release-skill 0.1.1

package/src/core/state-machine.mjs

@@ -0,0 +1,76 @@
+// Release state machine: guards and enforces valid state transitions.
+
+import { ReleaseError, INVALID_STATE_TRANSITION } from './errors.mjs';
+
+// ---- State constants ----
+
+export const DISCOVERED = 'DISCOVERED';
+export const ASSESSED = 'ASSESSED';
+export const PREPARED = 'PREPARED';
+export const APPROVED = 'APPROVED';
+export const PUBLISHING = 'PUBLISHING';
+export const PUBLISHED = 'PUBLISHED';
+export const VERIFIED = 'VERIFIED';
+
+export const NEEDS_INPUT = 'NEEDS_INPUT';
+export const BLOCKED = 'BLOCKED';
+export const PARTIAL = 'PARTIAL';
+
+/** Normal lifecycle states in order. */
+export const NORMAL_STATES = Object.freeze([
+  DISCOVERED, ASSESSED, PREPARED, APPROVED, PUBLISHING, PUBLISHED, VERIFIED,
+]);
+
+/** Exception states. */
+export const EXCEPTION_STATES = Object.freeze([
+  NEEDS_INPUT, BLOCKED, PARTIAL,
+]);
+
+/** All valid states. */
+export const ALL_STATES = Object.freeze([...NORMAL_STATES, ...EXCEPTION_STATES]);
+
+// ---- Allowed transitions ----
+
+/**
+ * Explicit transition map.
+ *
+ * Design rules:
+ * - Normal path only moves forward (single step).
+ * - NEEDS_INPUT and BLOCKED can be entered from any normal state except VERIFIED.
+ * - NEEDS_INPUT and BLOCKED can return to any normal state except VERIFIED.
+ * - PARTIAL can only be entered from PUBLISHING.
+ * - PARTIAL can return to PUBLISHING/PUBLISHED or escalate to NEEDS_INPUT / BLOCKED.
+ * - APPROVED cannot skip directly to VERIFIED.
+ * - NEEDS_INPUT and BLOCKED cannot transition to VERIFIED.
+ * - VERIFIED is terminal with no outbound transitions.
+ */
+const TRANSITIONS = Object.freeze({
+  [DISCOVERED]: Object.freeze([ASSESSED, NEEDS_INPUT, BLOCKED]),
+  [ASSESSED]: Object.freeze([PREPARED, NEEDS_INPUT, BLOCKED]),
+  [PREPARED]: Object.freeze([APPROVED, NEEDS_INPUT, BLOCKED]),
+  [APPROVED]: Object.freeze([PUBLISHING, NEEDS_INPUT, BLOCKED]),
+  [PUBLISHING]: Object.freeze([PUBLISHED, PARTIAL, NEEDS_INPUT, BLOCKED]),
+  [PUBLISHED]: Object.freeze([VERIFIED, NEEDS_INPUT, BLOCKED]),
+  [VERIFIED]: Object.freeze([]),
+  [NEEDS_INPUT]: Object.freeze([ASSESSED, PREPARED, APPROVED, BLOCKED]),
+  [BLOCKED]: Object.freeze([ASSESSED, PREPARED, APPROVED, NEEDS_INPUT]),
+  [PARTIAL]: Object.freeze([PUBLISHING, PUBLISHED, NEEDS_INPUT, BLOCKED]),
+});
+
+/**
+ * Assert that a transition from `from` to `to` is allowed.
+ *
+ * @param {string} from  Current state.
+ * @param {string} to    Target state.
+ * @throws {ReleaseError} with code INVALID_STATE_TRANSITION if the transition is not allowed.
