@claude-flow/cli 3.32.26 → 3.32.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (403) hide show
  1. package/.claude/helpers/.helpers-version +1 -1
  2. package/.claude/helpers/helpers.manifest.json +2 -2
  3. package/catalog-manifest.json +4 -4
  4. package/dist/src/commands/index.d.ts +1 -0
  5. package/dist/src/commands/index.js +5 -3
  6. package/dist/src/commands/memory.js +49 -5
  7. package/dist/src/commands/metaharness.js +25 -5
  8. package/dist/src/commands/policy.d.ts +4 -0
  9. package/dist/src/commands/policy.js +107 -0
  10. package/dist/src/index.js +18 -0
  11. package/dist/src/init/claudemd-generator.js +53 -2
  12. package/dist/src/mcp-client.js +25 -1
  13. package/dist/src/mcp-tools/capability-brain.d.ts +134 -0
  14. package/dist/src/mcp-tools/capability-brain.js +697 -0
  15. package/dist/src/mcp-tools/guidance-tools.d.ts +2 -0
  16. package/dist/src/mcp-tools/guidance-tools.js +369 -37
  17. package/dist/src/mcp-tools/index.d.ts +4 -1
  18. package/dist/src/mcp-tools/index.js +3 -1
  19. package/dist/src/mcp-tools/memory-tools.js +26 -0
  20. package/dist/src/mcp-tools/metaharness-tools.js +27 -1
  21. package/dist/src/mcp-tools/policy-tools.d.ts +3 -0
  22. package/dist/src/mcp-tools/policy-tools.js +121 -0
  23. package/dist/src/memory/memory-bridge.d.ts +11 -0
  24. package/dist/src/memory/memory-bridge.js +100 -21
  25. package/dist/src/memory/memory-initializer.d.ts +22 -1
  26. package/dist/src/memory/memory-initializer.js +184 -39
  27. package/dist/src/services/bounded-worker-pool.d.ts +28 -0
  28. package/dist/src/services/bounded-worker-pool.js +90 -0
  29. package/dist/src/services/harness-flywheel-runtime.d.ts +2 -0
  30. package/dist/src/services/harness-flywheel-runtime.js +18 -0
  31. package/dist/src/services/harness-flywheel.d.ts +4 -1
  32. package/dist/src/services/harness-flywheel.js +27 -6
  33. package/dist/src/services/policy-runtime.d.ts +38 -0
  34. package/dist/src/services/policy-runtime.js +340 -0
  35. package/node_modules/@claude-flow/codex/.agents/skills/memory-management/SKILL.md +45 -0
  36. package/node_modules/@claude-flow/codex/.agents/skills/security-audit/SKILL.md +46 -0
  37. package/node_modules/@claude-flow/codex/.agents/skills/sparc-methodology/SKILL.md +46 -0
  38. package/node_modules/@claude-flow/codex/.agents/skills/swarm-orchestration/SKILL.md +53 -0
  39. package/node_modules/@claude-flow/codex/README.md +1044 -0
  40. package/node_modules/@claude-flow/codex/dist/cli.d.ts +9 -0
  41. package/node_modules/@claude-flow/codex/dist/cli.d.ts.map +1 -0
  42. package/node_modules/@claude-flow/codex/dist/cli.js +686 -0
  43. package/node_modules/@claude-flow/codex/dist/cli.js.map +1 -0
  44. package/node_modules/@claude-flow/codex/dist/dual-mode/cli.d.ts +17 -0
  45. package/node_modules/@claude-flow/codex/dist/dual-mode/cli.d.ts.map +1 -0
  46. package/node_modules/@claude-flow/codex/dist/dual-mode/cli.js +278 -0
  47. package/node_modules/@claude-flow/codex/dist/dual-mode/cli.js.map +1 -0
  48. package/node_modules/@claude-flow/codex/dist/dual-mode/index.d.ts +8 -0
  49. package/node_modules/@claude-flow/codex/dist/dual-mode/index.d.ts.map +1 -0
  50. package/node_modules/@claude-flow/codex/dist/dual-mode/index.js +7 -0
  51. package/node_modules/@claude-flow/codex/dist/dual-mode/index.js.map +1 -0
  52. package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.d.ts +143 -0
  53. package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.d.ts.map +1 -0
  54. package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.js +621 -0
  55. package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.js.map +1 -0
  56. package/node_modules/@claude-flow/codex/dist/generators/agents-md.d.ts +12 -0
  57. package/node_modules/@claude-flow/codex/dist/generators/agents-md.d.ts.map +1 -0
  58. package/node_modules/@claude-flow/codex/dist/generators/agents-md.js +730 -0
  59. package/node_modules/@claude-flow/codex/dist/generators/agents-md.js.map +1 -0
  60. package/node_modules/@claude-flow/codex/dist/generators/config-toml.d.ts +74 -0
  61. package/node_modules/@claude-flow/codex/dist/generators/config-toml.d.ts.map +1 -0
  62. package/node_modules/@claude-flow/codex/dist/generators/config-toml.js +922 -0
  63. package/node_modules/@claude-flow/codex/dist/generators/config-toml.js.map +1 -0
  64. package/node_modules/@claude-flow/codex/dist/generators/index.d.ts +9 -0
  65. package/node_modules/@claude-flow/codex/dist/generators/index.d.ts.map +1 -0
  66. package/node_modules/@claude-flow/codex/dist/generators/index.js +9 -0
  67. package/node_modules/@claude-flow/codex/dist/generators/index.js.map +1 -0
  68. package/node_modules/@claude-flow/codex/dist/generators/skill-md.d.ts +20 -0
  69. package/node_modules/@claude-flow/codex/dist/generators/skill-md.d.ts.map +1 -0
  70. package/node_modules/@claude-flow/codex/dist/generators/skill-md.js +951 -0
  71. package/node_modules/@claude-flow/codex/dist/generators/skill-md.js.map +1 -0
  72. package/node_modules/@claude-flow/codex/dist/harness/build-evidence.d.ts +46 -0
  73. package/node_modules/@claude-flow/codex/dist/harness/build-evidence.d.ts.map +1 -0
  74. package/node_modules/@claude-flow/codex/dist/harness/build-evidence.js +126 -0
  75. package/node_modules/@claude-flow/codex/dist/harness/build-evidence.js.map +1 -0
  76. package/node_modules/@claude-flow/codex/dist/harness/contract.d.ts +153 -0
  77. package/node_modules/@claude-flow/codex/dist/harness/contract.d.ts.map +1 -0
  78. package/node_modules/@claude-flow/codex/dist/harness/contract.js +44 -0
  79. package/node_modules/@claude-flow/codex/dist/harness/contract.js.map +1 -0
  80. package/node_modules/@claude-flow/codex/dist/harness/in-memory-fenced-lease-reference.d.ts +33 -0
  81. package/node_modules/@claude-flow/codex/dist/harness/in-memory-fenced-lease-reference.d.ts.map +1 -0
  82. package/node_modules/@claude-flow/codex/dist/harness/in-memory-fenced-lease-reference.js +175 -0
  83. package/node_modules/@claude-flow/codex/dist/harness/in-memory-fenced-lease-reference.js.map +1 -0
  84. package/node_modules/@claude-flow/codex/dist/harness/in-memory-inbox-reference.d.ts +42 -0
  85. package/node_modules/@claude-flow/codex/dist/harness/in-memory-inbox-reference.d.ts.map +1 -0
  86. package/node_modules/@claude-flow/codex/dist/harness/in-memory-inbox-reference.js +140 -0
  87. package/node_modules/@claude-flow/codex/dist/harness/in-memory-inbox-reference.js.map +1 -0
  88. package/node_modules/@claude-flow/codex/dist/harness/in-memory-run-receipt-reference.d.ts +19 -0
  89. package/node_modules/@claude-flow/codex/dist/harness/in-memory-run-receipt-reference.d.ts.map +1 -0
  90. package/node_modules/@claude-flow/codex/dist/harness/in-memory-run-receipt-reference.js +79 -0
  91. package/node_modules/@claude-flow/codex/dist/harness/in-memory-run-receipt-reference.js.map +1 -0
  92. package/node_modules/@claude-flow/codex/dist/harness/index.d.ts +9 -0
  93. package/node_modules/@claude-flow/codex/dist/harness/index.d.ts.map +1 -0
  94. package/node_modules/@claude-flow/codex/dist/harness/index.js +9 -0
  95. package/node_modules/@claude-flow/codex/dist/harness/index.js.map +1 -0
  96. package/node_modules/@claude-flow/codex/dist/harness/portable-case-fold.d.ts +8 -0
  97. package/node_modules/@claude-flow/codex/dist/harness/portable-case-fold.d.ts.map +1 -0
  98. package/node_modules/@claude-flow/codex/dist/harness/portable-case-fold.js +10 -0
  99. package/node_modules/@claude-flow/codex/dist/harness/portable-case-fold.js.map +1 -0
  100. package/node_modules/@claude-flow/codex/dist/harness/repository-state.d.ts +68 -0
  101. package/node_modules/@claude-flow/codex/dist/harness/repository-state.d.ts.map +1 -0
  102. package/node_modules/@claude-flow/codex/dist/harness/repository-state.js +403 -0
  103. package/node_modules/@claude-flow/codex/dist/harness/repository-state.js.map +1 -0
  104. package/node_modules/@claude-flow/codex/dist/harness/unsigned-integer.d.ts +3 -0
  105. package/node_modules/@claude-flow/codex/dist/harness/unsigned-integer.d.ts.map +1 -0
  106. package/node_modules/@claude-flow/codex/dist/harness/unsigned-integer.js +14 -0
  107. package/node_modules/@claude-flow/codex/dist/harness/unsigned-integer.js.map +1 -0
  108. package/node_modules/@claude-flow/codex/dist/index.d.ts +53 -0
  109. package/node_modules/@claude-flow/codex/dist/index.d.ts.map +1 -0
  110. package/node_modules/@claude-flow/codex/dist/index.js +54 -0
  111. package/node_modules/@claude-flow/codex/dist/index.js.map +1 -0
  112. package/node_modules/@claude-flow/codex/dist/initializer.d.ts +98 -0
  113. package/node_modules/@claude-flow/codex/dist/initializer.d.ts.map +1 -0
  114. package/node_modules/@claude-flow/codex/dist/initializer.js +795 -0
  115. package/node_modules/@claude-flow/codex/dist/initializer.js.map +1 -0
  116. package/node_modules/@claude-flow/codex/dist/loop/cli.d.ts +3 -0
  117. package/node_modules/@claude-flow/codex/dist/loop/cli.d.ts.map +1 -0
  118. package/node_modules/@claude-flow/codex/dist/loop/cli.js +123 -0
  119. package/node_modules/@claude-flow/codex/dist/loop/cli.js.map +1 -0
  120. package/node_modules/@claude-flow/codex/dist/loop/index.d.ts +58 -0
  121. package/node_modules/@claude-flow/codex/dist/loop/index.d.ts.map +1 -0
  122. package/node_modules/@claude-flow/codex/dist/loop/index.js +230 -0
  123. package/node_modules/@claude-flow/codex/dist/loop/index.js.map +1 -0
  124. package/node_modules/@claude-flow/codex/dist/mcp-config.d.ts +28 -0
