@aiwg/cli 2026.9.0 → 2026.9.2

package/dist/src/schema/catalog.js

@@ -0,0 +1,234 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { createDiagnostic, hasSchemaErrors, SCHEMA_DIAGNOSTIC_CODES } from './diagnostics.js';
+import { diagnosePolicy, resolveEffectivePolicy } from './policy.js';
+function parseJson(path) {
+    return JSON.parse(readFileSync(path, 'utf8'));
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isDomainManifest(value) {
+    return (isRecord(value) &&
+        value.schemaVersion === '1' &&
+        typeof value.domain === 'string' &&
+        isRecord(value.owner) &&
+        typeof value.owner.id === 'string' &&
+        Array.isArray(value.artifacts));
+}
+function isCatalogSource(value) {
+    return isRecord(value) && value.schemaVersion === '1' && Array.isArray(value.domains);
+}
+function safePath(rootDir, path) {
+    const absolute = resolve(rootDir, path);
+    const rel = relative(resolve(rootDir), absolute);
+    return rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel)) ? absolute : undefined;
+}
+function sha256(path) {
+    return `sha256:${createHash('sha256').update(readFileSync(path)).digest('hex')}`;
+}
+function validateArtifactShape(artifact, domain) {
+    const diagnostics = [];
+    const required = [
+        'logicalName',
+        'id',
+        'version',
+        'format',
+        'lifecycle',
+        'owner',
+        'authority',
+    ];
+    for (const field of required) {
+        if (artifact[field] === undefined || artifact[field] === '') {
+            diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.invalidManifest, `Artifact in domain ${domain} is missing required field ${field}`, { artifactId: artifact.id }));
+        }
+    }
+    if (artifact.format === 'json-schema' && !artifact.dialect) {
+        diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.invalidManifest, 'JSON Schema artifacts require a dialect', {
+            artifactId: artifact.id,
+        }));
+    }
+    if (artifact.lifecycle === 'deprecated' && artifact.deprecation === undefined) {
+        diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.invalidManifest, 'Deprecated artifacts require deprecation data', {
+            artifactId: artifact.id,
+        }));
+    }
+    return diagnostics;
+}
+function walkSchemaFiles(root) {
+    if (!existsSync(root))
+        return [];
+    const result = [];
+    for (const entry of readdirSync(root).sort()) {
+        const path = resolve(root, entry);
+        const stat = statSync(path);
+        if (stat.isDirectory())
+            result.push(...walkSchemaFiles(path));
+        else if (/\.schema\.json$/u.test(entry))
+            result.push(path);
+    }
+    return result;
+}
+function readSchemaId(path) {
+    try {
+        const value = parseJson(path);
+        return isRecord(value) && typeof value.$id === 'string' ? value.$id : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function compileSchemaCatalog(source, manifests, options) {
+    const rootDir = resolve(options.rootDir);
+    const diagnostics = [];
+    const entries = [];
+    const ids = new Map();
+    const names = new Map();
+    const authorities = new Map();
+    const declaredPaths = new Map();
+    for (const manifest of [...manifests].sort((a, b) => a.domain.localeCompare(b.domain))) {
+        for (const artifact of [...manifest.artifacts].sort((a, b) => `${a.logicalName}\0${a.version}\0${a.id}`.localeCompare(`${b.logicalName}\0${b.version}\0${b.id}`))) {
+            diagnostics.push(...validateArtifactShape(artifact, manifest.domain));
+            const nameVersion = `${artifact.logicalName}@${artifact.version}`;
+            if (ids.has(artifact.id)) {
+                diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.duplicateId, `Duplicate schema id ${artifact.id}`, { artifactId: artifact.id, details: { firstDomain: ids.get(artifact.id), secondDomain: manifest.domain } }));
+            }
+            else
+                ids.set(artifact.id, manifest.domain);
+            if (names.has(nameVersion)) {
+                diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.duplicateNameVersion, `Duplicate schema name and version ${nameVersion}`, { artifactId: artifact.id }));
+            }
+            else
+                names.set(nameVersion, artifact.id);
+            let digest = artifact.digest;
+            if (artifact.authority.kind === 'canonical') {
+                const canonicalPath = artifact.authority.path;
+                if (!canonicalPath) {
+                    diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.invalidManifest, 'Canonical authority requires a path', { artifactId: artifact.id }));
+                }
+                else {
+                    const absolute = safePath(rootDir, canonicalPath);
+                    if (!absolute)
+                        diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.pathOutsideRoot, `Authority path escapes repository root: ${canonicalPath}`, { artifactId: artifact.id, path: canonicalPath }));
+                    else if (!existsSync(absolute))
+                        diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.missingPath, `Authority path does not exist: ${canonicalPath}`, { artifactId: artifact.id, path: canonicalPath }));
+                    else {
+                        const normalized = relative(rootDir, absolute).split(sep).join('/');
+                        const previous = authorities.get(normalized);
+                        if (previous)
+                            diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.duplicateAuthority, `Canonical path ${normalized} is claimed by ${previous} and ${artifact.id}`, { artifactId: artifact.id, path: normalized }));
+                        else
+                            authorities.set(normalized, artifact.id);
+                        declaredPaths.set(normalized, { id: artifact.id, projection: false });
+                        const actual = sha256(absolute);
+                        if (digest && digest !== actual)
+                            diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.digestMismatch, `Digest mismatch for ${normalized}`, { artifactId: artifact.id, path: normalized, details: { declared: digest, actual } }));
+                        digest = actual;
+                    }
+                }
+            }
+            for (const projection of artifact.projections ?? []) {
+                const absolute = safePath(rootDir, projection.path);