+ */
+export function assertTransition(from, to) {
+  const allowed = TRANSITIONS[from];
+  if (!allowed || !allowed.includes(to)) {
+    throw new ReleaseError(
+      INVALID_STATE_TRANSITION,
+      `Invalid state transition: ${from} -> ${to}`,
+      { from, to },
+    );
+  }
+}

package/src/core/version-consistency.mjs

@@ -0,0 +1,111 @@
+/**
+ * 版本一致性校验纯函数 — 供 blackbox runner 和单测使用。
+ *
+ * 给定 release plan JSON 和预期版本字符串，检查：
+ * 1. plan.status === 'PREPARED'
+ * 2. plan 至少有一个 release unit
+ * 3. 若指定 expectedUnitId，该 unit 必须存在且 targetVersion === expectedVersion
+ * 4. 每个 unit 的 targetVersion === expectedVersion
+ * 5. 每个带 parameters.version 的 action === expectedVersion
+ * 6. 每个带 expected.version 的 action === expectedVersion
+ * 7. 每个带 expected.tag 的 action：必须通过 unitId 找到 unit，
+ *    unit 必须有合法 tagTemplate，然后只做模板展开后的精确相等；
+ *    否则失败。不做子串匹配。
+ *
+ * @param {object} plan - 解析后的 release plan JSON
+ * @param {string} expectedVersion - 预期版本号
+ * @param {object} [options] - 可选参数
+ * @param {string} [options.expectedUnitId] - 必须存在的 unit id
+ * @returns {{ passed: boolean, details: object }}
+ */
+export function validateVersionConsistency(plan, expectedVersion, options = {}) {
+  const failures = [];
+
+  // 1. plan status
+  if (!plan || typeof plan !== 'object') {
+    return { passed: false, details: { failures: ['plan is null or not an object'], expectedVersion } };
+  }
+  if (plan.status !== 'PREPARED') {
+    failures.push(`plan.status is ${JSON.stringify(plan.status)}, expected PREPARED`);
+  }
+
+  // 2. plan must have at least one release unit (must be an array)
+  const rawUnits = plan.units;
+  const units = Array.isArray(rawUnits) ? rawUnits : [];
+  if (!Array.isArray(rawUnits)) {
+    failures.push(`plan.units is ${JSON.stringify(rawUnits)}, expected an array`);
+  }
+  if (units.length === 0) {
+    failures.push('plan has no release units; at least one unit is required');
+  }
+
+  // 3. expectedUnitId validation (if specified)
+  const { expectedUnitId } = options;
+  if (expectedUnitId) {
+    const found = units.find(u => u.id === expectedUnitId);
+    if (!found) {
+      failures.push(`expected unit "${expectedUnitId}" not found in plan units`);
+    } else if (found.targetVersion !== expectedVersion) {
+      failures.push(`expected unit "${expectedUnitId}" targetVersion is ${JSON.stringify(found.targetVersion)}, expected ${expectedVersion}`);
+    }
+  }
+
+  // 4. unit versions
+  for (const unit of units) {
+    if (unit.targetVersion !== expectedVersion) {
+      failures.push(`unit "${unit.id ?? '(unknown)'}" targetVersion is ${JSON.stringify(unit.targetVersion)}, expected ${expectedVersion}`);
+    }
+  }
+
+  // 5. action parameters.version & expected.version (externalActions must be an array)
+  const rawActions = plan.externalActions;
+  const actions = Array.isArray(rawActions) ? rawActions : [];
+  if (!Array.isArray(rawActions)) {
+    failures.push(`plan.externalActions is ${JSON.stringify(rawActions)}, expected an array`);
+  }
+
+  // Build unit -> tagTemplate map for exact tag validation
+  const unitTagTemplates = new Map();
+  for (const unit of units) {
+    if (unit.id && unit.tagTemplate) {
+      unitTagTemplates.set(unit.id, unit.tagTemplate);
+    }
+  }
+
+  for (const action of actions) {
+    if (action.parameters?.version != null && action.parameters.version !== expectedVersion) {
+      failures.push(`action "${action.id}" parameters.version is ${JSON.stringify(action.parameters.version)}, expected ${expectedVersion}`);
+    }
+    if (action.expected?.version != null && action.expected.version !== expectedVersion) {
+      failures.push(`action "${action.id}" expected.version is ${JSON.stringify(action.expected.version)}, expected ${expectedVersion}`);
+    }
+    // 7. tag must match exactly via template expansion — no substring matching.
