@behavproof/cli 0.0.0-stage → 0.1.0

package/dist/trust.d.ts

@@ -0,0 +1,533 @@
+import { z } from 'zod';
+import { type EvidenceSubject, type ManifestValidation, type Evidence, type Contract } from '@behavproof/core';
+export declare const ClaimScopesSchema: z.ZodArray<z.ZodObject<{
+    contractId: z.ZodString;
+    caseIds: z.ZodArray<z.ZodString>;
+    targetRef: z.ZodString;
+    method: z.ZodString;
+}, z.core.$strict>>;
+export declare const TrustRootSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    policy: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        profileVersion: z.ZodLiteral<"1">;
+        rules: z.ZodPipe<z.ZodUnknown, z.ZodRecord<z.ZodString, z.ZodObject<{
+            severity: z.ZodEnum<{
+                error: "error";
+                off: "off";
+                warn: "warn";
+            }>;
+            min: z.ZodOptional<z.ZodNumber>;
+            minMutants: z.ZodOptional<z.ZodNumber>;
+            allowNotApplicable: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+    config: z.ZodPipe<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        formal: z.ZodOptional<z.ZodObject<{
+            models: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                contractId: z.ZodString;
+                model: z.ZodString;
+                modelSources: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                quint: z.ZodObject<{
+                    entry: z.ZodString;
+                    version: z.ZodString;
+                    apalacheVersion: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+                properties: z.ZodArray<z.ZodString>;
+                checks: z.ZodArray<z.ZodEnum<{
+                    parse: "parse";
+                    typecheck: "typecheck";
+                    test: "test";
+                    run: "run";
+                    verify: "verify";
+                }>>;
+                maxSteps: z.ZodNumber;
+                maxSamples: z.ZodDefault<z.ZodNumber>;
+                seed: z.ZodString;
+                timeoutMs: z.ZodDefault<z.ZodNumber>;
+                report: z.ZodString;
+                driver: z.ZodOptional<z.ZodString>;
+                driverSources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                implementation: z.ZodOptional<z.ZodString>;
+                implementationSources: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                conformanceReport: z.ZodOptional<z.ZodString>;
+                traceReceipt: z.ZodOptional<z.ZodString>;
+                traceDirectory: z.ZodOptional<z.ZodString>;
+                requiredActions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                minTraces: z.ZodDefault<z.ZodNumber>;
+                minComparisons: z.ZodDefault<z.ZodNumber>;
+                requireCanary: z.ZodDefault<z.ZodBoolean>;
+                canary: z.ZodOptional<z.ZodObject<{
+                    faultId: z.ZodString;
+                    implementation: z.ZodString;
+                    targetRef: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        mode: z.ZodDefault<z.ZodEnum<{
+            audit: "audit";
+            gate: "gate";
+        }>>;
+        profile: z.ZodDefault<z.ZodEnum<{
+            basic: "basic";
+            standard: "standard";
+            critical: "critical";
+        }>>;
+        profileVersion: z.ZodDefault<z.ZodLiteral<"1">>;
+        riskOverrides: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            selector: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"path">;
+                value: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"module">;
+                value: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"contract-kind">;
+                value: z.ZodEnum<{
+                    external: "external";
+                    examples: "examples";
+                    invariant: "invariant";
+                    state_machine: "state_machine";
+                    api_contract: "api_contract";
+                }>;
+            }, z.core.$strict>], "kind">;
+            profile: z.ZodEnum<{
+                basic: "basic";
+                standard: "standard";
+                critical: "critical";
+            }>;
+        }, z.core.$strict>>>;
+        git: z.ZodDefault<z.ZodObject<{
+            base: z.ZodDefault<z.ZodString>;
+        }, z.core.$strict>>;
+        reports: z.ZodDefault<z.ZodObject<{
+            vitest: z.ZodOptional<z.ZodString>;
+            coverage: z.ZodOptional<z.ZodString>;
