@ai-dossier/core 1.15.1-next.631.1 → 1.16.0-next.633.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -4
- package/dist/formatter/formatter.d.ts.map +1 -1
- package/dist/formatter/formatter.js +4 -0
- package/dist/formatter/formatter.js.map +1 -1
- package/dist/index.d.ts +3 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +15 -1
- package/dist/index.js.map +1 -1
- package/dist/linter/rules/schema-valid.d.ts.map +1 -1
- package/dist/linter/rules/schema-valid.js +44 -41
- package/dist/linter/rules/schema-valid.js.map +1 -1
- package/dist/parser.d.ts +2 -1
- package/dist/parser.d.ts.map +1 -1
- package/dist/parser.js +25 -2
- package/dist/parser.js.map +1 -1
- package/dist/schema/dossier-schema.json +102 -15
- package/dist/signing-payload.d.ts +37 -5
- package/dist/signing-payload.d.ts.map +1 -1
- package/dist/signing-payload.js +76 -22
- package/dist/signing-payload.js.map +1 -1
- package/dist/spec-shape.d.ts +91 -0
- package/dist/spec-shape.d.ts.map +1 -0
- package/dist/spec-shape.js +260 -0
- package/dist/spec-shape.js.map +1 -0
- package/dist/types.d.ts +17 -2
- package/dist/types.d.ts.map +1 -1
- package/dist/utils/canonical-json.d.ts +9 -0
- package/dist/utils/canonical-json.d.ts.map +1 -0
- package/dist/utils/canonical-json.js +24 -0
- package/dist/utils/canonical-json.js.map +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -57,12 +57,16 @@ import {
|
|
|
57
57
|
|
|
58
58
|
#### `parseDossierContent(content: string): ParsedDossier`
|
|
59
59
|
|
|
60
|
-
Parse a dossier content string into frontmatter and body. Accepts both `---dossier` (JSON/YAML) and standard `---` (YAML) delimiters.
|
|
60
|
+
Parse a dossier content string into frontmatter and body. Accepts both `---dossier` (JSON/YAML) and standard `---` (YAML) delimiters, in either frontmatter shape: legacy (every Dossier field flat at the top level) or spec (Agent Skills fields `name`, `description`, `license`, `compatibility`, `allowed-tools` at the top level, every other field under `metadata` as `dossier.<field>` strings). `frontmatter` is always the same flat logical object; `rawFrontmatter` is the frontmatter as it sits on disk and `shape` says which layout it uses. Throws a `SpecShapeError` (message prefixed `Invalid spec-shaped frontmatter:`) when a spec-shaped frontmatter is ambiguous — see `fromSpecFrontmatter`.
|
|
61
61
|
|
|
62
62
|
```typescript
|
|
63
|
-
const { frontmatter, body, raw } = parseDossierContent(content);
|
|
63
|
+
const { frontmatter, body, raw, rawFrontmatter, shape } = parseDossierContent(content);
|
|
64
64
|
```
|
|
65
65
|
|
|
66
|
+
#### `toSpecFrontmatter(logical) / fromSpecFrontmatter(spec)`
|
|
67
|
+
|
|
68
|
+
Convert flat logical frontmatter to the spec shape and back. Values under `metadata` are strings: a string is stored as-is unless it would itself parse as JSON (then it is JSON-quoted), and any other value is stored as canonical JSON (`encodeSpecValue` / `decodeSpecValue`), so `fromSpecFrontmatter(toSpecFrontmatter(x))` equals `x`. `fromSpecFrontmatter` throws `SpecShapeError` on anything ambiguous: a Dossier field at the top level, `dossier.<agent-skills-field>`, or a non-string metadata value.
|
|
69
|
+
|
|
66
70
|
#### `parseDossierFile(filePath: string): ParsedDossier`
|
|
67
71
|
|
|
68
72
|
Read and parse a dossier file from disk.
|
|
@@ -105,6 +109,7 @@ const result = verifyIntegrity(body, frontmatter.checksum?.hash);
|
|
|
105
109
|
|
|
106
110
|
```typescript
|
|
107
111
|
import {
|
|
112
|
+
buildVerificationPayload,
|
|
108
113
|
verifySignature,
|
|
109
114
|
verifyWithEd25519,
|
|
110
115
|
verifyWithKms,
|
|
@@ -120,10 +125,15 @@ import {
|
|
|
120
125
|
Verify a signature using the verifier registry. Automatically selects the correct verifier based on `signature.algorithm`.
|
|
121
126
|
|
|
122
127
|
```typescript
|
|
123
|
-
const
|
|
128
|
+
const parsed = parseDossierContent(content);
|
|
129
|
+
const result = await verifySignature(buildVerificationPayload(parsed), parsed.frontmatter.signature);
|
|
124
130
|
console.log(result.valid); // true | false
|
|
125
131
|
```
|
|
126
132
|
|
|
133
|
+
#### `buildVerificationPayload(parsed: ParsedDossier): string`
|
|
134
|
+
|
|
135
|
+
The bytes a parsed dossier's signature must verify against. Selects the scheme from `signature.covers` — absent: v1 (body only); `frontmatter+body`: v2 (flat frontmatter + body); `spec-frontmatter+body`: v3 (on-disk spec-shaped frontmatter minus `metadata["dossier.signature"]`, + body) — and binds it to the file's shape: spec-shaped files verify only under v3, legacy files only under v1/v2. Throws on an unsigned dossier, an unknown `covers`, or a scheme/shape mismatch; treat a throw as a failed verification.
|
|
136
|
+
|
|
127
137
|
#### `verifyWithEd25519(content: string, signature: string, publicKey: string): VerifyResult`
|
|
128
138
|
|
|
129
139
|
Verify an Ed25519 signature directly. `publicKey` may be SPKI PEM, raw 32-byte base64, or base64 SPKI DER.
|
|
@@ -251,7 +261,7 @@ All TypeScript types are exported from the package root:
|
|
|
251
261
|
import type {
|
|
252
262
|
// Core types
|
|
253
263
|
DossierFrontmatter, // Frontmatter fields (title, version, checksum, signature, ...)
|
|
254
|
-
ParsedDossier, // { frontmatter, body, raw }
|
|
264
|
+
ParsedDossier, // { frontmatter, body, raw, rawFrontmatter, shape }
|
|
255
265
|
DossierStatus, // "Draft" | "Stable" | "Deprecated" | "Experimental"
|
|
256
266
|
DossierListItem, // Summary for listing dossiers
|
|
257
267
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../src/formatter/formatter.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../src/formatter/formatter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAmG3D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAC/B,YAAY,CAsCd"}
|
|
@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
3
3
|
exports.formatDossierContent = formatDossierContent;
|
|
4
4
|
const checksum_1 = require("../checksum");
|
|
5
5
|
const parser_1 = require("../parser");
|
|
6
|
+
const spec_shape_1 = require("../spec-shape");
|
|
6
7
|
const types_1 = require("./types");
|
|
7
8
|
/**
|
|
8
9
|
* Conventional key ordering for dossier frontmatter.
