feat(registry): add workspace-scoped artifact metadata

crates/crank-artifacts/src/lib.rs

@@ -19,5 +19,7 @@ pub mod test_support;
 
 pub use error::ArtifactError;
 pub use housekeeping::{StaleTemp, TempScan};
-pub use model::{ArtifactRef, MAX_ARTIFACT_BYTES, MAX_SOURCE_BYTES, StoredArtifact};
+pub use model::{
+    ArtifactRef, MAX_ARTIFACT_BYTES, MAX_SOURCE_BYTES, RegisteredArtifact, StoredArtifact,
+};
 pub use store::ArtifactStore;

crates/crank-artifacts/src/model.rs

@@ -66,3 +66,23 @@ pub struct StoredArtifact {
     pub artifact_ref: ArtifactRef,
     pub size_bytes: usize,
 }
+
+/// Non-forgeable proof that this process published and verified an artifact.
+///
+/// Registry metadata creation accepts this capability instead of a caller-built
+/// digest, preventing knowledge of a shared digest from granting read access.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct RegisteredArtifact {
+    pub(crate) artifact_ref: ArtifactRef,
+    pub(crate) size_bytes: usize,
+}
+
+impl RegisteredArtifact {
+    pub fn artifact_ref(&self) -> &ArtifactRef {
+        &self.artifact_ref
+    }
+
+    pub fn size_bytes(&self) -> usize {
+        self.size_bytes
+    }
+}

crates/crank-artifacts/src/store.rs

@@ -13,7 +13,7 @@ use std::{
 use rand::random;
 use sha2::{Digest, Sha256};
 
-use crate::{ArtifactError, ArtifactRef, MAX_ARTIFACT_BYTES, StoredArtifact};
+use crate::{ArtifactError, ArtifactRef, MAX_ARTIFACT_BYTES, RegisteredArtifact, StoredArtifact};
 
 const SHA_DIR: &[u8] = b"sha256";
 const TEMP_PREFIX: &str = ".crank-artifact-tmp-v1-";
@@ -106,6 +106,16 @@ impl ArtifactStore {
         self.put_reader(&mut io::Cursor::new(bytes))
     }
 
+    /// Stores bytes and returns a non-forgeable capability suitable for
+    /// creating authoritative registry metadata.
+    pub fn put_registered(&self, bytes: &[u8]) -> Result<RegisteredArtifact, ArtifactError> {
+        let stored = self.put(bytes)?;
+        Ok(RegisteredArtifact {
+            artifact_ref: stored.artifact_ref,
+            size_bytes: stored.size_bytes,
+        })
+    }
+
     /// Historical spelling retained for source compatibility; bytes are not
     /// restricted to UTF-8 at this filesystem boundary.
     pub fn put_utf8(&self, bytes: &[u8]) -> Result<StoredArtifact, ArtifactError> {