python-cad-tools 0.1.0rc1__py3-none-any.whl

python_cad_tools/artifacts.py

@@ -0,0 +1,546 @@
+"""Artifact inventory, parser-level validation, and final-byte verification."""
+
+from __future__ import annotations
+
+import json
+import mimetypes
+import os
+import re
+from dataclasses import asdict, dataclass
+from importlib import metadata, resources
+from pathlib import Path, PurePosixPath
+from typing import Any, Literal, cast
+from xml.etree import ElementTree
+
+from .determinism import semantic_hash, sha256_file
+from .exceptions import ArtifactIntegrityError, BuildExportError
+from .manifests import load_json_document, validate_json_document
+from .validation import ValidationIssue
+
+BUILD_MANIFEST_RELATIVE = "manifests/build-manifest.json"
+_HEX = re.compile(r"[0-9a-f]{64}\Z")
+_ARTIFACT_FIELDS = {"path", "size", "sha256", "media_type", "producer", "schema_id", "schema_version", "volatile"}
+
+
+@dataclass(frozen=True, slots=True)
+class ArtifactRecord:
+    path: str
+    size: int
+    sha256: str
+    media_type: str
+    producer: str
+    schema_id: str | None
+    schema_version: int | None
+    volatile: bool
+
+
+@dataclass(frozen=True, slots=True)
+class VerificationResult:
+    ok: bool
+    output_root: Path
+    issues: tuple[ValidationIssue, ...]
+    artifacts: tuple[ArtifactRecord, ...]
+    build_manifest: Path
+    artifact_set_hash: str
+    stable_artifact_set_hash: str
+
+
+@dataclass(frozen=True, slots=True)
+class PackageBuildInfo:
+    schema_id: Literal["urn:python-cad-tools:schema:package-build-info:1"]
+    schema_version: Literal[1]
+    distribution: Literal["python-cad-tools"]
+    version: str
+    source_commit: str
+    source_dirty: bool
+    viewer_shell_sha256: str
+
+
+def load_build_manifest(path: Path) -> dict[str, Any]:
+    value = validate_json_document(path)
+    if value["schema_id"] != "urn:python-cad-tools:schema:build-manifest:1":
+        raise ArtifactIntegrityError(f"Not a build manifest: {path}")
+    return value
+
+
+def load_design_manifest(path: Path) -> dict[str, Any]:
+    value = validate_json_document(path)
+    if value["schema_id"] != "urn:python-cad-tools:schema:design-manifest:1":
+        raise ArtifactIntegrityError(f"Not a design manifest: {path}")
+    return value
+
+
+def artifact_records(output_root: Path) -> tuple[ArtifactRecord, ...]:
+    records: list[ArtifactRecord] = []
+    for relative, path in _inventory(output_root).items():
+        if relative == BUILD_MANIFEST_RELATIVE:
+            continue
+        schema_id: str | None = None
+        schema_version: int | None = None
+        if path.suffix == ".json":
+            document = validate_json_document(path)
+            schema_id = cast(str, document["schema_id"])
+            schema_version = cast(int, document["schema_version"])
+        records.append(
+            ArtifactRecord(
+                path=relative,
+                size=path.stat().st_size,
+                sha256=sha256_file(path),
+                media_type=_media_type(path),
+                producer="python-cad-tools",
+                schema_id=schema_id,
+                schema_version=schema_version,
+                volatile=relative == "manifests/run-metadata.json",
+            )
+        )
+    return tuple(sorted(records, key=lambda record: record.path))
+
+
+def validate_export_tree(output_root: Path, selected_formats: tuple[str, ...], artifact_stem: str) -> None:
+    """Validate the complete exporter output before inventory hashing."""
