{"version":3,"file":"platform-manifest.cjs","names":["readFileSync","join","readFrameworkVersion","composePlatformReleaseManifest","readWorkspaceCatalog","computeTemplateInventory","serializePlatformReleaseManifest","getPlatformManifestKey","computeSriHash","satisfiesConstraint","resolvePlatformManifest"],"sources":["../../../src/services/deploy/platform-manifest.ts"],"sourcesContent":["/**\n * The deploy-side half of the platform release manifest (ADR 0034 pt 1/2):\n * wires the framework repo's release inputs into the pure composer and shapes\n * the registry entry that rides the train's atomic FastKV write. Framework-\n * rooted deploys only — a child deploy publishes no release manifest.\n */\nimport { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { satisfiesConstraint } from \"../federation/service\";\nimport {\n  composePlatformReleaseManifest,\n  computeTemplateInventory,\n  getPlatformManifestKey,\n  type PlatformReleaseManifest,\n  resolvePlatformManifest,\n  serializePlatformReleaseManifest,\n} from \"../platform/manifest\";\nimport { readWorkspaceCatalog } from \"../workspace/catalog\";\nimport { readFrameworkVersion } from \"./image\";\nimport { computeSriHash } from \"./integrity\";\n\n/** The universal image (ADR 0020/0021) — the release manifest's image ref. */\nexport const PLATFORM_IMAGE_REF = \"ghcr.io/nearbuilders/everything-dev\";\n\nfunction readWorkspacePackageVersion(configDir: string, name: string): string | undefined {\n  try {\n    const raw = readFileSync(join(configDir, \"packages\", name, \"package.json\"), \"utf-8\");\n    const pkg = JSON.parse(raw) as { version?: unknown };\n    return typeof pkg.version === \"string\" ? pkg.version : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport function readEveryPluginVersion(configDir: string): string | undefined {\n  return readWorkspacePackageVersion(configDir, \"every-plugin\");\n}\n\nexport interface PlatformManifestPublishEntry {\n  key: string;\n  value: string;\n  integrity: string;\n  manifest: PlatformReleaseManifest;\n}\n\nexport function composePlatformManifestPublishEntry(opts: {\n  configDir: string;\n  account: string;\n  gateway: string;\n  /** The previous release's framework version — the compat floor it implies. */\n  previousFrameworkVersion?: string;\n  /** The deploy's repo HEAD — the serving build's identity on the wire. */\n  gitSha?: string;\n  imageRef?: string;\n}): PlatformManifestPublishEntry | null {\n  const frameworkVersion = readFrameworkVersion(opts.configDir);\n  const everyPluginVersion = readEveryPluginVersion(opts.configDir);\n  if (!frameworkVersion || !everyPluginVersion) return null;\n\n  const manifest = composePlatformReleaseManifest({\n    frameworkVersion,\n    everyPluginVersion,\n    ...(opts.gitSha ? { gitSha: opts.gitSha } : {}),\n    imageRef: opts.imageRef ?? PLATFORM_IMAGE_REF,\n    catalog: readWorkspaceCatalog(opts.configDir),\n    templateInventory: computeTemplateInventory(opts.configDir),\n    compatMinChild: opts.previousFrameworkVersion ?? frameworkVersion,\n  });\n  const value = serializePlatformReleaseManifest(manifest);\n  return {\n    key: getPlatformManifestKey(opts.account, opts.gateway),\n    value,\n    integrity: computeSriHash(value),\n    manifest,\n  };\n}\n\nexport interface DerivedImageRef {\n  image: string;\n  tag: string;\n  digest?: string;\n}\n\n/**\n * The truth gate (#546): every uploaded workspace's version manifest declares\n * the shared-singleton versions its build embedded; the release manifest pins\n * the same names from the release catalog. A version that appears in both but\n * disagrees means the workspace's install drifted from the catalog — the\n * manifest would lie about the uploaded bytes and pinned children would boot\n * a skewed composition. Pin shapes mirror `checkPlatformCompat`'s semantics\n * (via `satisfiesConstraint`): an exact pin must match exactly, a range pin\n * must be satisfied by the built version — the catalog pinning every-plugin\n * as `^X` while bundles record the exact resolved version is not a violation.