+                if (!absolute)
+                    diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.pathOutsideRoot, `Projection path escapes repository root: ${projection.path}`, { artifactId: artifact.id, path: projection.path }));
+                else if (!existsSync(absolute))
+                    diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.missingPath, `Projection path does not exist: ${projection.path}`, { artifactId: artifact.id, path: projection.path }));
+                else {
+                    const normalized = relative(rootDir, absolute).split(sep).join('/');
+                    declaredPaths.set(normalized, { id: artifact.id, projection: true });
+                    if (projection.digest && projection.digest !== sha256(absolute))
+                        diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.digestMismatch, `Projection digest mismatch for ${normalized}`, { artifactId: artifact.id, path: normalized }));
+                }
+            }
+            const effectivePolicy = resolveEffectivePolicy(source.policy, manifest, artifact);
+            diagnostics.push(...diagnosePolicy(effectivePolicy, artifact.id, options.now));
+            if (effectivePolicy.requireDigest && artifact.digest === undefined) {
+                diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.invalidManifest, 'Effective policy requires a declared digest', { artifactId: artifact.id }));
+            }
+            entries.push({ artifact, domain: manifest.domain, ...(digest === undefined ? {} : { digest }), effectivePolicy });
+        }
+    }
+    for (const entry of entries) {
+        for (const dependency of entry.artifact.dependencies ?? []) {
+            if (!ids.has(dependency.id))
+                diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.unresolvedDependency, `Unresolved dependency ${dependency.id}`, { artifactId: entry.artifact.id, details: { dependency: dependency.id } }));
+        }
+    }
+    for (const inventoryRoot of options.inventoryRoots ?? []) {
+        const absoluteRoot = safePath(rootDir, inventoryRoot);
+        if (!absoluteRoot) {
+            diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.pathOutsideRoot, `Inventory root escapes repository root: ${inventoryRoot}`, { path: inventoryRoot }));
+            continue;
+        }
+        for (const file of walkSchemaFiles(absoluteRoot)) {
+            const normalized = relative(rootDir, file).split(sep).join('/');
+            if (!declaredPaths.has(normalized)) {
+                const schemaId = readSchemaId(file);
+                const canonical = schemaId === undefined ? undefined : entries.find((entry) => entry.artifact.id === schemaId);
+                diagnostics.push(createDiagnostic(canonical ? SCHEMA_DIAGNOSTIC_CODES.undeclaredMirror : SCHEMA_DIAGNOSTIC_CODES.undeclaredCanonical, canonical
+                    ? `Schema file shares ${schemaId} but is not declared as a mirror: ${normalized}`
+                    : `Schema file is not registered: ${normalized}`, { path: normalized, ...(schemaId === undefined ? {} : { details: { schemaId } }) }));
+            }
+        }
+    }
+    entries.sort((a, b) => `${a.artifact.id}\0${a.artifact.version}`.localeCompare(`${b.artifact.id}\0${b.artifact.version}`));
+    const catalog = { schemaVersion: '1', entries, domains: [...new Set(manifests.map((manifest) => manifest.domain))].sort() };
+    return { catalog, diagnostics, valid: !hasSchemaErrors(diagnostics) };
+}
+export function loadSchemaCatalog(options) {
+    const rootDir = resolve(options.rootDir);
+    const catalogPath = resolve(rootDir, options.catalogPath ?? 'schemas/catalog/catalog.json');
+    const diagnostics = [];
+    if (!existsSync(catalogPath)) {
+        diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.missingPath, `Catalog does not exist: ${relative(rootDir, catalogPath)}`, { path: relative(rootDir, catalogPath) }));
+        return { diagnostics, valid: false };
+    }
+    let source;
+    try {
+        source = parseJson(catalogPath);
+    }
+    catch (error) {
+        diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.invalidCatalog, `Cannot parse catalog: ${error instanceof Error ? error.message : String(error)}`, { path: relative(rootDir, catalogPath) }));
+        return { diagnostics, valid: false };
+    }
+    if (!isCatalogSource(source)) {
+        diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.invalidCatalog, 'Catalog must use schemaVersion 1 and contain a domains array', { path: relative(rootDir, catalogPath) }));
+        return { diagnostics, valid: false };
+    }
+    const manifests = [];
+    for (const item of source.domains) {
+        let candidate = item;
+        let path;
+        if (typeof item === 'string') {
+            path = resolve(dirname(catalogPath), item);
+            if (!safePath(rootDir, relative(rootDir, path))) {
+                diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.pathOutsideRoot, `Domain manifest escapes repository root: ${item}`, { path: item }));
+                continue;
+            }
+            if (!existsSync(path)) {
+                diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.missingPath, `Domain manifest does not exist: ${item}`, { path: item }));
+                continue;
+            }
+            try {
+                candidate = parseJson(path);
+            }
+            catch (error) {
+                diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.invalidManifest, `Cannot parse domain manifest ${item}: ${error instanceof Error ? error.message : String(error)}`, { path: item }));
+                continue;
+            }
+        }
+        if (!isDomainManifest(candidate)) {
+            diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.invalidManifest, 'Domain manifest must use schemaVersion 1 and contain domain, owner, and artifacts', path ? { path: relative(rootDir, path) } : {}));
+            continue;
+        }
+        manifests.push(candidate);
+    }
+    const result = compileSchemaCatalog(source, manifests, options);
+    return { catalog: result.catalog, diagnostics: [...diagnostics, ...result.diagnostics], valid: diagnostics.length === 0 && result.valid };
+}
+/** Serialize compiler output without timestamps or filesystem-specific data. */
+export function serializeCompiledSchemaCatalog(catalog) {
+    return `${JSON.stringify(catalog, null, 2)}\n`;
+}
+//# sourceMappingURL=catalog.js.map