+    actual = set(_inventory(output_root))
+    expected = _expected_paths(selected_formats, artifact_stem, ".gitkeep" in actual)
+    if BUILD_MANIFEST_RELATIVE in actual:
+        expected.add(BUILD_MANIFEST_RELATIVE)
+    missing = sorted(expected - actual)
+    unexpected = sorted(actual - expected)
+    if missing or unexpected:
+        parts = []
+        if missing:
+            parts.append("missing: " + ", ".join(missing))
+        if unexpected:
+            parts.append("unexpected: " + ", ".join(unexpected))
+        raise ArtifactIntegrityError("Invalid staged artifact set (" + "; ".join(parts) + ")")
+    for relative in sorted(actual):
+        if relative.endswith(".json"):
+            validate_json_document(output_root / relative)
+    _parse_formats(output_root, selected_formats, artifact_stem)
+    _reconcile_formats(output_root, selected_formats)
+
+
+def verify_output_root(output_root: Path, project_root: Path | None = None) -> VerificationResult:
+    if output_root.is_symlink() or not output_root.is_dir():
+        raise ArtifactIntegrityError(f"Generated output is missing or unsafe: {output_root}")
+    manifest_path = output_root / BUILD_MANIFEST_RELATIVE
+    document = load_build_manifest(manifest_path)
+    records = _records_from_manifest(document)
+    actual = _inventory(output_root)
+    expected = {record.path for record in records} | {BUILD_MANIFEST_RELATIVE}
+    if set(actual) != expected:
+        missing = sorted(expected - set(actual))
+        unexpected = sorted(set(actual) - expected)
+        raise ArtifactIntegrityError(f"Artifact inventory mismatch; missing={missing}, unexpected={unexpected}")
+    for record in records:
+        path = actual[record.path]
+        size = path.stat().st_size
+        digest = sha256_file(path)
+        if size != record.size:
+            raise ArtifactIntegrityError(f"Artifact size mismatch for {record.path}: expected {record.size}, got {size}")
+        if digest != record.sha256:
+            raise ArtifactIntegrityError(f"Artifact SHA-256 mismatch for {record.path}: expected {record.sha256}, got {digest}")
+        if path.suffix == ".json":
+            value = validate_json_document(path)
+            if value["schema_id"] != record.schema_id or value["schema_version"] != record.schema_version:
+                raise ArtifactIntegrityError(f"Recorded schema mismatch for {record.path}")
+    artifact_hash = semantic_hash([asdict(record) for record in records])
+    stable_hash = semantic_hash([asdict(record) for record in records if not record.volatile])
+    if document["artifact_set_hash"] != artifact_hash:
+        raise ArtifactIntegrityError("Build manifest artifact_set_hash does not reproduce")
+    if document["stable_artifact_set_hash"] != stable_hash:
+        raise ArtifactIntegrityError("Build manifest stable_artifact_set_hash does not reproduce")
+    if project_root is not None:
+        _verify_sources(project_root, document)
+    selected = _selected_formats(document)
+    design = load_design_manifest(output_root / "manifests/design-manifest.json")
+    design_without_hash = dict(design)
+    recorded_design_hash = design_without_hash.pop("semantic_hash", None)
+    if recorded_design_hash != semantic_hash(design_without_hash):
+        raise ArtifactIntegrityError("Design manifest semantic_hash does not reproduce")
+    if document["design_semantic_hash"] != design["semantic_hash"]:
+        raise ArtifactIntegrityError("Build and design manifest semantic hashes disagree")
+    validate_export_tree(output_root, selected, str(design["artifact_stem"]))
+    return VerificationResult(
+        ok=True,
+        output_root=output_root,
+        issues=(),
+        artifacts=records,
+        build_manifest=manifest_path,
+        artifact_set_hash=artifact_hash,
+        stable_artifact_set_hash=stable_hash,
+    )
+
+