  125. package/node_modules/@claude-flow/codex/dist/mcp-config.d.ts.map +1 -0
  126. package/node_modules/@claude-flow/codex/dist/mcp-config.js +121 -0
  127. package/node_modules/@claude-flow/codex/dist/mcp-config.js.map +1 -0
  128. package/node_modules/@claude-flow/codex/dist/migrations/index.d.ts +114 -0
  129. package/node_modules/@claude-flow/codex/dist/migrations/index.d.ts.map +1 -0
  130. package/node_modules/@claude-flow/codex/dist/migrations/index.js +880 -0
  131. package/node_modules/@claude-flow/codex/dist/migrations/index.js.map +1 -0
  132. package/node_modules/@claude-flow/codex/dist/templates/index.d.ts +92 -0
  133. package/node_modules/@claude-flow/codex/dist/templates/index.d.ts.map +1 -0
  134. package/node_modules/@claude-flow/codex/dist/templates/index.js +284 -0
  135. package/node_modules/@claude-flow/codex/dist/templates/index.js.map +1 -0
  136. package/node_modules/@claude-flow/codex/dist/types.d.ts +240 -0
  137. package/node_modules/@claude-flow/codex/dist/types.d.ts.map +1 -0
  138. package/node_modules/@claude-flow/codex/dist/types.js +8 -0
  139. package/node_modules/@claude-flow/codex/dist/types.js.map +1 -0
  140. package/node_modules/@claude-flow/codex/dist/validators/index.d.ts +42 -0
  141. package/node_modules/@claude-flow/codex/dist/validators/index.d.ts.map +1 -0
  142. package/node_modules/@claude-flow/codex/dist/validators/index.js +929 -0
  143. package/node_modules/@claude-flow/codex/dist/validators/index.js.map +1 -0
  144. package/node_modules/@claude-flow/codex/dist/worktrees/coordinator.d.ts +37 -0
  145. package/node_modules/@claude-flow/codex/dist/worktrees/coordinator.d.ts.map +1 -0
  146. package/node_modules/@claude-flow/codex/dist/worktrees/coordinator.js +137 -0
  147. package/node_modules/@claude-flow/codex/dist/worktrees/coordinator.js.map +1 -0
  148. package/node_modules/@claude-flow/codex/dist/worktrees/index.d.ts +2 -0
  149. package/node_modules/@claude-flow/codex/dist/worktrees/index.d.ts.map +1 -0
  150. package/node_modules/@claude-flow/codex/dist/worktrees/index.js +2 -0
  151. package/node_modules/@claude-flow/codex/dist/worktrees/index.js.map +1 -0
  152. package/node_modules/@claude-flow/codex/package.json +122 -0
  153. package/node_modules/@claude-flow/plugin-agent-federation/README.md +49 -0
  154. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/agent-card.d.ts +130 -0
  155. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/agent-card.d.ts.map +1 -0
  156. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/agent-card.js +239 -0
  157. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/agent-card.js.map +1 -0
  158. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.d.ts +34 -0
  159. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.d.ts.map +1 -0
  160. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.js +69 -0
  161. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.js.map +1 -0
  162. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.d.ts +46 -0
  163. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.d.ts.map +1 -0
  164. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.js +84 -0
  165. package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.js.map +1 -0
  166. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.d.ts +27 -0
  167. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.d.ts.map +1 -0
  168. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.js +46 -0
  169. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.js.map +1 -0
  170. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-breaker-service.d.ts +192 -0
  171. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-breaker-service.d.ts.map +1 -0
  172. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-breaker-service.js +253 -0
  173. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-breaker-service.js.map +1 -0
  174. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.d.ts +211 -0
  175. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.d.ts.map +1 -0
  176. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.js +501 -0
  177. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.js.map +1 -0
  178. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/inbound-dispatcher.d.ts +114 -0
  179. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/inbound-dispatcher.d.ts.map +1 -0
  180. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/inbound-dispatcher.js +356 -0
  181. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/inbound-dispatcher.js.map +1 -0
  182. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/policy-engine.d.ts +41 -0
  183. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/policy-engine.d.ts.map +1 -0
  184. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/policy-engine.js +184 -0
  185. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/policy-engine.js.map +1 -0
  186. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/spend-reporter.d.ts +150 -0
  187. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/spend-reporter.d.ts.map +1 -0
  188. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/spend-reporter.js +128 -0
  189. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/spend-reporter.js.map +1 -0
  190. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/trust-evaluator.d.ts +74 -0
  191. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/trust-evaluator.d.ts.map +1 -0
  192. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/trust-evaluator.js +179 -0
  193. package/node_modules/@claude-flow/plugin-agent-federation/dist/application/trust-evaluator.js.map +1 -0
  194. package/node_modules/@claude-flow/plugin-agent-federation/dist/bin.d.ts +13 -0
  195. package/node_modules/@claude-flow/plugin-agent-federation/dist/bin.d.ts.map +1 -0
  196. package/node_modules/@claude-flow/plugin-agent-federation/dist/bin.js +189 -0
  197. package/node_modules/@claude-flow/plugin-agent-federation/dist/bin.js.map +1 -0
  198. package/node_modules/@claude-flow/plugin-agent-federation/dist/cli-commands.d.ts +7 -0
  199. package/node_modules/@claude-flow/plugin-agent-federation/dist/cli-commands.d.ts.map +1 -0
  200. package/node_modules/@claude-flow/plugin-agent-federation/dist/cli-commands.js +317 -0
  201. package/node_modules/@claude-flow/plugin-agent-federation/dist/cli-commands.js.map +1 -0
  202. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-envelope.d.ts +45 -0
  203. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-envelope.d.ts.map +1 -0
  204. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-envelope.js +71 -0
  205. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-envelope.js.map +1 -0
  206. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-node.d.ts +104 -0
  207. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-node.d.ts.map +1 -0
  208. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-node.js +152 -0
  209. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-node.js.map +1 -0
  210. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-session.d.ts +55 -0
  211. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-session.d.ts.map +1 -0
  212. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-session.js +105 -0
  213. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-session.js.map +1 -0
  214. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/trust-level.d.ts +17 -0
  215. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/trust-level.d.ts.map +1 -0
  216. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/trust-level.js +35 -0
  217. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/trust-level.js.map +1 -0
  218. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/audit-service.d.ts +69 -0
  219. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/audit-service.d.ts.map +1 -0
  220. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/audit-service.js +149 -0
  221. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/audit-service.js.map +1 -0
  222. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/discovery-service.d.ts +68 -0
  223. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/discovery-service.d.ts.map +1 -0
  224. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/discovery-service.js +161 -0
  225. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/discovery-service.js.map +1 -0
  226. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/handshake-service.d.ts +58 -0
  227. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/handshake-service.d.ts.map +1 -0
  228. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/handshake-service.js +122 -0
  229. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/handshake-service.js.map +1 -0
  230. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/pii-pipeline-service.d.ts +65 -0
  231. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/pii-pipeline-service.d.ts.map +1 -0
  232. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/pii-pipeline-service.js +208 -0
  233. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/pii-pipeline-service.js.map +1 -0
  234. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.d.ts +51 -0
  235. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.d.ts.map +1 -0
  236. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.js +147 -0
  237. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.js.map +1 -0
  238. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-firewall-service.d.ts +71 -0
