@awak-app/simy-cli 0.3.3 → 0.4.0

package/src/sqm/session.js

@@ -0,0 +1,58 @@
+import { startAgent } from "../agent.js";
+import { openAuthorizationUrl } from "../browser.js";
+import { isSessionValid, readSession } from "../session-store.js";
+import { createAgentShutdown } from "../shutdown.js";
+
+const DEFAULT_AUTH_TIMEOUT_MS = 2 * 60 * 1000;
+
+export async function ensureSqmSession(
+  webOrigin,
+  {
+    noOpen = false,
+    timeoutMs = DEFAULT_AUTH_TIMEOUT_MS,
+    logger = console,
+    now = Date.now,
+    sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+    readSessionImpl = readSession,
+    isSessionValidImpl = isSessionValid,
+    startAgentImpl = startAgent,
+    openAuthorizationUrlImpl = openAuthorizationUrl,
+    createAgentShutdownImpl = createAgentShutdown,
+  } = {},
+) {
+  let session = await readSessionImpl(webOrigin);
+  if (sqmSessionReady(session, webOrigin, now(), isSessionValidImpl)) return session;
+
+  const agent = await startAgentImpl({ requestedPort: 0, webOrigin, quiet: true });
+  const shutdown = createAgentShutdownImpl(agent);
+  try {
+    const loginUrl = agent.loginUrl;
+    if (!loginUrl) throw new Error("SIMY could not create an SQM authorization session.");
+    logger.log("SIMY sign-in is required before the SQM check can continue.");
+    if (noOpen) logger.log(`Open this URL to authorize SIMY CLI: ${loginUrl}`);
+    else await openAuthorizationUrlImpl(loginUrl, { logger });
+    logger.log("Waiting for browser authorization...");
+
+    const deadline = now() + timeoutMs;
+    while (now() < deadline) {
+      await sleep(Math.min(500, Math.max(1, deadline - now())));
+      session = await readSessionImpl(webOrigin);
+      if (sqmSessionReady(session, webOrigin, now(), isSessionValidImpl)) {
+        logger.log("SIMY CLI authorization completed. Continuing SQM check.");
+        return session;
+      }
+    }
+    throw new Error("SIMY authorization timed out. Complete the browser sign-in and rerun the SQM command.");
+  } finally {
+    await shutdown();
+  }
+}
+
+function sqmSessionReady(session, webOrigin, now, isSessionValidImpl) {
+  return Boolean(
+    isSessionValidImpl(session, now, webOrigin) &&
+      (session?.organization_id || session?.org_id) &&
+      session?.token &&
+      session?.api_base_url,
+  );
+}

package/src/sqm/validation.js

@@ -0,0 +1,305 @@
+const SEMVER = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const DIGEST = /^sha256:[a-f0-9]{64}$/;
+const MODULE_ID = /^KM-[A-Z0-9][A-Z0-9._-]{2,127}$/;
+const INCIDENT_ID = /^INC-[A-Z0-9][A-Z0-9._-]{2,127}$/;
+const RULE_ID = /^[a-z][a-z0-9._-]{2,127}$/;
+const REPOSITORY = /^[^/\s]+\/[^/\s]+$/;
+const CHECKERS = new Set(["diff_regex", "path_presence", "content_regex", "reference_definition"]);
+const MATCHERS = new Set(["changed_path", "diff_regex", "content_regex", "reference"]);
+const LIFECYCLES = new Set(["candidate", "shadow", "warn", "blocking", "retired"]);
+const SEVERITIES = new Set(["info", "low", "medium", "high", "critical"]);
+const BOUNDARIES = new Set(["api", "auth", "database", "deployment", "external_tool", "human", "llm", "pipeline", "runtime", "ui"]);
+const ASSURANCE_ID = /^[A-Z][A-Z0-9._-]{2,127}$/;
+const STRENGTH_KINDS = new Set(["prevention", "detection", "recovery"]);
+const STRENGTH_STATUSES = new Set(["existing", "expected"]);
+const SCENARIO_REQUIREMENTS = new Set(["local", "requires_human", "requires_post_deploy"]);
+
+export function validateKnowledgeBundle(bundle, { cliVersion }) {
+  const errors = [];
+  object(bundle, "$", errors);
+  exactKeys(bundle, ["schema_version", "bundle_id", "version", "organization_id", "generated_at", "expires_at", "modules", "integrity"], "$", errors);