+            mutation: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        executionManifests: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        rules: z.ZodDefault<z.ZodPipe<z.ZodUnknown, z.ZodRecord<z.ZodString, z.ZodObject<{
+            severity: z.ZodEnum<{
+                error: "error";
+                off: "off";
+                warn: "warn";
+            }>;
+            min: z.ZodOptional<z.ZodNumber>;
+            minMutants: z.ZodOptional<z.ZodNumber>;
+            allowNotApplicable: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>>;
+        contracts: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            sources: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    external: "external";
+                    "vitest-inline": "vitest-inline";
+                    manifest: "manifest";
+                    gherkin: "gherkin";
+                    openapi: "openapi";
+                }>;
+                include: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>>>;
+            requireExecutionEvidence: z.ZodDefault<z.ZodBoolean>;
+            approval: z.ZodDefault<z.ZodObject<{
+                provider: z.ZodLiteral<"github-protected-review">;
+                requiredForRisk: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                    basic: "basic";
+                    standard: "standard";
+                    critical: "critical";
+                }>>>;
+                onUnverifiable: z.ZodDefault<z.ZodLiteral<"unknown">>;
+            }, z.core.$strict>>;
+            documents: z.ZodDefault<z.ZodObject<{
+                output: z.ZodDefault<z.ZodString>;
+                commit: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodTransform<{
+        rules: Record<string, {
+            severity: "error" | "off" | "warn";
+            min?: number | undefined;
+            minMutants?: number | undefined;
+            allowNotApplicable?: string[] | undefined;
+        }>;
+        schemaVersion: 1;
+        mode: "audit" | "gate";
+        profile: "basic" | "standard" | "critical";
+        profileVersion: "1";
+        riskOverrides: {
+            selector: {
+                kind: "path";
+                value: string;
+            } | {
+                kind: "module";
+                value: string;
+            } | {
+                kind: "contract-kind";
+                value: "external" | "examples" | "invariant" | "state_machine" | "api_contract";
+            };
+            profile: "basic" | "standard" | "critical";
+        }[];
+        git: {
+            base: string;
+        };
+        reports: {
+            vitest?: string | undefined;
+            coverage?: string | undefined;
+            mutation?: string | undefined;
+        };
+        executionManifests: string[];
+        contracts: {
+            enabled: boolean;
+            sources: {
+                type: "external" | "vitest-inline" | "manifest" | "gherkin" | "openapi";
+                include: string[];
+            }[];
+            requireExecutionEvidence: boolean;
+            approval: {
+                provider: "github-protected-review";
+                requiredForRisk: ("basic" | "standard" | "critical")[];
+                onUnverifiable: "unknown";
+            };
+            documents: {
+                output: string;
+                commit: boolean;
+            };
+        };
+        formal?: {
+            models: {
+                id: string;
+                contractId: string;
+                model: string;
+                modelSources: string[];
+                quint: {
+                    entry: string;
+                    version: string;
+                    apalacheVersion?: string | undefined;
+                };
+                properties: string[];
+                checks: ("parse" | "typecheck" | "test" | "run" | "verify")[];
+                maxSteps: number;
+                maxSamples: number;
+                seed: string;
+                timeoutMs: number;
+                report: string;
+                implementationSources: string[];
+                requiredActions: string[];
+                minTraces: number;
+                minComparisons: number;
+                requireCanary: boolean;
+                driver?: string | undefined;
+                driverSources?: string[] | undefined;
+                implementation?: string | undefined;
+                conformanceReport?: string | undefined;
+                traceReceipt?: string | undefined;
+                traceDirectory?: string | undefined;
+                canary?: {
+                    faultId: string;
+                    implementation: string;
+                    targetRef: string;