  239. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-firewall-service.d.ts.map +1 -0
  240. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-firewall-service.js +194 -0
  241. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-firewall-service.js.map +1 -0
  242. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-mesh-service.d.ts +156 -0
  243. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-mesh-service.d.ts.map +1 -0
  244. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-mesh-service.js +292 -0
  245. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-mesh-service.js.map +1 -0
  246. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.d.ts +98 -0
  247. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.d.ts.map +1 -0
  248. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.js +122 -0
  249. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.js.map +1 -0
  250. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.d.ts +89 -0
  251. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.d.ts.map +1 -0
  252. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.js +165 -0
  253. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.js.map +1 -0
  254. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.d.ts +92 -0
  255. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.d.ts.map +1 -0
  256. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.js +100 -0
  257. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.js.map +1 -0
  258. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.d.ts +70 -0
  259. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.d.ts.map +1 -0
  260. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.js +104 -0
  261. package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.js.map +1 -0
  262. package/node_modules/@claude-flow/plugin-agent-federation/dist/index.d.ts +23 -0
  263. package/node_modules/@claude-flow/plugin-agent-federation/dist/index.d.ts.map +1 -0
  264. package/node_modules/@claude-flow/plugin-agent-federation/dist/index.js +24 -0
  265. package/node_modules/@claude-flow/plugin-agent-federation/dist/index.js.map +1 -0
  266. package/node_modules/@claude-flow/plugin-agent-federation/dist/mcp-tools.d.ts +10 -0
  267. package/node_modules/@claude-flow/plugin-agent-federation/dist/mcp-tools.d.ts.map +1 -0
  268. package/node_modules/@claude-flow/plugin-agent-federation/dist/mcp-tools.js +439 -0
  269. package/node_modules/@claude-flow/plugin-agent-federation/dist/mcp-tools.js.map +1 -0
  270. package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.d.ts +19 -0
  271. package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.d.ts.map +1 -0
  272. package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.js +515 -0
  273. package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.js.map +1 -0
  274. package/node_modules/@claude-flow/plugin-agent-federation/dist/transport/midstream-aware-loader.d.ts +72 -0
  275. package/node_modules/@claude-flow/plugin-agent-federation/dist/transport/midstream-aware-loader.d.ts.map +1 -0
  276. package/node_modules/@claude-flow/plugin-agent-federation/dist/transport/midstream-aware-loader.js +269 -0
  277. package/node_modules/@claude-flow/plugin-agent-federation/dist/transport/midstream-aware-loader.js.map +1 -0
  278. package/node_modules/@claude-flow/plugin-agent-federation/dist/version.d.ts +3 -0
  279. package/node_modules/@claude-flow/plugin-agent-federation/dist/version.d.ts.map +1 -0
  280. package/node_modules/@claude-flow/plugin-agent-federation/dist/version.js +3 -0
  281. package/node_modules/@claude-flow/plugin-agent-federation/dist/version.js.map +1 -0
  282. package/node_modules/@claude-flow/plugin-agent-federation/package.json +64 -0
  283. package/node_modules/@claude-flow/security/README.md +292 -0
  284. package/node_modules/@claude-flow/security/dist/CVE-REMEDIATION.d.ts +97 -0
  285. package/node_modules/@claude-flow/security/dist/CVE-REMEDIATION.d.ts.map +1 -0
  286. package/node_modules/@claude-flow/security/dist/CVE-REMEDIATION.js +537 -0
  287. package/node_modules/@claude-flow/security/dist/CVE-REMEDIATION.js.map +1 -0
  288. package/node_modules/@claude-flow/security/dist/application/index.d.ts +7 -0
  289. package/node_modules/@claude-flow/security/dist/application/index.d.ts.map +1 -0
  290. package/node_modules/@claude-flow/security/dist/application/index.js +7 -0
  291. package/node_modules/@claude-flow/security/dist/application/index.js.map +1 -0
  292. package/node_modules/@claude-flow/security/dist/application/services/security-application-service.d.ts +71 -0
  293. package/node_modules/@claude-flow/security/dist/application/services/security-application-service.d.ts.map +1 -0
  294. package/node_modules/@claude-flow/security/dist/application/services/security-application-service.js +153 -0
  295. package/node_modules/@claude-flow/security/dist/application/services/security-application-service.js.map +1 -0
  296. package/node_modules/@claude-flow/security/dist/authorization/propagator.d.ts +148 -0
  297. package/node_modules/@claude-flow/security/dist/authorization/propagator.d.ts.map +1 -0
  298. package/node_modules/@claude-flow/security/dist/authorization/propagator.js +182 -0
  299. package/node_modules/@claude-flow/security/dist/authorization/propagator.js.map +1 -0
  300. package/node_modules/@claude-flow/security/dist/credential-generator.d.ts +176 -0
  301. package/node_modules/@claude-flow/security/dist/credential-generator.d.ts.map +1 -0
  302. package/node_modules/@claude-flow/security/dist/credential-generator.js +272 -0
  303. package/node_modules/@claude-flow/security/dist/credential-generator.js.map +1 -0
  304. package/node_modules/@claude-flow/security/dist/domain/entities/security-context.d.ts +68 -0
  305. package/node_modules/@claude-flow/security/dist/domain/entities/security-context.d.ts.map +1 -0
  306. package/node_modules/@claude-flow/security/dist/domain/entities/security-context.js +132 -0
  307. package/node_modules/@claude-flow/security/dist/domain/entities/security-context.js.map +1 -0
  308. package/node_modules/@claude-flow/security/dist/domain/index.d.ts +8 -0
  309. package/node_modules/@claude-flow/security/dist/domain/index.d.ts.map +1 -0
  310. package/node_modules/@claude-flow/security/dist/domain/index.js +8 -0
  311. package/node_modules/@claude-flow/security/dist/domain/index.js.map +1 -0
  312. package/node_modules/@claude-flow/security/dist/domain/services/security-domain-service.d.ts +71 -0
  313. package/node_modules/@claude-flow/security/dist/domain/services/security-domain-service.d.ts.map +1 -0
  314. package/node_modules/@claude-flow/security/dist/domain/services/security-domain-service.js +237 -0
  315. package/node_modules/@claude-flow/security/dist/domain/services/security-domain-service.js.map +1 -0
  316. package/node_modules/@claude-flow/security/dist/index.d.ts +129 -0
  317. package/node_modules/@claude-flow/security/dist/index.d.ts.map +1 -0
  318. package/node_modules/@claude-flow/security/dist/index.js +176 -0
  319. package/node_modules/@claude-flow/security/dist/index.js.map +1 -0
  320. package/node_modules/@claude-flow/security/dist/input-validator.d.ts +306 -0
  321. package/node_modules/@claude-flow/security/dist/input-validator.d.ts.map +1 -0
  322. package/node_modules/@claude-flow/security/dist/input-validator.js +393 -0
  323. package/node_modules/@claude-flow/security/dist/input-validator.js.map +1 -0
  324. package/node_modules/@claude-flow/security/dist/keychain-adapter.d.ts +48 -0
  325. package/node_modules/@claude-flow/security/dist/keychain-adapter.d.ts.map +1 -0
  326. package/node_modules/@claude-flow/security/dist/keychain-adapter.js +0 -0
  327. package/node_modules/@claude-flow/security/dist/keychain-adapter.js.map +1 -0
  328. package/node_modules/@claude-flow/security/dist/mcp-composition-inspector.d.ts +133 -0
  329. package/node_modules/@claude-flow/security/dist/mcp-composition-inspector.d.ts.map +1 -0
  330. package/node_modules/@claude-flow/security/dist/mcp-composition-inspector.js +254 -0
  331. package/node_modules/@claude-flow/security/dist/mcp-composition-inspector.js.map +1 -0
  332. package/node_modules/@claude-flow/security/dist/oauth/browser.d.ts +31 -0
  333. package/node_modules/@claude-flow/security/dist/oauth/browser.d.ts.map +1 -0
  334. package/node_modules/@claude-flow/security/dist/oauth/browser.js +55 -0
  335. package/node_modules/@claude-flow/security/dist/oauth/browser.js.map +1 -0
  336. package/node_modules/@claude-flow/security/dist/oauth/callback-server.d.ts +37 -0
  337. package/node_modules/@claude-flow/security/dist/oauth/callback-server.d.ts.map +1 -0
  338. package/node_modules/@claude-flow/security/dist/oauth/callback-server.js +86 -0
  339. package/node_modules/@claude-flow/security/dist/oauth/callback-server.js.map +1 -0
  340. package/node_modules/@claude-flow/security/dist/oauth/client.d.ts +57 -0
  341. package/node_modules/@claude-flow/security/dist/oauth/client.d.ts.map +1 -0
  342. package/node_modules/@claude-flow/security/dist/oauth/client.js +120 -0
  343. package/node_modules/@claude-flow/security/dist/oauth/client.js.map +1 -0
  344. package/node_modules/@claude-flow/security/dist/oauth/pkce.d.ts +25 -0
  345. package/node_modules/@claude-flow/security/dist/oauth/pkce.d.ts.map +1 -0
  346. package/node_modules/@claude-flow/security/dist/oauth/pkce.js +36 -0
  347. package/node_modules/@claude-flow/security/dist/oauth/pkce.js.map +1 -0