package/dist/src/schema/compatibility.js

@@ -0,0 +1,42 @@
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : undefined;
+}
+function strings(value) {
+    return new Set(Array.isArray(value) ? value.filter((item) => typeof item === 'string') : []);
+}
+/** Conservative backward-compatibility analysis: unknown means human review, never an optimistic pass. */
+export function analyzeBackwardCompatibility(before, after) {
+    const left = record(before);
+    const right = record(after);
+    if (!left || !right)
+        return { status: 'unknown', direction: 'backward', reasons: ['schemas are not JSON objects'] };
+    if (JSON.stringify(left) === JSON.stringify(right))
+        return { status: 'compatible', direction: 'backward', reasons: ['schemas are identical'] };
+    const reasons = [];
+    if (left.type !== undefined && right.type !== undefined && JSON.stringify(left.type) !== JSON.stringify(right.type))
+        reasons.push('accepted root type changed');
+    const oldRequired = strings(left.required);
+    for (const field of strings(right.required))
+        if (!oldRequired.has(field))
+            reasons.push(`required property added: ${field}`);
+    const oldProperties = record(left.properties) ?? {};
+    const newProperties = record(right.properties) ?? {};
+    for (const field of Object.keys(oldProperties))
+        if (!(field in newProperties))
+            reasons.push(`property removed: ${field}`);
+    if (left.additionalProperties !== false && right.additionalProperties === false)
+        reasons.push('additional properties changed from allowed to forbidden');
+    const oldEnum = strings(left.enum);
+    const newEnum = strings(right.enum);
+    if (oldEnum.size && newEnum.size)
+        for (const member of oldEnum)
+            if (!newEnum.has(member))
+                reasons.push(`enum member removed: ${member}`);
+    return reasons.length
+        ? { status: 'breaking', direction: 'backward', reasons }
+        : { status: 'unknown', direction: 'backward', reasons: ['no conservative breaking rule matched; review is required'] };
+}
+export function analyzeCompatibilityChain(schemas) {
+    return schemas.slice(1).map((schema, index) => analyzeBackwardCompatibility(schemas[index], schema));
+}
+//# sourceMappingURL=compatibility.js.map