+                } | undefined;
+            }[];
+        } | undefined;
+    }, {
+        schemaVersion: 1;
+        mode: "audit" | "gate";
+        profile: "basic" | "standard" | "critical";
+        profileVersion: "1";
+        riskOverrides: {
+            selector: {
+                kind: "path";
+                value: string;
+            } | {
+                kind: "module";
+                value: string;
+            } | {
+                kind: "contract-kind";
+                value: "external" | "examples" | "invariant" | "state_machine" | "api_contract";
+            };
+            profile: "basic" | "standard" | "critical";
+        }[];
+        git: {
+            base: string;
+        };
+        reports: {
+            vitest?: string | undefined;
+            coverage?: string | undefined;
+            mutation?: string | undefined;
+        };
+        executionManifests: string[];
+        rules: Record<string, {
+            severity: "error" | "off" | "warn";
+            min?: number | undefined;
+            minMutants?: number | undefined;
+            allowNotApplicable?: string[] | undefined;
+        }>;
+        contracts: {
+            enabled: boolean;
+            sources: {
+                type: "external" | "vitest-inline" | "manifest" | "gherkin" | "openapi";
+                include: string[];
+            }[];
+            requireExecutionEvidence: boolean;
+            approval: {
+                provider: "github-protected-review";
+                requiredForRisk: ("basic" | "standard" | "critical")[];
+                onUnverifiable: "unknown";
+            };
+            documents: {
+                output: string;
+                commit: boolean;
+            };
+        };
+        formal?: {
+            models: {
+                id: string;
+                contractId: string;
+                model: string;
+                modelSources: string[];
+                quint: {
+                    entry: string;
+                    version: string;
+                    apalacheVersion?: string | undefined;
+                };
+                properties: string[];
+                checks: ("parse" | "typecheck" | "test" | "run" | "verify")[];
+                maxSteps: number;
+                maxSamples: number;
+                seed: string;
+                timeoutMs: number;
+                report: string;
+                implementationSources: string[];
+                requiredActions: string[];
+                minTraces: number;
+                minComparisons: number;
+                requireCanary: boolean;
+                driver?: string | undefined;
+                driverSources?: string[] | undefined;
+                implementation?: string | undefined;
+                conformanceReport?: string | undefined;
+                traceReceipt?: string | undefined;
+                traceDirectory?: string | undefined;
+                canary?: {
+                    faultId: string;
+                    implementation: string;
+                    targetRef: string;
+                } | undefined;
+            }[];
+        } | undefined;
+    }>>;
+    baseline: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        repositoryId: z.ZodOptional<z.ZodString>;
+        commitSha: z.ZodString;
+        contracts: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            formal: z.ZodOptional<z.ZodObject<{
+                modelId: z.ZodString;
+                modelHash: z.ZodString;
+                driverHash: z.ZodOptional<z.ZodString>;
+                propertyIds: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>>;
+            kind: z.ZodEnum<{
+                external: "external";
+                examples: "examples";
+                invariant: "invariant";
+                state_machine: "state_machine";
+                api_contract: "api_contract";
+            }>;
+            intentIds: z.ZodArray<z.ZodString>;
+            revisionHash: z.ZodString;
+            sourceRef: z.ZodString;
+            caseIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            risk: z.ZodOptional<z.ZodEnum<{
+                basic: "basic";
+                standard: "standard";
+                critical: "critical";
+            }>>;
+            cases: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                input: z.ZodJSONSchema;
+                expected: z.ZodJSONSchema;
+                negative: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+        intents: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            statement: z.ZodString;
