@claude-flow/cli 3.32.29 → 3.32.32
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/helpers/helpers.manifest.json +2 -2
- package/catalog-manifest.json +2 -2
- package/dist/src/autopilot-state.d.ts +10 -0
- package/dist/src/autopilot-state.js +16 -0
- package/dist/src/commands/autopilot.js +10 -4
- package/dist/src/init/claudemd-generator.js +53 -2
- package/dist/src/mcp-tools/autopilot-tools.js +18 -3
- package/dist/src/mcp-tools/capability-brain.js +22 -22
- package/dist/src/mcp-tools/guidance-tools.js +1 -1
- package/dist/src/services/harness-flywheel-runtime.d.ts +21 -1
- package/dist/src/services/harness-flywheel-runtime.js +46 -24
- package/node_modules/@claude-flow/codex/.agents/skills/memory-management/SKILL.md +45 -0
- package/node_modules/@claude-flow/codex/.agents/skills/security-audit/SKILL.md +46 -0
- package/node_modules/@claude-flow/codex/.agents/skills/sparc-methodology/SKILL.md +46 -0
- package/node_modules/@claude-flow/codex/.agents/skills/swarm-orchestration/SKILL.md +53 -0
- package/node_modules/@claude-flow/codex/README.md +1044 -0
- package/node_modules/@claude-flow/codex/dist/cli.d.ts +9 -0
- package/node_modules/@claude-flow/codex/dist/cli.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/cli.js +686 -0
- package/node_modules/@claude-flow/codex/dist/cli.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/cli.d.ts +17 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/cli.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/cli.js +278 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/cli.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/index.d.ts +8 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/index.js +7 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/index.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.d.ts +143 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.js +621 -0
- package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/generators/agents-md.d.ts +12 -0
- package/node_modules/@claude-flow/codex/dist/generators/agents-md.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/generators/agents-md.js +730 -0
- package/node_modules/@claude-flow/codex/dist/generators/agents-md.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/generators/config-toml.d.ts +74 -0
- package/node_modules/@claude-flow/codex/dist/generators/config-toml.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/generators/config-toml.js +922 -0
- package/node_modules/@claude-flow/codex/dist/generators/config-toml.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/generators/index.d.ts +9 -0
- package/node_modules/@claude-flow/codex/dist/generators/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/generators/index.js +9 -0
- package/node_modules/@claude-flow/codex/dist/generators/index.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/generators/skill-md.d.ts +20 -0
- package/node_modules/@claude-flow/codex/dist/generators/skill-md.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/generators/skill-md.js +951 -0
- package/node_modules/@claude-flow/codex/dist/generators/skill-md.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/build-evidence.d.ts +46 -0
- package/node_modules/@claude-flow/codex/dist/harness/build-evidence.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/build-evidence.js +126 -0
- package/node_modules/@claude-flow/codex/dist/harness/build-evidence.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/contract.d.ts +153 -0
- package/node_modules/@claude-flow/codex/dist/harness/contract.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/contract.js +44 -0
- package/node_modules/@claude-flow/codex/dist/harness/contract.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-fenced-lease-reference.d.ts +33 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-fenced-lease-reference.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-fenced-lease-reference.js +175 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-fenced-lease-reference.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-inbox-reference.d.ts +42 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-inbox-reference.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-inbox-reference.js +140 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-inbox-reference.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-run-receipt-reference.d.ts +19 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-run-receipt-reference.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-run-receipt-reference.js +79 -0
- package/node_modules/@claude-flow/codex/dist/harness/in-memory-run-receipt-reference.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/index.d.ts +9 -0
- package/node_modules/@claude-flow/codex/dist/harness/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/index.js +9 -0
- package/node_modules/@claude-flow/codex/dist/harness/index.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/portable-case-fold.d.ts +8 -0