package/dist/src/schema/diagnostics.js

@@ -0,0 +1,36 @@
+export const SCHEMA_DIAGNOSTIC_CODES = {
+    invalidCatalog: 'SCHEMA_CATALOG_INVALID',
+    invalidManifest: 'SCHEMA_MANIFEST_INVALID',
+    duplicateId: 'SCHEMA_DUPLICATE_ID',
+    duplicateNameVersion: 'SCHEMA_DUPLICATE_NAME_VERSION',
+    duplicateAuthority: 'SCHEMA_DUPLICATE_AUTHORITY',
+    missingPath: 'SCHEMA_PATH_MISSING',
+    pathOutsideRoot: 'SCHEMA_PATH_OUTSIDE_ROOT',
+    digestMismatch: 'SCHEMA_DIGEST_MISMATCH',
+    unresolvedDependency: 'SCHEMA_DEPENDENCY_UNRESOLVED',
+    undeclaredCanonical: 'SCHEMA_CANONICAL_UNREGISTERED',
+    undeclaredMirror: 'SCHEMA_MIRROR_UNDECLARED',
+    expiredException: 'SCHEMA_POLICY_EXCEPTION_EXPIRED',
+};
+export function createDiagnostic(code, message, options = {}) {
+    return {
+        code,
+        severity: options.severity ?? 'error',
+        message,
+        ...(options.artifactId === undefined ? {} : { artifactId: options.artifactId }),
+        ...(options.path === undefined ? {} : { path: options.path }),
+        ...(options.details === undefined ? {} : { details: options.details }),
+    };
+}
+export function hasSchemaErrors(diagnostics) {
+    return diagnostics.some((diagnostic) => diagnostic.severity === 'error');
+}
+export class SchemaCatalogError extends Error {
+    diagnostics;
+    constructor(message, diagnostics) {
+        super(message);
+        this.name = 'SchemaCatalogError';
+        this.diagnostics = diagnostics;
+    }
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/src/schema/index.js

@@ -0,0 +1,8 @@
+export * from './types.js';
+export * from './diagnostics.js';
+export * from './policy.js';
+export * from './catalog.js';
+export * from './resolver.js';
+export * from './validator.js';
+export * from './compatibility.js';
+//# sourceMappingURL=index.js.map

package/dist/src/schema/policy.js

@@ -0,0 +1,58 @@
+import { createDiagnostic, SCHEMA_DIAGNOSTIC_CODES } from './diagnostics.js';
+export const DEFAULT_SCHEMA_POLICY = {
+    strict: true,
+    remoteReferences: 'deny',
+    compatibility: 'unknown',
+    requireFixtures: false,
+    requireDigest: false,
+    exceptions: [],
+};
+export function resolveEffectivePolicy(repositoryPolicy, domain, artifact) {
+    const layers = [repositoryPolicy, domain.policy, artifact.policy];
+    const merged = {};
+    for (const layer of layers) {
+        if (layer === undefined)
+            continue;
+        if (layer.strict !== undefined)
+            merged.strict = layer.strict;
+        if (layer.remoteReferences !== undefined)
+            merged.remoteReferences = layer.remoteReferences;
+        if (layer.compatibility !== undefined)
+            merged.compatibility = layer.compatibility;
+        if (layer.requireFixtures !== undefined)
+            merged.requireFixtures = layer.requireFixtures;
+        if (layer.requireDigest !== undefined)
+            merged.requireDigest = layer.requireDigest;
+        if (layer.exceptions !== undefined)
+            merged.exceptions = [...(merged.exceptions ?? []), ...layer.exceptions];
+    }
+    if (artifact.compatibility?.mode !== undefined && artifact.policy?.compatibility === undefined) {
+        merged.compatibility = artifact.compatibility.mode;
+    }
+    return {
+        strict: merged.strict ?? DEFAULT_SCHEMA_POLICY.strict,
+        remoteReferences: merged.remoteReferences ?? DEFAULT_SCHEMA_POLICY.remoteReferences,
+        compatibility: merged.compatibility ?? DEFAULT_SCHEMA_POLICY.compatibility,
+        requireFixtures: merged.requireFixtures ?? DEFAULT_SCHEMA_POLICY.requireFixtures,
+        requireDigest: merged.requireDigest ?? DEFAULT_SCHEMA_POLICY.requireDigest,
+        exceptions: [...(merged.exceptions ?? [])].sort((left, right) => `${left.rule}\0${left.expires}`.localeCompare(`${right.rule}\0${right.expires}`)),
+        provenance: [
+            ...(repositoryPolicy === undefined ? [] : [{ source: 'repository', value: repositoryPolicy }]),
+            ...(domain.policy === undefined
+                ? []
+                : [{ source: 'domain', domain: domain.domain, value: domain.policy }]),
+            ...(artifact.policy === undefined ? [] : [{ source: 'artifact', value: artifact.policy }]),
+        ],
+    };
+}
+export function diagnosePolicy(policy, artifactId, now = new Date()) {
+    const diagnostics = [];
+    for (const exception of policy.exceptions) {
+        const expires = new Date(exception.expires);
+        if (Number.isNaN(expires.getTime()) || expires.getTime() <= now.getTime()) {
+            diagnostics.push(createDiagnostic(SCHEMA_DIAGNOSTIC_CODES.expiredException, `Policy exception ${exception.rule} expired on ${exception.expires}`, { artifactId, details: { rule: exception.rule, owner: exception.owner, expires: exception.expires } }));
+        }
+    }
+    return diagnostics;
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/schema/resolver.js