  348. package/node_modules/@claude-flow/security/dist/password-hasher.d.ts +128 -0
  349. package/node_modules/@claude-flow/security/dist/password-hasher.d.ts.map +1 -0
  350. package/node_modules/@claude-flow/security/dist/password-hasher.js +190 -0
  351. package/node_modules/@claude-flow/security/dist/password-hasher.js.map +1 -0
  352. package/node_modules/@claude-flow/security/dist/path-validator.d.ts +148 -0
  353. package/node_modules/@claude-flow/security/dist/path-validator.d.ts.map +1 -0
  354. package/node_modules/@claude-flow/security/dist/path-validator.js +421 -0
  355. package/node_modules/@claude-flow/security/dist/path-validator.js.map +1 -0
  356. package/node_modules/@claude-flow/security/dist/plugins/integrity-verifier.d.ts +125 -0
  357. package/node_modules/@claude-flow/security/dist/plugins/integrity-verifier.d.ts.map +1 -0
  358. package/node_modules/@claude-flow/security/dist/plugins/integrity-verifier.js +186 -0
  359. package/node_modules/@claude-flow/security/dist/plugins/integrity-verifier.js.map +1 -0
  360. package/node_modules/@claude-flow/security/dist/policy/canonical.d.ts +5 -0
  361. package/node_modules/@claude-flow/security/dist/policy/canonical.d.ts.map +1 -0
  362. package/node_modules/@claude-flow/security/dist/policy/canonical.js +30 -0
  363. package/node_modules/@claude-flow/security/dist/policy/canonical.js.map +1 -0
  364. package/node_modules/@claude-flow/security/dist/policy/engine.d.ts +34 -0
  365. package/node_modules/@claude-flow/security/dist/policy/engine.d.ts.map +1 -0
  366. package/node_modules/@claude-flow/security/dist/policy/engine.js +285 -0
  367. package/node_modules/@claude-flow/security/dist/policy/engine.js.map +1 -0
  368. package/node_modules/@claude-flow/security/dist/policy/envelope.d.ts +9 -0
  369. package/node_modules/@claude-flow/security/dist/policy/envelope.d.ts.map +1 -0
  370. package/node_modules/@claude-flow/security/dist/policy/envelope.js +90 -0
  371. package/node_modules/@claude-flow/security/dist/policy/envelope.js.map +1 -0
  372. package/node_modules/@claude-flow/security/dist/policy/evaluator.d.ts +4 -0
  373. package/node_modules/@claude-flow/security/dist/policy/evaluator.d.ts.map +1 -0
  374. package/node_modules/@claude-flow/security/dist/policy/evaluator.js +119 -0
  375. package/node_modules/@claude-flow/security/dist/policy/evaluator.js.map +1 -0
  376. package/node_modules/@claude-flow/security/dist/policy/index.d.ts +7 -0
  377. package/node_modules/@claude-flow/security/dist/policy/index.d.ts.map +1 -0
  378. package/node_modules/@claude-flow/security/dist/policy/index.js +7 -0
  379. package/node_modules/@claude-flow/security/dist/policy/index.js.map +1 -0
  380. package/node_modules/@claude-flow/security/dist/policy/product-plane.d.ts +238 -0
  381. package/node_modules/@claude-flow/security/dist/policy/product-plane.d.ts.map +1 -0
  382. package/node_modules/@claude-flow/security/dist/policy/product-plane.js +1022 -0
  383. package/node_modules/@claude-flow/security/dist/policy/product-plane.js.map +1 -0
  384. package/node_modules/@claude-flow/security/dist/policy/types.d.ts +169 -0
  385. package/node_modules/@claude-flow/security/dist/policy/types.d.ts.map +1 -0
  386. package/node_modules/@claude-flow/security/dist/policy/types.js +2 -0
  387. package/node_modules/@claude-flow/security/dist/policy/types.js.map +1 -0
  388. package/node_modules/@claude-flow/security/dist/safe-executor.d.ts +180 -0
  389. package/node_modules/@claude-flow/security/dist/safe-executor.d.ts.map +1 -0
  390. package/node_modules/@claude-flow/security/dist/safe-executor.js +390 -0
  391. package/node_modules/@claude-flow/security/dist/safe-executor.js.map +1 -0
  392. package/node_modules/@claude-flow/security/dist/token-generator.d.ts +224 -0
  393. package/node_modules/@claude-flow/security/dist/token-generator.d.ts.map +1 -0
  394. package/node_modules/@claude-flow/security/dist/token-generator.js +351 -0
  395. package/node_modules/@claude-flow/security/dist/token-generator.js.map +1 -0
  396. package/node_modules/@claude-flow/security/dist/tool-output-guardrail.d.ts +126 -0
  397. package/node_modules/@claude-flow/security/dist/tool-output-guardrail.d.ts.map +1 -0
  398. package/node_modules/@claude-flow/security/dist/tool-output-guardrail.js +257 -0
  399. package/node_modules/@claude-flow/security/dist/tool-output-guardrail.js.map +1 -0
  400. package/node_modules/@claude-flow/security/package.json +44 -0
  401. package/package.json +44 -12
  402. package/plugins/ruflo-metaharness/scripts/smoke.sh +22 -14
  403. package/plugins/ruflo-metaharness/scripts/test-mcp-tools.mjs +3 -1
@@ -0,0 +1 @@
1
+ {"version":3,"file":"skill-md.js","sourceRoot":"","sources":["../../src/generators/skill-md.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAuB;IAC3D,MAAM,EACJ,IAAI,EACJ,WAAW,EACX,OAAO,GAAG,OAAO,EACjB,MAAM,GAAG,KAAK,EACd,IAAI,EACJ,QAAQ,GAAG,EAAE,EACb,QAAQ,GAAG,EAAE,EACb,OAAO,GAAG,EAAE,EACZ,UAAU,GAAG,EAAE,EACf,QAAQ,GAAG,EAAE,GACd,GAAG,OAAO,CAAC;IAEZ,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEjF,yBAAyB;IACzB,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAC,aAAa,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACrC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;QAClC,CAAC,CAAC,cAAc,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACtC,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,WAAW,GAAG;QACd,IAAI;YACA,OAAO;UACT,MAAM;SACP,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;IAEvB,WAAW;IACX,WAAW;IACX,QAAQ;IACR,CAAC;IAEH,yBAAyB;IACzB,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;QACzC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAChC,CAAC,CAAC,EAAE,CAAC;IAEP,wBAAwB;IACxB,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;QACvC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAC9B,CAAC,CAAC,EAAE,CAAC;IAEP,2BAA2B;IAC3B,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7C,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC;IAEP,uBAAuB;IACvB,OAAO,GAAG,WAAW;;IAEnB,eAAe,CAAC,IAAI,CAAC;;;EAGvB,WAAW;;;EAGX,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kCAAkC;;;EAGjG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yCAAyC;EACxG,eAAe;EACf,cAAc;EACd,iBAAiB;;;;;;CAMlB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,QAAwB;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QAC/B,IAAI,KAAK,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,WAAW,mBAAmB,GAAG,CAAC,OAAO,UAAU,CAAC;QACxF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,KAAK,IAAI,iCAAiC,GAAG,CAAC,OAAO,UAAU,CAAC;QAClE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO;;;EAGP,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;CACnB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAA8D;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;IAEvF,OAAO;;;;;EAKP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;CACjB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,UAAkE;IAChG,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC/B,OAAO,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,WAAW,IAAI,EAAE,IAAI,CAC7D,CAAC;IAEF,OAAO;;;;;EAKP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;CACjB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACzD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB;IAEjB,MAAM,cAAc,GAAmC;QACrD,qBAAqB,EAAE;YACrB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,gLAAgL;YAC7L,QAAQ,EAAE;gBACR,uBAAuB;gBACvB,4BAA4B;gBAC5B,0BAA0B;gBAC1B,wBAAwB;gBACxB,0BAA0B;gBAC1B,0CAA0C;gBAC1C,yBAAyB;aAC1B;YACD,QAAQ,EAAE;gBACR,mBAAmB;gBACnB,8BAA8B;gBAC9B,uBAAuB;gBACvB,uBAAuB;gBACvB,mBAAmB;aACpB;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,2DAA2D;oBACxE,OAAO,EAAE,oFAAoF;oBAC7F,OAAO,EAAE,oFAAoF;iBAC9F;gBACD;oBACE,IAAI,EAAE,YAAY;oBAClB,WAAW,EAAE,2DAA2D;oBACxE,OAAO,EAAE,8DAA8D;oBACvE,OAAO,EAAE,gFAAgF;iBAC1F;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,6BAA6B;oBAC1C,OAAO,EAAE,8DAA8D;oBACvE,OAAO,EAAE,gEAAgE;iBAC1E;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,gCAAgC;oBAC7C,OAAO,EAAE,6CAA6C;iBACvD;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,2CAA2C;oBACxD,OAAO,EAAE,2EAA2E;oBACpF,OAAO,EAAE,wGAAwG;iBAClH;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,wBAAwB;oBACrC,OAAO,EAAE,iDAAiD;iBAC3D;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,gCAAgC;oBACtC,WAAW,EAAE,wCAAwC;iBACtD;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,kCAAkC;oBACxC,WAAW,EAAE,sCAAsC;iBACpD;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,+CAA+C;iBAC7D;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,oCAAoC;iBAClD;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,4LAA4L;YACzM,QAAQ,EAAE;gBACR,mCAAmC;gBACnC,iCAAiC;gBACjC,8BAA8B;gBAC9B,8BAA8B;gBAC9B,kCAAkC;gBAClC,yBAAyB;aAC1B;YACD,QAAQ,EAAE;gBACR,oBAAoB;gBACpB,yBAAyB;gBACzB,iCAAiC;gBACjC,uBAAuB;aACxB;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,eAAe;oBACrB,WAAW,EAAE,6CAA6C;oBAC1D,OAAO,EAAE,wFAAwF;oBACjG,OAAO,EAAE,8HAA8H;iBACxI;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,yCAAyC;oBACtD,OAAO,EAAE,wEAAwE;oBACjF,OAAO,EAAE,sFAAsF;iBAChG;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,yCAAyC;oBACtD,OAAO,EAAE,uEAAuE;oBAChF,OAAO,EAAE,+EAA+E;iBACzF;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,iCAAiC;oBAC9C,OAAO,EAAE,0DAA0D;oBACnE,OAAO,EAAE,kEAAkE;iBAC5E;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,uBAAuB;oBACpC,OAAO,EAAE,0EAA0E;iBACpF;gBACD;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,WAAW,EAAE,qCAAqC;oBAClD,OAAO,EAAE,gDAAgD;iBAC1D;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,8BAA8B;oBAC3C,OAAO,EAAE,mCAAmC;iBAC7C;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,WAAW,EAAE,uBAAuB;oBACpC,OAAO,EAAE,gEAAgE;iBAC1E;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,kCAAkC;oBACxC,WAAW,EAAE,mCAAmC;iBACjD;gBACD;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,IAAI,EAAE,uCAAuC;oBAC7C,WAAW,EAAE,iCAAiC;iBAC/C;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,kCAAkC;iBAChD;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,uBAAuB;oBAC7B,WAAW,EAAE,uCAAuC;iBACrD;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,8LAA8L;YAC3M,QAAQ,EAAE;gBACR,4BAA4B;gBAC5B,yBAAyB;gBACzB,uBAAuB;gBACvB,iBAAiB;gBACjB,kBAAkB;gBAClB,sBAAsB;aACvB;YACD,QAAQ,EAAE;gBACR,kBAAkB;gBAClB,uBAAuB;gBACvB,uBAAuB;gBACvB,0BAA0B;gBAC1B,qBAAqB;aACtB;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,2DAA2D;oBACxE,OAAO,EAAE,yEAAyE;oBAClF,OAAO,EAAE,uHAAuH;iBACjI;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,oDAAoD;oBACjE,OAAO,EAAE,iEAAiE;oBAC1E,OAAO,EAAE,4FAA4F;iBACtG;gBACD;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,uDAAuD;oBACpE,OAAO,EAAE,kEAAkE;oBAC3E,OAAO,EAAE,uHAAuH;iBACjI;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,yCAAyC;oBACtD,OAAO,EAAE,kEAAkE;oBAC3E,OAAO,EAAE,oGAAoG;iBAC9G;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,sDAAsD;oBACnE,OAAO,EAAE,sEAAsE;oBAC/E,OAAO,EAAE,+GAA+G;iBACzH;gBACD;oBACE,IAAI,EAAE,mBAAmB;oBACzB,WAAW,EAAE,+BAA+B;oBAC5C,OAAO,EAAE,uEAAuE;iBACjF;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,+BAA+B;oBACrC,WAAW,EAAE,6CAA6C;iBAC3D;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,iCAAiC;oBACvC,WAAW,EAAE,kCAAkC;iBAChD;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,eAAe;oBACrB,WAAW,EAAE,kCAAkC;iBAChD;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,IAAI,EAAE,yBAAyB;oBAC/B,WAAW,EAAE,gCAAgC;iBAC9C;aACF;SACF;QACD,gBAAgB,EAAE;YAChB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,0KAA0K;YACvL,QAAQ,EAAE;gBACR,+BAA+B;gBAC/B,qBAAqB;gBACrB,oBAAoB;gBACpB,oBAAoB;gBACpB,uBAAuB;gBACvB,sBAAsB;gBACtB,kBAAkB;gBAClB,0BAA0B;aAC3B;YACD,QAAQ,EAAE;gBACR,qCAAqC;gBACrC,8BAA8B;gBAC9B,sBAAsB;gBACtB,iBAAiB;aAClB;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,qDAAqD;oBAClE,OAAO,EAAE,iDAAiD;oBAC1D,OAAO,EAAE,+EAA+E;iBACzF;gBACD;oBACE,IAAI,EAAE,wBAAwB;oBAC9B,WAAW,EAAE,mCAAmC;oBAChD,OAAO,EAAE,6DAA6D;oBACtE,OAAO,EAAE,8EAA8E;iBACxF;gBACD;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,0CAA0C;oBACvD,OAAO,EAAE,2DAA2D;iBACrE;gBACD;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,yCAAyC;oBACtD,OAAO,EAAE,0DAA0D;iBACpE;gBACD;oBACE,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,gDAAgD;oBAC7D,OAAO,EAAE,gDAAgD;iBAC1D;gBACD;oBACE,IAAI,EAAE,UAAU;oBAChB,WAAW,EAAE,kCAAkC;oBAC/C,OAAO,EAAE,0CAA0C;oBACnD,OAAO,EAAE,0DAA0D;iBACpE;gBACD;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,WAAW,EAAE,qCAAqC;oBAClD,OAAO,EAAE,8CAA8C;oBACvD,OAAO,EAAE,qFAAqF;iBAC/F;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,8BAA8B;oBAC3C,OAAO,EAAE,iDAAiD;iBAC3D;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,6BAA6B;oBAC1C,OAAO,EAAE,wDAAwD;iBAClE;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,kCAAkC;oBACxC,WAAW,EAAE,iCAAiC;iBAC/C;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,kCAAkC;oBACxC,WAAW,EAAE,2BAA2B;iBACzC;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,IAAI,EAAE,4BAA4B;oBAClC,WAAW,EAAE,2BAA2B;iBACzC;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,+BAA+B;iBAC7C;aACF;SACF;QACD,sBAAsB,EAAE;YACtB,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,8JAA8J;YAC3K,QAAQ,EAAE;gBACR,0BAA0B;gBAC1B,qBAAqB;gBACrB,qBAAqB;gBACrB,oCAAoC;gBACpC,6BAA6B;gBAC7B,sBAAsB;gBACtB,sBAAsB;aACvB;YACD,QAAQ,EAAE;gBACR,2BAA2B;gBAC3B,uBAAuB;gBACvB,mBAAmB;gBACnB,uBAAuB;aACxB;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,oCAAoC;oBACjD,OAAO,EAAE,wDAAwD;oBACjE,OAAO,EAAE,qGAAqG;iBAC/G;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,2CAA2C;oBACxD,OAAO,EAAE,yDAAyD;oBAClE,OAAO,EAAE,4EAA4E;iBACtF;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,+BAA+B;oBAC5C,OAAO,EAAE,0DAA0D;oBACnE,OAAO,EAAE,4EAA4E;iBACtF;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,6BAA6B;oBAC1C,OAAO,EAAE,2DAA2D;iBACrE;gBACD;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,wCAAwC;oBACrD,OAAO,EAAE,qDAAqD;oBAC9D,OAAO,EAAE,kEAAkE;iBAC5E;gBACD;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,6BAA6B;oBAC1C,OAAO,EAAE,yCAAyC;oBAClD,OAAO,EAAE,iFAAiF;iBAC3F;gBACD;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,2BAA2B;oBACxC,OAAO,EAAE,iFAAiF;iBAC3F;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,8BAA8B;oBAC3C,OAAO,EAAE,yDAAyD;iBACnE;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,kCAAkC;oBACxC,WAAW,EAAE,8BAA8B;iBAC5C;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,IAAI,EAAE,oCAAoC;oBAC1C,WAAW,EAAE,mCAAmC;iBACjD;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,gCAAgC;iBAC9C;gBACD;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,mCAAmC;iBACjD;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,wJAAwJ;YACrK,QAAQ,EAAE;gBACR,wBAAwB;gBACxB,4BAA4B;gBAC5B,oBAAoB;gBACpB,2BAA2B;gBAC3B,mBAAmB;gBACnB,uBAAuB;gBACvB,wBAAwB;aACzB;YACD,QAAQ,EAAE;gBACR,wBAAwB;gBACxB,6BAA6B;gBAC7B,yBAAyB;gBACzB,cAAc;aACf;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,wCAAwC;oBACrD,OAAO,EAAE,uDAAuD;oBAChE,OAAO,EAAE,qKAAqK;iBAC/K;gBACD;oBACE,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,2BAA2B;oBACxC,OAAO,EAAE,qBAAqB;oBAC9B,OAAO,EAAE,2BAA2B;iBACrC;gBACD;oBACE,IAAI,EAAE,UAAU;oBAChB,WAAW,EAAE,sBAAsB;oBACnC,OAAO,EAAE,+BAA+B;oBACxC,OAAO,EAAE,0CAA0C;iBACpD;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,mCAAmC;oBAChD,OAAO,EAAE,4BAA4B;oBACrC,OAAO,EAAE,6CAA6C;iBACvD;gBACD;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,2BAA2B;oBACxC,OAAO,EAAE,wBAAwB;iBAClC;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,oBAAoB;oBACjC,OAAO,EAAE,mDAAmD;oBAC5D,OAAO,EAAE,gGAAgG;iBAC1G;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,sBAAsB;oBACnC,OAAO,EAAE,2CAA2C;oBACpD,OAAO,EAAE,qEAAqE;iBAC/E;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,sBAAsB;oBACnC,OAAO,EAAE,uBAAuB;oBAChC,OAAO,EAAE,0BAA0B;iBACpC;gBACD;oBACE,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,oBAAoB;oBACjC,OAAO,EAAE,oDAAoD;oBAC7D,OAAO,EAAE,oEAAoE;iBAC9E;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,gCAAgC;oBACtC,WAAW,EAAE,2BAA2B;iBACzC;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,iCAAiC;oBACvC,WAAW,EAAE,gCAAgC;iBAC9C;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,8BAA8B;iBAC5C;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,uBAAuB;oBAC7B,WAAW,EAAE,6BAA6B;iBAC3C;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,eAAe;oBACrB,WAAW,EAAE,8BAA8B;iBAC5C;aACF;SACF;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAEhD,0BAA0B;IAC1B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,kDAAkD;YAClD,MAAM,cAAc,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC;YAC3C,OAAO,CAAC,cAAc,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,OAAO;QACP,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,SAAiB,EAAE,UAAkB;IACjE,MAAM,OAAO,GAA2C;QACtD,qBAAqB,EAAE;YACrB,aAAa,EAAE;;;;;;;;;;;;;;CAcpB;YACK,eAAe,EAAE;;;;;;;;CAQtB;SACI;QACD,mBAAmB,EAAE;YACnB,eAAe,EAAE;;;;;;;;;;;;;;;;CAgBtB;YACK,oBAAoB,EAAE;;;;;;;;;;;CAW3B;SACI;QACD,mBAAmB,EAAE;YACnB,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBnB;YACK,cAAc,EAAE;;;;;;;;;;;;;;;;;;CAkBrB;SACI;QACD,gBAAgB,EAAE;YAChB,eAAe,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCtB;YACK,eAAe,EAAE;;;;;;;;;;;;;;;;CAgBtB;SACI;QACD,sBAAsB,EAAE;YACtB,eAAe,EAAE;;;;;;;;;;;;;;;CAetB;YACK,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBxB;SACI;QACD,mBAAmB,EAAE;YACnB,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCpB;YACK,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBrB;SACI;KACF,CAAC;IAEF,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,YAAY,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,OAAO;IACL,SAAS,MAAM,UAAU;;;;;gBAKb,UAAU;;CAEzB,CAAC;AACF,CAAC"}
@@ -0,0 +1,46 @@
1
+ import { type ExactSourceState } from './repository-state.js';
2
+ export interface DeclaredBuildInput {
3
+ name: string;
4
+ /** Repository-relative declaration; it may name an ignored generated input. */
5
+ path: string;
6
+ digest: string;
7
+ bytes: number;
8
+ }
9
+ export interface DeclaredToolchain {
10
+ name: string;
11
+ version: string;
12
+ /** Digest of the executable, image, lock, or immutable toolchain manifest. */
13
+ digest: string;
14
+ }
15
+ export interface BuildInputDeclaration {
16
+ name: string;
17
+ path: string;
18
+ }
19
+ export interface ToolchainDeclaration {
20
+ name: string;
21
+ version: string;
22
+ /** Local executable or immutable manifest to hash; not embedded in evidence. */
23
+ path: string;
24
+ }
25
+ export interface BuildEvidence {
26
+ contractVersion: 1;
27
+ assurance: 'declared-unsigned';
28
+ sourceStateId: string;
29
+ buildInputs: readonly DeclaredBuildInput[];
30
+ toolchains: readonly DeclaredToolchain[];
31
+ evidenceDigest: string;
32
+ }
33
+ /**
34
+ * Bind explicitly declared non-Git inputs and toolchains to one Git-visible
35
+ * source state. This does not claim completeness; policy decides which
36
+ * declarations are required for a release profile.
37
+ */
38
+ export declare function createBuildEvidence(sourceState: ExactSourceState, buildInputs: readonly DeclaredBuildInput[], toolchains: readonly DeclaredToolchain[]): BuildEvidence;
39
+ /**
40
+ * Recompute declared evidence from local bytes. It does not prove the
41
+ * declaration set is complete and does not sign or authorize a release.