|
|
@@ -94,6 +95,9 @@ function ensureFinalNewline(text) {
|
|
|
94
95
|
function formatDossierContent(content, options) {
|
|
95
96
|
const opts = { ...types_1.defaultFormatOptions, ...options };
|
|
96
97
|
const parsed = (0, parser_1.parseDossierContent)(content);
|
|
98
|
+
if (parsed.shape === 'spec') {
|
|
99
|
+
throw new Error(spec_shape_1.SPEC_SHAPE_WRITE_UNSUPPORTED);
|
|
100
|
+
}
|
|
97
101
|
let frontmatter = parsed.frontmatter;
|
|
98
102
|
if (opts.sortKeys) {
|
|
99
103
|
frontmatter = sortFrontmatterKeys(frontmatter);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../src/formatter/formatter.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../src/formatter/formatter.ts"],"names":[],"mappings":";;AAsGA,oDAyCC;AA/ID,0CAAgD;AAChD,sCAAgD;AAChD,8CAA6D;AAE7D,mCAA+C;AAE/C;;;;GAIG;AACH,MAAM,SAAS,GAAa;IAC1B,wBAAwB;IACxB,OAAO;IACP,SAAS;IACT,kBAAkB;IAClB,QAAQ;IACR,cAAc;IACd,WAAW;IACX,UAAU;IACV,MAAM;IACN,gBAAgB;IAChB,oBAAoB;IACpB,YAAY;IACZ,cAAc;IACd,mBAAmB;IACnB,wBAAwB;IACxB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,QAAQ;IACR,SAAS;IACT,eAAe;IACf,UAAU;IACV,YAAY;IACZ,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,iBAAiB;IACjB,eAAe;IACf,UAAU;IACV,WAAW;CACZ,CAAC;AAEF,SAAS,mBAAmB,CAAC,WAAoC;IAC/D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAEpC,0BAA0B;IAC1B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;SACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC/B,IAAI,EAAE,CAAC;IACV,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,mCAAmC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,sFAAsF;IACtF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAE3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;gBAChB,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;SAC7B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,oBAAoB,CAClC,OAAe,EACf,OAAgC;IAEhC,MAAM,IAAI,GAAkB,EAAE,GAAG,4BAAoB,EAAE,GAAG,OAAO,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,IAAA,4BAAmB,EAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,WAAW,GAA4B,MAAM,CAAC,WAAsC,CAAC;IAEzF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,WAAW,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,2FAA2F;IAC3F,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAErE,6BAA6B;IAC7B,IAAI,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,WAAW,CAAC,QAAmC,CAAC;QACpE,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,IAAA,4BAAiB,EAAC,IAAI,CAAC,CAAC;YACxC,WAAW,CAAC,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE/D,6BAA6B;IAC7B,IAAI,MAAM,GAAG,eAAe,OAAO,UAAU,IAAI,EAAE,CAAC;IAEpD,uBAAuB;IACvB,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEpC,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,MAAM,KAAK,OAAO;KAC5B,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -36,7 +36,9 @@ export type { TrustedKeyEntry, TrustedKeyProblem } from './signature';
|
|
|
36
36
|
export { findTrustedIdentifier, isKmsKeyIdentifier, loadTrustedKeys, parseTrustedKeys, reportTrustedKeyProblems, trustedKeysFromContent, verifySignature, verifyWithEd25519, verifyWithKms, } from './signature';
|
|
37
37
|
export { Ed25519Signer, Ed25519Verifier, getVerifierRegistry, KmsSigner, KmsVerifier, SignatureResult, Signer, Verifier, VerifierRegistry, VerifyResult, } from './signers';
|
|
38
38
|
export type { SignatureCoverage } from './signing-payload';
|
|
39
|
-
export { buildSignedPayload, canonicalizeFrontmatter, isSupportedPublicKey, normalizePublicKey, publicKeysMatch, signatureCoverage, toSpkiPem, } from './signing-payload';
|
|
39
|
+
export { buildSignedPayload, buildVerificationPayload, canonicalizeFrontmatter, canonicalizeSpecFrontmatter, isSupportedPublicKey, normalizePublicKey, publicKeysMatch, SIGNATURE_COVERAGES, signatureCoverage, toSpkiPem, } from './signing-payload';
|
|
40
|
+
export type { FrontmatterShape } from './spec-shape';
|
|
41
|
+
export { DOSSIER_METADATA_PREFIX, decodeSpecValue, encodeSpecValue, fromSpecFrontmatter, isSpecShapedFrontmatter, SPEC_SHAPE_WRITE_UNSUPPORTED, SPEC_TOP_LEVEL_FIELDS, SpecShapeError, toSpecFrontmatter, } from './spec-shape';
|
|
40
42
|
export type { ConfigLayer as TraceConfigLayer, ResolvedTraceConfig, TraceConfigOptions, TraceConfigSource, } from './trace-config';
|
|
41
43
|
export { resolveTraceConfig } from './trace-config';
|
|
42
44
|
export type { DossierTraceInfo, StepInput as TraceStepInput, TraceInput, TraceRecorder, TraceRecorderOptions, TraceStatus, TraceUpdate, } from './trace-recorder';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEvE,YAAY,EACV,aAAa,EACb,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,UAAU,EACV,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,WAAW,IAAI,gBAAgB,EAC/B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,YAAY,EACV,gBAAgB,EAChB,SAAS,IAAI,cAAc,EAC3B,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE3F,cAAc,SAAS,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEvE,YAAY,EACV,aAAa,EACb,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,UAAU,EACV,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,cAAc,EACd,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,WAAW,IAAI,gBAAgB,EAC/B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,YAAY,EACV,gBAAgB,EAChB,SAAS,IAAI,cAAc,EAC3B,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE3F,cAAc,SAAS,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -27,7 +27,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
|
27
27
|
};
|
|
28
28
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
29
29
|
exports.buildReport = exports.runsLogPath = exports.assessVerificationRisk = exports.assessContentRisk = exports.validateFrontmatter = exports.VALID_STATUSES = exports.VALID_RISK_LEVELS = exports.REQUIRED_FIELDS = exports.RECOMMENDED_FIELDS = exports.parseDossierFile = exports.parseDossierContent = exports.toPortablePath = exports.resolvePortablePath = exports.redactHomePaths = exports.REPO_PATH_TOKEN = exports.parseWorktreePorcelain = exports.LOCAL_PATH_TOKEN = exports.isPortablePath = exports.containsHomePath = exports.anchorFromCommonDir = exports.loadLintConfig = exports.lintDossierFile = exports.lintDossier = exports.LintRuleRegistry = exports.defaultRules = exports.formatDossierFile = exports.formatDossierContent = exports.validateEvidence = exports.parseEvidence = exports.evidenceMatchesDossier = exports.EVIDENCE_SCHEMA_VERSION = exports.EVIDENCE_MAX_RATIONALE_CHARS = exports.EVIDENCE_MAX_BYTES = exports.createEvidenceRecord = exports.levelForScore = exports.DRY_RUN_SCHEMA_VERSION = exports.DRY_RUN_DISCLAIMER = exports.analyzeDryRun = exports.validateStepCoherence = exports.validateCoherence = exports.verifyIntegrity = exports.calculateChecksum = exports.usageParserFor = exports.SCHED_DISPATCH_EVENT = exports.parseOpenCodeUsage = exports.parseLastToolUse = exports.parseDispatchApiError = exports.parseAnnouncedWait = exports.parseAgentUsage = exports.isOpenCodeUsageStream = void 0;
|
|
30
|
-
exports.