+  equal(bundle?.schema_version, "1.0.0", "$.schema_version", errors);
+  stringPattern(bundle?.bundle_id, /^[a-z][a-z0-9._-]{2,127}$/, "$.bundle_id", errors);
+  stringPattern(bundle?.version, /^[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.[0-9]+$/, "$.version", errors);
+  nullableString(bundle?.organization_id, 200, "$.organization_id", errors);
+  dateTime(bundle?.generated_at, "$.generated_at", errors);
+  dateTime(bundle?.expires_at, "$.expires_at", errors);
+  if (!Array.isArray(bundle?.modules)) errors.push("$.modules must be an array");
+  for (const [index, module] of (bundle?.modules || []).entries()) {
+    validateModule(module, `$.modules[${index}]`, errors, cliVersion);
+  }
+  object(bundle?.integrity, "$.integrity", errors);
+  exactKeys(bundle?.integrity, ["algorithm", "digest", "key_id", "signature"], "$.integrity", errors);
+  equal(bundle?.integrity?.algorithm, "ed25519", "$.integrity.algorithm", errors);
+  stringPattern(bundle?.integrity?.digest, DIGEST, "$.integrity.digest", errors);
+  boundedString(bundle?.integrity?.key_id, 1, 200, "$.integrity.key_id", errors);
+  boundedString(bundle?.integrity?.signature, 1, 1000, "$.integrity.signature", errors);
+  if (errors.length) throw new Error(`Invalid SQM knowledge bundle:\n- ${errors.join("\n- ")}`);
+  return bundle;
+}
+
+function validateModule(module, at, errors, cliVersion) {
+  object(module, at, errors);
+  exactKeys(module, ["schema_version", "id", "version", "title", "summary", "lifecycle", "scope", "invariant", "detection", "assurance", "incident_refs", "provenance", "evaluation", "compatibility"], at, errors);
+  oneOf(module?.schema_version, new Set(["1.0.0", "1.1.0"]), `${at}.schema_version`, errors);
+  stringPattern(module?.id, MODULE_ID, `${at}.id`, errors);
+  stringPattern(module?.version, SEMVER, `${at}.version`, errors);
+  boundedString(module?.title, 1, 200, `${at}.title`, errors);
+  boundedString(module?.summary, 1, 2000, `${at}.summary`, errors);
+
+  object(module?.lifecycle, `${at}.lifecycle`, errors);
+  exactKeys(module?.lifecycle, ["status", "severity", "owner"], `${at}.lifecycle`, errors);
+  oneOf(module?.lifecycle?.status, LIFECYCLES, `${at}.lifecycle.status`, errors);
+  oneOf(module?.lifecycle?.severity, SEVERITIES, `${at}.lifecycle.severity`, errors);
+  nullableString(module?.lifecycle?.owner, 200, `${at}.lifecycle.owner`, errors);
+
+  object(module?.scope, `${at}.scope`, errors);
+  exactKeys(module?.scope, ["visibility", "organization_id", "repositories", "languages", "frameworks", "boundaries"], `${at}.scope`, errors);
+  oneOf(module?.scope?.visibility, new Set(["core", "framework", "organization"]), `${at}.scope.visibility`, errors);
+  nullableString(module?.scope?.organization_id, 200, `${at}.scope.organization_id`, errors);
+  stringArray(module?.scope?.repositories, `${at}.scope.repositories`, errors, REPOSITORY, 500, false);
+  stringArray(module?.scope?.languages, `${at}.scope.languages`, errors, null, 100, false);
+  stringArray(module?.scope?.frameworks, `${at}.scope.frameworks`, errors, null, 100, false);
+  enumArray(module?.scope?.boundaries, `${at}.scope.boundaries`, errors, BOUNDARIES, true);
+
+  object(module?.invariant, `${at}.invariant`, errors);
+  exactKeys(module?.invariant, ["statement", "failure_condition", "remediation"], `${at}.invariant`, errors);
+  boundedString(module?.invariant?.statement, 1, 1000, `${at}.invariant.statement`, errors);
+  boundedString(module?.invariant?.failure_condition, 1, 1000, `${at}.invariant.failure_condition`, errors);
+  nullableString(module?.invariant?.remediation, 2000, `${at}.invariant.remediation`, errors);
+
+  object(module?.detection, `${at}.detection`, errors);
+  exactKeys(module?.detection, ["matchers", "checks", "exceptions"], `${at}.detection`, errors);
