@akagilnc/pi-workflow-roles 0.1.5955 → 0.1.6014

package/src/public-cli/option-definitions.ts

@@ -1042,7 +1042,7 @@ export function createTypedOptionConsumer(
   };
 }
 
-/** Structured option projection used by help and acceptance tests. */
+/** Structured option projection used by help. */
 export type StructuredOptionProjection = {
   readonly id: string;
   readonly owner: OptionOwner;
@@ -1091,15 +1091,6 @@ export function projectOwnerOptions(
   }));
 }
 
-/** All rejected spelling tokens flattened (for leakage scans). */
-export function allRejectedSpellingTokens(): readonly string[] {
-  const out: string[] = [];
-  for (const entry of REJECTED_PUBLIC_SPELLINGS) {
-    out.push(...entry.spellings);
-  }
-  return out;
-}
-
 /**
  * #125 — public command help facts on the sole option-owner module.
  * Presentation inputs only (USAGE synopsis + public `ak-role` examples).

package/dist/canonical-json.js

@@ -1,75 +0,0 @@
-const CANONICAL_JSON_VALIDATION_ERROR_CODE = "canonical-json-invalid";
-class CanonicalJsonValidationError extends Error {
-  constructor(path, reason) {
-    super(`Canonical JSON validation failed at ${path}: ${reason}`);
-    this.path = path;
-    this.reason = reason;
-    this.name = "CanonicalJsonValidationError";
-  }
-  path;
-  reason;
-  code = CANONICAL_JSON_VALIDATION_ERROR_CODE;
-}
-function childPath(path, segment) {
-  return `${path}/${String(segment).replaceAll("~", "~0").replaceAll("/", "~1")}`;
-}
-function ownStringKeys(value, path) {
-  const keys = Reflect.ownKeys(value);
-  if (keys.some((key) => typeof key === "symbol")) {
-    throw new CanonicalJsonValidationError(childPath(path, "<symbol>"), "symbol-keyed member is not a JSON member");
-  }
-  return keys;
-}
-function canonicalJson(value) {
-  const ancestors = /* @__PURE__ */ new WeakSet();
-  const serialize = (item, path) => {
-    if (item === null) return "null";
-    switch (typeof item) {
-      case "boolean":
-      case "string":
-        return JSON.stringify(item);
-      case "number":
-        if (!Number.isFinite(item)) throw new CanonicalJsonValidationError(path, "number must be finite");
-        return JSON.stringify(item);
-      case "undefined":
-      case "function":
-      case "symbol":
-      case "bigint":
-        throw new CanonicalJsonValidationError(path, `${typeof item} is not a JSON value`);
-      case "object": {
-        if (ancestors.has(item)) throw new CanonicalJsonValidationError(path, "cycle is not a JSON value");
-        ancestors.add(item);
-        try {
-          if (Array.isArray(item)) {
-            if (Object.getPrototypeOf(item) !== Array.prototype) throw new CanonicalJsonValidationError(path, "array must not be a custom object");
-            const keys = ownStringKeys(item, path);
-            const extraKey = keys.find((key) => key !== "length" && (!/^(0|[1-9][0-9]*)$/.test(key) || Number(key) >= item.length));
-            if (extraKey !== void 0) throw new CanonicalJsonValidationError(childPath(path, extraKey), "non-index array member is not a JSON member");
-            const values = [];
-            for (let index = 0; index < item.length; index += 1) {
-              if (!Object.hasOwn(item, index)) throw new CanonicalJsonValidationError(childPath(path, index), "sparse array slot is not a JSON value");
-              values.push(serialize(item[index], childPath(path, index)));
-            }
-            return `[${values.join(",")}]`;
-          }
-          const prototype = Object.getPrototypeOf(item);
-          if (prototype !== Object.prototype && prototype !== null) throw new CanonicalJsonValidationError(path, "object must be a plain record");
-          return `{${ownStringKeys(item, path).sort().map((key) => `${JSON.stringify(key)}:${serialize(item[key], childPath(path, key))}`).join(",")}}`;
-        } finally {
-          ancestors.delete(item);
-        }
-      }
-    }
-    throw new Error("Unreachable canonical JSON value type");
-  };
-  return serialize(value, "$");
-}
-function canonicalJsonBytes(value) {
-  return new TextEncoder().encode(canonicalJson(value));
-}
-export {
-  CANONICAL_JSON_VALIDATION_ERROR_CODE,
-  CanonicalJsonValidationError,
-  canonicalJson,
-  canonicalJsonBytes
-};