|
|
30
|
+
exports.collectDeclaredUrls = exports.readFileIfExists = exports.getErrorStack = exports.getErrorMessage = exports.sha256Hex = exports.sha256Hash = exports.TRUSTED_AUTHOR_ASSOCIATIONS = exports.isTrustedAuthorAssociation = exports.VALID_TRACE_STATUSES = exports.createTraceRecorder = exports.resolveTraceConfig = exports.toSpecFrontmatter = exports.SpecShapeError = exports.SPEC_TOP_LEVEL_FIELDS = exports.SPEC_SHAPE_WRITE_UNSUPPORTED = exports.isSpecShapedFrontmatter = exports.fromSpecFrontmatter = exports.encodeSpecValue = exports.decodeSpecValue = exports.DOSSIER_METADATA_PREFIX = exports.toSpkiPem = exports.signatureCoverage = exports.SIGNATURE_COVERAGES = exports.publicKeysMatch = exports.normalizePublicKey = exports.isSupportedPublicKey = exports.canonicalizeSpecFrontmatter = exports.canonicalizeFrontmatter = exports.buildVerificationPayload = exports.buildSignedPayload = exports.VerifierRegistry = exports.KmsVerifier = exports.KmsSigner = exports.getVerifierRegistry = exports.Ed25519Verifier = exports.Ed25519Signer = exports.verifyWithKms = exports.verifyWithEd25519 = exports.verifySignature = exports.trustedKeysFromContent = exports.reportTrustedKeyProblems = exports.parseTrustedKeys = exports.loadTrustedKeys = exports.isKmsKeyIdentifier = exports.findTrustedIdentifier = exports.scanMarkdown = exports.scanDossierFile = exports.scanDossier = exports.SecurityRuleRegistry = exports.defaultSecurityRules = void 0;
|
|
31
|
+
exports.createDefaultVerificationResult = exports.scanBodyForUrls = exports.isUrlCoveredByDeclared = exports.isPlaceholderUrl = exports.findUndeclaredUrls = exports.findStaleReferences = void 0;
|
|
31
32
|
var agent_usage_1 = require("./agent-usage");
|
|
32
33
|
Object.defineProperty(exports, "isOpenCodeUsageStream", { enumerable: true, get: function () { return agent_usage_1.isOpenCodeUsageStream; } });
|
|
33
34
|
Object.defineProperty(exports, "parseAgentUsage", { enumerable: true, get: function () { return agent_usage_1.parseAgentUsage; } });
|
|
@@ -120,12 +121,25 @@ Object.defineProperty(exports, "KmsVerifier", { enumerable: true, get: function
|
|
|
120
121
|
Object.defineProperty(exports, "VerifierRegistry", { enumerable: true, get: function () { return signers_1.VerifierRegistry; } });
|
|
121
122
|
var signing_payload_1 = require("./signing-payload");
|
|
122
123
|
Object.defineProperty(exports, "buildSignedPayload", { enumerable: true, get: function () { return signing_payload_1.buildSignedPayload; } });
|
|
124
|
+
Object.defineProperty(exports, "buildVerificationPayload", { enumerable: true, get: function () { return signing_payload_1.buildVerificationPayload; } });
|
|
123
125
|
Object.defineProperty(exports, "canonicalizeFrontmatter", { enumerable: true, get: function () { return signing_payload_1.canonicalizeFrontmatter; } });
|
|
126
|
+
Object.defineProperty(exports, "canonicalizeSpecFrontmatter", { enumerable: true, get: function () { return signing_payload_1.canonicalizeSpecFrontmatter; } });
|
|
124
127
|
Object.defineProperty(exports, "isSupportedPublicKey", { enumerable: true, get: function () { return signing_payload_1.isSupportedPublicKey; } });
|
|
125
128
|
Object.defineProperty(exports, "normalizePublicKey", { enumerable: true, get: function () { return signing_payload_1.normalizePublicKey; } });
|
|
126
129
|
Object.defineProperty(exports, "publicKeysMatch", { enumerable: true, get: function () { return signing_payload_1.publicKeysMatch; } });
|
|
130
|
+
Object.defineProperty(exports, "SIGNATURE_COVERAGES", { enumerable: true, get: function () { return signing_payload_1.SIGNATURE_COVERAGES; } });
|
|
127
131
|
Object.defineProperty(exports, "signatureCoverage", { enumerable: true, get: function () { return signing_payload_1.signatureCoverage; } });
|
|
128
132
|
Object.defineProperty(exports, "toSpkiPem", { enumerable: true, get: function () { return signing_payload_1.toSpkiPem; } });
|
|
133
|
+
var spec_shape_1 = require("./spec-shape");
|
|
134
|
+
Object.defineProperty(exports, "DOSSIER_METADATA_PREFIX", { enumerable: true, get: function () { return spec_shape_1.DOSSIER_METADATA_PREFIX; } });
|
|
135
|
+
Object.defineProperty(exports, "decodeSpecValue", { enumerable: true, get: function () { return spec_shape_1.decodeSpecValue; } });
|
|
136
|
+
Object.defineProperty(exports, "encodeSpecValue", { enumerable: true, get: function () { return spec_shape_1.encodeSpecValue; } });
|
|
137
|
+
Object.defineProperty(exports, "fromSpecFrontmatter", { enumerable: true, get: function () { return spec_shape_1.fromSpecFrontmatter; } });
|
|
138
|
+
Object.defineProperty(exports, "isSpecShapedFrontmatter", { enumerable: true, get: function () { return spec_shape_1.isSpecShapedFrontmatter; } });
|
|
139
|
+
Object.defineProperty(exports, "SPEC_SHAPE_WRITE_UNSUPPORTED", { enumerable: true, get: function () { return spec_shape_1.SPEC_SHAPE_WRITE_UNSUPPORTED; } });
|
|
140
|
+
Object.defineProperty(exports, "SPEC_TOP_LEVEL_FIELDS", { enumerable: true, get: function () { return spec_shape_1.SPEC_TOP_LEVEL_FIELDS; } });
|
|
141
|
+
Object.defineProperty(exports, "SpecShapeError", { enumerable: true, get: function () { return spec_shape_1.SpecShapeError; } });