+  nonEmptyArray(module?.detection?.matchers, `${at}.detection.matchers`, errors);
+  for (const [index, matcher] of (module?.detection?.matchers || []).entries()) validateMatcher(matcher, `${at}.detection.matchers[${index}]`, errors);
+  nonEmptyArray(module?.detection?.checks, `${at}.detection.checks`, errors);
+  for (const [index, check] of (module?.detection?.checks || []).entries()) validateCheck(check, `${at}.detection.checks[${index}]`, errors);
+  array(module?.detection?.exceptions, `${at}.detection.exceptions`, errors);
+  for (const [index, exception] of (module?.detection?.exceptions || []).entries()) validateException(exception, `${at}.detection.exceptions[${index}]`, errors);
+
+  if (module?.schema_version === "1.1.0") validateAssurance(module?.assurance, module, `${at}.assurance`, errors);
+  else if (module?.assurance !== undefined) validateAssurance(module.assurance, module, `${at}.assurance`, errors);
+
+  stringArray(module?.incident_refs, `${at}.incident_refs`, errors, INCIDENT_ID, 128, true);
+  object(module?.provenance, `${at}.provenance`, errors);
+  exactKeys(module?.provenance, ["created_at", "created_by", "generation_method", "model", "prompt_digest", "source_digests"], `${at}.provenance`, errors);
+  dateTime(module?.provenance?.created_at, `${at}.provenance.created_at`, errors);
+  boundedString(module?.provenance?.created_by, 1, 200, `${at}.provenance.created_by`, errors);
+  oneOf(module?.provenance?.generation_method, new Set(["human", "ai", "hybrid", "imported"]), `${at}.provenance.generation_method`, errors);
+  nullableString(module?.provenance?.model, 200, `${at}.provenance.model`, errors);
+  nullablePattern(module?.provenance?.prompt_digest, /^(sha256:[a-f0-9]{64})?$/, `${at}.provenance.prompt_digest`, errors);
+  stringArray(module?.provenance?.source_digests, `${at}.provenance.source_digests`, errors, DIGEST, 71, true);
+
+  object(module?.evaluation, `${at}.evaluation`, errors);
+  exactKeys(module?.evaluation, ["status", "true_positives", "false_positives", "false_negatives", "evaluated_at", "benchmark_digest"], `${at}.evaluation`, errors);
+  oneOf(module?.evaluation?.status, new Set(["not_evaluated", "synthetic_only", "historical_replay", "prospective"]), `${at}.evaluation.status`, errors);
+  nonNegativeInteger(module?.evaluation?.true_positives, `${at}.evaluation.true_positives`, errors);
+  nonNegativeInteger(module?.evaluation?.false_positives, `${at}.evaluation.false_positives`, errors);
+  nonNegativeInteger(module?.evaluation?.false_negatives, `${at}.evaluation.false_negatives`, errors);
+  nullableDateTime(module?.evaluation?.evaluated_at, `${at}.evaluation.evaluated_at`, errors);
+  nullablePattern(module?.evaluation?.benchmark_digest, /^(sha256:[a-f0-9]{64})?$/, `${at}.evaluation.benchmark_digest`, errors);
+
+  object(module?.compatibility, `${at}.compatibility`, errors);
+  exactKeys(module?.compatibility, ["min_cli_version", "checker_api_version"], `${at}.compatibility`, errors);
+  stringPattern(module?.compatibility?.min_cli_version, SEMVER, `${at}.compatibility.min_cli_version`, errors);
+  oneOf(module?.compatibility?.checker_api_version, new Set(["1.0.0", "1.1.0"]), `${at}.compatibility.checker_api_version`, errors);
+  if (SEMVER.test(cliVersion || "") && SEMVER.test(module?.compatibility?.min_cli_version || "") && compareSemver(cliVersion, module.compatibility.min_cli_version) < 0) {
+    errors.push(`${at} requires CLI ${module.compatibility.min_cli_version}, current ${cliVersion}`);
+  }
+}
+
+function validateAssurance(value, module, at, errors) {
+  object(value, at, errors);
+  exactKeys(value, ["state_models", "stressors", "strengths", "scenarios"], at, errors);