+            risk: z.ZodEnum<{
+                basic: "basic";
+                standard: "standard";
+                critical: "critical";
+            }>;
+            contentHash: z.ZodString;
+            origin: z.ZodObject<{
+                kind: z.ZodEnum<{
+                    external: "external";
+                    manifest: "manifest";
+                    inline: "inline";
+                }>;
+                ref: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+        policyHash: z.ZodOptional<z.ZodString>;
+        extractorVersion: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        discoveryDiagnostics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            code: z.ZodString;
+            sourceRef: z.ZodString;
+            message: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+    policySource: z.ZodOptional<z.ZodObject<{
+        repository: z.ZodString;
+        commitSha: z.ZodString;
+        ref: z.ZodString;
+        fileHash: z.ZodString;
+        policyHash: z.ZodString;
+    }, z.core.$strict>>;
+    runner: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodLiteral<"vitest">;
+        version: z.ZodString;
+        manifestRef: z.ZodString;
+    }, z.core.$strict>>;
+    inputs: z.ZodArray<z.ZodString>;
+    qualitySources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    configPaths: z.ZodArray<z.ZodString>;
+    dependencyLockPath: z.ZodOptional<z.ZodString>;
+    manifests: z.ZodArray<z.ZodObject<{
+        ref: z.ZodString;
+        manifestHash: z.ZodOptional<z.ZodString>;
+        expected: z.ZodObject<{
+            executionId: z.ZodString;
+            subject: z.ZodObject<{
+                repositoryId: z.ZodOptional<z.ZodString>;
+                prHeadSha: z.ZodOptional<z.ZodString>;
+                testedCommitSha: z.ZodString;
+                testedCommitParents: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                sourceTreeHash: z.ZodString;
+                dirty: z.ZodBoolean;
+                baseSha: z.ZodOptional<z.ZodString>;
+                diffBaseSha: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            commandHash: z.ZodString;
+            configHashes: z.ZodRecord<z.ZodString, z.ZodString>;
+            dependencyLockHash: z.ZodOptional<z.ZodString>;
+            artifacts: z.ZodArray<z.ZodObject<{
+                ref: z.ZodString;
+                kind: z.ZodString;
+                scope: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        authority: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"ci">;
+            producer: z.ZodObject<{
+                tool: z.ZodString;
+                version: z.ZodString;
+                collectorVersion: z.ZodString;
+            }, z.core.$strict>;
+            ci: z.ZodObject<{
+                repositoryId: z.ZodString;
+                workflowRef: z.ZodString;
+                runId: z.ZodString;
+                runAttempt: z.ZodNumber;
+                jobId: z.ZodString;
+                eventName: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"local">;
+            producer: z.ZodObject<{
+                tool: z.ZodString;
+                version: z.ZodString;
+                collectorVersion: z.ZodString;
+            }, z.core.$strict>;
+            executionId: z.ZodString;
+            commandHash: z.ZodString;
+        }, z.core.$strict>], "kind">;
+        github: z.ZodOptional<z.ZodObject<{
+            repository: z.ZodString;
+            workflowPath: z.ZodString;
+            workflowSha: z.ZodString;
+            jobName: z.ZodString;
+            artifactName: z.ZodString;
+            archivePath: z.ZodString;
+            archiveEntries: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    github: z.ZodOptional<z.ZodObject<{
+        repository: z.ZodString;
+        pr: z.ZodNumber;
+        reviewers: z.ZodArray<z.ZodString>;
+        requiredChecks: z.ZodArray<z.ZodObject<{
+            context: z.ZodString;
+            appId: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    notApplicable: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        ruleId: z.ZodString;
+        reason: z.ZodString;
+        evidenceRef: z.ZodString;
+    }, z.core.$strict>>>;
+    claimScopes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        contractId: z.ZodString;
+        caseIds: z.ZodArray<z.ZodString>;
+        targetRef: z.ZodString;
+        method: z.ZodString;
+    }, z.core.$strict>>>;
+    pipeline: z.ZodOptional<z.ZodObject<{
+        workflow: z.ZodString;
+        gateJob: z.ZodString;
+        requiredJobs: z.ZodArray<z.ZodString>;