+    const tag = action.expected?.tag;
+    if (tag) {
+      if (!action.unitId) {
+        failures.push(`action "${action.id}" has expected.tag but no unitId; unitId is required for tag validation`);
+      } else {
+        const tagTemplate = unitTagTemplates.get(action.unitId);
+        if (!tagTemplate) {
+          failures.push(`action "${action.id}" unit "${action.unitId}" has no tagTemplate; tagTemplate is required for tag validation`);
+        } else {
+          const expectedTag = tagTemplate.replace('{version}', expectedVersion);
+          if (tag !== expectedTag) {
+            failures.push(`action "${action.id}" expected.tag ${JSON.stringify(tag)} does not match expanded template ${JSON.stringify(expectedTag)} (exact match required)`);
+          }
+        }
+      }
+    }
+  }
+
+  return {
+    passed: failures.length === 0,
+    details: {
+      expectedVersion,
+      expectedUnitId: expectedUnitId ?? null,
+      unitCount: units.length,
+      actionCount: actions.length,
+      failures,
+    },
+  };
+}

package/src/producers/build-adapters.mjs

@@ -0,0 +1,231 @@
+/**
+ * Pure producer: build adapters from skills and plugin templates.
+ *
+ * Reads skill metadata from skills-src/ and plugin.json templates,
+ * generates adapter directories for each platform (claude, codex).
+ *
+ * Deterministic: sorted directory enumeration, no timestamps, no randomness.
+ *
+ * @module producers/build-adapters
+ */
+
+import { readdir, readFile, writeFile, mkdir } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+import { createHash } from 'node:crypto';
+
+import { canonicalJson, sha256Hex } from '../core/digest.mjs';
+
+/**
+ * Compute an implementation digest from the source bytes of this module.
+ *
+ * @param {Buffer[]} sourceBytes
+ * @returns {string}
+ */
+export function computeBuildAdaptersDigest(sourceBytes) {
+  const h = createHash('sha256');
+  for (const buf of sourceBytes) h.update(buf);
+  h.update(`node:${process.version}`);
+  h.update('locale:en-US timezone:UTC');
+  return `sha256:${h.digest('hex')}`;
+}
+
+// Platform definitions (same as legacy script)
+const PLATFORMS = [
+  {
+    name: 'claude',
+    pluginDirName: '.claude-plugin',
+    templateFileName: 'plugin.json',
+    marketplaceFileName: 'marketplace.json',
+    hasMarketplace: true,
+  },
+  {
+    name: 'codex',
+    pluginDirName: '.codex-plugin',
+    templateFileName: 'plugin.json',
+    hasMarketplace: false,
+  },
+];
+
+/**
+ * Collect skill metadata from skills-src/.
+ *
+ * @param {string} srcDir - Absolute path to skills-src/.
+ * @returns {Promise<Array<{name:string,description:string,content:string}>>}
+ */
+async function collectSkills(srcDir) {
+  const entries = await readdir(srcDir, { withFileTypes: true });
+  const dirs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
+  dirs.sort();
+
+  const skills = [];
+  for (const dirName of dirs) {
+    const skillMdPath = join(srcDir, dirName, 'SKILL.md');
+    let content;
+    try {
+      content = await readFile(skillMdPath, 'utf-8');
+    } catch (err) {
+      if (err.code === 'ENOENT') continue;
+      throw err;
+    }
+
+    // Extract description: first paragraph of the first ## section.
+    const lines = content.split('\n');
+    let inFirstSection = false;
+    let pastSectionHeader = false;
+    const descLines = [];
+    for (const line of lines) {
+      if (line.startsWith('## ')) {
+        if (inFirstSection) break;
+        inFirstSection = true;
+        continue;
+      }
+      if (inFirstSection && !pastSectionHeader) {
+        if (line.trim() === '') pastSectionHeader = true;
+        continue;
+      }
+      if (pastSectionHeader) {
+        if (line.trim() === '') break;
+        descLines.push(line);
+      }
+    }
+    const description = descLines.join('\n').trim();
+    skills.push({ name: dirName, description, content });
+  }
+  return skills;
+}
+
+/**
+ * Generate the full file tree for an adapter platform.
+ *
+ * @param {object} platform - Platform definition.
+ * @param {Array} skills - Skill metadata array.
+ * @param {object} templateJson - Parsed plugin.json template.
+ * @param {object|null} marketplaceTemplateJson - Parsed marketplace template.
+ * @returns {Promise<Array<{relPath:string,content:string}>>}
+ */
+async function generateAdapterFiles(platform, skills, templateJson, marketplaceTemplateJson = null) {
+  const files = [];
+
+  // Transform plugin.json: rewrite source paths
+  const adapted = JSON.parse(JSON.stringify(templateJson));
+
+  // Preserve platform-supported directory auto-discovery in generated adapters.