+def verify_build_output(project_root: Path) -> VerificationResult:
+    from ._locking import project_lock
+    from ._transaction import recover_promotion
+    from .project_config import load_project_config, output_path, resolve_project_root
+
+    root = resolve_project_root(project_root)
+    config = load_project_config(root)
+    output = output_path(root, config)
+    with project_lock(root):
+        recover_promotion(output, lambda candidate: verify_output_root(candidate))
+        return verify_output_root(output, root)
+
+
+def get_package_build_info() -> PackageBuildInfo:
+    try:
+        document = json.loads(resources.files("python_cad_tools").joinpath("build-info.json").read_text(encoding="utf-8"))
+    except (FileNotFoundError, json.JSONDecodeError) as error:
+        raise ArtifactIntegrityError("The installed distribution has no valid build-info.json") from error
+    fields = {"schema_id", "schema_version", "distribution", "version", "source_commit", "source_dirty", "viewer_shell_sha256"}
+    if not isinstance(document, dict) or set(document) != fields:
+        raise ArtifactIntegrityError("build-info.json must contain an object")
+    installed_version = metadata.version("python-cad-tools")
+    if (
+        document.get("schema_id") != "urn:python-cad-tools:schema:package-build-info:1"
+        or document.get("schema_version") != 1
+        or document.get("distribution") != "python-cad-tools"
+        or document.get("version") != installed_version
+        or type(document.get("source_dirty")) is not bool
+        or not isinstance(document.get("source_commit"), str)
+        or not isinstance(document.get("viewer_shell_sha256"), str)
+        or _HEX.fullmatch(document["viewer_shell_sha256"]) is None
+    ):
+        raise ArtifactIntegrityError("build-info.json contains invalid package identity or integrity fields")
+    try:
+        return PackageBuildInfo(
+            schema_id=cast(Any, document["schema_id"]),
+            schema_version=cast(Any, document["schema_version"]),
+            distribution=cast(Any, document["distribution"]),
+            version=installed_version,
+            source_commit=str(document["source_commit"]),
+            source_dirty=bool(document["source_dirty"]),
+            viewer_shell_sha256=str(document["viewer_shell_sha256"]),
+        )
+    except KeyError as error:
+        raise ArtifactIntegrityError(f"build-info.json is missing {error.args[0]!r}") from error
+
+
+def _records_from_manifest(document: dict[str, Any]) -> tuple[ArtifactRecord, ...]:
+    raw = document.get("artifacts")
+    if not isinstance(raw, list):
+        raise ArtifactIntegrityError("Build manifest artifacts must be an array")
+    records: list[ArtifactRecord] = []
+    seen: set[str] = set()
+    for value in raw:
+        if not isinstance(value, dict) or set(value) != _ARTIFACT_FIELDS:
+            raise ArtifactIntegrityError("Build manifest contains an invalid artifact record")
+        relative = _safe_relative(value.get("path"))
+        if relative in seen:
+            raise ArtifactIntegrityError(f"Build manifest contains duplicate path: {relative}")
+        seen.add(relative)
+        if type(value.get("size")) is not int or value["size"] < 0:
+            raise ArtifactIntegrityError(f"Invalid artifact size for {relative}")
+        if not isinstance(value.get("sha256"), str) or _HEX.fullmatch(value["sha256"]) is None:
+            raise ArtifactIntegrityError(f"Invalid artifact SHA-256 for {relative}")
+        if not isinstance(value.get("media_type"), str) or not isinstance(value.get("producer"), str):
+            raise ArtifactIntegrityError(f"Invalid artifact metadata for {relative}")
+        schema_id = value.get("schema_id")
+        schema_version = value.get("schema_version")
+        if (schema_id is None) != (schema_version is None):
