@askexenow/exe-os 0.9.382 → 0.9.384

package/dist/chunk-AZXMR25O.js

@@ -0,0 +1,545 @@
+import {
+  parseInstant
+} from "./chunk-YRUZK2QA.js";
+
+// src/lib/delivery-schemas.ts
+import { z } from "zod";
+var DeliverySchemaError = class extends Error {
+  code;
+  path;
+  detail;
+  constructor(code, path, detail) {
+    super(`[${code}] ${path}: ${detail}`);
+    this.name = "DeliverySchemaError";
+    this.code = code;
+    this.path = path;
+    this.detail = detail;
+  }
+};
+function assertNoDuplicateKeys(raw) {
+  const stack = [];
+  let i = 0;
+  while (i < raw.length) {
+    const c = raw[i];
+    if (c === '"') {
+      const start = i;
+      i += 1;
+      while (i < raw.length) {
+        if (raw[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        if (raw[i] === '"') break;
+        i += 1;
+      }
+      const literal = raw.slice(start, i + 1);
+      i += 1;
+      const top = stack[stack.length - 1];
+      if (top?.isObject && top.expectKey) {
+        let key;
+        try {
+          key = JSON.parse(literal);
+        } catch {
+          return;
+        }
+        if (top.keys.has(key)) {
+          throw new DeliverySchemaError(
+            "duplicate_key",
+            `$.${key}`,
+            `key "${key}" appears more than once in the same object; JSON.parse would keep only the last value`
+          );
+        }
+        top.keys.add(key);
+        top.expectKey = false;
+      }
+      continue;
+    }
+    if (c === "{") {
+      stack.push({ isObject: true, keys: /* @__PURE__ */ new Set(), expectKey: true });
+    } else if (c === "[") {
+      stack.push({ isObject: false, keys: /* @__PURE__ */ new Set(), expectKey: false });
+    } else if (c === "}" || c === "]") {
+      stack.pop();
+    } else if (c === ",") {
+      const top = stack[stack.length - 1];
+      if (top?.isObject) top.expectKey = true;
+    }
+    i += 1;
+  }
+}
+function parseJsonStrict(raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch (e) {
+    throw new DeliverySchemaError(
+      "json_parse",
+      "$",
+      e instanceof Error ? e.message : String(e)
+    );
+  }
+  assertNoDuplicateKeys(raw);
+  return value;
+}
+var GIT_SHA_RE = /^[0-9a-f]{40}$/;
+var OCI_DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+var NPM_INTEGRITY_RE = /^sha512-[A-Za-z0-9+/]{86}==$/;
+var RELEASE_TAG_RE = /^askexe-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+var SEMVER_RE = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+var UTC_TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
+var PLATFORM_RE = /^[a-z0-9]+\/[a-z0-9]+(\/v[0-9]+)?$/;
+var SHA256_HEX_RE = /^[0-9a-f]{64}$/;
+var gitSha = z.string().regex(GIT_SHA_RE, "must be a lowercase 40-hex commit SHA");
+var ociDigest = z.string().regex(OCI_DIGEST_RE, "must be sha256:<64 lowercase hex>");
+var npmIntegrity = z.string().regex(NPM_INTEGRITY_RE, "must be an npm SHA-512 integrity string");
+var releaseTag = z.string().regex(RELEASE_TAG_RE, "must be askexe-vMAJOR.MINOR.PATCH");
+var semver = z.string().regex(SEMVER_RE, "must be MAJOR.MINOR.PATCH");
+function isRealUtcInstant(v) {
+  if (!UTC_TIMESTAMP_RE.test(v)) return false;
+  const ms = Date.parse(v);
+  if (!Number.isFinite(ms)) return false;
+  return new Date(ms).toISOString().slice(0, 19) === v.slice(0, 19);
+}
+var utcTimestamp = z.string().refine(isRealUtcInstant, "must be a real ISO-8601 UTC instant ending in Z");
+var platform = z.string().regex(PLATFORM_RE, "must be an OCI platform string, e.g. linux/amd64");
+var sha256Hex = z.string().regex(SHA256_HEX_RE, "must be 64 lowercase hex characters");
+var nonEmpty = z.string().min(1);
+var repositoryName = z.string().regex(/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/);
+var CHANNELS = ["canary", "stable"];
+var channel = z.enum(CHANNELS);
+var RELEASE_STATES = [
+  "INTENT",
+  "BUILDING",
+  "CANDIDATE",
+  "VERIFIED",
+  "RELEASED",
+  "PROPOSED",
+  "SIGNED",
+  "PUBLISHED",
+  "DEPLOYED",
+  "VERIFIED_DEPLOYMENT",
+  "BLOCKED",
+  "ABANDONED",
+  "SUPERSEDED_BY"
+];
+var ReleaseStateSchema = z.enum(RELEASE_STATES);
+var RECOVERABLE_TERMINAL_STATES = ["BLOCKED"];
+function isRecoverableTerminal(state) {
+  return RECOVERABLE_TERMINAL_STATES.includes(state);
+}
+var SCAN_RESULTS = ["pass", "policy_fail", "engine_error", "stale_database"];
+var ScanEvidenceSchema = z.strictObject({
+  engine: nonEmpty,
+  engineVersion: nonEmpty,
+  databaseVersion: nonEmpty,
+  reportSha256: sha256Hex,
+  /**
+   * WHAT was scanned, named by the same identity the artifact is published
+   * under. An OCI digest for an image, an SHA-512 integrity for an npm tarball,
+   * a SHA-256 for a binary — because an exe-os release is npm AND images, and a
+   * contract that can only express "scanned this image digest" cannot record
+   * that the tarball was scanned at all.