package/dist/judge-recording-anti-forge.js

@@ -1,39 +0,0 @@
-import { sha256Hex } from "./sha256.js";
-/**
- * On-demand anti-forge for judge recordings.
- *
- * Standing CI must not byte-pin soul free text. Call these only when a
- * concrete recording is being consumed as evidence and must be checked
- * against the soul body supplied at that moment (current or packaged).
- */
-export function soulTextDigest(soulText) {
-    return sha256Hex(soulText);
-}
-export function assertRecordingSoulDigest(options) {
-    if (typeof options.claimedDigest !== "string") {
-        throw new Error(`${options.label} metadata soulDigest must be a string`);
-    }
-    const actual = soulTextDigest(options.soulText);
-    if (actual !== options.claimedDigest) {
-        throw new Error(`${options.label} metadata soulDigest must match the soul supplied at consumption`);
-    }
-}
-/**
- * Construct-at-consumption check: resolve the packaged soul via the injected
- * reader, then verify meta.soulDigest. Reader is injected so callers control
- * git/fs access and tests stay synthetic.
- */
-export function assertPackagedSoulMatchesMeta(meta, label, readPackagedSoul) {
-    if (typeof meta.packageSha !== "string") {
-        throw new Error(`${label} metadata packageSha must be a string`);
-    }
-    if (typeof meta.soulDigest !== "string") {
-        throw new Error(`${label} metadata soulDigest must be a string`);
-    }
-    const packagedSoul = readPackagedSoul(meta.packageSha, label);
-    assertRecordingSoulDigest({
-        claimedDigest: meta.soulDigest,
-        soulText: packagedSoul,
-        label,
-    });
-}