- package/node_modules/@claude-flow/codex/dist/harness/portable-case-fold.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/portable-case-fold.js +10 -0
- package/node_modules/@claude-flow/codex/dist/harness/portable-case-fold.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/repository-state.d.ts +68 -0
- package/node_modules/@claude-flow/codex/dist/harness/repository-state.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/repository-state.js +403 -0
- package/node_modules/@claude-flow/codex/dist/harness/repository-state.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/unsigned-integer.d.ts +3 -0
- package/node_modules/@claude-flow/codex/dist/harness/unsigned-integer.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/harness/unsigned-integer.js +14 -0
- package/node_modules/@claude-flow/codex/dist/harness/unsigned-integer.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/index.d.ts +53 -0
- package/node_modules/@claude-flow/codex/dist/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/index.js +54 -0
- package/node_modules/@claude-flow/codex/dist/index.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/initializer.d.ts +98 -0
- package/node_modules/@claude-flow/codex/dist/initializer.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/initializer.js +795 -0
- package/node_modules/@claude-flow/codex/dist/initializer.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/loop/cli.d.ts +3 -0
- package/node_modules/@claude-flow/codex/dist/loop/cli.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/loop/cli.js +123 -0
- package/node_modules/@claude-flow/codex/dist/loop/cli.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/loop/index.d.ts +58 -0
- package/node_modules/@claude-flow/codex/dist/loop/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/loop/index.js +230 -0
- package/node_modules/@claude-flow/codex/dist/loop/index.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/mcp-config.d.ts +28 -0
- package/node_modules/@claude-flow/codex/dist/mcp-config.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/mcp-config.js +121 -0
- package/node_modules/@claude-flow/codex/dist/mcp-config.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/migrations/index.d.ts +114 -0
- package/node_modules/@claude-flow/codex/dist/migrations/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/migrations/index.js +880 -0
- package/node_modules/@claude-flow/codex/dist/migrations/index.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/templates/index.d.ts +92 -0
- package/node_modules/@claude-flow/codex/dist/templates/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/templates/index.js +284 -0
- package/node_modules/@claude-flow/codex/dist/templates/index.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/types.d.ts +240 -0
- package/node_modules/@claude-flow/codex/dist/types.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/types.js +8 -0
- package/node_modules/@claude-flow/codex/dist/types.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/validators/index.d.ts +42 -0
- package/node_modules/@claude-flow/codex/dist/validators/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/validators/index.js +929 -0
- package/node_modules/@claude-flow/codex/dist/validators/index.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/worktrees/coordinator.d.ts +37 -0
- package/node_modules/@claude-flow/codex/dist/worktrees/coordinator.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/worktrees/coordinator.js +137 -0
- package/node_modules/@claude-flow/codex/dist/worktrees/coordinator.js.map +1 -0
- package/node_modules/@claude-flow/codex/dist/worktrees/index.d.ts +2 -0
- package/node_modules/@claude-flow/codex/dist/worktrees/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/codex/dist/worktrees/index.js +2 -0
- package/node_modules/@claude-flow/codex/dist/worktrees/index.js.map +1 -0
- package/node_modules/@claude-flow/codex/package.json +122 -0
- package/node_modules/@claude-flow/plugin-agent-federation/README.md +49 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/agent-card.d.ts +130 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/agent-card.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/agent-card.js +239 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/agent-card.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.d.ts +34 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.js +69 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.d.ts +46 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.js +84 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.d.ts +27 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.js +46 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-breaker-service.d.ts +192 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-breaker-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-breaker-service.js +253 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-breaker-service.