+  // Codex validation requires the canonical "skills" directory, and Claude
+  // also accepts the same plugin-root-relative directory contract.
+  if (typeof adapted.skills === 'string') {
+    adapted.skills = './skills/';
+  } else if (Array.isArray(adapted.skills)) {
+    for (const skill of adapted.skills) {
+      skill.source = `../skills/${skill.name}/SKILL.md`;
+    }
+  }
+
+  const pluginJsonContent = JSON.stringify(adapted, null, 2) + '\n';
+  files.push({
+    relPath: join(platform.pluginDirName, 'plugin.json'),
+    content: pluginJsonContent,
+  });
+
+  // Generate marketplace.json for platforms that need it
+  if (platform.hasMarketplace) {
+    const marketplace = JSON.parse(JSON.stringify(marketplaceTemplateJson ?? {}));
+    marketplace.name = adapted.name;
+    marketplace.description = adapted.description;
+    marketplace.owner = marketplace.owner ?? adapted.author;
+    marketplace.plugins = [{
+      ...(marketplace.plugins?.[0] ?? {}),
+      name: adapted.name,
+      source: './',
+      version: adapted.version,
+      description: adapted.description,
+    }];
+    const marketplaceContent = JSON.stringify(marketplace, null, 2) + '\n';
+    files.push({
+      relPath: join(platform.pluginDirName, 'marketplace.json'),
+      content: marketplaceContent,
+    });
+  }
+
+  // Copy SKILL.md files verbatim
+  for (const skill of skills) {
+    files.push({
+      relPath: join('skills', skill.name, 'SKILL.md'),
+      content: skill.content,
+    });
+  }
+
+  // Sort for deterministic output
+  files.sort((a, b) => a.relPath.localeCompare(b.relPath));
+  return files;
+}
+
+/**
+ * Pure producer function for building adapters.
+ *
+ * @param {object} options
+ * @param {string} [options.inputs] - Root directory path. Defaults to package root.
+ * @param {string} options.output - Output directory path.
+ * @param {string} [options.platformFilter] - Only generate for this platform name.
+ */
+export async function produceBuildAdapters({ inputs, output, platformFilter } = {}) {
+  const defaultRoot = new URL('../..', import.meta.url).pathname;
+  const root = inputs ?? defaultRoot;
+  const srcDir = join(root, 'skills-src');
+
+  const skills = await collectSkills(srcDir);
+
+  const outputs = [];
+
+  for (const platform of PLATFORMS) {
+    if (platformFilter && platform.name !== platformFilter) continue;
+    const templatePath = join(root, platform.pluginDirName, platform.templateFileName);
+    const templateRaw = await readFile(templatePath, 'utf-8');
+    const templateJson = JSON.parse(templateRaw);
+    let marketplaceTemplateJson = null;
+    if (platform.hasMarketplace) {
+      try {
+        marketplaceTemplateJson = JSON.parse(
+          await readFile(join(root, platform.pluginDirName, platform.marketplaceFileName), 'utf-8'),
+        );
+      } catch (error) {
+        if (error.code !== 'ENOENT') throw error;
+      }
+    }
+
+    const files = await generateAdapterFiles(platform, skills, templateJson, marketplaceTemplateJson);
+
+    for (const file of files) {
+      const dstPath = join(output, file.relPath);
+      await mkdir(dirname(dstPath), { recursive: true });
+      const content = Buffer.from(file.content, 'utf-8');
+      await writeFile(dstPath, content);
+
+      outputs.push(Object.freeze({
+        path: file.relPath,
+        type: 'blob',
+        mode: '100644',
+        content,
+        sha256: sha256Hex(content),
+        size: content.length,
+      }));
+    }
+  }
+
+  return Object.freeze({
+    outputs: Object.freeze(outputs),
+    outputManifestDigest: digestEntryOutputs(outputs),
+  });
+}
+
+/**
+ * Compute manifest digest from output entries.
+ *
+ * @param {Array<{path:string,type:string,mode:string,sha256:string,size:number}>} entries
+ * @returns {string}
+ */
+export function digestEntryOutputs(entries) {
+  const canonical = entries.map(({ path, type, mode, sha256, size }) => ({
+    path, type, mode, size, sha256,
+  }));
+  return `sha256:${sha256Hex(canonicalJson(canonical))}`;
+}

package/src/producers/render-public-assets.mjs

@@ -0,0 +1,152 @@
+/**
+ * Pure producer: render public assets from standards/ and schemas/.