+        artifacts: z.ZodArray<z.ZodString>;
+        protectedBranch: z.ZodString;
+        currentRun: z.ZodOptional<z.ZodObject<{
+            ci: z.ZodObject<{
+                repositoryId: z.ZodString;
+                workflowRef: z.ZodString;
+                runId: z.ZodString;
+                runAttempt: z.ZodNumber;
+                jobId: z.ZodString;
+                eventName: z.ZodString;
+            }, z.core.$strict>;
+            workflowPath: z.ZodString;
+            workflowSha: z.ZodString;
+            workflowHash: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type TrustRoot = z.infer<typeof TrustRootSchema>;
+export declare function loadTrust(root: string, path: string): Promise<TrustRoot>;
+export declare function authenticate(root: string, trust: TrustRoot | undefined, subject: EvidenceSubject): Promise<{
+    verified: Set<string>;
+    failures: string[];
+    unknowns: string[];
+    manifests: {
+        ref: string;
+        validation: ManifestValidation;
+    }[];
+    trustedCi: boolean;
+    artifactBytes: Map<string, Uint8Array<ArrayBufferLike>>;
+    configHashes: Record<string, string>;
+    dependencyLockHash: string | undefined;
+    observations: {
+        manifestRef: string;
+        observation: import("@behavproof/adapter-github").Observation;
+    }[];
+}>;
+export declare const approvalKey: (v: unknown) => string;
+export declare function isCurrentClaim(evidence: Evidence, artifactRef: string, subject: EvidenceSubject, policyHash: string, contracts: readonly Pick<Contract, 'id' | 'revisionHash'>[]): boolean;
+/** Runner selection belongs to the protected invocation and one authenticated
+ * test artifact. It never grants artifact/producer authority by itself. */
+export declare function selectedRunner(trust: TrustRoot | undefined, auth: {
+    failures: readonly string[];
+    verified: ReadonlySet<string>;
+    manifests: readonly {
+        ref: string;
+        validation: ManifestValidation;
+    }[];
+}, testRef: string | undefined, inputs: readonly string[]): {
+    runner: "vitest";
+    version: string;
+} | undefined;
+//# sourceMappingURL=trust.d.ts.map

package/dist/trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../src/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAA6O,KAAK,eAAe,EAAE,KAAK,kBAAkB,EAAE,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG1V,eAAO,MAAM,iBAAiB;;;;;mBAA2e,CAAC;AAC1gB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6CqG,CAAC;sBAAwC,CAAC;8BAChI,CAAC;;;;;;;;;;;;;;;;;;;;;;;kBAO2G,CAAC;oBAAsC,CAAC;oBAAsC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCAMS,CAAC;;;;;;;;;;;;;;sBAAkf,CAAC;6BAA+C,CAAC;8BAAkD,CAAC;iCAAmD,CAAC;4BAA8C,CAAC;8BAAgD,CAAC;sBAAwC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAyuB,CAAC;oBAAsC,CAAC;oBAAsC,CAAC;;;;;eAAkJ,CAAC;sBAAwC,CAAC;8BAAgD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCAAizB,CAAC;;;;;;;;;;;;;;sBAAkf,CAAC;6BAA+C,CAAC;8BAAkD,CAAC;iCAAmD,CAAC;4BAA8C,CAAC;8BAAgD,CAAC;sBAAwC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAjD99G,CAAC;AAChJ,MAAM,MAAM,SAAS,GAAC,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACtD,wBAAsB,SAAS,CAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,MAAM,GAAE,OAAO,CAAC,SAAS,CAAC,CAI1E;AACD,wBAAsB,YAAY,CAAC,IAAI,EAAC,MAAM,EAAC,KAAK,EAAC,SAAS,GAAC,SAAS,EAAC,OAAO,EAAC,eAAe;;;;;aAE4C,MAAM;oBAAY,kBAAkB;;;;;;;qBAD/I,MAAM;qBAAa,OAAO,4BAA4B,EAAE,WAAW;;GAwBnG;AACD,eAAO,MAAM,WAAW,GAAE,GAAE,OAAO,WAAU,CAAC;AAE9C,wBAAgB,cAAc,CAAC,QAAQ,EAAC,QAAQ,EAAC,WAAW,EAAC,MAAM,EAAC,OAAO,EAAC,eAAe,EAAC,UAAU,EAAC,MAAM,EAAC,SAAS,EAAC,SAAS,IAAI,CAAC,QAAQ,EAAC,IAAI,GAAC,cAAc,CAAC,EAAE,GAAE,OAAO,CAI7K;AAED;2EAC2E;AAC3E,wBAAgB,cAAc,CAAC,KAAK,EAAC,SAAS,GAAC,SAAS,EAAC,IAAI,EAAC;IAAC,QAAQ,EAAC,SAAS,MAAM,EAAE,CAAC;IAAA,QAAQ,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAAA,SAAS,EAAC,SAAS;QAAC,GAAG,EAAC,MAAM,CAAC;QAAA,UAAU,EAAC,kBAAkB,CAAA;KAAC,EAAE,CAAA;CAAC,EAAC,OAAO,EAAC,MAAM,GAAC,SAAS,EAAC,MAAM,EAAC,SAAS,MAAM,EAAE;;;cAKxO"}

package/dist/trust.js

@@ -0,0 +1,130 @@
+import { z } from 'zod';
+import { resolve, dirname, basename, relative, sep, isAbsolute } from 'node:path';
+import { realpath } from 'node:fs/promises';
+import { ConfigSchema, PolicySchema, RegistrySnapshotSchema, RelativePathSchema, HashSchema, CiIdentitySchema, ManifestExpectedSchema, ProducerAuthoritySchema, safeReadJson, safeRead, hashBytes, validateManifest, ExecutionManifestSchema, hash } from '@behavproof/core';
+import { GitHubAuthority, verifyArtifactArchive } from '@behavproof/adapter-github';
+import { git } from './project.js';