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.d.ts +211 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.js +501 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/inbound-dispatcher.d.ts +114 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/inbound-dispatcher.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/inbound-dispatcher.js +356 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/inbound-dispatcher.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/policy-engine.d.ts +41 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/policy-engine.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/policy-engine.js +184 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/policy-engine.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/spend-reporter.d.ts +150 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/spend-reporter.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/spend-reporter.js +128 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/spend-reporter.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/trust-evaluator.d.ts +74 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/trust-evaluator.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/trust-evaluator.js +179 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/trust-evaluator.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/bin.d.ts +13 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/bin.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/bin.js +189 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/bin.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/cli-commands.d.ts +7 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/cli-commands.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/cli-commands.js +317 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/cli-commands.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-envelope.d.ts +45 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-envelope.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-envelope.js +71 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-envelope.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-node.d.ts +104 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-node.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-node.js +152 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-node.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-session.d.ts +55 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-session.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-session.js +105 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/federation-session.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/trust-level.d.ts +17 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/trust-level.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/trust-level.js +35 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/entities/trust-level.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/audit-service.d.ts +69 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/audit-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/audit-service.js +149 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/audit-service.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/discovery-service.d.ts +68 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/discovery-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/discovery-service.js +161 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/discovery-service.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/handshake-service.d.ts +58 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/handshake-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/handshake-service.js +122 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/handshake-service.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/pii-pipeline-service.d.ts +65 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/pii-pipeline-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/pii-pipeline-service.js +208 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/pii-pipeline-service.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.d.ts +51 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.js +147 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-firewall-service.d.ts +71 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-firewall-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-firewall-service.js +194 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-firewall-service.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-mesh-service.d.ts +156 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-mesh-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-mesh-service.js +292 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-mesh-service.