+   *
+   * The descriptor refines this further: it must match an artifact THIS release
+   * actually ships. A scan of bytes we do not publish is not evidence.
+   */
+  scannedDigest: z.union([ociDigest, npmIntegrity, sha256Hex]),
+  result: z.enum(SCAN_RESULTS),
+  completedAt: utcTimestamp
+});
+var NOT_APPLICABLE_CLASSIFICATIONS = [
+  "documentation_only",
+  "paths_not_affected",
+  "artifact_not_produced"
+];
+var PassedCheckSchema = z.strictObject({
+  name: nonEmpty,
+  conclusion: z.literal("success"),
+  headSha: gitSha
+});
+var NotApplicableCheckSchema = z.strictObject({
+  name: nonEmpty,
+  conclusion: z.literal("skipped"),
+  headSha: gitSha,
+  /** Mandatory. A skip with no accountable classification is not evidence. */
+  notApplicable: z.strictObject({
+    classification: z.enum(NOT_APPLICABLE_CLASSIFICATIONS),
+    /** Free text for the human who has to audit this later. */
+    reason: nonEmpty,
+    /** The role accountable for the classification. Not a department. */
+    approvedBy: nonEmpty
+  })
+});
+var RequiredCheckSchema = z.discriminatedUnion("conclusion", [
+  PassedCheckSchema,
+  NotApplicableCheckSchema
+]);
+var EvidenceSchema = z.strictObject({
+  requiredChecks: z.array(RequiredCheckSchema).min(1),
+  scans: z.array(ScanEvidenceSchema).min(1),
+  identityReportSha256: sha256Hex,
+  smokeReportSha256: sha256Hex
+});
+var ReferenceSchema = z.strictObject({
+  digest: ociDigest,
+  mediaType: nonEmpty
+});
+var PlatformDigestSchema = z.strictObject({
+  platform,
+  digest: ociDigest
+});
+var OciImageArtifactSchema = z.strictObject({
+  componentId: nonEmpty,
+  type: z.literal("oci-image"),
+  registry: nonEmpty,
+  repositoryPath: nonEmpty,
+  versionAlias: nonEmpty,
+  digest: ociDigest,
+  mediaType: nonEmpty,
+  platforms: z.array(PlatformDigestSchema).min(1),
+  sbom: ReferenceSchema.optional(),
+  provenance: ReferenceSchema.optional()
+});
+var NpmPackageArtifactSchema = z.strictObject({
+  componentId: nonEmpty,
+  type: z.literal("npm-package"),
+  registry: nonEmpty,
+  packageName: nonEmpty,
+  versionAlias: nonEmpty,
+  integrity: npmIntegrity,
+  provenance: ReferenceSchema.optional()
+});
+var BinaryArtifactSchema = z.strictObject({
+  componentId: nonEmpty,
+  type: z.literal("binary"),
+  releaseAsset: nonEmpty,
+  versionAlias: nonEmpty,
+  sha256: sha256Hex,
+  platform,
+  provenance: ReferenceSchema.optional()
+});
+var DesktopBundleArtifactSchema = z.strictObject({
+  componentId: nonEmpty,
+  type: z.literal("desktop-bundle"),
+  releaseAsset: nonEmpty,
+  versionAlias: nonEmpty,
+  sha256: sha256Hex,
+  platform,
+  signed: z.boolean(),
+  provenance: ReferenceSchema.optional()
+});
+var ArtifactSchema = z.discriminatedUnion("type", [
+  OciImageArtifactSchema,
+  NpmPackageArtifactSchema,
+  BinaryArtifactSchema,
+  DesktopBundleArtifactSchema
+]);
+var BuildInputsSchema = z.strictObject({
+  toolchain: z.record(z.string(), nonEmpty),
+  baseImages: z.array(z.strictObject({ ref: nonEmpty, digest: ociDigest })),
+  lockfiles: z.array(z.strictObject({ path: nonEmpty, sha256: sha256Hex })),
+  /**
+   * The version injected into the build workspace, plus the revision of the
+   * transformation that injected it. Recorded so a released artifact's version
+   * is traceable WITHOUT a bump-only commit mutating the tagged source tree.
