Publish detached sanitized source evidence

internal/engine/records.go

@@ -191,9 +191,19 @@ type SourceInfo struct {
 	Kind          SourceKind
 	UnderlayIndex int
 	ImportedFrom  *Location
+	VersionCheck  *SourceVersionCheck
 	namespace     *namespaceToken
 }
 
+// SourceVersionCheck is a detached, public-safe record of a source-local
+// version declaration observed during an enabled load.
+type SourceVersionCheck struct {
+	Path     Path
+	Version  Version
+	Location *Location
+	Redacted bool
+}
+
 // Diagnostic is a safe structured problem report. Message and source labels must
 // never contain configuration values or other secrets.
 type Diagnostic struct {
@@ -262,9 +272,20 @@ func cloneLocations(locations []Location) []Location {
 func cloneSourceInfo(source SourceInfo) SourceInfo {
 	source.ImportedFrom = cloneLocation(source.ImportedFrom)
 	source.Destination = source.Destination.clone()
+	source.VersionCheck = cloneSourceVersionCheck(source.VersionCheck)
 	return source
 }
 
+func cloneSourceVersionCheck(value *SourceVersionCheck) *SourceVersionCheck {
+	if value == nil {
+		return nil
+	}
+	cloned := *value
+	cloned.Path = value.Path.clone()
+	cloned.Location = cloneLocation(value.Location)
+	return &cloned
+}
+
 func cloneSourceInfos(sources []SourceInfo) []SourceInfo {
 	if sources == nil {
 		return nil