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.d.ts +98 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.js +122 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.d.ts +89 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.js +165 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.d.ts +92 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.js +100 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.d.ts +70 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.js +104 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/index.d.ts +23 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/index.js +24 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/index.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/mcp-tools.d.ts +10 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/mcp-tools.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/mcp-tools.js +439 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/mcp-tools.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.d.ts +19 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.js +515 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/transport/midstream-aware-loader.d.ts +72 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/transport/midstream-aware-loader.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/transport/midstream-aware-loader.js +269 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/transport/midstream-aware-loader.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/version.d.ts +3 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/version.d.ts.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/version.js +3 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/version.js.map +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/package.json +64 -0
- package/node_modules/@claude-flow/security/README.md +292 -0
- package/node_modules/@claude-flow/security/dist/CVE-REMEDIATION.d.ts +97 -0
- package/node_modules/@claude-flow/security/dist/CVE-REMEDIATION.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/CVE-REMEDIATION.js +537 -0
- package/node_modules/@claude-flow/security/dist/CVE-REMEDIATION.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/application/index.d.ts +7 -0
- package/node_modules/@claude-flow/security/dist/application/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/application/index.js +7 -0
- package/node_modules/@claude-flow/security/dist/application/index.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/application/services/security-application-service.d.ts +71 -0
- package/node_modules/@claude-flow/security/dist/application/services/security-application-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/application/services/security-application-service.js +153 -0
- package/node_modules/@claude-flow/security/dist/application/services/security-application-service.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/authorization/propagator.d.ts +148 -0
- package/node_modules/@claude-flow/security/dist/authorization/propagator.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/authorization/propagator.js +182 -0
- package/node_modules/@claude-flow/security/dist/authorization/propagator.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/credential-generator.d.ts +176 -0
- package/node_modules/@claude-flow/security/dist/credential-generator.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/credential-generator.js +272 -0
- package/node_modules/@claude-flow/security/dist/credential-generator.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/domain/entities/security-context.d.ts +68 -0
- package/node_modules/@claude-flow/security/dist/domain/entities/security-context.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/domain/entities/security-context.js +132 -0
- package/node_modules/@claude-flow/security/dist/domain/entities/security-context.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/domain/index.d.ts +8 -0
- package/node_modules/@claude-flow/security/dist/domain/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/domain/index.js +8 -0
- package/node_modules/@claude-flow/security/dist/domain/index.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/domain/services/security-domain-service.d.ts +71 -0
- package/node_modules/@claude-flow/security/dist/domain/services/security-domain-service.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/domain/services/security-domain-service.js +237 -0
- package/node_modules/@claude-flow/security/dist/domain/services/security-domain-service.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/index.d.ts +129 -0
- package/node_modules/@claude-flow/security/dist/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/index.js +176 -0
- package/node_modules/@claude-flow/security/dist/index.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/input-validator.d.ts +306 -0