+   */
+  generatedVersion: z.strictObject({
+    version: semver,
+    transformationRevision: gitSha
+  })
+});
+var ROLLBACK_CLASSES = ["safe", "forward_only", "irreversible"];
+var CompatibilitySchema = z.strictObject({
+  updaterFloor: semver,
+  apiRequirements: z.array(z.strictObject({ name: nonEmpty, range: nonEmpty })),
+  migrationIds: z.array(nonEmpty),
+  rollback: z.enum(ROLLBACK_CLASSES)
+});
+var WorkflowIdentitySchema = z.strictObject({
+  repository: repositoryName,
+  path: nonEmpty,
+  /** The FULL 40-char commit of the trusted reusable workflow — never `@v1`. */
+  workflowSha: gitSha,
+  runId: nonEmpty,
+  attempt: z.number().int().min(1),
+  event: nonEmpty,
+  evaluatedSourceSha: gitSha
+});
+var DESCRIPTOR_SCHEMA_VERSION = 1;
+var ReleaseDescriptorSchema = z.strictObject({
+  schemaVersion: z.literal(DESCRIPTOR_SCHEMA_VERSION),
+  /** Full commit SHA of the trusted contract this release was produced under. */
+  contractRevision: gitSha,
+  /** Numeric GitHub repository ID — survives rename and transfer. */
+  repositoryId: z.number().int().positive(),
+  repository: repositoryName,
+  sourceSha: gitSha,
+  sourceTree: gitSha,
+  tag: releaseTag,
+  version: semver,
+  channel,
+  intentId: nonEmpty,
+  workflow: WorkflowIdentitySchema,
+  artifacts: z.array(ArtifactSchema).min(1),
+  buildInputs: BuildInputsSchema,
+  compatibility: CompatibilitySchema,
+  evidence: EvidenceSchema
+}).superRefine((d, ctx) => {
+  if (d.tag !== `askexe-v${d.version}`) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["version"],
+      message: `version "${d.version}" does not match tag "${d.tag}"`
+    });
+  }
+  if (d.workflow.evaluatedSourceSha !== d.sourceSha) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["workflow", "evaluatedSourceSha"],
+      message: "workflow evaluated a different source SHA than the descriptor claims"
+    });
+  }
+  if (d.buildInputs.generatedVersion.version !== d.version) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["buildInputs", "generatedVersion", "version"],
+      message: "generated build version does not match the released version"
+    });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  d.artifacts.forEach((a, i) => {
+    if (seen.has(a.componentId)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["artifacts", i, "componentId"],
+        message: `duplicate componentId "${a.componentId}"`
+      });
+    }
+    seen.add(a.componentId);
+    const expectedAlias = a.type === "oci-image" ? d.tag : d.version;
+    if (a.versionAlias !== expectedAlias) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["artifacts", i, "versionAlias"],
+        message: `versionAlias "${a.versionAlias}" must be "${expectedAlias}" for a ${a.type} artifact of ${d.tag}`
+      });
+    }
+  });
+  d.evidence.requiredChecks.forEach((c, i) => {
+    if (c.headSha !== d.sourceSha) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["evidence", "requiredChecks", i, "headSha"],
+        message: `check "${c.name}" was evaluated on ${c.headSha}, not on the released source ${d.sourceSha}`
+      });
+    }
+  });
+  const artifactDigests = new Set(
+    d.artifacts.flatMap((a) => {
+      if (a.type === "oci-image") return [a.digest, ...a.platforms.map((p) => p.digest)];
+      if (a.type === "npm-package") return [a.integrity];
+      return [a.sha256];
+    })
+  );
+  d.evidence.scans.forEach((scan, i) => {
+    if (!artifactDigests.has(scan.scannedDigest)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["evidence", "scans", i, "scannedDigest"],
+        message: `scan targeted ${scan.scannedDigest}, which is not an artifact digest of this release`
+      });
+    }
+  });
+});
+var ReleaseIntentSchema = z.strictObject({
+  intentId: nonEmpty,
+  repositoryId: z.number().int().positive(),
+  repository: repositoryName,
+  sourceSha: gitSha,
+  channel,
+  /** The component IDs this intent is obliged to produce. A short set is a failure. */
+  expectedComponents: z.array(nonEmpty).min(1),
+  state: ReleaseStateSchema,
+  attempt: z.number().int().min(1),
+  queuedAt: utcTimestamp,
+  deadlineAt: utcTimestamp,
+  /** Reserved version, once allocated. Reservation survives a failed attempt. */
+  reservedVersion: semver.optional(),
+  /**
+   * The furthest stage this intent actually completed and verified.