\n * Returns human-readable violations; empty = clean.\n */\nexport function platformTruthViolations(\n  manifest: PlatformReleaseManifest,\n  sharedByWorkspace: Map<string, Record<string, string> | undefined>,\n): string[] {\n  const violations: string[] = [];\n  for (const [workspace, shared] of sharedByWorkspace) {\n    if (!shared) continue;\n    for (const [name, version] of Object.entries(shared)) {\n      const pin = manifest.sharedDeps[name];\n      if (pin && !satisfiesConstraint(version, pin.version)) {\n        violations.push(\n          `${workspace} was built against ${name}@${version}, the release manifest pins ${pin.version} — ` +\n            `a stale install publishes a manifest that lies about the uploaded bytes; ` +\n            `run pnpm install and redeploy`,\n        );\n      }\n    }\n  }\n  return violations;\n}\n\n/**\n * The derived-pin seam for image refs (ADR 0034 pt 2): when the platform\n * manifest resolves, a runtime's image ref derives as `ref@v<version>` —\n * never hand-pinned. Digest resolution rides the registry and arrives as\n * `digest` when the caller can fetch it; the deploy preflight consumer is\n * follow-up work (plan 054 T4).\n */\nexport async function deriveImageRefFromPlatformManifest(opts: {\n  configDir: string;\n  localConfig: Record<string, unknown>;\n  fetchManifest?: (account: string, gateway: string) => Promise<PlatformReleaseManifest | null>;\n  fetchParent?: (account: string, gateway: string) => Promise<Record<string, unknown> | null>;\n}): Promise<DerivedImageRef | null> {\n  const resolved = await resolvePlatformManifest({\n    configDir: opts.configDir,\n    localConfig: opts.localConfig,\n    fetchManifest: opts.fetchManifest,\n    ...(opts.fetchParent ? { fetchParent: opts.fetchParent } : {}),\n  });\n  if (!resolved) return null;\n  const tag = resolved.manifest.image.tags[0];\n  if (!tag) return null;\n  return { image: resolved.manifest.image.ref, tag };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAa,qBAAqB;AAElC,SAAS,4BAA4B,WAAmB,MAAkC;CACxF,IAAI;EACF,MAAM,UAAMA,0BAAaC,gBAAK,WAAW,YAAY,MAAM,cAAc,GAAG,OAAO;EACnF,MAAM,MAAM,KAAK,MAAM,GAAG;EAC1B,OAAO,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;CACzD,QAAQ;EACN;CACF;AACF;AAEA,SAAgB,uBAAuB,WAAuC;CAC5E,OAAO,4BAA4B,WAAW,cAAc;AAC9D;AASA,SAAgB,oCAAoC,MASZ;CACtC,MAAM,mBAAmBC,mCAAqB,KAAK,SAAS;CAC5D,MAAM,qBAAqB,uBAAuB,KAAK,SAAS;CAChE,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,OAAO;CAErD,MAAM,WAAWC,gDAA+B;EAC9C;EACA;EACA,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;EAC7C,UAAU,KAAK;EACf,SAASC,qCAAqB,KAAK,SAAS;EAC5C,mBAAmBC,0CAAyB,KAAK,SAAS;EAC1D,gBAAgB,KAAK,4BAA4B;CACnD,CAAC;CACD,MAAM,QAAQC,kDAAiC,QAAQ;CACvD,OAAO;EACL,KAAKC,wCAAuB,KAAK,SAAS,KAAK,OAAO;EACtD;EACA,WAAWC,iDAAe,KAAK;EAC/B;CACF;AACF;;;;;;;;;;;;;AAoBA,SAAgB,wBACd,UACA,mBACU;CACV,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,CAAC,WAAW,WAAW,mBAAmB;EACnD,IAAI,CAAC,QAAQ;EACb,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,MAAM,GAAG;GACpD,MAAM,MAAM,SAAS,WAAW;GAChC,IAAI,OAAO,CAACC,wDAAoB,SAAS,IAAI,OAAO,GAClD,WAAW,KACT,GAAG,UAAU,qBAAqB,KAAK,GAAG,QAAQ,8BAA8B,IAAI,QAAQ,0GAG9F;EAEJ;CACF;CACA,OAAO;AACT;;;;;;;;AASA,eAAsB,mCAAmC,MAKrB;CAClC,MAAM,WAAW,MAAMC,yCAAwB;EAC7C,WAAW,KAAK;EAChB,aAAa,KAAK;EAClB,eAAe,KAAK;EACpB,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;CAC9D,CAAC;CACD,IAAI,CAAC,UAAU,OAAO;CACtB,MAAM,MAAM,SAAS,SAAS,MAAM,KAAK;CACzC,IAAI,CAAC,KAAK,OAAO;CACjB,OAAO;EAAE,OAAO,SAAS,SAAS,MAAM;EAAK;CAAI;AACnD"}