+  for (const key of ["state_models", "stressors", "strengths", "scenarios"]) nonEmptyArray(value?.[key], `${at}.${key}`, errors);
+  const checkIds = new Set((module?.detection?.checks || []).map((check) => check?.id));
+  const stressorIds = new Set();
+  const strengthIds = new Set();
+  const scenarioIds = new Set();
+  const modelIds = new Set();
+
+  for (const [index, stressor] of (value?.stressors || []).entries()) {
+    const path = `${at}.stressors[${index}]`;
+    object(stressor, path, errors);
+    exactKeys(stressor, ["id", "title", "description", "source", "activation_check_refs"], path, errors);
+    assuranceId(stressor?.id, `${path}.id`, stressorIds, errors);
+    boundedString(stressor?.title, 1, 200, `${path}.title`, errors);
+    boundedString(stressor?.description, 1, 1000, `${path}.description`, errors);
+    oneOf(stressor?.source, new Set(["historical_incident", "derived", "human"]), `${path}.source`, errors);
+    checkReferenceArray(stressor?.activation_check_refs, `${path}.activation_check_refs`, checkIds, errors, true);
+  }
+  for (const [index, strength] of (value?.strengths || []).entries()) {
+    const path = `${at}.strengths[${index}]`;
+    object(strength, path, errors);
+    exactKeys(strength, ["id", "title", "description", "kind", "status", "check_refs"], path, errors);
+    assuranceId(strength?.id, `${path}.id`, strengthIds, errors);
+    boundedString(strength?.title, 1, 200, `${path}.title`, errors);
+    boundedString(strength?.description, 1, 1000, `${path}.description`, errors);
+    oneOf(strength?.kind, STRENGTH_KINDS, `${path}.kind`, errors);
+    oneOf(strength?.status, STRENGTH_STATUSES, `${path}.status`, errors);
+    checkReferenceArray(strength?.check_refs, `${path}.check_refs`, checkIds, errors, true);
+  }
+  for (const [index, scenario] of (value?.scenarios || []).entries()) {
+    const path = `${at}.scenarios[${index}]`;
+    object(scenario, path, errors);
+    exactKeys(scenario, ["id", "title", "state_model_id", "transition_id", "stressor_refs", "expected_strength_refs", "check_refs", "expected_outcome", "execution_requirement"], path, errors);
+    assuranceId(scenario?.id, `${path}.id`, scenarioIds, errors);
+    boundedString(scenario?.title, 1, 200, `${path}.title`, errors);
+    stringPattern(scenario?.state_model_id, ASSURANCE_ID, `${path}.state_model_id`, errors);
+    stringPattern(scenario?.transition_id, ASSURANCE_ID, `${path}.transition_id`, errors);
+    referenceArray(scenario?.stressor_refs, `${path}.stressor_refs`, stressorIds, errors, true);
+    referenceArray(scenario?.expected_strength_refs, `${path}.expected_strength_refs`, strengthIds, errors, true);
+    checkReferenceArray(scenario?.check_refs, `${path}.check_refs`, checkIds, errors, true);
+    boundedString(scenario?.expected_outcome, 1, 1000, `${path}.expected_outcome`, errors);
+    oneOf(scenario?.execution_requirement, SCENARIO_REQUIREMENTS, `${path}.execution_requirement`, errors);
+  }
+  for (const [index, model] of (value?.state_models || []).entries()) {
+    const path = `${at}.state_models[${index}]`;
+    object(model, path, errors);
+    exactKeys(model, ["id", "version", "subject", "initial_state", "states", "transitions", "forbidden_states", "forbidden_transitions"], path, errors);
+    assuranceId(model?.id, `${path}.id`, modelIds, errors);
+    stringPattern(model?.version, SEMVER, `${path}.version`, errors);
+    boundedString(model?.subject, 1, 500, `${path}.subject`, errors);
+    stringPattern(model?.initial_state, ASSURANCE_ID, `${path}.initial_state`, errors);
+    nonEmptyArray(model?.states, `${path}.states`, errors);
+    nonEmptyArray(model?.transitions, `${path}.transitions`, errors);
+    array(model?.forbidden_states, `${path}.forbidden_states`, errors);