+   *
+   * §6.5 requires "rerun the same intent from its LAST VERIFIED STAGE", and
+   * `state` alone cannot express that: the moment an attempt fails, `state`
+   * becomes `BLOCKED` and the stage it had reached is gone. Keeping the resume
+   * point only in the controller's own storage works right up until an intent
+   * crosses a process or repository boundary, at which point the trip silently
+   * costs you the resume and the retry rebuilds bytes that were already
+   * verified — which §6.5 explicitly forbids.
+   */
+  lastVerifiedStage: ReleaseStateSchema.optional(),
+  /**
+   * The one terminal outcome `state` cannot express: this commit was audited and
+   * owes no release at all (a documentation-only change).
+   *
+   * It used to also carry BLOCKED / ABANDONED / SUPERSEDED_BY, which are already
+   * `state` values — so a record could say `state: BLOCKED, disposition:
+   * ABANDONED` and the contract permitted the contradiction. One fact belongs in
+   * one field; the duplicates are gone rather than merely discouraged.
+   */
+  disposition: z.literal("NO_RELEASE_REQUIRED").optional(),
+  /** Required when state is SUPERSEDED_BY: the successor containing this commit. */
+  supersededBy: gitSha.optional(),
+  blockedReason: nonEmpty.optional(),
+  /**
+   * Lease held by the controller currently advancing this intent.
+   *
+   * §3 requires fencing tokens for leases, and without the lease ON the intent
+   * two controllers reading the same wire object cannot tell it is already
+   * claimed — they both proceed, and the fencing token that was supposed to
+   * settle the race exists only inside one of them. The token increases
+   * monotonically; a writer presenting a token older than the recorded one is
+   * refused.
+   */
+  lease: z.strictObject({
+    holder: nonEmpty,
+    fencingToken: z.number().int().min(1),
+    expiresAt: utcTimestamp
+  }).optional()
+}).superRefine((i, ctx) => {
+  if (i.state === "SUPERSEDED_BY" && !i.supersededBy) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["supersededBy"],
+      message: "state SUPERSEDED_BY requires supersededBy to name the successor commit"
+    });
+  }
+  if (i.supersededBy && i.state !== "SUPERSEDED_BY") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["state"],
+      message: `supersededBy is set but state is ${i.state}, not SUPERSEDED_BY`
+    });
+  }
+  if (i.state === "BLOCKED" && !i.blockedReason) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["blockedReason"],
+      message: "state BLOCKED requires blockedReason \u2014 an unexplained block cannot be actioned"
+    });
+  }
+  const deadlineMs = parseInstant(i.deadlineAt);
+  const queuedMs = parseInstant(i.queuedAt);
+  if (deadlineMs === null || queuedMs === null) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["deadlineAt"],
+      message: "deadlineAt and queuedAt must name real instants before they can be ordered"
+    });
+  } else if (deadlineMs < queuedMs) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["deadlineAt"],
+      message: "deadlineAt precedes queuedAt"
+    });
+  }
+});
+var StackCompositionSchema = z.strictObject({
+  channel,
+  sequence: z.number().int().min(0),
+  compositionHash: sha256Hex,
+  previousSequence: z.number().int().min(0).nullable(),
+  /**
+   * MUST be sorted ascending by `componentId`, and the hasher MUST fold them in
+   * that order.
+   *
+   * `services` is an array, so `[a,b]` and `[b,a]` would otherwise be two
+   * documents describing one identical stack, each hashing differently. That
+   * would replace the clock with array order as a spurious release trigger —
+   * precisely the bug the absent timestamp above exists to prevent. Mandating
+   * the order in the CONTRACT, rather than only canonicalizing inside one
+   * hasher, means any independent implementation computes the same hash.