- package/node_modules/@claude-flow/security/dist/input-validator.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/input-validator.js +393 -0
- package/node_modules/@claude-flow/security/dist/input-validator.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/keychain-adapter.d.ts +48 -0
- package/node_modules/@claude-flow/security/dist/keychain-adapter.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/keychain-adapter.js +0 -0
- package/node_modules/@claude-flow/security/dist/keychain-adapter.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/mcp-composition-inspector.d.ts +133 -0
- package/node_modules/@claude-flow/security/dist/mcp-composition-inspector.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/mcp-composition-inspector.js +254 -0
- package/node_modules/@claude-flow/security/dist/mcp-composition-inspector.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/oauth/browser.d.ts +31 -0
- package/node_modules/@claude-flow/security/dist/oauth/browser.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/oauth/browser.js +55 -0
- package/node_modules/@claude-flow/security/dist/oauth/browser.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/oauth/callback-server.d.ts +37 -0
- package/node_modules/@claude-flow/security/dist/oauth/callback-server.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/oauth/callback-server.js +86 -0
- package/node_modules/@claude-flow/security/dist/oauth/callback-server.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/oauth/client.d.ts +57 -0
- package/node_modules/@claude-flow/security/dist/oauth/client.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/oauth/client.js +120 -0
- package/node_modules/@claude-flow/security/dist/oauth/client.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/oauth/pkce.d.ts +25 -0
- package/node_modules/@claude-flow/security/dist/oauth/pkce.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/oauth/pkce.js +36 -0
- package/node_modules/@claude-flow/security/dist/oauth/pkce.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/password-hasher.d.ts +128 -0
- package/node_modules/@claude-flow/security/dist/password-hasher.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/password-hasher.js +190 -0
- package/node_modules/@claude-flow/security/dist/password-hasher.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/path-validator.d.ts +148 -0
- package/node_modules/@claude-flow/security/dist/path-validator.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/path-validator.js +421 -0
- package/node_modules/@claude-flow/security/dist/path-validator.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/plugins/integrity-verifier.d.ts +125 -0
- package/node_modules/@claude-flow/security/dist/plugins/integrity-verifier.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/plugins/integrity-verifier.js +186 -0
- package/node_modules/@claude-flow/security/dist/plugins/integrity-verifier.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/canonical.d.ts +5 -0
- package/node_modules/@claude-flow/security/dist/policy/canonical.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/canonical.js +30 -0
- package/node_modules/@claude-flow/security/dist/policy/canonical.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/engine.d.ts +34 -0
- package/node_modules/@claude-flow/security/dist/policy/engine.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/engine.js +285 -0
- package/node_modules/@claude-flow/security/dist/policy/engine.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/envelope.d.ts +9 -0
- package/node_modules/@claude-flow/security/dist/policy/envelope.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/envelope.js +90 -0
- package/node_modules/@claude-flow/security/dist/policy/envelope.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/evaluator.d.ts +4 -0
- package/node_modules/@claude-flow/security/dist/policy/evaluator.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/evaluator.js +119 -0
- package/node_modules/@claude-flow/security/dist/policy/evaluator.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/index.d.ts +7 -0
- package/node_modules/@claude-flow/security/dist/policy/index.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/index.js +7 -0
- package/node_modules/@claude-flow/security/dist/policy/index.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/product-plane.d.ts +238 -0
- package/node_modules/@claude-flow/security/dist/policy/product-plane.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/product-plane.js +1022 -0
- package/node_modules/@claude-flow/security/dist/policy/product-plane.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/types.d.ts +169 -0
- package/node_modules/@claude-flow/security/dist/policy/types.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/policy/types.js +2 -0
- package/node_modules/@claude-flow/security/dist/policy/types.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/safe-executor.d.ts +180 -0