+            raise ArtifactIntegrityError(f"Incomplete schema metadata for {relative}")
+        if schema_id is not None and (not isinstance(schema_id, str) or type(schema_version) is not int):
+            raise ArtifactIntegrityError(f"Invalid schema metadata for {relative}")
+        if type(value.get("volatile")) is not bool:
+            raise ArtifactIntegrityError(f"Invalid volatile flag for {relative}")
+        records.append(ArtifactRecord(**value))
+    if [record.path for record in records] != sorted(record.path for record in records):
+        raise ArtifactIntegrityError("Build manifest artifact records are not path-sorted")
+    volatile = [record.path for record in records if record.volatile]
+    if volatile != ["manifests/run-metadata.json"]:
+        raise ArtifactIntegrityError(f"Unsupported volatile artifact set: {volatile}")
+    return tuple(records)
+
+
+def _inventory(root: Path) -> dict[str, Path]:
+    if root.is_symlink() or not root.is_dir():
+        raise ArtifactIntegrityError(f"Artifact root is not a regular directory: {root}")
+    result: dict[str, Path] = {}
+    for directory, names, files in os.walk(root, followlinks=False):
+        current = Path(directory)
+        for name in sorted(names):
+            path = current / name
+            if path.is_symlink():
+                raise ArtifactIntegrityError(f"Artifact tree contains a symlink: {path.relative_to(root)}")
+        for name in sorted(files):
+            path = current / name
+            if path.is_symlink() or not path.is_file():
+                raise ArtifactIntegrityError(f"Artifact is not a regular file: {path.relative_to(root)}")
+            relative = _safe_relative(path.relative_to(root).as_posix())
+            if relative in result:
+                raise ArtifactIntegrityError(f"Duplicate artifact path: {relative}")
+            result[relative] = path
+    return dict(sorted(result.items()))
+
+
+def _safe_relative(value: object) -> str:
+    if not isinstance(value, str) or not value or "\\" in value or "\x00" in value:
+        raise ArtifactIntegrityError(f"Unsafe artifact path: {value!r}")
+    path = PurePosixPath(value)
+    if path.is_absolute() or any(part in {"", ".", ".."} for part in path.parts) or path.as_posix() != value:
+        raise ArtifactIntegrityError(f"Unsafe artifact path: {value!r}")
+    return value
+
+
+def _expected_paths(formats: tuple[str, ...], stem: str, anchor: bool) -> set[str]:
+    expected = {"manifests/design-manifest.json", "manifests/run-metadata.json"}
+    if anchor:
+        expected.add(".gitkeep")
+    if "step" in formats:
+        expected |= {f"step/{stem}.step", "step/validation.json"}
+    if "ifc" in formats:
+        expected |= {f"ifc/{stem}.ifc", "ifc/validation.json"}
+    if "glb" in formats:
+        expected |= {f"glb/{stem}.glb", "glb/manifest.json"}
+    if "quantities" in formats:
+        expected |= {
+            "quantities/quantities.json",
+            "quantities/quantities.csv",
+            "quantities/materials.csv",
+            "quantities/summary.md",
+        }
+    if "drawings" in formats:
+        expected.add("drawings/annotation-manifest.json")
+        expected.add(f"drawings/pdf/{stem}_Conceptual_Drawings.pdf")
+        for view in ("plan", "front", "side", "section"):
+            expected.add(f"drawings/svg/{stem}_{view}.svg")
+            expected.add(f"drawings/dxf/{stem}_{view}.dxf")
+    return expected
+
+
+def _parse_formats(root: Path, formats: tuple[str, ...], stem: str) -> None:
+    try:
+        if "step" in formats:
+            from build123d import import_step
+
+            from .exporters.step import step_schema
+
+            step = root / f"step/{stem}.step"
+            if not step_schema(step).startswith("AP242_") or not import_step(step).is_valid:
+                raise ArtifactIntegrityError("STEP parser validation failed")
+        if "ifc" in formats:
