stage, \"cas-go.json\"), budget);\n\tconst go = readGitStartGate(join(stage, \"cas-go.json\"));\n\tif (go.kind !== \"prepared\" || go.candidateOid !== candidateOid) throw new VerifiedRunError(\"git_worker_protocol\");\n\tlet kind: \"committed\" | \"ref-rejected\" = \"committed\";\n\ttry {\n\t\tcasRef(\"/workspace\", OMK_ACCEPTED_REF, candidateOid, request.input.parentOid, budget);\n\t} catch (error) {\n\t\tif (!(error instanceof GitRefCasError)) throw error;\n\t\tif (resolveRef(\"/workspace\", OMK_ACCEPTED_REF) !== candidateOid) kind = \"ref-rejected\";\n\t}\n\twriteGitControl(join(stage, \"result.json\"), { kind, candidateOid });\n\t// Keep the namespace owned while the host observes CAS and persists its result.\n\tawait waitFor(join(stage, \"finish.json\"), budget);\n\tconst finish = readGitNotice(join(stage, \"finish.json\"));\n\tif (finish.kind !== kind || finish.candidateOid !== candidateOid) throw new VerifiedRunError(\"git_worker_protocol\");\n}\n\ntry {\n\tawait main();\n} catch {\n\tprocess.stderr.write(\"git_worker_failed\\n\");\n\tprocess.exitCode = 1;\n}\n"]}

package/dist/core/verified-run/git-sandbox-layout.d.ts

@@ -0,0 +1,4 @@
+/** The initial owned publisher supports a real .git directory, not external worktree aliases. */
+export declare function ownedGitDirectory(workspace: string): string;
+export declare function ownedGitMounts(workspace: string): readonly string[];
+//# sourceMappingURL=git-sandbox-layout.d.ts.map

package/dist/core/verified-run/git-sandbox-layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sandbox-layout.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/git-sandbox-layout.ts"],"names":[],"mappings":"AAIA,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAW3D;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CASnE","sourcesContent":["import { lstatSync, realpathSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\n/** The initial owned publisher supports a real .git directory, not external worktree aliases. */\nexport function ownedGitDirectory(workspace: string): string {\n\tconst path = join(realpathSync(workspace), \".git\");\n\ttry {\n\t\tconst stat = lstatSync(path);\n\t\tif (!stat.isDirectory() || stat.isSymbolicLink() || realpathSync(path) !== resolve(path))\n\t\t\tthrow new VerifiedRunError(\"unsupported_git_layout\");\n\t\treturn path;\n\t} catch (error) {\n\t\tif (error instanceof VerifiedRunError) throw error;\n\t\tthrow new VerifiedRunError(\"unsupported_git_layout\");\n\t}\n}\n\nexport function ownedGitMounts(workspace: string): readonly string[] {\n\treturn [\n\t\t\"--bind\",\n\t\townedGitDirectory(workspace),\n\t\t\"/workspace/.git\",\n\t\t\"--ro-bind\",\n\t\trealpathSync(process.execPath),\n\t\t\"/omk-node\",\n\t];\n}\n"]}

package/dist/core/verified-run/git-sandbox-layout.js

@@ -0,0 +1,29 @@
+import { lstatSync, realpathSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { VerifiedRunError } from "./storage.js";
+/** The initial owned publisher supports a real .git directory, not external worktree aliases. */
+export function ownedGitDirectory(workspace) {
+    const path = join(realpathSync(workspace), ".git");
+    try {
+        const stat = lstatSync(path);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || realpathSync(path) !== resolve(path))
+            throw new VerifiedRunError("unsupported_git_layout");
+        return path;
+    }
+    catch (error) {
+        if (error instanceof VerifiedRunError)
+            throw error;
+        throw new VerifiedRunError("unsupported_git_layout");
+    }
+}
+export function ownedGitMounts(workspace) {
+    return [
+        "--bind",
+        ownedGitDirectory(workspace),
+        "/workspace/.git",
+        "--ro-bind",
+        realpathSync(process.execPath),
+        "/omk-node",
+    ];
+}
+//# sourceMappingURL=git-sandbox-layout.js.map