42
+ */
43
+ export declare function captureBuildEvidence(repoPath: string, sourceState: ExactSourceState, buildInputs: readonly BuildInputDeclaration[], toolchains: readonly ToolchainDeclaration[]): BuildEvidence;
44
+ export declare function recomputeBuildEvidence(repoPath: string, expected: BuildEvidence, toolchains: readonly ToolchainDeclaration[]): BuildEvidence;
45
+ export declare function buildEvidenceMatches(expected: BuildEvidence, actual: BuildEvidence): boolean;
46
+ //# sourceMappingURL=build-evidence.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"build-evidence.d.ts","sourceRoot":"","sources":["../../src/harness/build-evidence.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAK/B,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,CAAC,CAAC;IACnB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC3C,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;CACxB;AAkDD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,gBAAgB,EAC7B,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAC1C,UAAU,EAAE,SAAS,iBAAiB,EAAE,GACvC,aAAa,CAiCf;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,gBAAgB,EAC7B,WAAW,EAAE,SAAS,qBAAqB,EAAE,EAC7C,UAAU,EAAE,SAAS,oBAAoB,EAAE,GAC1C,aAAa,CAwBf;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,aAAa,EACvB,UAAU,EAAE,SAAS,oBAAoB,EAAE,GAC1C,aAAa,CAWf;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAG5F"}
@@ -0,0 +1,126 @@
1
+ import { createHash } from 'node:crypto';
2
+ import { lstatSync, readFileSync, readlinkSync, realpathSync } from 'node:fs';
3
+ import { isAbsolute, relative, resolve, sep } from 'node:path';
4
+ import { canonicalJson, captureRepositorySourceState, } from './repository-state.js';
5
+ import { portableCaseFold } from './portable-case-fold.js';
6
+ const DIGEST = /^sha256:[0-9a-f]{64}$/;
7
+ function compare(left, right) {
8
+ return left < right ? -1 : left > right ? 1 : 0;
9
+ }
10
+ function requireText(value, label) {
11
+ const result = value.trim();
12
+ if (!result)
13
+ throw new Error(`${label} must be non-empty`);
14
+ return result;
15
+ }
16
+ function requireDigest(value, label) {
17
+ if (!DIGEST.test(value))
18
+ throw new Error(`${label} must be a canonical sha256 digest`);
19
+ return value;
20
+ }
21
+ function normalizePath(value) {
22
+ const path = requireText(value, 'build input path');
23
+ if (path.includes('\\')
24
+ || path.startsWith('/')
25
+ || path.startsWith('-')
26
+ || path !== path.normalize('NFC')
27
+ || path.split('/').some((part) => !part || part === '.' || part === '..')) {
28
+ throw new Error(`unsafe build input path: ${value}`);
29
+ }
30
+ return path;
31
+ }
32
+ function sha256(value) {
33
+ return `sha256:${createHash('sha256').update(value).digest('hex')}`;
34
+ }
35
+ function digestPath(path, followSymlink) {
36
+ const resolved = followSymlink ? realpathSync(path) : path;
37
+ const stat = lstatSync(resolved);
38
+ const content = stat.isSymbolicLink()
39
+ ? Buffer.from(readlinkSync(resolved), 'utf8')
40
+ : stat.isFile()
41
+ ? readFileSync(resolved)
42
+ : undefined;
43
+ if (!content)
44
+ throw new Error(`build evidence path is not a file or symlink: ${path}`);
45
+ return {
46
+ digest: `sha256:${createHash('sha256').update(content).digest('hex')}`,
47
+ bytes: content.byteLength,
48
+ };
49
+ }
50
+ /**
51
+ * Bind explicitly declared non-Git inputs and toolchains to one Git-visible
52
+ * source state. This does not claim completeness; policy decides which
53
+ * declarations are required for a release profile.
54
+ */
55
+ export function createBuildEvidence(sourceState, buildInputs, toolchains) {
56
+ const inputs = buildInputs.map((input) => ({
57
+ name: requireText(input.name, 'build input name'),
58
+ path: normalizePath(input.path),
59
+ digest: requireDigest(input.digest, 'build input digest'),
60
+ bytes: input.bytes,
61
+ })).sort((left, right) => compare(left.path, right.path) || compare(left.name, right.name));
62
+ const tools = toolchains.map((toolchain) => ({
63
+ name: requireText(toolchain.name, 'toolchain name'),
64
+ version: requireText(toolchain.version, 'toolchain version'),
65
+ digest: requireDigest(toolchain.digest, 'toolchain digest'),
66
+ })).sort((left, right) => compare(left.name, right.name) || compare(left.version, right.version));
67
+ if (inputs.some(({ bytes }) => !Number.isSafeInteger(bytes) || bytes < 0)) {
68
+ throw new Error('build input bytes must be a non-negative safe integer');
69
+ }
70
+ const inputKeys = inputs.map(({ name, path }) => `${name}\0${path}`);
71
+ if (new Set(inputKeys).size !== inputKeys.length)
72
+ throw new Error('duplicate declared build input');
73
+ const foldedPaths = inputs.map(({ path }) => portableCaseFold(path));
74
+ if (new Set(foldedPaths).size !== foldedPaths.length) {
75
+ throw new Error('case-fold collision in declared build inputs');
76
+ }
77
+ const toolKeys = tools.map(({ name, version }) => `${name}\0${version}`);
78
+ if (new Set(toolKeys).size !== toolKeys.length)
79
+ throw new Error('duplicate declared toolchain');
80
+ const body = {
81
+ contractVersion: 1,
82
+ assurance: 'declared-unsigned',
83
+ sourceStateId: requireDigest(sourceState.sourceStateId, 'source state id'),
84
+ buildInputs: inputs,
85
+ toolchains: tools,
86
+ };
87
+ return { ...body, evidenceDigest: sha256(canonicalJson(body)) };
88
+ }
89
+ /**
90
+ * Recompute declared evidence from local bytes. It does not prove the
91
+ * declaration set is complete and does not sign or authorize a release.
92
+ */
93
+ export function captureBuildEvidence(repoPath, sourceState, buildInputs, toolchains) {
94
+ const repoRoot = realpathSync(resolve(repoPath));
95
+ if (captureRepositorySourceState(repoRoot).sourceStateId !== sourceState.sourceStateId) {
96
+ throw new Error('Git-visible source state does not match the build evidence request');
97
+ }
98
+ const inputs = buildInputs.map((declaration) => {
99
+ const path = normalizePath(declaration.path);
100
+ const absolute = resolve(repoRoot, path);
101
+ const real = realpathSync(absolute);
102
+ const rel = relative(repoRoot, real);
103
+ if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
104
+ throw new Error(`build input escapes repository: ${path}`);
105
+ }
106
+ return { name: declaration.name, path, ...digestPath(real, true) };
107
+ });
108
+ const tools = toolchains.map((declaration) => ({
109
+ name: declaration.name,
110
+ version: declaration.version,
111
+ digest: digestPath(isAbsolute(declaration.path) ? declaration.path : resolve(repoRoot, declaration.path), true).digest,
112
+ }));
113
+ return createBuildEvidence(sourceState, inputs, tools);
114
+ }
115
+ export function recomputeBuildEvidence(repoPath, expected, toolchains) {
116
+ const sourceState = captureRepositorySourceState(repoPath);
117
+ if (sourceState.sourceStateId !== expected.sourceStateId) {
118
+ throw new Error('Git-visible source state changed before build evidence recomputation');
119
+ }
120
+ return captureBuildEvidence(repoPath, sourceState, expected.buildInputs.map(({ name, path }) => ({ name, path })), toolchains);
121
+ }
122
+ export function buildEvidenceMatches(expected, actual) {
123
+ return expected.evidenceDigest === actual.evidenceDigest
124
+ && expected.sourceStateId === actual.sourceStateId;
125
+ }
126
+ //# sourceMappingURL=build-evidence.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"build-evidence.js","sourceRoot":"","sources":["../../src/harness/build-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EACL,aAAa,EACb,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAsCvC,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACpD,IACE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;WAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;WACpB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;WACpB,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;WAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,aAAsB;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;YACb,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;IACvF,OAAO;QACL,MAAM,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACtE,KAAK,EAAE,OAAO,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA6B,EAC7B,WAA0C,EAC1C,UAAwC;IAExC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,kBAAkB,CAAC;QACjD,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/B,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC;QACzD,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC;QACnD,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;QAC5D,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC;KAC5D,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAElG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IACzE,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAEhG,MAAM,IAAI,GAAG;QACX,eAAe,EAAE,CAAU;QAC3B,SAAS,EAAE,mBAA4B;QACvC,aAAa,EAAE,aAAa,CAAC,WAAW,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAC1E,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,KAAK;KAClB,CAAC;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,WAA6B,EAC7B,WAA6C,EAC7C,UAA2C;IAE3C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAsB,EAAE;QACjE,MAAM,IAAI,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,WAAW,EAAqB,EAAE,CAAC,CAAC;QAChE,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,MAAM,EAAE,UAAU,CAChB,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,EACrF,IAAI,CACL,CAAC,MAAM;KACT,CAAC,CAAC,CAAC;IACJ,OAAO,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,QAAuB,EACvB,UAA2C;IAE3C,MAAM,WAAW,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,oBAAoB,CACzB,QAAQ,EACR,WAAW,EACX,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9D,UAAU,CACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAuB,EAAE,MAAqB;IACjF,OAAO,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;WACnD,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,CAAC;AACvD,CAAC"}
@@ -0,0 +1,153 @@
1
+ /**
2
+ * Advisory repository-harness contract.
3
+ *
4
+ * Repository harnesses coordinate local ownership and collect evidence. They do
5
+ * not grant Ruflo policy capabilities. Existing harnesses can implement only
6
+ * `describe`; omitted operations remain unavailable and the descriptor
7
+ * normalizes to observe-only compatibility mode.