|
|
142
|
+
Object.defineProperty(exports, "toSpecFrontmatter", { enumerable: true, get: function () { return spec_shape_1.toSpecFrontmatter; } });
|
|
129
143
|
var trace_config_1 = require("./trace-config");
|
|
130
144
|
Object.defineProperty(exports, "resolveTraceConfig", { enumerable: true, get: function () { return trace_config_1.resolveTraceConfig; } });
|
|
131
145
|
var trace_recorder_1 = require("./trace-recorder");
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;;AAIH,6CASuB;AARrB,oHAAA,qBAAqB,OAAA;AACrB,8GAAA,eAAe,OAAA;AACf,iHAAA,kBAAkB,OAAA;AAClB,oHAAA,qBAAqB,OAAA;AACrB,+GAAA,gBAAgB,OAAA;AAChB,iHAAA,kBAAkB,OAAA;AAClB,mHAAA,oBAAoB,OAAA;AACpB,6GAAA,cAAc,OAAA;AAEhB,mBAAmB;AACnB,uCAAgE;AAAvD,6GAAA,iBAAiB,OAAA;AAAE,2GAAA,eAAe,OAAA;AAU3C,yCAAuE;AAA9D,8GAAA,iBAAiB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAYjD,qCAKmB;AAJjB,wGAAA,aAAa,OAAA;AACb,6GAAA,kBAAkB,OAAA;AAClB,iHAAA,sBAAsB,OAAA;AACtB,wGAAA,aAAa,OAAA;AAIf,uCAQoB;AAPlB,gHAAA,oBAAoB,OAAA;AACpB,8GAAA,kBAAkB,OAAA;AAClB,wHAAA,4BAA4B,OAAA;AAC5B,mHAAA,uBAAuB,OAAA;AACvB,kHAAA,sBAAsB,OAAA;AACtB,yGAAA,aAAa,OAAA;AACb,4GAAA,gBAAgB,OAAA;AAGlB,oBAAoB;AACpB,yCAAsE;AAA7D,iHAAA,oBAAoB,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAUhD,iBAAiB;AACjB,mCAMkB;AALhB,sGAAA,YAAY,OAAA;AACZ,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,yGAAA,eAAe,OAAA;AACf,wGAAA,cAAc,OAAA;AAIhB,2CAUsB;AATpB,iHAAA,mBAAmB,OAAA;AACnB,8GAAA,gBAAgB,OAAA;AAChB,4GAAA,cAAc,OAAA;AACd,8GAAA,gBAAgB,OAAA;AAChB,oHAAA,sBAAsB,OAAA;AACtB,6GAAA,eAAe,OAAA;AACf,6GAAA,eAAe,OAAA;AACf,iHAAA,mBAAmB,OAAA;AACnB,4GAAA,cAAc,OAAA;AAEhB,iBAAiB;AACjB,mCAQkB;AAPhB,6GAAA,mBAAmB,OAAA;AACnB,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,wGAAA,cAAc,OAAA;AACd,6GAAA,mBAAmB,OAAA;AASrB,0BAA0B;AAC1B,qDAA8E;AAArE,oHAAA,iBAAiB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAGlD,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AAYpB,uDAO4B;AAN1B,+GAAA,WAAW,OAAA;AACX,wHAAA,oBAAoB,OAAA;AACpB,wHAAA,oBAAoB,OAAA;AACpB,+GAAA,WAAW,OAAA;AACX,mHAAA,eAAe,OAAA;AACf,gHAAA,YAAY,OAAA;AAId,yCAUqB;AATnB,kHAAA,qBAAqB,OAAA;AACrB,+GAAA,kBAAkB,OAAA;AAClB,4GAAA,eAAe,OAAA;AACf,6GAAA,gBAAgB,OAAA;AAChB,qHAAA,wBAAwB,OAAA;AACxB,mHAAA,sBAAsB,OAAA;AACtB,4GAAA,eAAe,OAAA;AACf,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AAEf,iDAAiD;AACjD,qCAWmB;AAVjB,wGAAA,aAAa,OAAA;AACb,0GAAA,eAAe,OAAA;AACf,8GAAA,mBAAmB,OAAA;AACnB,oGAAA,SAAS,OAAA;AACT,sGAAA,WAAW,OAAA;AAIX,2GAAA,gBAAgB,OAAA;AAKlB,qDAW2B;AAVzB,qHAAA,kBAAkB,OAAA;AAClB,2HAAA,wBAAwB,OAAA;AACxB,0HAAA,uBAAuB,OAAA;AACvB,8HAAA,2BAA2B,OAAA;AAC3B,uHAAA,oBAAoB,OAAA;AACpB,qHAAA,kBAAkB,OAAA;AAClB,kHAAA,eAAe,OAAA;AACf,sHAAA,mBAAmB,OAAA;AACnB,oHAAA,iBAAiB,OAAA;AACjB,4GAAA,SAAS,OAAA;AAIX,2CAUsB;AATpB,qHAAA,uBAAuB,OAAA;AACvB,6GAAA,eAAe,OAAA;AACf,6GAAA,eAAe,OAAA;AACf,iHAAA,mBAAmB,OAAA;AACnB,qHAAA,uBAAuB,OAAA;AACvB,0HAAA,4BAA4B,OAAA;AAC5B,mHAAA,qBAAqB,OAAA;AACrB,4GAAA,cAAc,OAAA;AACd,+GAAA,iBAAiB,OAAA;AASnB,+CAAoD;AAA3C,kHAAA,kBAAkB,OAAA;AAW3B,mDAA6E;AAApE,qHAAA,mBAAmB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAClD,4EAA4E;AAC5E,mDAA2F;AAAlF,4HAAA,0BAA0B,OAAA;AAAE,6HAAA,2BAA2B,OAAA;AAChE,eAAe;AACf,0CAAwB;AACxB,mBAAmB;AACnB,yCAAuD;AAA9C,oGAAA,UAAU,OAAA;AAAE,mGAAA,SAAS,OAAA;AAC9B,kBAAkB;AAClB,yCAAgE;AAAvD,yGAAA,eAAe,OAAA;AAAE,uGAAA,aAAa,OAAA;AACvC,wBAAwB;AACxB,iCAA8C;AAArC,sGAAA,gBAAgB,OAAA;AACzB,yBAAyB;AACzB,mDAO6B;AAN3B,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,iHAAA,kBAAkB,OAAA;AAClB,+GAAA,gBAAgB,OAAA;AAChB,qHAAA,sBAAsB,OAAA;AACtB,8GAAA,eAAe,OAAA;AAEjB,yBAAyB;AACzB,qDAAuE;AAA9D,+HAAA,+BAA+B,OAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema-valid.d.ts","sourceRoot":"","sources":["../../../src/linter/rules/schema-valid.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"schema-valid.d.ts","sourceRoot":"","sources":["../../../src/linter/rules/schema-valid.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAkB,QAAQ,EAAE,MAAM,UAAU,CAAC;AA2CzD,eAAO,MAAM,eAAe,EAAE,QAc7B,CAAC"}
|
|
@@ -7,6 +7,47 @@ exports.schemaValidRule = void 0;
|
|
|
7
7
|
const dossier_schema_json_1 = __importDefault(require("../../schema/dossier-schema.json"));
|
|
8
8
|
const ajv_1 = require("../../utils/ajv");
|
|
9
9
|
const validate = (0, ajv_1.compileSchema)(dossier_schema_json_1.default);
|
|
10
|
+
function toDiagnostic(err) {
|
|
11
|
+
const path = err.instancePath || '';
|
|
12
|
+
const field = path.replace(/^\//, '').replace(/\//g, '.');
|
|
13
|
+
// Simplify oneOf errors for signature field
|
|
14
|
+
if (err.keyword === 'oneOf' && field === 'signature') {
|
|
15
|
+
return {
|
|
16
|
+
ruleId: 'schema-valid',
|
|
17
|
+
severity: 'error',
|
|
18
|
+
message: 'signature must match either AWS KMS (ecdsa-sha256) or Ed25519 format',
|
|
19
|
+
field: 'signature',
|
|
20
|
+
};
|
|
21
|
+
}
|
|
22
|
+
let message;
|
|
23
|
+
if (err.keyword === 'required') {
|
|
24
|
+
message = `Missing required field: ${err.params.missingProperty}`;
|
|
25
|
+
}
|
|
26
|
+
else if (err.keyword === 'enum') {
|
|
27
|
+
message = `${field || 'value'} must be one of: ${err.params.allowedValues.join(', ')}`;
|
|
28
|
+
}
|
|
29
|
+
else if (err.keyword === 'const') {
|
|
30