- package/node_modules/@claude-flow/security/dist/safe-executor.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/safe-executor.js +390 -0
- package/node_modules/@claude-flow/security/dist/safe-executor.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/token-generator.d.ts +224 -0
- package/node_modules/@claude-flow/security/dist/token-generator.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/token-generator.js +351 -0
- package/node_modules/@claude-flow/security/dist/token-generator.js.map +1 -0
- package/node_modules/@claude-flow/security/dist/tool-output-guardrail.d.ts +126 -0
- package/node_modules/@claude-flow/security/dist/tool-output-guardrail.d.ts.map +1 -0
- package/node_modules/@claude-flow/security/dist/tool-output-guardrail.js +257 -0
- package/node_modules/@claude-flow/security/dist/tool-output-guardrail.js.map +1 -0
- package/node_modules/@claude-flow/security/package.json +44 -0
- package/package.json +24 -8
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"skill-md.js","sourceRoot":"","sources":["../../src/generators/skill-md.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAuB;IAC3D,MAAM,EACJ,IAAI,EACJ,WAAW,EACX,OAAO,GAAG,OAAO,EACjB,MAAM,GAAG,KAAK,EACd,IAAI,EACJ,QAAQ,GAAG,EAAE,EACb,QAAQ,GAAG,EAAE,EACb,OAAO,GAAG,EAAE,EACZ,UAAU,GAAG,EAAE,EACf,QAAQ,GAAG,EAAE,GACd,GAAG,OAAO,CAAC;IAEZ,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEjF,yBAAyB;IACzB,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAC,aAAa,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACrC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;QAClC,CAAC,CAAC,cAAc,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACtC,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,WAAW,GAAG;QACd,IAAI;YACA,OAAO;UACT,MAAM;SACP,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;IAEvB,WAAW;IACX,WAAW;IACX,QAAQ;IACR,CAAC;IAEH,yBAAyB;IACzB,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;QACzC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAChC,CAAC,CAAC,EAAE,CAAC;IAEP,wBAAwB;IACxB,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;QACvC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAC9B,CAAC,CAAC,EAAE,CAAC;IAEP,2BAA2B;IAC3B,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7C,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC;IAEP,uBAAuB;IACvB,OAAO,GAAG,WAAW;;IAEnB,eAAe,CAAC,IAAI,CAAC;;;EAGvB,WAAW;;;EAGX,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kCAAkC;;;EAGjG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yCAAyC;EACxG,eAAe;EACf,cAAc;EACd,iBAAiB;;;;;;CAMlB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,QAAwB;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QAC/B,IAAI,KAAK,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,WAAW,mBAAmB,GAAG,CAAC,OAAO,UAAU,CAAC;QACxF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,KAAK,IAAI,iCAAiC,GAAG,CAAC,OAAO,UAAU,CAAC;QAClE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO;;;EAGP,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;CACnB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAA8D;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;IAEvF,OAAO;;;;;EAKP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;CACjB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,UAAkE;IAChG,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC/B,OAAO,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,WAAW,IAAI,EAAE,IAAI,CAC7D,CAAC;IAEF,OAAO;;;;;EAKP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;CACjB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACzD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB;IAEjB,MAAM,cAAc,GAAmC;QACrD,qBAAqB,EAAE;YACrB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,gLAAgL;YAC7L,QAAQ,EAAE;gBACR,uBAAuB;gBACvB,4BAA4B;gBAC5B,0BAA0B;gBAC1B,wBAAwB;gBACxB,0BAA0B;gBAC1B,0CAA0C;gBAC1C,yBAAyB;aAC1B;YACD,QAAQ,EAAE;gBACR,mBAAmB;gBACnB,8BAA8B;gBAC9B,uBAAuB;gBACvB,uBAAuB;gBACvB,mBAAmB;aACpB;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,2DAA2D;oBACxE,OAAO,EAAE,oFAAoF;oBAC7F,OAAO,EAAE,oFAAoF;iBAC9F;gBACD;oBACE,IAAI,EAAE,YAAY;oBAClB,WAAW,EAAE,2DAA2D;oBACxE,OAAO,EAAE,8DAA8D;oBACvE,OAAO,EAAE,gFAAgF;iBAC1F;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,6BAA6B;oBAC1C,OAAO,EAAE,8DAA8D;oBACvE,OAAO,EAAE,gEAAgE;iBAC1E;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,gCAAgC;oBAC7C,OAAO,EAAE,6CAA6C;iBACvD;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,2CAA2C;oBACxD,OAAO,EAAE,2EAA2E;oBACpF,OAAO,EAAE,wGAAwG;iBAClH;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,wBAAwB;oBACrC,OAAO,EAAE,iDAAiD;iBAC3D;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,gCAAgC;oBACtC,WAAW,EAAE,wCAAwC;iBACtD;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,kCAAkC;oBACxC,WAAW,EAAE,sCAAsC;iBACpD;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,+CAA+C;iBAC7D;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,oCAAoC;iBAClD;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,4LAA4L;YACzM,QAAQ,EAAE