Attribution Verdict

Per-buyer source attribution marking for TypeScript and Python libraries. It answers one question after a leak -- WHICH BUYER DID THIS COPY COME FROM -- and it is built around the rule a naive version of this idea always breaks: IT MUST BE ALLOWED TO SAY "I DON'T KNOW."

THE NUMBER TO LEAD WITH, NOT BURY. A real Prettier 3 pass was run over a marked copy of a real, currently-shipping library, counting per mark type how many marks still carried THE VALUE THEY WERE ASSIGNED -- not how many mark SITES were merely still detectable. Those are different measurements, and counting sites is the flattering mistake.

    Comment-text marks              47/47  (100%)
    Marker file (token)               1/1
    Whitespace (blank-line count)     0/4   -- ZERO, not "most"
    Total                           48/52  (92%)

WHITESPACE MARKING DOES NOT SURVIVE A FORMATTER. Not "degrades", not "mostly survives" -- zero of four. Any scheme that leans on blank-line counts is attributing a leak on evidence a single `prettier --write` erased, and the resulting accusation is confident and wrong.

SO IT REFUSES. A verdict that cannot distinguish two buyers returns NOT DETERMINABLE naming what is missing, rather than the nearest match. An attribution system that always produces a name is worse than none: it converts an unknown into a false accusation against a real customer.

VERIFIED: 240 tests, measured by running the suite.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function applyWatermark(base: FileTree, opts: ApplyOptions):;
  export function readDirectoryToTree(root: string): FileTree;
  export function writeTreeToDirectory(root: string, tree: FileTree): void;
  export function observeMarks(tree: FileTree, opts: ObserveOptions = {}): ObservedMarks;
  export function scoreCandidate( entry: ManifestEntry, observed: ObservedMarks, ):;
  export function extractAttribution( candidates: ManifestEntry[], tree: FileTree, rawArtifactBytes?: Buffer, opts: ObserveOptions = {}, ): ExtractionResult;
  export function detectLanguage(relPath: string): SourceLang | null;
  export function lineCommentMarker(lang: SourceLang): string;
  export function linesStartInsideMultilineLiteral(content: string, lang: SourceLang): boolean[];
  export function applyCommentMarks( filePath: string, content: string, lang: SourceLang, key: WatermarkKey, buyerId: string, ):;
  export function detectCommentMarks(content: string, langOrPath: SourceLang | string): CommentHit[];
  export function findImportRuns(lines: string[], lang: SourceLang): number[][];

  export type SourceLang = "ts" | "py";
  export type FileTree = Map<string, string | Buffer>;
  export type Confidence = number;
  export type ExtractionResult = | { verdict: "match";