+    array(model?.forbidden_transitions, `${path}.forbidden_transitions`, errors);
+    const stateIds = new Set();
+    const invariantIds = new Set();
+    const transitionIds = new Set();
+    for (const [stateIndex, state] of (model?.states || []).entries()) {
+      const statePath = `${path}.states[${stateIndex}]`;
+      object(state, statePath, errors);
+      exactKeys(state, ["id", "label", "terminal", "invariants"], statePath, errors);
+      assuranceId(state?.id, `${statePath}.id`, stateIds, errors);
+      boundedString(state?.label, 1, 200, `${statePath}.label`, errors);
+      if (typeof state?.terminal !== "boolean") errors.push(`${statePath}.terminal must be a boolean`);
+      array(state?.invariants, `${statePath}.invariants`, errors);
+      for (const [invIndex, invariant] of (state?.invariants || []).entries()) {
+        const invPath = `${statePath}.invariants[${invIndex}]`;
+        object(invariant, invPath, errors);
+        exactKeys(invariant, ["id", "statement", "check_refs"], invPath, errors);
+        assuranceId(invariant?.id, `${invPath}.id`, invariantIds, errors);
+        boundedString(invariant?.statement, 1, 1000, `${invPath}.statement`, errors);
+        checkReferenceArray(invariant?.check_refs, `${invPath}.check_refs`, checkIds, errors, true);
+      }
+    }
+    if (!stateIds.has(model?.initial_state)) errors.push(`${path}.initial_state must reference a declared state`);
+    for (const [transitionIndex, transition] of (model?.transitions || []).entries()) {
+      const transitionPath = `${path}.transitions[${transitionIndex}]`;
+      object(transition, transitionPath, errors);
+      exactKeys(transition, ["id", "from", "event", "to", "preconditions", "invariant_refs", "stressor_refs", "strength_refs", "scenario_refs"], transitionPath, errors);
+      assuranceId(transition?.id, `${transitionPath}.id`, transitionIds, errors);
+      if (!stateIds.has(transition?.from)) errors.push(`${transitionPath}.from must reference a declared state`);
+      if (!stateIds.has(transition?.to)) errors.push(`${transitionPath}.to must reference a declared state`);
+      boundedString(transition?.event, 1, 200, `${transitionPath}.event`, errors);
+      array(transition?.preconditions, `${transitionPath}.preconditions`, errors);
+      for (const [preIndex, precondition] of (transition?.preconditions || []).entries()) {
+        const prePath = `${transitionPath}.preconditions[${preIndex}]`;
+        object(precondition, prePath, errors);
+        exactKeys(precondition, ["id", "statement", "check_refs"], prePath, errors);
+        stringPattern(precondition?.id, ASSURANCE_ID, `${prePath}.id`, errors);
+        boundedString(precondition?.statement, 1, 1000, `${prePath}.statement`, errors);
+        checkReferenceArray(precondition?.check_refs, `${prePath}.check_refs`, checkIds, errors, true);
+      }
+      referenceArray(transition?.invariant_refs, `${transitionPath}.invariant_refs`, invariantIds, errors, false);
+      referenceArray(transition?.stressor_refs, `${transitionPath}.stressor_refs`, stressorIds, errors, true);
+      referenceArray(transition?.strength_refs, `${transitionPath}.strength_refs`, strengthIds, errors, true);
+      referenceArray(transition?.scenario_refs, `${transitionPath}.scenario_refs`, scenarioIds, errors, true);
+    }
+    for (const [forbiddenIndex, forbidden] of (model?.forbidden_states || []).entries()) {
+      const forbiddenPath = `${path}.forbidden_states[${forbiddenIndex}]`;
+      object(forbidden, forbiddenPath, errors);
+      exactKeys(forbidden, ["id", "statement", "check_refs"], forbiddenPath, errors);
+      stringPattern(forbidden?.id, ASSURANCE_ID, `${forbiddenPath}.id`, errors);