package/dist/core/verified-run/git-sandbox-layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sandbox-layout.js","sourceRoot":"","sources":["../../../src/core/verified-run/git-sandbox-layout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAU;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;YACvF,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,KAAK,CAAC;QACnD,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;IACtD,CAAC;AAAA,CACD;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAqB;IACpE,OAAO;QACN,QAAQ;QACR,iBAAiB,CAAC,SAAS,CAAC;QAC5B,iBAAiB;QACjB,WAAW;QACX,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC9B,WAAW;KACX,CAAC;AAAA,CACF","sourcesContent":["import { lstatSync, realpathSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\n/** The initial owned publisher supports a real .git directory, not external worktree aliases. */\nexport function ownedGitDirectory(workspace: string): string {\n\tconst path = join(realpathSync(workspace), \".git\");\n\ttry {\n\t\tconst stat = lstatSync(path);\n\t\tif (!stat.isDirectory() || stat.isSymbolicLink() || realpathSync(path) !== resolve(path))\n\t\t\tthrow new VerifiedRunError(\"unsupported_git_layout\");\n\t\treturn path;\n\t} catch (error) {\n\t\tif (error instanceof VerifiedRunError) throw error;\n\t\tthrow new VerifiedRunError(\"unsupported_git_layout\");\n\t}\n}\n\nexport function ownedGitMounts(workspace: string): readonly string[] {\n\treturn [\n\t\t\"--bind\",\n\t\townedGitDirectory(workspace),\n\t\t\"/workspace/.git\",\n\t\t\"--ro-bind\",\n\t\trealpathSync(process.execPath),\n\t\t\"/omk-node\",\n\t];\n}\n"]}

package/dist/core/verified-run/git-worker-protocol.d.ts

@@ -0,0 +1,19 @@
+import type { SealCandidateInput } from "./git-plumbing.ts";
+export interface GitWorkerRequest {
+    readonly input: SealCandidateInput;
+    readonly timeoutMs: number;
+    /** Linux CLOCK_MONOTONIC deadline, shared across the host and its PID namespace. */
+    readonly deadlineNs: string;
+}
+export interface GitWorkerNotice {
+    readonly kind: "prepared" | "committed" | "ref-rejected";
+    readonly candidateOid: string;
+}
+export declare function writeGitControl(path: string, value: unknown): void;
+export declare function serializeGitRequest(request: GitWorkerRequest): unknown;
+export declare function readGitRequest(path: string): GitWorkerRequest;
+export declare function readGitStartGate(path: string): GitWorkerNotice & {
+    readonly authorizationDeadline: number;
+};
+export declare function readGitNotice(path: string): GitWorkerNotice;
+//# sourceMappingURL=git-worker-protocol.d.ts.map