8
+ */
9
+ import type { ExactSourceState } from './repository-state.js';
10
+ import type { BuildEvidence } from './build-evidence.js';
11
+ export type HarnessMode = 'observe' | 'enforce';
12
+ export type HarnessCapability = 'sessions' | 'leases' | 'lease-fencing' | 'messages' | 'message-acknowledgement' | 'run-evidence' | 'exact-source-state' | 'release-decisions';
13
+ interface HarnessDescriptorBase {
14
+ contractVersion: 1;
15
+ harnessId: string;
16
+ }
17
+ export interface InMemoryReferenceHarnessDescriptor extends HarnessDescriptorBase {
18
+ mode: 'observe';
19
+ capabilities: readonly Exclude<HarnessCapability, 'release-decisions'>[];
20
+ advisory: true;
21
+ assurance: 'in-memory-reference';
22
+ }
23
+ export interface ExternalAuthorityHarnessDescriptor extends HarnessDescriptorBase {
24
+ mode: HarnessMode;
25
+ capabilities: readonly HarnessCapability[];
26
+ advisory: false;
27
+ assurance: 'external-authority';
28
+ }
29
+ export type HarnessDescriptor = InMemoryReferenceHarnessDescriptor | ExternalAuthorityHarnessDescriptor;
30
+ /** Shape accepted from pre-contract local harnesses. */
31
+ export interface LegacyHarnessDescriptor {
32
+ harnessId?: string;
33
+ name?: string;
34
+ mode?: HarnessMode;
35
+ capabilities?: readonly string[];
36
+ }
37
+ export interface StartSessionRequest {
38
+ sessionId: string;
39
+ workloadId: string;
40
+ repositoryId: string;
41
+ worktreeId: string;
42
+ readOnly: boolean;
43
+ }
44
+ export interface HarnessSession {
45
+ sessionId: string;
46
+ workloadId: string;
47
+ repositoryId: string;
48
+ worktreeId: string;
49
+ startedAt: string;
50
+ }
51
+ export interface LeaseRequest {
52
+ sessionId: string;
53
+ repositoryId: string;
54
+ worktreeId: string;
55
+ kind: 'path' | 'resource';
56
+ scopes: readonly string[];
57
+ ttlMs: number;
58
+ }
59
+ export interface FencedLease {
60
+ leaseId: string;
61
+ repositoryId: string;
62
+ sessionId: string;
63
+ workloadId: string;
64
+ worktreeId: string;
65
+ kind: 'path' | 'resource';
66
+ scopes: readonly string[];
67
+ /** Decimal strings avoid losing 64-bit epochs when receipts cross JSON. */
68
+ epoch: string;
69
+ version: string;
70
+ issuedAt: string;
71
+ expiresAt: string;
72
+ advisory: boolean;
73
+ }
74
+ export interface HarnessMessage {
75
+ messageId: string;
76
+ issuer: string;
77
+ audience: string;
78
+ correlationId?: string;
79
+ causationId?: string;
80
+ sequence: string;
81
+ expiresAt?: string;
82
+ contentDigest: string;
83
+ content: unknown;
84
+ }
85
+ export interface MessageReceipt {
86
+ messageId: string;
87
+ acceptedAt: string;
88
+ duplicate: boolean;
89
+ }
90
+ export interface RunEvidence {
91
+ executionId: string;
92
+ sessionId: string;
93
+ workloadId: string;
94
+ sourceState: ExactSourceState;
95
+ /** Optional for legacy/debug runs; release policy may require it. */
96
+ buildEvidence?: BuildEvidence;
97
+ commandDigest: string;
98
+ scope: string;
99
+ profile: 'focused' | 'integration' | 'release';
100
+ startedAt: string;
101
+ completedAt: string;
102
+ exitCode: number;
103
+ evidenceDigest: string;
104
+ policyReceiptId?: string;
105
+ leaseEpochs?: Readonly<Record<string, string>>;
106
+ }
107
+ export interface RunReceipt extends RunEvidence {
108
+ receiptId: string;
109
+ recordedAt: string;
110
+ }
111
+ export interface ReleaseRequest {
112
+ repositoryId: string;
113
+ sourceStateId: string;
114
+ artifactDigest: string;
115
+ runReceiptIds: readonly string[];
116
+ /** Optional for compatibility; enforce-mode release policy may require it. */
117
+ buildEvidence?: BuildEvidence;
118
+ capabilityId?: string;
119
+ }
120
+ export interface ReleaseDecision {
121
+ allowed: boolean;
122
+ dryRun: boolean;
123
+ reason: string;
124
+ policyReceiptId?: string;
125
+ }
126
+ /**
127
+ * Progressive adapter surface. Optional methods preserve compatibility with
128
+ * local harnesses that predate sessions, fencing, durable messages, or exact
129
+ * source-state receipts. Callers must feature-detect every optional operation.
130
+ */
131
+ export interface RepositoryHarnessAdapter {
132
+ describe(): Promise<HarnessDescriptor | LegacyHarnessDescriptor>;
133
+ start?(request: StartSessionRequest): Promise<HarnessSession>;
134
+ acquire?(request: LeaseRequest): Promise<FencedLease>;
135
+ renew?(lease: FencedLease): Promise<FencedLease>;
136
+ release?(lease: FencedLease): Promise<void>;
137
+ send?(message: HarnessMessage): Promise<MessageReceipt>;
138
+ receive?(cursor?: string): AsyncIterable<HarnessMessage>;
139
+ acknowledge?(messageId: string): Promise<void>;
140
+ recordRun?(run: RunEvidence): Promise<RunReceipt>;
141
+ authorizeRelease?(request: ReleaseRequest): Promise<ReleaseDecision>;
142
+ end?(sessionId: string): Promise<void>;
143
+ }
144
+ /**
145
+ * Convert an older descriptor to the safe v1 reference baseline.
146
+ *
147
+ * Unknown and authority-bearing capabilities are ignored. A legacy descriptor
148
+ * can never self-assert enforce or release authority through this compatibility
149
+ * function. A separately verified external adapter is required for that.
150
+ */
151
+ export declare function normalizeHarnessDescriptor(input: HarnessDescriptor | LegacyHarnessDescriptor): InMemoryReferenceHarnessDescriptor;
152
+ export {};
153
+ //# sourceMappingURL=contract.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/harness/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAChD,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,QAAQ,GACR,eAAe,GACf,UAAU,GACV,yBAAyB,GACzB,cAAc,GACd,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,UAAU,qBAAqB;IAC7B,eAAe,EAAE,CAAC,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kCAAmC,SAAQ,qBAAqB;IAC/E,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,EAAE,SAAS,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,EAAE,CAAC;IACzE,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,MAAM,WAAW,kCAAmC,SAAQ,qBAAqB;IAC/E,IAAI,EAAE,WAAW,CAAC;IAClB,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,oBAAoB,CAAC;CACjC;AAED,MAAM,MAAM,iBAAiB,GACzB,kCAAkC,GAClC,kCAAkC,CAAC;AAEvC,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,qEAAqE;IACrE,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8EAA8E;IAC9E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,IAAI,OAAO,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,CAAC;IACjE,KAAK,CAAC,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,KAAK,CAAC,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IACzD,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAClD,gBAAgB,CAAC,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrE,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,iBAAiB,GAAG,uBAAuB,GACjD,kCAAkC,CAuBpC"}
@@ -0,0 +1,44 @@
1
+ /**
2
+ * Advisory repository-harness contract.
3
+ *
4
+ * Repository harnesses coordinate local ownership and collect evidence. They do
5
+ * not grant Ruflo policy capabilities. Existing harnesses can implement only
6
+ * `describe`; omitted operations remain unavailable and the descriptor
7
+ * normalizes to observe-only compatibility mode.
8
+ */
9
+ const CAPABILITIES = new Set([
10
+ 'sessions',
11
+ 'leases',
12
+ 'lease-fencing',
13
+ 'messages',
14
+ 'message-acknowledgement',
15
+ 'run-evidence',
16
+ 'exact-source-state',
17
+ 'release-decisions',
18
+ ]);
19
+ /**
20
+ * Convert an older descriptor to the safe v1 reference baseline.
21
+ *
22
+ * Unknown and authority-bearing capabilities are ignored. A legacy descriptor
23
+ * can never self-assert enforce or release authority through this compatibility
24
+ * function. A separately verified external adapter is required for that.
25
+ */
26
+ export function normalizeHarnessDescriptor(input) {
27
+ const harnessId = input.harnessId ?? ('name' in input ? input.name : undefined);
28
+ if (typeof harnessId !== 'string' || harnessId.trim().length === 0) {
29
+ throw new Error('repository harness descriptor requires a non-empty harnessId');
30
+ }
31
+ const requested = Array.isArray(input.capabilities) ? input.capabilities : [];
32
+ const capabilities = [...new Set(requested.filter((value) => (CAPABILITIES.has(value)
33
+ && value !== 'release-decisions')))];
34
+ capabilities.sort();
35
+ return {
36
+ contractVersion: 1,
37
+ harnessId: harnessId.trim(),
38
+ mode: 'observe',
39
+ capabilities,
40
+ advisory: true,
41
+ assurance: 'in-memory-reference',
42
+ };
43
+ }
44
+ //# sourceMappingURL=contract.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/harness/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAqKH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAoB;IAC9C,UAAU;IACV,QAAQ;IACR,eAAe;IACf,UAAU;IACV,yBAAyB;IACzB,cAAc;IACd,oBAAoB;IACpB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAkD;IAElD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,YAAY,GAA2D,CAAC,GAAG,IAAI,GAAG,CACtF,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,CACtD,YAAY,CAAC,GAAG,CAAC,KAA0B,CAAC;eACzC,KAAK,KAAK,mBAAmB,CACjC,CAAC,CACH,CAA2D,CAAC;IAC7D,YAAY,CAAC,IAAI,EAAE,CAAC;IAEpB,OAAO;QACL,eAAe,EAAE,CAAC;QAClB,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;QAC3B,IAAI,EAAE,SAAS;QACf,YAAY;QACZ,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,qBAAqB;KACjC,CAAC;AACJ,CAAC"}
@@ -0,0 +1,33 @@
1
+ import type { FencedLease, LeaseRequest } from './contract.js';
2
+ export interface FencedLeaseRequest extends LeaseRequest {
3
+ workloadId: string;
4
+ }
5
+ export type InMemoryFenceRefusal = 'invalid-request' | 'scope-conflict' | 'stale-fence' | 'expired-fence' | 'unknown-lease';
6
+ export declare class InMemoryFenceReferenceError extends Error {
7
+ readonly reason: InMemoryFenceRefusal;
8
+ constructor(reason: InMemoryFenceRefusal, detail: string);
9
+ }
10
+ /**
11
+ * Unsigned, non-durable, single-process conformance reference.
12
+ *
13
+ * JavaScript executes each method without an await boundary, so compare,
14
+ * validate, and mutate form one atomic critical section. Distributed adapters
15
+ * must provide the same semantics with a CP store. This class cannot satisfy an
16
+ * enforce-mode policy decision or authorize release/external side effects.