+   */
+  services: z.array(
+    z.strictObject({
+      componentId: nonEmpty,
+      digest: ociDigest,
+      version: semver
+    })
+  ).min(1).refine(
+    (svcs) => svcs.every((s, i) => i === 0 || svcs[i - 1].componentId < s.componentId),
+    { message: "services must be sorted ascending by componentId, with no duplicates" }
+  ),
+  compatibility: z.strictObject({
+    result: z.enum(["pass", "fail"]),
+    detail: nonEmpty.optional()
+  })
+});
+function issuePath(issue) {
+  if (issue.path.length === 0) return "$";
+  return `$.${issue.path.map((p) => typeof p === "number" ? `[${p}]` : String(p)).join(".").replace(/\.\[/g, "[")}`;
+}
+function parseReleaseDescriptor(raw) {
+  const value = parseJsonStrict(raw);
+  if (typeof value === "object" && value !== null && "schemaVersion" in value && value.schemaVersion !== DESCRIPTOR_SCHEMA_VERSION) {
+    throw new DeliverySchemaError(
+      "unsupported_schema_version",
+      "$.schemaVersion",
+      `this build understands schemaVersion ${DESCRIPTOR_SCHEMA_VERSION}, got ${String(
+        value.schemaVersion
+      )}`
+    );
+  }
+  return parseWith(ReleaseDescriptorSchema, value, "descriptor");
+}
+function parseWith(schema, value, label) {
+  const result = schema.safeParse(value);
+  if (!result.success) {
+    const first = result.error.issues[0];
+    throw new DeliverySchemaError(
+      "schema_invalid",
+      first ? issuePath(first) : "$",
+      first?.message ?? `${label} failed validation`
+    );
+  }
+  return result.data;
+}
+function parseEvidence(raw) {
+  return parseWith(EvidenceSchema, parseJsonStrict(raw), "evidence");
+}
+function parseReleaseIntent(raw) {
+  return parseWith(ReleaseIntentSchema, parseJsonStrict(raw), "release intent");
+}
+function parseStackComposition(raw) {
+  return parseWith(StackCompositionSchema, parseJsonStrict(raw), "stack composition");
+}
+
+export {
+  DeliverySchemaError,
+  parseJsonStrict,
+  GIT_SHA_RE,
+  OCI_DIGEST_RE,
+  NPM_INTEGRITY_RE,
+  RELEASE_TAG_RE,
+  SEMVER_RE,
+  UTC_TIMESTAMP_RE,
+  PLATFORM_RE,
+  SHA256_HEX_RE,
+  CHANNELS,
+  RELEASE_STATES,
+  ReleaseStateSchema,
+  RECOVERABLE_TERMINAL_STATES,
+  isRecoverableTerminal,
+  SCAN_RESULTS,
+  NOT_APPLICABLE_CLASSIFICATIONS,
+  EvidenceSchema,
+  ArtifactSchema,
+  ROLLBACK_CLASSES,
+  DESCRIPTOR_SCHEMA_VERSION,
+  ReleaseDescriptorSchema,
+  ReleaseIntentSchema,
+  StackCompositionSchema,
+  parseReleaseDescriptor,
+  parseEvidence,
+  parseReleaseIntent,
+  parseStackComposition
+};

package/dist/{chunk-WPWEBZ37.js → chunk-B7AMNZTC.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-CBPNZFSU.js";
 import {
   initStore
-} from "./chunk-CO5ZVE3D.js";
+} from "./chunk-UOPCVFVR.js";
 import {
   getClient,
   isInitialized
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 
 // src/lib/schedules.ts
 import crypto from "crypto";

package/dist/{chunk-4CF5KUWH.js → chunk-BPVFZ6Q4.js}

@@ -3,19 +3,19 @@ import {
   getClient,
   isInitialized,
   loadEmployees
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 import {
   checkLicense,
   isFeatureAllowed,
   isPersonalFreeGrandfathered,
   resolveClientLimits
-} from "./chunk-5DFE2NAF.js";
+} from "./chunk-TNS63ATU.js";
 import {
   PLAN_LIMITS
 } from "./chunk-A7XLR3K7.js";
 import {
   EXE_AI_DIR
-} from "./chunk-ZIG7VPJV.js";
+} from "./chunk-MMS2HBRT.js";
 
 // src/lib/plan-limits.ts
 import { readFileSync, existsSync } from "fs";