package/dist/core/verified-run/git-worker-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-worker-protocol.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/git-worker-protocol.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,cAAc,CAAC;IACzD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAaD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAKlE;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAQtE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAyD7D;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;CAAE,CAc3G;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAK3D","sourcesContent":["import { renameSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { fsyncDirectorySync } from \"../durable-file-io.ts\";\nimport type { CandidateFile, CandidateManifest } from \"./candidate.ts\";\nimport { preflightGitCandidate } from \"./git-candidate-preflight.ts\";\nimport type { SealCandidateInput } from \"./git-plumbing.ts\";\nimport { digestObject, publishObject, readJson, VerifiedRunError } from \"./storage.ts\";\n\nexport interface GitWorkerRequest {\n\treadonly input: SealCandidateInput;\n\treadonly timeoutMs: number;\n\t/** Linux CLOCK_MONOTONIC deadline, shared across the host and its PID namespace. */\n\treadonly deadlineNs: string;\n}\nexport interface GitWorkerNotice {\n\treadonly kind: \"prepared\" | \"committed\" | \"ref-rejected\";\n\treadonly candidateOid: string;\n}\n\nfunction object(value: unknown): Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new VerifiedRunError(\"git_worker_protocol\");\n\treturn value as Record<string, unknown>;\n}\nfunction text(value: unknown, pattern: RegExp): string {\n\tif (typeof value !== \"string\" || !pattern.test(value)) throw new VerifiedRunError(\"git_worker_protocol\");\n\treturn value;\n}\nconst DIGEST = /^[a-f0-9]{64}$/;\nconst OID = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;\n\nexport function writeGitControl(path: string, value: unknown): void {\n\tconst temporary = `${path}.tmp`;\n\tpublishObject(temporary, value);\n\trenameSync(temporary, path);\n\tfsyncDirectorySync(dirname(path));\n}\n\nexport function serializeGitRequest(request: GitWorkerRequest): unknown {\n\treturn {\n\t\tversion: 1,\n\t\t...request.input,\n\t\tcontents: [...request.input.contents].map(([digest, bytes]) => ({ digest, bytes: bytes.toString(\"base64\") })),\n\t\ttimeoutMs: request.timeoutMs,\n\t\tdeadlineNs: request.deadlineNs,\n\t};\n}\n\nexport function readGitRequest(path: string): GitWorkerRequest {\n\tconst raw = object(readJson(path, 128 * 1024 * 1024));\n\tif (\n\t\traw.version !== 1 ||\n\t\ttypeof raw.timeoutMs !== \"number\" ||\n\t\t!Number.isSafeInteger(raw.timeoutMs) ||\n\t\traw.timeoutMs <= 0 ||\n\t\traw.timeoutMs > 60_000\n\t)\n\t\tthrow new VerifiedRunError(\"git_worker_protocol\");\n\tconst manifest = object(raw.manifest);\n\tif (\n\t\tmanifest.version !== 1 ||\n\t\t!Array.isArray(manifest.files) ||\n\t\t!Array.isArray(manifest.directories) ||\n\t\t!Array.isArray(raw.contents)\n\t)\n\t\tthrow new VerifiedRunError(\"git_worker_protocol\");\n\tconst directories = manifest.directories.map((entry: unknown) => text(entry, /^.{1,4096}$/u));\n\tconst files: CandidateFile[] = manifest.files.map((entry: unknown) => {\n\t\tconst file = object(entry);\n\t\tif (typeof file.mode !== \"number\" || typeof file.size !== \"number\")\n\t\t\tthrow new VerifiedRunError(\"git_worker_protocol\");\n\t\treturn {\n\t\t\tpath: text(file.path, /^.{1,4096}$/u),\n\t\t\tmode: file.mode,\n\t\t\tsize: file.size,\n\t\t\tdigest: text(file.digest, DIGEST),\n\t\t};\n\t});\n\tconst contents = new Map<string, Buffer>();\n\tfor (const entry of raw.contents) {\n\t\tconst blob = object(entry);\n\t\tconst digest = text(blob.digest, DIGEST);\n\t\tif (typeof blob.bytes !== \"string\" || contents.has(digest)) throw new VerifiedRunError(\"git_worker_protocol\");\n\t\tcontents.set(digest, Buffer.from(blob.bytes, \"base64\"));\n\t}\n\tconst candidate: CandidateManifest = { version: 1, directories, files };\n\tpreflightGitCandidate(candidate, contents);\n\tconst candidateDigest = text(raw.candidateDigest, DIGEST);\n\tif (digestObject(candidate) !== candidateDigest) throw new VerifiedRunError(\"integrity\");\n\tconst parentOid = text(raw.parentOid, OID);\n\tconst zeroOid = text(raw.zeroOid, /^(?:0{40}|0{64})$/);\n\tif (parentOid.length !== zeroOid.length) throw new VerifiedRunError(\"git_worker_protocol\");\n\treturn {\n\t\ttimeoutMs: raw.timeoutMs,\n\t\tdeadlineNs: text(raw.deadlineNs, /^\\d{1,24}$/),\n\t\tinput: {\n\t\t\tmanifest: candidate,\n\t\t\tcontents,\n\t\t\tcandidateDigest,\n\t\t\tparentOid,\n\t\t\tzeroOid,\n\t\t\trunId: text(raw.runId, /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/),\n\t\t\treceiptDigest: text(raw.receiptDigest, DIGEST),\n\t\t},\n\t};\n}\n\nexport function readGitStartGate(path: string): GitWorkerNotice & { readonly authorizationDeadline: number } {\n\tconst raw = object(readJson(path, 4096));\n\tif (\n\t\traw.kind !== \"prepared\" ||\n\t\ttypeof raw.authorizationDeadline !== \"number\" ||\n\t\t!Number.isSafeInteger(raw.authorizationDeadline) ||\n\t\tDate.now() >= raw.authorizationDeadline\n\t)\n\t\tthrow new VerifiedRunError(\"authority\");\n\treturn {\n\t\tkind: \"prepared\",\n\t\tcandidateOid: text(raw.candidateOid, OID),\n\t\tauthorizationDeadline: raw.authorizationDeadline,\n\t};\n}\n\nexport function readGitNotice(path: string): GitWorkerNotice {\n\tconst raw = object(readJson(path, 4096));\n\tif (raw.kind !== \"prepared\" && raw.kind !== \"committed\" && raw.kind !== \"ref-rejected\")\n\t\tthrow new VerifiedRunError(\"git_worker_protocol\");\n\treturn { kind: raw.kind, candidateOid: text(raw.candidateOid, OID) };\n}\n"]}