17
+ */
18
+ export declare class InMemoryFencedLeaseReference {
19
+ private readonly now;
20
+ /** This model is local, unsigned, and never an enforce-mode policy authority. */
21
+ readonly referenceOnly = true;
22
+ private readonly leases;
23
+ private readonly repositoryEpoch;
24
+ constructor(now?: () => number);
25
+ acquire(request: FencedLeaseRequest): FencedLease;
26
+ renew(presented: FencedLease, ttlMs: number): FencedLease;
27
+ release(presented: FencedLease): void;
28
+ assertCurrentFence(presented: FencedLease): void;
29
+ current(repositoryId?: string): FencedLease[];
30
+ private assertStoredFence;
31
+ private pruneExpired;
32
+ }
33
+ //# sourceMappingURL=in-memory-fenced-lease-reference.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"in-memory-fenced-lease-reference.d.ts","sourceRoot":"","sources":["../../src/harness/in-memory-fenced-lease-reference.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAI/D,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,gBAAgB,GAChB,aAAa,GACb,eAAe,GACf,eAAe,CAAC;AAEpB,qBAAa,2BAA4B,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,oBAAoB;gBAA5B,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM;CAGlE;AAsDD;;;;;;;GAOG;AACH,qBAAa,4BAA4B;IAM3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IALhC,iFAAiF;IACjF,QAAQ,CAAC,aAAa,QAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;gBAEhC,GAAG,GAAE,MAAM,MAAiB;IAEzD,OAAO,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW;IA4CjD,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW;IAwBzD,OAAO,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI;IAKrC,kBAAkB,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI;IAQhD,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE;IAS7C,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,YAAY;CAKrB"}
@@ -0,0 +1,175 @@
1
+ import { randomUUID } from 'node:crypto';
2
+ import { portableCaseFold } from './portable-case-fold.js';
3
+ import { parseCanonicalUnsigned } from './unsigned-integer.js';
4
+ export class InMemoryFenceReferenceError extends Error {
5
+ reason;
6
+ constructor(reason, detail) {
7
+ super(detail);
8
+ this.reason = reason;
9
+ }
10
+ }
11
+ function compare(left, right) {
12
+ return left < right ? -1 : left > right ? 1 : 0;
13
+ }
14
+ function text(value, label) {
15
+ const result = value.trim();
16
+ if (!result)
17
+ throw new InMemoryFenceReferenceError('invalid-request', `${label} must be non-empty`);
18
+ return result;
19
+ }
20
+ function normalizeScope(kind, value) {
21
+ const scope = text(value, 'lease scope');
22
+ if (scope.startsWith('-') || scope.includes('\\') || scope !== scope.normalize('NFC')) {
23
+ throw new InMemoryFenceReferenceError('invalid-request', `unsafe lease scope: ${value}`);
24
+ }
25
+ if (kind === 'resource') {
26
+ if (scope.includes('/') || scope === '.' || scope === '..') {
27
+ throw new InMemoryFenceReferenceError('invalid-request', `invalid named resource: ${value}`);
28
+ }
29
+ return scope;
30
+ }
31
+ if (scope.startsWith('/')
32
+ || scope.split('/').some((part) => !part || part === '.' || part === '..')) {
33
+ throw new InMemoryFenceReferenceError('invalid-request', `invalid path scope: ${value}`);
34
+ }
35
+ return scope;
36
+ }
37
+ function overlaps(kind, left, right) {
38
+ if (kind === 'resource')
39
+ return left === right;
40
+ const foldedLeft = portableCaseFold(left);
41
+ const foldedRight = portableCaseFold(right);
42
+ return foldedLeft === foldedRight
43
+ || foldedLeft.startsWith(`${foldedRight}/`)
44
+ || foldedRight.startsWith(`${foldedLeft}/`);
45
+ }
46
+ function sameStrings(left, right) {
47
+ return left.length === right.length && left.every((value, index) => value === right[index]);
48
+ }
49
+ function copyLease(lease) {
50
+ return { ...lease, scopes: [...lease.scopes] };
51
+ }
52
+ /**
53
+ * Unsigned, non-durable, single-process conformance reference.
54
+ *
55
+ * JavaScript executes each method without an await boundary, so compare,
56
+ * validate, and mutate form one atomic critical section. Distributed adapters
57
+ * must provide the same semantics with a CP store. This class cannot satisfy an
58
+ * enforce-mode policy decision or authorize release/external side effects.
59
+ */
60
+ export class InMemoryFencedLeaseReference {
61
+ now;
62
+ /** This model is local, unsigned, and never an enforce-mode policy authority. */
63
+ referenceOnly = true;
64
+ leases = new Map();
65
+ repositoryEpoch = new Map();
66
+ constructor(now = Date.now) {
67
+ this.now = now;
68
+ }
69
+ acquire(request) {
70
+ const repositoryId = text(request.repositoryId, 'repositoryId');
71
+ const scopes = [...new Set(request.scopes.map((scope) => normalizeScope(request.kind, scope)))]
72
+ .sort(compare);
73
+ if (!scopes.length || !Number.isSafeInteger(request.ttlMs) || request.ttlMs <= 0) {
74
+ throw new InMemoryFenceReferenceError('invalid-request', 'lease requires scopes and a positive safe ttlMs');
75
+ }
76
+ const now = this.now();
77
+ this.pruneExpired(now);
78
+ for (const stored of this.leases.values()) {
79
+ const current = stored.lease;
80
+ if (current.repositoryId !== repositoryId || current.kind !== request.kind)
81
+ continue;
82
+ if (current.scopes.some((held) => scopes.some((wanted) => overlaps(request.kind, held, wanted)))) {
83
+ throw new InMemoryFenceReferenceError('scope-conflict', `scope conflicts with active lease ${current.leaseId}`);
84
+ }
85
+ }
86
+ const epoch = (this.repositoryEpoch.get(repositoryId) ?? 0n) + 1n;
87
+ this.repositoryEpoch.set(repositoryId, epoch);
88
+ const expiresAtMs = now + request.ttlMs;
89
+ if (!Number.isSafeInteger(expiresAtMs)) {
90
+ throw new InMemoryFenceReferenceError('invalid-request', 'lease expiry exceeds safe timestamp range');
91
+ }
92
+ const lease = {
93
+ leaseId: `lease-${randomUUID()}`,
94
+ repositoryId,
95
+ sessionId: text(request.sessionId, 'sessionId'),
96
+ workloadId: text(request.workloadId, 'workloadId'),
97
+ worktreeId: text(request.worktreeId, 'worktreeId'),
98
+ kind: request.kind,
99
+ scopes,
100
+ epoch: epoch.toString(),
101
+ version: '1',
102
+ issuedAt: new Date(now).toISOString(),
103
+ expiresAt: new Date(expiresAtMs).toISOString(),
104
+ advisory: true,
105
+ };
106
+ this.leases.set(lease.leaseId, { lease, expiresAtMs });
107
+ return copyLease(lease);
108
+ }
109
+ renew(presented, ttlMs) {
110
+ if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0) {
111
+ throw new InMemoryFenceReferenceError('invalid-request', 'renewal requires a positive safe ttlMs');
112
+ }
113
+ const stored = this.assertStoredFence(presented);
114
+ const now = this.now();
115
+ if (stored.expiresAtMs <= now) {
116
+ this.leases.delete(presented.leaseId);
117
+ throw new InMemoryFenceReferenceError('expired-fence', `lease ${presented.leaseId} expired`);
118
+ }
119
+ const expiresAtMs = now + ttlMs;
120
+ if (!Number.isSafeInteger(expiresAtMs)) {
121
+ throw new InMemoryFenceReferenceError('invalid-request', 'lease expiry exceeds safe timestamp range');
122
+ }
123
+ const lease = {
124
+ ...stored.lease,
125
+ version: (parseCanonicalUnsigned(stored.lease.version, 'lease version') + 1n).toString(),
126
+ expiresAt: new Date(expiresAtMs).toISOString(),
127
+ scopes: [...stored.lease.scopes],
128
+ };
129
+ this.leases.set(lease.leaseId, { lease, expiresAtMs });
130
+ return copyLease(lease);
131
+ }
132
+ release(presented) {
133
+ this.assertCurrentFence(presented);
134
+ this.leases.delete(presented.leaseId);
135
+ }
136
+ assertCurrentFence(presented) {
137
+ const stored = this.assertStoredFence(presented);
138
+ if (stored.expiresAtMs <= this.now()) {
139
+ this.leases.delete(presented.leaseId);
140
+ throw new InMemoryFenceReferenceError('expired-fence', `lease ${presented.leaseId} expired`);
141
+ }
142
+ }
143
+ current(repositoryId) {
144
+ this.pruneExpired(this.now());
145
+ return [...this.leases.values()]
146
+ .map(({ lease }) => lease)
147
+ .filter((lease) => repositoryId === undefined || lease.repositoryId === repositoryId)
148
+ .sort((left, right) => compare(left.leaseId, right.leaseId))
149
+ .map(copyLease);
150
+ }
151
+ assertStoredFence(presented) {
152
+ const stored = this.leases.get(presented.leaseId);
153
+ if (!stored)
154
+ throw new InMemoryFenceReferenceError('unknown-lease', `unknown lease ${presented.leaseId}`);
155
+ const current = stored.lease;
156
+ if (current.repositoryId !== presented.repositoryId
157
+ || current.sessionId !== presented.sessionId
158
+ || current.workloadId !== presented.workloadId
159
+ || current.worktreeId !== presented.worktreeId
160
+ || current.kind !== presented.kind
161
+ || !sameStrings(current.scopes, presented.scopes)
162
+ || current.epoch !== presented.epoch
163
+ || current.version !== presented.version) {
164
+ throw new InMemoryFenceReferenceError('stale-fence', `stale or altered fence ${presented.leaseId}`);
165
+ }
166
+ return stored;
167
+ }
168
+ pruneExpired(now) {
169
+ for (const [leaseId, stored] of this.leases) {
170
+ if (stored.expiresAtMs <= now)
171
+ this.leases.delete(leaseId);
172
+ }
173
+ }
174
+ }
175
+ //# sourceMappingURL=in-memory-fenced-lease-reference.js.map