|
+
message = `${field || 'value'} must be ${JSON.stringify(err.params.allowedValue)}`;
|
|
31
|
+
}
|
|
32
|
+
else if (err.keyword === 'minLength') {
|
|
33
|
+
message = `${field || 'value'} is too short (minimum ${err.params.limit} characters)`;
|
|
34
|
+
}
|
|
35
|
+
else if (err.keyword === 'maxLength') {
|
|
36
|
+
message = `${field || 'value'} is too long (maximum ${err.params.limit} characters)`;
|
|
37
|
+
}
|
|
38
|
+
else if (err.keyword === 'pattern') {
|
|
39
|
+
message = `${field || 'value'} does not match expected pattern`;
|
|
40
|
+
}
|
|
41
|
+
else {
|
|
42
|
+
message = `${field || 'value'}: ${err.message}`;
|
|
43
|
+
}
|
|
44
|
+
return {
|
|
45
|
+
ruleId: 'schema-valid',
|
|
46
|
+
severity: 'error',
|
|
47
|
+
message,
|
|
48
|
+
field: field || undefined,
|
|
49
|
+
};
|
|
50
|
+
}
|
|
10
51
|
exports.schemaValidRule = {
|
|
11
52
|
id: 'schema-valid',
|
|
12
53
|
description: 'Validate frontmatter against the full JSON Schema',
|
|
@@ -16,47 +57,9 @@ exports.schemaValidRule = {
|
|
|
16
57
|
if (valid) {
|
|
17
58
|
return [];
|
|
18
59
|
}
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
// Simplify oneOf errors for signature field
|
|
23
|
-
if (err.keyword === 'oneOf' && field === 'signature') {
|
|
24
|
-
return {
|
|
25
|
-
ruleId: 'schema-valid',
|
|
26
|
-
severity: 'error',
|
|
27
|
-
message: 'signature must match either AWS KMS (ecdsa-sha256) or Ed25519 format',
|
|
28
|
-
field: 'signature',
|
|
29
|
-
};
|
|
30
|
-
}
|
|
31
|
-
let message;
|
|
32
|
-
if (err.keyword === 'required') {
|
|
33
|
-
message = `Missing required field: ${err.params.missingProperty}`;
|
|
34
|
-
}
|
|
35
|
-
else if (err.keyword === 'enum') {
|
|
36
|
-
message = `${field || 'value'} must be one of: ${err.params.allowedValues.join(', ')}`;
|
|
37
|
-
}
|
|
38
|
-
else if (err.keyword === 'const') {
|
|
39
|
-
message = `${field || 'value'} must be ${JSON.stringify(err.params.allowedValue)}`;
|
|
40
|
-
}
|
|
41
|
-
else if (err.keyword === 'minLength') {
|
|
42
|
-
message = `${field || 'value'} is too short (minimum ${err.params.limit} characters)`;
|
|
43
|
-
}
|
|
44
|
-
else if (err.keyword === 'maxLength') {
|
|
45
|
-
message = `${field || 'value'} is too long (maximum ${err.params.limit} characters)`;
|
|
46
|
-
}
|
|
47
|
-
else if (err.keyword === 'pattern') {
|
|
48
|
-
message = `${field || 'value'} does not match expected pattern`;
|
|
49
|
-
}
|
|
50
|
-
else {
|
|
51
|
-
message = `${field || 'value'}: ${err.message}`;
|
|
52
|
-
}
|
|
53
|
-
return {
|
|
54
|
-
ruleId: 'schema-valid',
|
|
55
|
-
severity: 'error',
|
|
56
|
-
message,
|
|
57
|
-
field: field || undefined,
|
|
58
|
-
};
|
|
59
|
-
});
|
|
60
|
+
// The root `if` only picks legacy vs spec shape; its own "must match else
|
|
61
|
+
// schema" error repeats what the branch's errors already say.
|
|
62
|
+
return (validate.errors || []).filter((err) => err.keyword !== 'if').map(toDiagnostic);
|
|
60
63
|
},
|
|
61
64
|
};
|
|
62
65
|
//# sourceMappingURL=schema-valid.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema-valid.js","sourceRoot":"","sources":["../../../src/linter/rules/schema-valid.ts"],"names":[],"mappings":";;;;;;
|
|
1
|
+
{"version":3,"file":"schema-valid.js","sourceRoot":"","sources":["../../../src/linter/rules/schema-valid.ts"],"names":[],"mappings":";;;;;;AACA,2FAA6D;AAC7D,yCAAgD;AAGhD,MAAM,QAAQ,GAAG,IAAA,mBAAa,EAAC,6BAAa,CAAC,CAAC;AAE9C,SAAS,YAAY,CAAC,GAAgB;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE1D,4CAA4C;IAC5C,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACrD,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,sEAAsE;YAC/E,KAAK,EAAE,WAAW;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,GAAG,2BAA2B,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;IACpE,CAAC;SAAM,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAClC,OAAO,GAAG,GAAG,KAAK,IAAI,OAAO,oBAAoB,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACzF,CAAC;SAAM,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,GAAG,GAAG,KAAK,IAAI,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;IACrF,CAAC;SAAM,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,GAAG,GAAG,KAAK,IAAI,OAAO,0BAA0B,GAAG,CAAC,MAAM,CAAC,KAAK,cAAc,CAAC;IACxF,CAAC;SAAM,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,GAAG,GAAG,KAAK,IAAI,OAAO,yBAAyB,GAAG,CAAC,MAAM,CAAC,KAAK,cAAc,CAAC;IACvF,CAAC;SAAM,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,GAAG,GAAG,KAAK,IAAI,OAAO,kCAAkC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,GAAG,KAAK,IAAI,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,OAAgB;QAC1B,OAAO;QACP,KAAK,EAAE,KAAK,IAAI,SAAS;KAC1B,CAAC;AACJ,CAAC;AAEY,QAAA,eAAe,GAAa;IACvC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,mDAAmD;IAChE,eAAe,EAAE,OAAO;IACxB,GAAG,CAAC,OAAO;QACT,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,0EAA0E;QAC1E,8DAA8D;QAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzF,CAAC;CACF,CAAC"}
|
package/dist/parser.d.ts
CHANGED
|
@@ -17,7 +17,8 @@ export declare const VALID_RISK_LEVELS: readonly ["low", "medium", "high", "crit
|
|
|
17
17
|
/**
|
|
18
18
|
* Parse dossier content into frontmatter and body.