+ *
+ * Deterministically renders authoritative standards and schemas into the
+ * public plugin directory. Normalizes line endings (LF), strips trailing
+ * whitespace, ensures trailing newline. No timestamps in output — time
+ * is only written to evidence.
+ *
+ * Deterministic: sorted file enumeration, content normalization, no randomness.
+ *
+ * @module producers/render-public-assets
+ */
+
+import { readFile, writeFile, readdir, stat, mkdir } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+import { createHash } from 'node:crypto';
+
+import { canonicalJson, sha256Hex } from '../core/digest.mjs';
+
+/**
+ * Compute an implementation digest from the source bytes of this module.
+ *
+ * @param {Buffer[]} sourceBytes
+ * @returns {string}
+ */
+export function computeRenderDigest(sourceBytes) {
+  const h = createHash('sha256');
+  for (const buf of sourceBytes) h.update(buf);
+  h.update(`node:${process.version}`);
+  h.update('locale:en-US timezone:UTC');
+  return `sha256:${h.digest('hex')}`;
+}
+
+/**
+ * Recursively collect all file paths under dirPath.
+ * Returns relative paths sorted by POSIX path for deterministic ordering.
+ */
+async function collectFiles(dirPath, base) {
+  const result = [];
+  const entries = await readdir(dirPath, { withFileTypes: true });
+  for (const entry of entries) {
+    const abs = join(dirPath, entry.name);
+    if (entry.isDirectory()) {
+      result.push(...await collectFiles(abs, base));
+    } else if (entry.isFile()) {
+      result.push(relative(base, abs));
+    }
+  }
+  return result;
+}
+
+/**
+ * Normalize line endings to LF, strip trailing whitespace per line,
+ * and ensure a single trailing newline.
+ */
+function normalizeContent(buf) {
+  return buf.toString('utf8')
+    .replace(/\r\n/g, '\n')
+    .split('\n')
+    .map(line => line.trimEnd())
+    .join('\n')
+    .replace(/\n+$/, '\n');
+}
+
+/**
+ * Deterministically render all files from srcDir into outDir.
+ *
+ * @param {string} srcDir - Source directory.
+ * @param {string} outDir - Output directory.
+ * @returns {Promise<Array<{path:string,type:string,mode:string,content:Buffer,sha256:string,size:number}>>}
+ */
+async function renderDir(srcDir, outDir, pathPrefix) {
+  await mkdir(outDir, { recursive: true });
+
+  const files = await collectFiles(srcDir, srcDir);
+  files.sort();
+
+  const outputs = [];
+  for (const rel of files) {
+    const destPath = join(outDir, rel);
+    await mkdir(join(destPath, '..'), { recursive: true });
+
+    const raw = await readFile(join(srcDir, rel));
+    const contentStr = normalizeContent(raw);
+    const content = Buffer.from(contentStr, 'utf8');
+
+    await writeFile(destPath, content, 'utf8');
+    outputs.push(Object.freeze({
+      path: pathPrefix ? `${pathPrefix}/${rel}` : rel,
+      type: 'blob',
+      mode: '100644',
+      content,
+      sha256: sha256Hex(content),
+      size: content.length,
+    }));
+  }
+
+  return outputs;
+}
+
+/**
+ * Pure producer function for rendering public assets.
+ *
+ * @param {object} options
+ * @param {string} [options.inputs] - Root directory containing standards/ and schemas/.
+ * @param {string} options.output - Output base directory (references/ and schemas/ are created under it).