+export const ClaimScopesSchema = z.array(z.strictObject({ contractId: z.string().min(1), caseIds: z.array(z.string().min(1)).min(1), targetRef: z.string().min(1), method: z.string().min(1) })).superRefine((scopes, ctx) => { if (new Set(scopes.map(scope => scope.contractId)).size !== scopes.length)
+    ctx.addIssue({ code: 'custom', message: 'Only one claim scope per contract is supported' }); for (const scope of scopes)
+    if (new Set(scope.caseIds).size !== scope.caseIds.length)
+        ctx.addIssue({ code: 'custom', message: 'Duplicate case IDs in claim scope' }); });
+export const TrustRootSchema = z.strictObject({
+    schemaVersion: z.literal(1), policy: PolicySchema, config: ConfigSchema, baseline: RegistrySnapshotSchema,
+    policySource: z.strictObject({ repository: z.string().regex(/^[\w-]+\/[\w.-]+$/), commitSha: z.string().regex(/^[a-f0-9]{40}$/), ref: RelativePathSchema, fileHash: HashSchema, policyHash: HashSchema }).optional(),
+    runner: z.strictObject({ kind: z.literal('vitest'), version: z.string().regex(/^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/), manifestRef: RelativePathSchema }).optional(),
+    inputs: z.array(RelativePathSchema).min(1), qualitySources: z.array(RelativePathSchema).min(1).optional(), configPaths: z.array(RelativePathSchema), dependencyLockPath: RelativePathSchema.optional(),
+    manifests: z.array(z.strictObject({ ref: RelativePathSchema, manifestHash: HashSchema.optional(), expected: ManifestExpectedSchema, authority: ProducerAuthoritySchema, github: z.strictObject({ repository: z.string().min(1), workflowPath: z.string(), workflowSha: z.string(), jobName: z.string(), artifactName: z.string(), archivePath: RelativePathSchema, archiveEntries: z.record(RelativePathSchema, RelativePathSchema) }).optional() }).refine(row => row.authority.kind !== 'local' || row.manifestHash !== undefined, 'Local authority requires host-pinned manifestHash')),
+    github: z.strictObject({ repository: z.string().regex(/^[\w-]+\/[\w.-]+$/), pr: z.number().int().positive(), reviewers: z.array(z.string().min(1)).min(1), requiredChecks: z.array(z.strictObject({ context: z.string().min(1), appId: z.number().int().positive() })).min(1) }).optional(),
+    notApplicable: z.array(z.strictObject({ ruleId: z.string().min(1), reason: z.string().min(1), evidenceRef: RelativePathSchema })).default([]),
+    claimScopes: ClaimScopesSchema.default([]),
+    pipeline: z.strictObject({ workflow: RelativePathSchema, gateJob: z.string().min(1), requiredJobs: z.array(z.string().min(1)).min(1), artifacts: z.array(RelativePathSchema).min(1), protectedBranch: z.string().min(1), currentRun: z.strictObject({ ci: CiIdentitySchema, workflowPath: RelativePathSchema, workflowSha: z.string().regex(/^[a-f0-9]{40}$/), workflowHash: HashSchema }).optional() }).optional(),
+}).refine(trust => !trust.policySource || trust.policySource.policyHash === hash(trust.policy), 'Registered policy source hash does not match policy');
+export async function loadTrust(root, path) {
+    const actual = await realpath(resolve(root, path)), base = await realpath((await git(root, ['rev-parse', '--show-toplevel'])).trim()), rel = relative(base, actual);
+    if (rel === '' || (!isAbsolute(rel) && rel !== '..' && !rel.startsWith(`..${sep}`)))
+        throw Error('--trust-root must be outside the project');
+    return TrustRootSchema.parse(await safeReadJson(dirname(actual), basename(actual)));
+}
+export async function authenticate(root, trust, subject) {
+    const observations = [];
+    const artifactBytes = new Map();
+    const verified = new Set(), failures = [], unknowns = [], manifests = [];
+    const configHashes = {};
+    let dependencyLockHash;
+    let trustedCi = false;
+    if (!trust)
+        return { verified, failures, unknowns: ['External producer authority unavailable'], manifests, trustedCi, artifactBytes, configHashes, dependencyLockHash, observations };
+    for (const path of trust.configPaths)
+        configHashes[path] = hashBytes(await safeRead(root, path));
+    dependencyLockHash = trust.dependencyLockPath ? hashBytes(await safeRead(root, trust.dependencyLockPath)) : undefined;
+    for (const spec of trust.manifests) {
+        let manifestBytes;
+        try {
+            manifestBytes = await safeRead(root, spec.ref);
+        }
+        catch (e) {
+            if (e.code === 'ENOENT') {
+                unknowns.push(`Missing manifest: ${spec.ref}`);
+                continue;
+            }
+            throw e;
+        }
+        const manifest = ExecutionManifestSchema.parse(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(manifestBytes))), bytes = {};
+        for (const a of manifest.artifacts) {
+            try {