@@ -0,0 +1,76 @@
+import { relative, resolve, sep } from 'node:path';
+export class SchemaResolver {
+    catalog;
+    rootDir;
+    index = new Map();
+    constructor(catalog, options = {}) {
+        this.catalog = catalog;
+        this.rootDir = options.rootDir === undefined ? undefined : resolve(options.rootDir);
+        for (const entry of catalog.entries) {
+            this.index.set(entry.artifact.id, entry);
+            this.index.set(`${entry.artifact.logicalName}@${entry.artifact.version}`, entry);
+            // The unqualified logical name resolves to the last deterministically
+            // ordered revision. Callers requiring reproducibility should use id or
+            // name@version.
+            this.index.set(entry.artifact.logicalName, entry);
+            for (const alias of entry.artifact.aliases ?? [])
+                this.index.set(alias, entry);
+            if (entry.artifact.authority.path) {
+                const normalized = entry.artifact.authority.path.split('\\').join('/');
+                this.index.set(normalized, entry);
+                if (this.rootDir)
+                    this.index.set(relative(this.rootDir, resolve(this.rootDir, normalized)).split(sep).join('/'), entry);
+            }
+        }
+    }
+    list(options = {}) {
+        return this.catalog.entries.filter((entry) => (options.domain === undefined || entry.domain === options.domain) &&
+            (options.lifecycle === undefined || entry.artifact.lifecycle === options.lifecycle) &&
+            (options.format === undefined || entry.artifact.format === options.format));
+    }
+    resolve(query) {
+        return this.index.get(query) ?? this.index.get(query.split('\\').join('/'));
+    }
+    require(query) {
+        const entry = this.resolve(query);
+        if (!entry)
+            throw new Error(`Unknown schema: ${query}`);
+        return entry;
+    }
+    policy(query) {
+        return this.require(query).effectivePolicy;
+    }
+    graph(query, options = {}) {
+        const direction = options.direction ?? 'both';
+        const allEdges = [];
+        for (const entry of this.catalog.entries) {
+            for (const dependency of entry.artifact.dependencies ?? [])
+                allEdges.push({ from: entry.artifact.id, to: dependency.id, kind: 'depends-on' });
+            for (const superseded of entry.artifact.supersedes ?? [])
+                allEdges.push({ from: entry.artifact.id, to: superseded, kind: 'supersedes' });
+        }
+        const selected = query === undefined ? new Set(this.catalog.entries.map((entry) => entry.artifact.id)) : this.collectConnected(this.require(query).artifact.id, allEdges, direction);
+        return {
+            nodes: this.catalog.entries.filter((entry) => selected.has(entry.artifact.id)).map((entry) => ({ id: entry.artifact.id, logicalName: entry.artifact.logicalName, version: entry.artifact.version, domain: entry.domain })).sort((a, b) => a.id.localeCompare(b.id)),
+            edges: allEdges.filter((edge) => selected.has(edge.from) && selected.has(edge.to)).sort((a, b) => `${a.from}\0${a.to}\0${a.kind}`.localeCompare(`${b.from}\0${b.to}\0${b.kind}`)),
+        };
+    }
+    collectConnected(seed, edges, direction) {
+        const result = new Set([seed]);
+        const queue = [seed];
+        while (queue.length) {
+            const current = queue.shift();
+            if (!current)
+                continue;
+            for (const edge of edges) {
+                const next = edge.from === current && direction !== 'dependents' ? edge.to : edge.to === current && direction !== 'dependencies' ? edge.from : undefined;
+                if (next && !result.has(next)) {
+                    result.add(next);
+                    queue.push(next);
+                }
+            }
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=resolver.js.map

package/dist/src/schema/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/schema/validator.js