+            import ifcopenshell
+
+            value = ifcopenshell.open(root / f"ifc/{stem}.ifc")
+            if value.schema != "IFC4":
+                raise ArtifactIntegrityError(f"Unsupported emitted IFC schema: {value.schema}")
+        if "glb" in formats:
+            import trimesh
+
+            from .exporters.glb import glb_json
+
+            glb = root / f"glb/{stem}.glb"
+            glb_json(glb)
+            if not isinstance(trimesh.load(glb, force="scene", process=False), trimesh.Scene):
+                raise ArtifactIntegrityError("GLB parser did not return a scene")
+        if "drawings" in formats:
+            import ezdxf
+            from pypdf import PdfReader
+
+            for svg in sorted((root / "drawings/svg").glob("*.svg")):
+                ElementTree.parse(svg)
+            for dxf in sorted((root / "drawings/dxf").glob("*.dxf")):
+                if ezdxf.readfile(dxf).audit().has_errors:
+                    raise ArtifactIntegrityError(f"DXF audit failed: {dxf.name}")
+            if not PdfReader(root / f"drawings/pdf/{stem}_Conceptual_Drawings.pdf").pages:
+                raise ArtifactIntegrityError("PDF contains no pages")
+            _reconcile_drawing_annotations(root, stem)
+    except ArtifactIntegrityError:
+        raise
+    except (OSError, ValueError, RuntimeError, BuildExportError) as error:
+        raise ArtifactIntegrityError(f"Final artifact parser validation failed: {error}") from error
+
+
+def _reconcile_formats(root: Path, formats: tuple[str, ...]) -> None:
+    design = load_design_manifest(root / "manifests/design-manifest.json")
+    elements = design["elements"]
+    if not isinstance(elements, list):
+        raise ArtifactIntegrityError("Design manifest elements must be an array")
+    if "step" in formats:
+        report = load_json_document(root / "step/validation.json")
+        expected_elements = [item for item in elements if item["physical"] and "step" in item["export_formats"]]
+        if report["solid_count"] != len(expected_elements):
+            raise ArtifactIntegrityError("STEP/design solid-count mismatch")
+        _require_matching_bounds("STEP", report["bounds_mm"], _combined_manifest_bounds(expected_elements))
+    if "ifc" in formats:
+        import ifcopenshell
+
+        from .exporters.ifc import property_value
+
+        ifc_path = next((root / "ifc").glob("*.ifc"))
+        actual = sorted(property_value(item, "StableId") for item in ifcopenshell.open(ifc_path).by_type("IfcBuildingElementProxy"))
+        expected = sorted(
+            item["id"]
+            for item in elements
+            if item["physical"] and "ifc" in item["export_formats"] and item["ifc_class"] is not None
+        )
+        if actual != expected:
+            raise ArtifactIntegrityError(f"IFC/design identity mismatch: expected {expected}, got {actual}")
+        report = load_json_document(root / "ifc/validation.json")
+        expected_elements = [
+            item
+            for item in elements
+            if item["physical"] and "ifc" in item["export_formats"] and item["ifc_class"] is not None
+        ]
+        _require_matching_bounds("IFC", report["bounds_mm"], _combined_manifest_bounds(expected_elements))
+    if "glb" in formats:
+        from .exporters.glb import glb_json
+
+        glb_path = next((root / "glb").glob("*.glb"))
+        document = glb_json(glb_path)
+        actual = sorted(node.get("extras", {}).get("stable_id") for node in document["nodes"] if node.get("extras", {}).get("stable_id"))
+        expected = sorted(item["id"] for item in elements if item["physical"] and "glb" in item["export_formats"])
+        if actual != expected:
+            raise ArtifactIntegrityError(f"GLB/design identity mismatch: expected {expected}, got {actual}")
+        report = load_json_document(root / "glb/manifest.json")