+ * @returns {Promise<{outputs: Array, outputManifestDigest: string}>}
+ */
+export async function produceRenderPublicAssets({ inputs, output } = {}) {
+  const defaultRoot = new URL('../../..', import.meta.url).pathname;
+  const root = inputs ?? defaultRoot;
+
+  const srcDirs = [
+    { src: join(root, 'standards'), out: join(output, 'references'), label: 'standards', prefix: 'references' },
+    { src: join(root, 'schemas'), out: join(output, 'schemas'), label: 'schemas', prefix: 'schemas' },
+  ];
+
+  const allOutputs = [];
+
+  for (const { src, out, prefix } of srcDirs) {
+    let dirExists = false;
+    try {
+      const s = await stat(src);
+      dirExists = s.isDirectory();
+    } catch {
+      dirExists = false;
+    }
+
+    if (!dirExists) continue;
+
+    const outputs = await renderDir(src, out, prefix);
+    allOutputs.push(...outputs);
+  }
+
+  return Object.freeze({
+    outputs: Object.freeze(allOutputs),
+    outputManifestDigest: digestEntryOutputs(allOutputs),
+  });
+}
+
+/**
+ * Compute manifest digest from output entries.
+ *
+ * @param {Array<{path:string,type:string,mode:string,sha256:string,size:number}>} entries
+ * @returns {string}
+ */
+export function digestEntryOutputs(entries) {
+  const canonical = entries.map(({ path, type, mode, sha256, size }) => ({
+    path, type, mode, size, sha256,
+  }));
+  return `sha256:${sha256Hex(canonicalJson(canonical))}`;
+}

package/src/producers/sync-skills.mjs

@@ -0,0 +1,96 @@
+/**
+ * Pure producer: sync skills from skills-src/ to skills/.
+ *
+ * Reads each subdirectory in the source path, copies SKILL.md files
+ * to the output directory. No side effects beyond the output directory.
+ *
+ * Deterministic: sorted directory enumeration, no timestamps, no randomness.
+ *
+ * @module producers/sync-skills
+ */
+
+import { readdir, readFile, writeFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+
+import { canonicalJson, sha256Hex } from '../core/digest.mjs';
+
+/**
+ * Compute an implementation digest from the source bytes of this module.
+ *
+ * @param {Buffer[]} sourceBytes
+ * @returns {string}
+ */
+export function computeSyncSkillsDigest(sourceBytes) {
+  const h = createHash('sha256');
+  for (const buf of sourceBytes) h.update(buf);
+  h.update(`node:${process.version}`);
+  h.update('locale:en-US timezone:UTC');
+  return `sha256:${h.digest('hex')}`;
+}
+
+/**
+ * Pure producer function for syncing skills.
+ *
+ * Reads subdirectories from `inputs` (or default skills-src/),
+ * copies SKILL.md files to `output`.
+ *
+ * @param {object} options
+ * @param {string} [options.inputs] - Source directory path. Defaults to skills-src/ relative to module.
+ * @param {string} options.output - Output directory path.
+ */
+export async function produceSyncSkills({ inputs, output } = {}) {
+  const defaultSrc = new URL('../../skills-src', import.meta.url).pathname;
+  const srcDir = inputs ?? defaultSrc;
+
+  const skillDirs = [];
+  for (const item of await readdir(srcDir, { withFileTypes: true })) {
+    if (item.isDirectory()) skillDirs.push(item.name);
+  }
+  skillDirs.sort();
+
+  const outputs = [];
+
+  for (const dirName of skillDirs) {
+    const srcFile = join(srcDir, dirName, 'SKILL.md');
+    let content;
+    try {
+      content = await readFile(srcFile);
+    } catch (err) {
+      if (err.code === 'ENOENT') continue;
+      throw err;
+    }
+
+    const dstDir = join(output, 'skills', dirName);
+    await mkdir(dstDir, { recursive: true });
+    const dstFile = join(dstDir, 'SKILL.md');
+    await writeFile(dstFile, content);
+
+    outputs.push(Object.freeze({
+      path: `skills/${dirName}/SKILL.md`,
+      type: 'blob',
+      mode: '100644',
+      content,
+      sha256: sha256Hex(content),
+      size: content.length,
+    }));
+  }
+
+  return Object.freeze({
+    outputs: Object.freeze(outputs),
+    outputManifestDigest: digestEntryOutputs(outputs),
+  });
+}
+
+/**
+ * Compute manifest digest from output entries.
+ *
+ * @param {Array<{path:string,type:string,mode:string,sha256:string,size:number}>} entries
+ * @returns {string}
+ */
+export function digestEntryOutputs(entries) {
+  const canonical = entries.map(({ path, type, mode, sha256, size }) => ({
+    path, type, mode, size, sha256,
+  }));
+  return `sha256:${sha256Hex(canonicalJson(canonical))}`;
+}