|
|
19
19
|
*
|
|
20
|
-
* Accepts both `---dossier` (JSON/YAML) and standard `---` (YAML) frontmatter
|
|
20
|
+
* Accepts both `---dossier` (JSON/YAML) and standard `---` (YAML) frontmatter,
|
|
21
|
+
* in either the legacy flat shape or the spec shape (see `spec-shape.ts`).
|
|
21
22
|
*/
|
|
22
23
|
export declare function parseDossierContent(content: string): ParsedDossier;
|
|
23
24
|
/**
|
package/dist/parser.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;
|
|
1
|
+
{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAIjE,uDAAuD;AACvD,eAAO,MAAM,eAAe,yDAA0D,CAAC;AAEvF,yCAAyC;AACzC,eAAO,MAAM,kBAAkB,gDAAiD,CAAC;AAEjF,8FAA8F;AAC9F,eAAO,MAAM,cAAc,4DAA6D,CAAC;AAEzF,6CAA6C;AAC7C,eAAO,MAAM,iBAAiB,gDAAiD,CAAC;AAiBhF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAuElE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAGhE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAgC7E"}
|
package/dist/parser.js
CHANGED
|
@@ -15,6 +15,7 @@ exports.parseDossierContent = parseDossierContent;
|
|
|
15
15
|
exports.parseDossierFile = parseDossierFile;
|
|
16
16
|
exports.validateFrontmatter = validateFrontmatter;
|
|
17
17
|
const gray_matter_1 = __importDefault(require("gray-matter"));
|
|
18
|
+
const spec_shape_1 = require("./spec-shape");
|
|
18
19
|
const errors_1 = require("./utils/errors");
|
|
19
20
|
const fs_1 = require("./utils/fs");
|
|
20
21
|
/** Required fields for a valid dossier frontmatter. */
|
|
@@ -41,7 +42,8 @@ const MATTER_OPTIONS = {
|
|
|
41
42
|
/**
|
|
42
43
|
* Parse dossier content into frontmatter and body.
|
|
43
44
|
*
|
|
44
|
-
* Accepts both `---dossier` (JSON/YAML) and standard `---` (YAML) frontmatter
|
|
45
|
+
* Accepts both `---dossier` (JSON/YAML) and standard `---` (YAML) frontmatter,
|
|
46
|
+
* in either the legacy flat shape or the spec shape (see `spec-shape.ts`).
|
|
45
47
|
*/
|
|
46
48
|
function parseDossierContent(content) {
|
|
47
49
|
if (!content || typeof content !== 'string') {
|
|
@@ -83,10 +85,31 @@ function parseDossierContent(content) {
|
|
|
83
85
|
throw new Error('Invalid dossier format. Expected:\n---dossier\n{...}\n---\n[body]\nor standard YAML frontmatter (---)');
|
|
84
86
|
}
|
|
85
87
|
}
|
|
88
|
+
// Spec-shaped files (Agent Skills layout, #1088) are read into the same flat
|
|
89
|
+
// logical object as legacy ones, so no consumer needs to know the shape. The
|
|
90
|
+
// on-disk object is kept alongside for v3 signature verification.
|
|
91
|
+
const rawFrontmatter = parsed.data;
|
|
92
|
+
const shape = (0, spec_shape_1.isSpecShapedFrontmatter)(rawFrontmatter) ? 'spec' : 'legacy';
|
|
93
|
+
let frontmatter = rawFrontmatter;
|
|
94
|
+
if (shape === 'spec') {
|
|
95
|
+
try {
|
|
96
|
+
if ((0, spec_shape_1.hasYamlMergeKey)(parsed.matter)) {
|
|
97
|
+
throw new spec_shape_1.SpecShapeError('YAML merge keys (<<) are not allowed');
|
|
98
|
+
}
|
|
99
|
+
frontmatter = (0, spec_shape_1.fromSpecFrontmatter)(rawFrontmatter);
|
|
100
|
+
}
|
|
101
|
+
catch (err) {
|
|
102
|
+
throw new spec_shape_1.SpecShapeError(`Invalid spec-shaped frontmatter: ${(0, errors_1.getErrorMessage)(err)}`, {
|
|
103
|
+
cause: err,
|
|
104
|
+
});
|
|
105
|
+
}
|
|
106
|
+
}
|
|
86
107
|
return {
|
|
87
|
-
frontmatter
|
|
108
|
+
frontmatter,
|
|
88
109
|
body: parsed.content,
|
|
89
110
|
raw: content,
|
|
111
|
+
rawFrontmatter,
|
|
112
|
+
shape,
|
|
90
113
|
};
|
|
91
114
|
}
|
|
92
115
|
/**
|
package/dist/parser.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parser.js","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;
|
|
1
|
+
{"version":3,"file":"parser.js","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;AA8CH,kDAuEC;AAKD,4CAGC;AAQD,kDAgCC;AAnKD,8DAAiC;AACjC,6CAKsB;AAEtB,2CAAiD;AACjD,mCAA8C;AAE9C,uDAAuD;AAC1C,QAAA,eAAe,GAAG,CAAC,wBAAwB,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAEvF,yCAAyC;AAC5B,QAAA,kBAAkB,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAU,CAAC;AAEjF,8FAA8F;AACjF,QAAA,cAAc,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,CAAU,CAAC;AAEzF,6CAA6C;AAChC,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAEhF,SAAS,YAAY;IACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,cAAc,GAAG;IACrB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE;QACP,EAAE,EAAE,YAAY;QAChB,UAAU,EAAE,YAAY;QACxB,MAAM,EAAE,YAAY;QACpB,YAAY,EAAE,YAAY;KAC3B;CACF,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IAC7F,IAAI,UAAU,GAAG,OAAO,CAAC;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,uEAAuE;QACvE,UAAU,GAAG,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClF,CAAC;SAAM,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YACvB,CAAC,CAAC,qCAAqC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,6EAA6E;YAC5I,CAAC,CAAC,uGAAuG,CAC5G,CAAC;IACJ,CAAC;SAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,UAAU,GAAG,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,GAAG,IAAA,qBAAM,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAA,wBAAe,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,0CAA0C;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,gDAAgD;QAChD,MAAM,aAAa,GAAG,8BAA8B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,cAAc,GAAG,MAAM,CAAC,IAA+B,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAA,oCAAuB,EAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1E,IAAI,WAAW,GAAG,cAAoC,CAAC;IACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,IAAA,4BAAe,EAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,2BAAc,CAAC,sCAAsC,CAAC,CAAC;YACnE,CAAC;YACD,WAAW,GAAG,IAAA,gCAAmB,EAAC,cAAc,CAAuB,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAAc,CAAC,oCAAoC,IAAA,wBAAe,EAAC,GAAG,CAAC,EAAE,EAAE;gBACnF,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW;QACX,IAAI,EAAE,MAAM,CAAC,OAAO;QACpB,GAAG,EAAE,OAAO;QACZ,cAAc;QACd,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,OAAO,GAAG,IAAA,qBAAgB,EAAC,QAAQ,EAAE,gCAAgC,CAAW,CAAC;IACvF,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,WAA+B;IACjE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,KAAK,IAAI,uBAAe,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IACE,WAAW,CAAC,UAAU;QACtB,CAAC,yBAAiB,CAAC,QAAQ,CACzB,WAAW,CAAC,UAAU,CAAC,WAAW,EAAwC,CAC3E,EACD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,uBAAuB,WAAW,CAAC,UAAU,qBAAqB,yBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjG,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,IAAI,CAAC,sBAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CACT,mBAAmB,WAAW,CAAC,MAAM,qBAAqB,sBAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