+        expected_elements = [item for item in elements if item["physical"] and "glb" in item["export_formats"]]
+        _require_matching_bounds("GLB", report["bounds_cad_mm"], _combined_manifest_bounds(expected_elements))
+    if "quantities" in formats:
+        quantities = load_json_document(root / "quantities/quantities.json")
+        actual = sorted(record["element_id"] for record in quantities["records"])
+        expected = sorted(item["id"] for item in elements if item["physical"] and "quantities" in item["export_formats"])
+        if actual != expected:
+            raise ArtifactIntegrityError(f"Quantity/design identity mismatch: expected {expected}, got {actual}")
+
+
+def _reconcile_drawing_annotations(root: Path, stem: str) -> None:
+    import ezdxf
+    from pypdf import PdfReader
+
+    manifest = load_json_document(root / "drawings/annotation-manifest.json")
+    sheets = manifest.get("sheets")
+    annotations = manifest.get("annotations")
+    if not isinstance(sheets, list) or not isinstance(annotations, list):
+        raise ArtifactIntegrityError("Drawing annotation manifest arrays are invalid")
+    rendered = {record["id"] for record in annotations if record.get("rendered_entity") is True}
+    declared_by_sheet: set[str] = set()
+    reader = PdfReader(root / f"drawings/pdf/{stem}_Conceptual_Drawings.pdf")
+    if len(reader.pages) != len(sheets):
+        raise ArtifactIntegrityError("Drawing annotation manifest/PDF page-count mismatch")
+    for expected_page, sheet in enumerate(sheets, start=1):
+        if not isinstance(sheet, dict):
+            raise ArtifactIntegrityError("Drawing annotation manifest contains an invalid sheet record")
+        sheet_id = sheet.get("sheet_id")
+        view_id = sheet.get("view_id")
+        page_number = sheet.get("page_number")
+        expected_ids = sheet.get("annotation_ids")
+        expected_text = sheet.get("pdf_text")
+        if (
+            not isinstance(sheet_id, str)
+            or not isinstance(view_id, str)
+            or page_number != expected_page
+            or not isinstance(expected_ids, list)
+            or not all(isinstance(value, str) for value in expected_ids)
+            or not isinstance(expected_text, list)
+            or not all(isinstance(value, str) for value in expected_text)
+        ):
+            raise ArtifactIntegrityError("Drawing annotation manifest sheet mapping is invalid")
+        svg = root / f"drawings/svg/{stem}_{view_id}.svg"
+        svg_root = ElementTree.parse(svg).getroot()
+        if svg_root.get("data-sheet") != sheet_id:
+            raise ArtifactIntegrityError(f"SVG sheet identity mismatch for {view_id}")
+        svg_ids = sorted(
+            element.attrib["data-annotation-id"]
+            for element in svg_root.iter()
+            if "data-annotation-id" in element.attrib
+        )
+        dxf = ezdxf.readfile(root / f"drawings/dxf/{stem}_{view_id}.dxf")
+        dxf_ids: list[str] = []
+        for entity in dxf.modelspace():
+            if entity.has_xdata("PYTHON_CAD_TOOLS"):
+                tags = entity.get_xdata("PYTHON_CAD_TOOLS")
+                dxf_ids.extend(str(tag.value) for tag in tags if tag.code == 1000)
+        if expected_ids != sorted(expected_ids) or svg_ids != expected_ids or sorted(dxf_ids) != expected_ids:
+            raise ArtifactIntegrityError(
+                f"Drawing annotation identity mismatch on {sheet_id}: expected {expected_ids}, SVG {svg_ids}, DXF {sorted(dxf_ids)}"
+            )
+        declared_by_sheet.update(expected_ids)
+        extracted = _normalized_text(reader.pages[expected_page - 1].extract_text() or "")
+        for value in expected_text:
+            if _normalized_text(value) not in extracted:
+                raise ArtifactIntegrityError(
+                    f"Drawing annotation PDF text mismatch on {sheet_id}: missing {value!r}"
+                )