package/src/canonical-json.ts

@@ -1,74 +0,0 @@
-export const CANONICAL_JSON_VALIDATION_ERROR_CODE = "canonical-json-invalid" as const;
-
-export class CanonicalJsonValidationError extends Error {
-  readonly code = CANONICAL_JSON_VALIDATION_ERROR_CODE;
-
-  constructor(readonly path: string, readonly reason: string) {
-    super(`Canonical JSON validation failed at ${path}: ${reason}`);
-    this.name = "CanonicalJsonValidationError";
-  }
-}
-
-function childPath(path: string, segment: string | number): string {
-  return `${path}/${String(segment).replaceAll("~", "~0").replaceAll("/", "~1")}`;
-}
-
-function ownStringKeys(value: object, path: string): string[] {
-  const keys = Reflect.ownKeys(value);
-  if (keys.some((key) => typeof key === "symbol")) {
-    throw new CanonicalJsonValidationError(childPath(path, "<symbol>"), "symbol-keyed member is not a JSON member");
-  }
-  return keys as string[];
-}
-
-/** Deterministic serialization of the closed JSON value domain. */
-export function canonicalJson(value: unknown): string {
-  const ancestors = new WeakSet<object>();
-
-  const serialize = (item: unknown, path: string): string => {
-    if (item === null) return "null";
-    switch (typeof item) {
-      case "boolean":
-      case "string":
-        return JSON.stringify(item);
-      case "number":
-        if (!Number.isFinite(item)) throw new CanonicalJsonValidationError(path, "number must be finite");
-        return JSON.stringify(item);
-      case "undefined":
-      case "function":
-      case "symbol":
-      case "bigint":
-        throw new CanonicalJsonValidationError(path, `${typeof item} is not a JSON value`);
-      case "object": {
-        if (ancestors.has(item)) throw new CanonicalJsonValidationError(path, "cycle is not a JSON value");
-        ancestors.add(item);
-        try {
-          if (Array.isArray(item)) {
-            if (Object.getPrototypeOf(item) !== Array.prototype) throw new CanonicalJsonValidationError(path, "array must not be a custom object");
-            const keys = ownStringKeys(item, path);
-            const extraKey = keys.find((key) => key !== "length" && (!/^(0|[1-9][0-9]*)$/.test(key) || Number(key) >= item.length));
-            if (extraKey !== undefined) throw new CanonicalJsonValidationError(childPath(path, extraKey), "non-index array member is not a JSON member");
-            const values: string[] = [];
-            for (let index = 0; index < item.length; index += 1) {
-              if (!Object.hasOwn(item, index)) throw new CanonicalJsonValidationError(childPath(path, index), "sparse array slot is not a JSON value");
-              values.push(serialize(item[index], childPath(path, index)));
-            }
-            return `[${values.join(",")}]`;
-          }
-          const prototype = Object.getPrototypeOf(item);
-          if (prototype !== Object.prototype && prototype !== null) throw new CanonicalJsonValidationError(path, "object must be a plain record");
-          return `{${ownStringKeys(item, path).sort().map((key) => `${JSON.stringify(key)}:${serialize((item as Record<string, unknown>)[key], childPath(path, key))}`).join(",")}}`;
-        } finally {
-          ancestors.delete(item);
-        }
-      }
-    }
-    throw new Error("Unreachable canonical JSON value type");
-  };
-
-  return serialize(value, "$");
-}
-
-export function canonicalJsonBytes(value: unknown): Uint8Array {
-  return new TextEncoder().encode(canonicalJson(value));
-}

package/src/judge-recording-anti-forge.ts

@@ -1,53 +0,0 @@
-import { sha256Hex } from "./sha256.ts";
-
-/**
- * On-demand anti-forge for judge recordings.
- *
- * Standing CI must not byte-pin soul free text. Call these only when a
- * concrete recording is being consumed as evidence and must be checked
- * against the soul body supplied at that moment (current or packaged).
- */
-
-export function soulTextDigest(soulText: string): string {
-  return sha256Hex(soulText);
-}
-
-export function assertRecordingSoulDigest(options: {
-  claimedDigest: unknown;
-  soulText: string;
-  label: string;
-}): void {
-  if (typeof options.claimedDigest !== "string") {
-    throw new Error(`${options.label} metadata soulDigest must be a string`);
-  }
-  const actual = soulTextDigest(options.soulText);
-  if (actual !== options.claimedDigest) {
-    throw new Error(
-      `${options.label} metadata soulDigest must match the soul supplied at consumption`,
-    );
-  }
-}
-
-/**
- * Construct-at-consumption check: resolve the packaged soul via the injected
- * reader, then verify meta.soulDigest. Reader is injected so callers control
- * git/fs access and tests stay synthetic.
- */
-export function assertPackagedSoulMatchesMeta(
-  meta: Record<string, unknown>,
-  label: string,
-  readPackagedSoul: (packageSha: string, label: string) => string,
-): void {
-  if (typeof meta.packageSha !== "string") {
-    throw new Error(`${label} metadata packageSha must be a string`);
-  }
-  if (typeof meta.soulDigest !== "string") {
-    throw new Error(`${label} metadata soulDigest must be a string`);
-  }
-  const packagedSoul = readPackagedSoul(meta.packageSha, label);
-  assertRecordingSoulDigest({
-    claimedDigest: meta.soulDigest,
-    soulText: packagedSoul,
-    label,
-  });
-}