|
@@ -4,17 +4,38 @@
|
|
|
4
4
|
"title": "Dossier Schema",
|
|
5
5
|
"description": "JSON Schema for Dossier frontmatter metadata, providing deterministic structure for LLM agent automation",
|
|
6
6
|
"type": "object",
|
|
7
|
-
"
|
|
8
|
-
"
|
|
9
|
-
"
|
|
10
|
-
"
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
7
|
+
"if": {
|
|
8
|
+
"description": "Spec shape (Agent Skills layout, #1088): a metadata map carrying at least one \"dossier.\" key",
|
|
9
|
+
"required": ["metadata"],
|
|
10
|
+
"properties": {
|
|
11
|
+
"metadata": {
|
|
12
|
+
"type": "object",
|
|
13
|
+
"not": {
|
|
14
|
+
"propertyNames": {
|
|
15
|
+
"not": {
|
|
16
|
+
"pattern": "^dossier\\."
|
|
17
|
+
}
|
|
18
|
+
}
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
}
|
|
22
|
+
},
|
|
23
|
+
"then": {
|
|
24
|
+
"$ref": "#/definitions/specShape"
|
|
25
|
+
},
|
|
26
|
+
"else": {
|
|
27
|
+
"required": [
|
|
28
|
+
"dossier_schema_version",
|
|
29
|
+
"title",
|
|
30
|
+
"version",
|
|
31
|
+
"protocol_version",
|
|
32
|
+
"status",
|
|
33
|
+
"objective",
|
|
34
|
+
"checksum",
|
|
35
|
+
"risk_level",
|
|
36
|
+
"requires_approval"
|
|
37
|
+
]
|
|
38
|
+
},
|
|
18
39
|
"properties": {
|
|
19
40
|
"dossier_schema_version": {
|
|
20
41
|
"type": "string",
|
|
@@ -272,8 +293,8 @@
|
|
|
272
293
|
},
|
|
273
294
|
"covers": {
|
|
274
295
|
"type": "string",
|
|
275
|
-
"description": "Which bytes the signature covers. 'frontmatter+body' binds the security metadata (risk_level, requires_approval, destructive_operations) to the signature. Absent means the legacy body-only scheme, under which frontmatter is unprotected.",
|
|
276
|
-
"enum": ["body", "frontmatter+body"],
|
|
296
|
+
"description": "Which bytes the signature covers. 'frontmatter+body' (v2) binds the security metadata (risk_level, requires_approval, destructive_operations) to the signature. 'spec-frontmatter+body' (v3) covers a spec-shaped file's on-disk frontmatter (metadata[\"dossier.*\"] strings) and body. Absent means the legacy body-only scheme, under which frontmatter is unprotected.",
|
|
297
|
+
"enum": ["body", "frontmatter+body", "spec-frontmatter+body"],
|
|
277
298
|
"default": "body"
|
|
278
299
|
},
|
|
279
300
|
"signed_by": {
|
|
@@ -315,8 +336,8 @@
|
|
|
315
336
|
},
|
|
316
337
|
"covers": {
|
|
317
338
|
"type": "string",
|
|
318
|
-
"description": "Which bytes the signature covers. 'frontmatter+body' binds the security metadata (risk_level, requires_approval, destructive_operations) to the signature. Absent means the legacy body-only scheme, under which frontmatter is unprotected.",
|
|
319
|
-
"enum": ["body", "frontmatter+body"],
|
|
339
|
+
"description": "Which bytes the signature covers. 'frontmatter+body' (v2) binds the security metadata (risk_level, requires_approval, destructive_operations) to the signature. 'spec-frontmatter+body' (v3) covers a spec-shaped file's on-disk frontmatter (metadata[\"dossier.*\"] strings) and body. Absent means the legacy body-only scheme, under which frontmatter is unprotected.",
|
|
340
|
+
"enum": ["body", "frontmatter+body", "spec-frontmatter+body"],
|
|
320
341
|
"default": "body"
|
|
321
342
|
},
|
|
322
343
|
"key_id": {
|
|
@@ -821,5 +842,71 @@
|
|
|
821
842
|
}
|
|
822
843
|
}
|
|
823
844
|
}
|
|
845
|
+
},
|
|
846
|
+
"definitions": {
|
|
847
|
+
"specShape": {
|
|
848
|
+
"description": "Spec-shaped dossier: only the Agent Skills fields at the top level; every other Dossier field under metadata as \"dossier.<field>\", its value a string (JSON text for non-string values, and for strings that would themselves parse as JSON).",
|
|
849
|
+
"type": "object",
|
|
850
|
+
"required": ["name", "description", "metadata"],
|
|
851
|
+
"additionalProperties": false,
|
|
852
|
+
"properties": {
|
|
853
|
+
"name": {
|
|
854
|
+
"type": "string",
|
|
855
|
+
"description": "Agent Skills name: lowercase letters, digits and single hyphens",
|
|
856
|
+
"minLength": 1,
|
|
857
|
+
"maxLength": 64,
|
|
858
|
+
"pattern": "^[a-z0-9]+(-[a-z0-9]+)*$"
|
|
859
|
+
},
|
|
860
|
+
"description": {
|
|
861
|
+
"type": "string",
|
|
862
|
+
"description": "What the skill does and when to use it",
|
|
863
|
+
"minLength": 1,
|
|
864
|
+
"maxLength": 1024
|
|
865
|
+
},
|
|
866
|
+
"license": {
|
|
867
|
+
"type": "string",
|
|
868
|
+
"description": "License identifier (SPDX format recommended)"
|
|
869
|
+
},
|
|
870
|
+
"compatibility": {
|
|
871
|
+
"type": "string",
|
|
872
|
+
"description": "Environment requirements",
|
|
873
|
+
"maxLength": 500
|
|
874
|
+
},
|
|
875
|
+
"allowed-tools": {
|
|
876
|
+
"type": "string",
|
|
877
|
+
"description": "Space-delimited list of pre-approved tools"
|
|
878
|
+
},
|
|
879
|
+
"metadata": {
|
|
880
|
+
"type": "object",
|
|
881
|
+
"description": "String-to-string map. Dossier fields are keyed \"dossier.<field>\"; other keys belong to other tools.",
|
|
882
|
+
"additionalProperties": {
|
|
883
|
+
"type": "string"
|
|
884
|
+
},
|
|
885
|
+
"propertyNames": {
|
|
886
|
+
"not": {
|
|
887
|
+
"enum": [
|
|
888
|
+
"dossier.",
|
|
889
|
+
"dossier.name",
|
|
890
|
+
"dossier.description",
|
|
891
|
+
"dossier.license",
|
|
892
|
+
"dossier.compatibility",
|
|
893
|
+
"dossier.allowed-tools"
|
|
894
|
+
]
|
|
895
|
+
}
|
|
896
|
+
},
|
|
897
|
+
"required": [
|
|
898
|
+
"dossier.dossier_schema_version",
|
|
899
|
+
"dossier.title",
|
|
900
|
+
"dossier.version",
|
|
901
|
+
"dossier.protocol_version",
|
|
902
|
+
"dossier.status",
|
|
903
|
+
"dossier.objective",
|
|
904
|
+
"dossier.checksum",
|
|
905
|
+
"dossier.risk_level",
|
|
906
|
+
"dossier.requires_approval"
|
|
907
|
+
]
|
|
908
|
+
}
|
|
909
|
+
}
|
|
910
|
+
}
|
|
824
911
|
}
|
|
825
912
|
}
|
|
@@ -18,14 +18,28 @@
|
|
|
18
18
|
* on. v2 payloads cover the frontmatter (minus the signature block itself)
|
|
19
19
|
* together with the body. `signature.covers` records which scheme was used;
|
|
20
20
|
* absent means the legacy body-only scheme.