+      boundedString(forbidden?.statement, 1, 1000, `${forbiddenPath}.statement`, errors);
+      checkReferenceArray(forbidden?.check_refs, `${forbiddenPath}.check_refs`, checkIds, errors, true);
+    }
+    for (const [forbiddenIndex, forbidden] of (model?.forbidden_transitions || []).entries()) {
+      const forbiddenPath = `${path}.forbidden_transitions[${forbiddenIndex}]`;
+      object(forbidden, forbiddenPath, errors);
+      exactKeys(forbidden, ["from", "to", "reason"], forbiddenPath, errors);
+      if (!stateIds.has(forbidden?.from)) errors.push(`${forbiddenPath}.from must reference a declared state`);
+      if (!stateIds.has(forbidden?.to)) errors.push(`${forbiddenPath}.to must reference a declared state`);
+      boundedString(forbidden?.reason, 1, 1000, `${forbiddenPath}.reason`, errors);
+    }
+    for (const scenario of value?.scenarios || []) {
+      if (scenario?.state_model_id === model?.id && !transitionIds.has(scenario?.transition_id)) errors.push(`${at}.scenarios transition must exist in ${model.id}`);
+    }
+  }
+  for (const scenario of value?.scenarios || []) if (!modelIds.has(scenario?.state_model_id)) errors.push(`${at}.scenarios state_model_id must reference a declared model`);
+}
+
+function assuranceId(value, at, seen, errors) {
+  stringPattern(value, ASSURANCE_ID, at, errors);
+  if (seen.has(value)) errors.push(`${at} must be unique`);
+  seen.add(value);
+}
+
+function referenceArray(value, at, declared, errors, required) {
+  stringArray(value, at, errors, ASSURANCE_ID, 128, required);
+  for (const item of value || []) if (!declared.has(item)) errors.push(`${at} references unknown ${item}`);
+}
+
+function checkReferenceArray(value, at, declared, errors, required) {
+  stringArray(value, at, errors, RULE_ID, 128, required);
+  for (const item of value || []) if (!declared.has(item)) errors.push(`${at} references unknown ${item}`);
+}
+
+function validateMatcher(value, at, errors) {
+  object(value, at, errors);
+  exactKeys(value, ["type", "paths", "pattern", "side"], at, errors);
+  oneOf(value?.type, MATCHERS, `${at}.type`, errors);
+  stringArray(value?.paths, `${at}.paths`, errors, null, 500, true);
+  nullableString(value?.pattern, 2000, `${at}.pattern`, errors);
+  if (["diff_regex", "content_regex", "reference"].includes(value?.type) && !value?.pattern) errors.push(`${at}.pattern is required for ${value.type}`);
+  if (value?.side !== undefined) oneOf(value.side, new Set(["added", "removed", "either"]), `${at}.side`, errors);
+}
+
+function validateCheck(value, at, errors) {
+  object(value, at, errors);
+  exactKeys(value, ["id", "type", "message", "paths", "pattern", "expect", "definition_paths"], at, errors);
+  stringPattern(value?.id, RULE_ID, `${at}.id`, errors);
+  oneOf(value?.type, CHECKERS, `${at}.type`, errors);
+  boundedString(value?.message, 1, 1000, `${at}.message`, errors);
+  stringArray(value?.paths, `${at}.paths`, errors, null, 500, false);
+  nullableString(value?.pattern, 2000, `${at}.pattern`, errors);
+  if (["diff_regex", "content_regex", "reference_definition"].includes(value?.type) && !value?.pattern) errors.push(`${at}.pattern is required for ${value.type}`);
+  if (value?.expect !== undefined) oneOf(value.expect, new Set(["present", "absent", "defined"]), `${at}.expect`, errors);
+  stringArray(value?.definition_paths, `${at}.definition_paths`, errors, null, 500, false);
+  if (value?.type === "reference_definition" && (!value?.definition_paths?.length || value?.expect !== "defined")) errors.push(`${at} reference_definition requires definition_paths and expect=defined`);
+  if (value?.type === "path_presence" && !["present", "absent"].includes(value?.expect)) errors.push(`${at} path_presence requires expect=present|absent`);