+                bytes[a.ref] = await safeRead(root, a.ref);
+            }
+            catch (e) {
+                if (e.code !== 'ENOENT')
+                    throw e;
+            }
+        }
+        let authority = spec.authority;
+        if ((authority.kind === 'local' || spec.manifestHash !== undefined) && hash(manifest) !== spec.manifestHash) {
+            failures.push('Host-pinned manifest digest mismatch');
+            continue;
+        }
+        if (authority.kind === 'ci') {
+            if (!spec.github) {
+                authority = undefined;
+                unknowns.push('CI authority requires live GitHub verification');
+            }
+            else {
+                const g = spec.github;
+                const archive = await safeRead(root, g.archivePath), digest = hashBytes(archive);
+                const archiveMatch = verifyArtifactArchive(archive, { [spec.ref]: manifestBytes, ...bytes }, g.archiveEntries);
+                if (archiveMatch.status !== 'pass') {
+                    unknowns.push(...archiveMatch.reasons);
+                    continue;
+                }
+                const result = await new GitHubAuthority({ repository: g.repository, ...(process.env.GITHUB_TOKEN ? { token: process.env.GITHUB_TOKEN } : {}) }).producer(manifest.ci, { ci: authority.ci, workflowPath: g.workflowPath, workflowSha: g.workflowSha, jobName: g.jobName, artifactName: g.artifactName, artifactDigest: digest });
+                observations.push({ manifestRef: spec.ref, observation: result });
+                if (result.status !== 'pass') {
+                    authority = undefined;
+                    unknowns.push(...result.reasons);
+                }
+            }
+        }
+        const result = validateManifest(manifest, spec.expected, bytes, authority);
+        if (hash(spec.expected.subject) !== hash(subject) || hash(spec.expected.configHashes) !== hash(configHashes) || spec.expected.dependencyLockHash !== dependencyLockHash) {
+            result.subjectMatch = 'fail';
+            result.reasons.push('Host-selected expectation does not match current input/config/lock snapshot');
+        }
+        manifests.push({ ref: spec.ref, validation: result });
+        const states = [result.artifactIntegrity, result.producerTrust, result.subjectMatch, result.executionStatus];
+        if (states.includes('fail'))
+            failures.push(...result.reasons);
+        else if (states.every(x => x === 'pass')) {
+            for (const a of manifest.artifacts) {
+                const captured = bytes[a.ref];
+                if (artifactBytes.has(a.ref) && hashBytes(artifactBytes.get(a.ref)) !== hashBytes(captured))
+                    throw Error('Conflicting authenticated artifact snapshots');
+                artifactBytes.set(a.ref, captured);
+                verified.add(a.ref);
+            }
+            if (authority?.kind === 'ci')
+                trustedCi = true;
+        }
+        else
+            unknowns.push(...result.reasons);
+    }
+    return { verified, failures: failures.sort(), unknowns: unknowns.sort(), manifests, trustedCi, artifactBytes, configHashes, dependencyLockHash, observations };
+}
+export const approvalKey = (v) => hash(v);
+export function isCurrentClaim(evidence, artifactRef, subject, policyHash, contracts) {
+    const payload = evidence.payload;
+    const active = contracts.find(c => c.id === payload.contractId);
+    return !!active && evidence.source.artifactRef === artifactRef && hash(evidence.context.subject ?? null) === hash(subject) && evidence.context.effectivePolicyHash === policyHash && evidence.context.contractHash === active.revisionHash;
+}
+/** Runner selection belongs to the protected invocation and one authenticated
+ * test artifact. It never grants artifact/producer authority by itself. */
+export function selectedRunner(trust, auth, testRef, inputs) {
+    const runner = trust?.runner;
+    if (!runner || !testRef || !inputs.includes('package.json') || auth.failures.length || !auth.verified.has(testRef))
+        return undefined;
+    const spec = trust.manifests.find(row => row.ref === runner.manifestRef), validation = auth.manifests.find(row => row.ref === runner.manifestRef)?.validation;
+    if (!spec?.expected.artifacts.some(row => row.kind === 'test' && row.ref === testRef) || !validation || ![validation.artifactIntegrity, validation.producerTrust, validation.subjectMatch, validation.executionStatus].every(status => status === 'pass'))
+        return undefined;
+    return { runner: runner.kind, version: runner.version };
+}
+//# sourceMappingURL=trust.js.map