|
|
21
|
+
*
|
|
22
|
+
* v3 (`spec-frontmatter+body`) is the scheme for spec-shaped dossiers (#1088):
|
|
23
|
+
* it covers the frontmatter exactly as it sits on disk — Agent Skills fields at
|
|
24
|
+
* the top level, Dossier fields as `metadata["dossier.*"]` strings — not the
|
|
25
|
+
* logical flat view, because a signature should cover what is actually shipped.
|
|
26
|
+
* Each scheme is bound to one shape: v3 only on spec-shaped files, v1/v2 only on
|
|
27
|
+
* legacy ones, and an unrecognized `covers` value is refused, never guessed.
|
|
21
28
|
*/
|
|
22
|
-
|
|
29
|
+
import type { ParsedDossier } from './types';
|
|
30
|
+
/** Every `signature.covers` scheme a verifier accepts: v1, v2, v3. */
|
|
31
|
+
export declare const SIGNATURE_COVERAGES: readonly ["body", "frontmatter+body", "spec-frontmatter+body"];
|
|
32
|
+
export type SignatureCoverage = (typeof SIGNATURE_COVERAGES)[number];
|
|
23
33
|
/**
|
|
24
34
|
* Coverage of a signature block, defaulting to the legacy body-only scheme when
|
|
25
35
|
* the field is absent.
|
|
36
|
+
*
|
|
37
|
+
* An unrecognized `covers` throws. Falling back to body-only would let anyone
|
|
38
|
+
* relabel a signature into the weakest scheme, and a scheme this code does not
|
|
39
|
+
* know cannot be verified correctly anyway — refusing is the only safe answer.
|
|
26
40
|
*/
|
|
27
41
|
export declare function signatureCoverage(signature: {
|
|
28
|
-
covers?:
|
|
42
|
+
covers?: unknown;
|
|
29
43
|
} | undefined): SignatureCoverage;
|
|
30
44
|
/**
|
|
31
45
|
* Normalize an Ed25519 public key to raw 32-byte base64.
|
|
@@ -68,10 +82,28 @@ export declare function publicKeysMatch(a: string | undefined, b: string | undef
|
|
|
68
82
|
*/
|
|
69
83
|
export declare function canonicalizeFrontmatter(frontmatter: Record<string, unknown>): string;
|
|
70
84
|
/**
|
|
71
|
-
*
|
|
85
|
+
* Canonical form of on-disk spec-shaped frontmatter for v3 signing: everything
|
|
86
|
+
* as written except `metadata["dossier.signature"]`, serialized deterministically.
|
|
87
|
+
*/
|
|
88
|
+
export declare function canonicalizeSpecFrontmatter(frontmatter: Record<string, unknown>): string;
|
|
89
|
+
/**
|
|
90
|
+
* The exact bytes a signature covers.
|
|
72
91
|
*
|
|
73
|
-
*
|
|
74
|
-
*
|
|
92
|
+
* v2 takes the flat frontmatter; v3 takes the on-disk spec-shaped frontmatter
|
|
93
|
+
* (`ParsedDossier.rawFrontmatter`). The version tag is inside the signed payload
|
|
94
|
+
* on purpose: it stops a signature made under one scheme from being replayed as
|
|
95
|
+
* another.
|
|
75
96
|
*/
|
|
76
97
|
export declare function buildSignedPayload(frontmatter: Record<string, unknown>, body: string, coverage?: SignatureCoverage): string;
|
|
98
|
+
/**
|
|
99
|
+
* The payload a parsed dossier's signature must verify against.
|
|
100
|
+
*
|
|
101
|
+
* Selects v1/v2/v3 from `signature.covers` and binds each scheme to the shape it
|
|
102
|
+
* was defined for: a spec-shaped file verifies only under v3, a legacy file only
|
|
103
|
+
* under v1 or v2. Without the binding, a legacy v2 signature could be carried
|
|
104
|
+
* onto a spec-shaped rewrite (same logical fields, so the v2 payload matches)
|
|
105
|
+
* and vouch for on-disk bytes it never covered. Throws when the dossier is
|
|
106
|
+
* unsigned, `covers` is unrecognized, or scheme and shape disagree.
|
|
107
|
+
*/
|
|
108
|
+
export declare function buildVerificationPayload(parsed: Pick<ParsedDossier, 'frontmatter' | 'body' | 'rawFrontmatter' | 'shape'>): string;
|
|
77
109
|
//# sourceMappingURL=signing-payload.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signing-payload.d.ts","sourceRoot":"","sources":["../src/signing-payload.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"signing-payload.d.ts","sourceRoot":"","sources":["../src/signing-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAQ7C,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,gEAAiE,CAAC;AAElG,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKrE;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GAAG,iBAAiB,CAWhG;AAmFD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAG/D;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAYnD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKrF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAGpF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAYxF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,iBAAsC,GAC/C,MAAM,CAQR;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,aAAa,GAAG,MAAM,GAAG,gBAAgB,GAAG,OAAO,CAAC,GAC/E,MAAM,CAsBR"}
|