@@ -0,0 +1,82 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import Ajv from 'ajv';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+function depth(value, seen = new Set()) {
+    if (typeof value !== 'object' || value === null)
+        return 0;
+    if (seen.has(value))
+        return 0;
+    seen.add(value);
+    const children = Array.isArray(value) ? value : Object.values(value);
+    return children.length === 0 ? 1 : 1 + Math.max(...children.map(item => depth(item, seen)));
+}
+function errorDiagnostic(artifactId, error) {
+    return {
+        code: 'SCHEMA_INSTANCE_INVALID',
+        severity: 'error',
+        message: error.message ?? 'validation failed',
+        artifactId,
+        path: error.instancePath,
+        details: { schemaPath: error.schemaPath, keyword: error.keyword, params: error.params },
+    };
+}
+/** Offline, catalog-backed validator with bounded inputs and compiled-schema caching. */
+export class SchemaValidator {
+    resolver;
+    options;
+    cache = new Map();
+    constructor(resolver, options) {
+        this.resolver = resolver;
+        this.options = options;
+    }
+    compile(query) {
+        const entry = this.resolver.require(query);
+        if (entry.artifact.format !== 'json-schema') {
+            throw new Error(`Validation requires a JSON Schema artifact; got ${entry.artifact.format}`);
+        }
+        const key = `${entry.artifact.id}\0${entry.digest ?? entry.artifact.version}`;
+        const cached = this.cache.get(key);
+        if (cached)
+            return cached;
+        const draft2020 = entry.artifact.dialect?.includes('2020-12') ?? false;
+        const ajv = draft2020
+            ? new Ajv2020({ strict: entry.effectivePolicy.strict, allErrors: true, loadSchema: undefined })
+            : new Ajv({ strict: entry.effectivePolicy.strict, allErrors: true, loadSchema: undefined });
+        addFormats(ajv);
+        for (const candidate of this.resolver.list())
+            this.addCompatibleSchema(ajv, candidate, draft2020);
+        const compiled = ajv.getSchema(entry.artifact.id);
+        if (!compiled)
+            throw new Error(`Could not compile schema ${entry.artifact.id}`);
+        this.cache.set(key, compiled);
+        return compiled;
+    }
+    validate(query, instance) {
+        const entry = this.resolver.require(query);
+        const diagnostics = [];
+        const serialized = JSON.stringify(instance);
+        const maxBytes = this.options.limits?.maxBytes ?? 10 * 1024 * 1024;
+        const maxDepth = this.options.limits?.maxDepth ?? 128;
+        if (Buffer.byteLength(serialized) > maxBytes)
+            diagnostics.push({ code: 'SCHEMA_RESOURCE_LIMIT', severity: 'error', message: `Instance exceeds ${maxBytes} byte limit`, artifactId: entry.artifact.id });
+        if (depth(instance) > maxDepth)
+            diagnostics.push({ code: 'SCHEMA_RESOURCE_LIMIT', severity: 'error', message: `Instance exceeds depth limit ${maxDepth}`, artifactId: entry.artifact.id });
+        if (diagnostics.length)
+            return { valid: false, artifactId: entry.artifact.id, diagnostics };
+        const check = this.compile(query);
+        const valid = check(instance);
+        return { valid, artifactId: entry.artifact.id, diagnostics: (check.errors ?? []).map(error => errorDiagnostic(entry.artifact.id, error)) };
+    }
+    addCompatibleSchema(ajv, entry, draft2020) {
+        if (entry.artifact.format !== 'json-schema' || !entry.artifact.authority.path)
+            return;
+        if ((entry.artifact.dialect?.includes('2020-12') ?? false) !== draft2020)
+            return;
+        const path = resolve(this.options.rootDir, entry.artifact.authority.path);
+        const schema = JSON.parse(readFileSync(path, 'utf8'));
+        ajv.addSchema(schema, entry.artifact.id);
+    }
+}
+//# sourceMappingURL=validator.js.map