+}
+
+function validateException(value, at, errors) {
+  object(value, at, errors);
+  exactKeys(value, ["id", "reason", "paths", "expires_at"], at, errors);
+  stringPattern(value?.id, RULE_ID, `${at}.id`, errors);
+  boundedString(value?.reason, 1, 1000, `${at}.reason`, errors);
+  stringArray(value?.paths, `${at}.paths`, errors, null, 500, true);
+  nullableDateTime(value?.expires_at, `${at}.expires_at`, errors);
+}
+
+export function compareSemver(left, right) {
+  const a = left.split(".").map(Number);
+  const b = right.split(".").map(Number);
+  for (let index = 0; index < 3; index += 1) if (a[index] !== b[index]) return a[index] - b[index];
+  return 0;
+}
+
+function exactKeys(value, allowed, at, errors) { if (!value || typeof value !== "object" || Array.isArray(value)) return; const set = new Set(allowed); for (const key of Object.keys(value)) if (!set.has(key)) errors.push(`${at}.${key} is not allowed`); }
+function object(value, at, errors) { if (!value || typeof value !== "object" || Array.isArray(value)) errors.push(`${at} must be an object`); }
+function array(value, at, errors) { if (value !== undefined && !Array.isArray(value)) errors.push(`${at} must be an array`); }
+function nonEmptyArray(value, at, errors) { if (!Array.isArray(value) || value.length === 0) errors.push(`${at} must be a non-empty array`); }
+function equal(value, expected, at, errors) { if (value !== expected) errors.push(`${at} must equal ${expected}`); }
+function oneOf(value, allowed, at, errors) { if (!allowed.has(value)) errors.push(`${at} has an unsupported value`); }
+function boundedString(value, min, max, at, errors) { if (typeof value !== "string" || value.length < min || value.length > max) errors.push(`${at} must be a string of length ${min}-${max}`); }
+function nullableString(value, max, at, errors) { if (value !== undefined && value !== null && (typeof value !== "string" || value.length > max)) errors.push(`${at} must be null or a string up to ${max} characters`); }
+function stringPattern(value, pattern, at, errors) { if (typeof value !== "string" || !pattern.test(value)) errors.push(`${at} has an invalid format`); }
+function nullablePattern(value, pattern, at, errors) { if (value !== undefined && value !== null && (typeof value !== "string" || !pattern.test(value))) errors.push(`${at} has an invalid format`); }
+function dateTime(value, at, errors) { if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) errors.push(`${at} must be a date-time`); }
+function nullableDateTime(value, at, errors) { if (value !== undefined && value !== null) dateTime(value, at, errors); }
+function nonNegativeInteger(value, at, errors) { if (!Number.isInteger(value) || value < 0) errors.push(`${at} must be a non-negative integer`); }
+function stringArray(value, at, errors, pattern, max, required) { if (value === undefined && !required) return; if (!Array.isArray(value) || (required && value.length === 0)) { errors.push(`${at} must be ${required ? "a non-empty" : "an"} array`); return; } const seen = new Set(); for (const item of value) { if (typeof item !== "string" || item.length === 0 || item.length > max || (pattern && !pattern.test(item))) errors.push(`${at} contains an invalid string`); if (seen.has(item)) errors.push(`${at} must contain unique values`); seen.add(item); } }
+function enumArray(value, at, errors, allowed, required) { if (!Array.isArray(value) || (required && value.length === 0)) { errors.push(`${at} must be a non-empty array`); return; } const seen = new Set(); for (const item of value) { if (!allowed.has(item)) errors.push(`${at} contains an unsupported value`); if (seen.has(item)) errors.push(`${at} must contain unique values`); seen.add(item); } }