+    if declared_by_sheet != rendered:
+        raise ArtifactIntegrityError("Drawing annotation sidecar rendered-entity inventory is inconsistent")
+
+
+def _normalized_text(value: str) -> str:
+    return " ".join(value.split())
+
+
+def _combined_manifest_bounds(elements: list[dict[str, Any]]) -> list[float]:
+    if not elements:
+        return [0.0] * 6
+    return [
+        round(min(float(item["bounds_mm"][index]) for item in elements), 6)
+        for index in range(3)
+    ] + [
+        round(max(float(item["bounds_mm"][index]) for item in elements), 6)
+        for index in range(3, 6)
+    ]
+
+
+def _require_matching_bounds(label: str, actual: object, expected: list[float]) -> None:
+    if not isinstance(actual, list) or len(actual) != 6:
+        raise ArtifactIntegrityError(f"{label} bounds are missing or invalid")
+    try:
+        matches = all(abs(float(left) - right) <= 1e-6 for left, right in zip(actual, expected, strict=True))
+    except (TypeError, ValueError):
+        matches = False
+    if not matches:
+        raise ArtifactIntegrityError(f"{label}/design bounds mismatch: expected {expected}, got {actual}")
+
+
+def _verify_sources(project_root: Path, document: dict[str, Any]) -> None:
+    raw = document.get("source_inputs")
+    if not isinstance(raw, list):
+        raise ArtifactIntegrityError("Build manifest source_inputs must be an array")
+    current = []
+    for record in raw:
+        if not isinstance(record, dict) or set(record) != {"path", "size", "sha256"}:
+            raise ArtifactIntegrityError("Invalid source input record")
+        relative = _safe_relative(record["path"])
+        path = project_root / PurePosixPath(relative)
+        if path.is_symlink() or not path.is_file() or not path.resolve().is_relative_to(project_root):
+            raise ArtifactIntegrityError(f"Authoritative source is missing or unsafe: {relative}")
+        current.append({"path": relative, "size": path.stat().st_size, "sha256": sha256_file(path)})
+    if current != raw or semantic_hash(current) != document.get("source_set_hash"):
+        raise ArtifactIntegrityError("Authoritative project sources differ from the verified build")
+
+
+def _selected_formats(document: dict[str, Any]) -> tuple[str, ...]:
+    from .project_config import FORMAT_ORDER
+
+    raw = document.get("selected_formats")
+    if not isinstance(raw, list) or not all(isinstance(item, str) for item in raw):
+        raise ArtifactIntegrityError("Build manifest selected_formats is invalid")
+    if not raw or len(raw) != len(set(raw)) or any(item not in FORMAT_ORDER for item in raw):
+        raise ArtifactIntegrityError("Build manifest selected_formats contains an unsupported or duplicate format")
+    if raw != [item for item in FORMAT_ORDER if item in raw]:
+        raise ArtifactIntegrityError("Build manifest selected_formats is not in canonical order")
+    return tuple(raw)
+
+
+def _media_type(path: Path) -> str:
+    explicit = {
+        ".step": "model/step",
+        ".ifc": "application/x-step",
+        ".glb": "model/gltf-binary",
+        ".dxf": "image/vnd.dxf",
+        ".csv": "text/csv; charset=utf-8",
+        ".md": "text/markdown; charset=utf-8",
+    }
+    return explicit.get(path.suffix.lower()) or mimetypes.guess_type(path.name)[0] or "application/octet-stream"
+
+
+__all__ = [
+    "ArtifactRecord",
+    "PackageBuildInfo",
+    "VerificationResult",
+    "get_package_build_info",
+    "load_build_manifest",
+    "load_design_manifest",
+    "verify_build_output",
+]

python_cad_tools/build-info.json

@@ -0,0 +1 @@
+{"distribution":"python-cad-tools","schema_id":"urn:python-cad-tools:schema:package-build-info:1","schema_version":1,"source_commit":"2266dd501edbb417c10eba356311808f5d29cce0","source_dirty":true,"version":"0.1.0rc1","viewer_shell_sha256":"5be46f14101b955176328ba78760be7ebaee08a3b73ea76a884d11ce38b25882"}