;gBACR,mCAAmC;gBACnC,iCAAiC;gBACjC,8BAA8B;gBAC9B,8BAA8B;gBAC9B,kCAAkC;gBAClC,yBAAyB;aAC1B;YACD,QAAQ,EAAE;gBACR,oBAAoB;gBACpB,yBAAyB;gBACzB,iCAAiC;gBACjC,uBAAuB;aACxB;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,eAAe;oBACrB,WAAW,EAAE,6CAA6C;oBAC1D,OAAO,EAAE,wFAAwF;oBACjG,OAAO,EAAE,8HAA8H;iBACxI;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,yCAAyC;oBACtD,OAAO,EAAE,wEAAwE;oBACjF,OAAO,EAAE,sFAAsF;iBAChG;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,yCAAyC;oBACtD,OAAO,EAAE,uEAAuE;oBAChF,OAAO,EAAE,+EAA+E;iBACzF;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,iCAAiC;oBAC9C,OAAO,EAAE,0DAA0D;oBACnE,OAAO,EAAE,kEAAkE;iBAC5E;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,uBAAuB;oBACpC,OAAO,EAAE,0EAA0E;iBACpF;gBACD;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,WAAW,EAAE,qCAAqC;oBAClD,OAAO,EAAE,gDAAgD;iBAC1D;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,8BAA8B;oBAC3C,OAAO,EAAE,mCAAmC;iBAC7C;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,WAAW,EAAE,uBAAuB;oBACpC,OAAO,EAAE,gEAAgE;iBAC1E;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,kCAAkC;oBACxC,WAAW,EAAE,mCAAmC;iBACjD;gBACD;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,IAAI,EAAE,uCAAuC;oBAC7C,WAAW,EAAE,iCAAiC;iBAC/C;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,kCAAkC;iBAChD;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,uBAAuB;oBAC7B,WAAW,EAAE,uCAAuC;iBACrD;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,8LAA8L;YAC3M,QAAQ,EAAE;gBACR,4BAA4B;gBAC5B,yBAAyB;gBACzB,uBAAuB;gBACvB,iBAAiB;gBACjB,kBAAkB;gBAClB,sBAAsB;aACvB;YACD,QAAQ,EAAE;gBACR,kBAAkB;gBAClB,uBAAuB;gBACvB,uBAAuB;gBACvB,0BAA0B;gBAC1B,qBAAqB;aACtB;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,2DAA2D;oBACxE,OAAO,EAAE,yEAAyE;oBAClF,OAAO,EAAE,uHAAuH;iBACjI;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,oDAAoD;oBACjE,OAAO,EAAE,iEAAiE;oBAC1E,OAAO,EAAE,4FAA4F;iBACtG;gBACD;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,uDAAuD;oBACpE,OAAO,EAAE,kEAAkE;oBAC3E,OAAO,EAAE,uHAAuH;iBACjI;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,yCAAyC;oBACtD,OAAO,EAAE,kEAAkE;oBAC3E,OAAO,EAAE,oGAAoG;iBAC9G;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,sDAAsD;oBACnE,OAAO,EAAE,sEAAsE;oBAC/E,OAAO,EAAE,+GAA+G;iBACzH;gBACD;oBACE,IAAI,EAAE,mBAAmB;oBACzB,WAAW,EAAE,+BAA+B;oBAC5C,OAAO,EAAE,uEAAuE;iBACjF;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,+BAA+B;oBACrC,WAAW,EAAE,6CAA6C;iBAC3D;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,iCAAiC;oBACvC,WAAW,EAAE,kCAAkC;iBAChD;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,eAAe;oBACrB,WAAW,EAAE,kCAAkC;iBAChD;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,IAAI,EAAE,yBAAyB;oBAC/B,WAAW,EAAE,gCAAgC;iBAC9C;aACF;SACF;QACD,gBAAgB,EAAE;YAChB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,0KAA0K;YACvL,QAAQ,EAAE;gBACR,+BAA+B;gBAC/B,qBAAqB;gBACrB,oBAAoB;gBACpB,oBAAoB;gBACpB,uBAAuB;gBACvB,sBAAsB;gBACtB,kBAAkB;gBAClB,0BAA0B;aAC3B;YACD,QAAQ,EAAE;gBACR,qCAAqC;gBACrC,8BAA8B;gBAC9B,sBAAsB;gBACtB,iBAAiB;aAClB;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,qDAAqD;oBAClE,OAAO,EAAE,iDAAiD;oBAC1D,OAAO,EAAE,+EAA+E;iBACzF;gBACD;oBACE,IAAI,EAAE,wBAAwB;oBAC9B,WAAW,EAAE,mCAAmC;oBAChD,OAAO,EAAE,6DAA6D;oBACtE,OAAO,EAAE,8EAA8E;iBACxF;gBACD;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,0CAA0C;oBACvD,OAAO,EAAE,2DAA2D;iBACrE;gBACD;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,yCAAyC;oBACtD,OAAO,EAAE,0DAA0D;iBACpE;gBACD;oBACE,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,gDAAgD;oBAC7D,OAAO,EAAE,gDAAgD;iBAC1D;gBACD;oBACE,IAAI,EAAE,UAAU;oBAChB,WAAW,EAAE,kCAAkC;oBAC/C,OAAO,EAAE,0CAA0C;oBACnD,OAAO,EAAE,0DAA0D;iBACpE;gBACD;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,WAAW,EAAE,qCAAqC;oBAClD,OAAO,EAAE,8CAA8C;oBACvD,OAAO,EAAE,qFAAqF;iBAC/F;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,8BAA8B;oBAC3C,OAAO,EAAE,iDAAiD;iBAC3D;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,6BAA6B;oBAC1C,OAAO,EAAE,wDAAwD;iBAClE;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,kCAAkC;oBACxC,WAAW,EAAE,iCAAiC;iBAC/C;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,kCAAkC;oBACxC,WAAW,EAAE,2BAA2B;iBACzC;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,IAAI,EAAE,4BAA4B;oBAClC,WAAW,EAAE,2BAA2B;iBACzC;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,+BAA+B;iBAC7C;aACF;SACF;QACD,sBAAsB,EAAE;YACtB,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,8JAA8J;YAC3K,QAAQ,EAAE;gBACR,0BAA0B;gBAC1B,qBAAqB;gBACrB,qBAAqB;gBACrB,oCAAoC;gBACpC,6BAA6B;gBAC7B,sBAAsB;gBACtB,sBAAsB;aACvB;YACD,QAAQ,EAAE;gBACR,2BAA2B;gBAC3B,uBAAuB;gBACvB,mBAAmB;gBACnB,uBAAuB;aACxB;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,oCAAoC;oBACjD,OAAO,EAAE,wDAAwD;oBACjE,OAAO,EAAE,qGAAqG;iBAC/G;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,2CAA2C;oBACxD,OAAO,EAAE,yDAAyD;oBAClE,OAAO,EAAE,4EAA4E;iBACtF;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,+BAA+B;oBAC5C,OAAO,EAAE,0DAA0D;oBACnE,OAAO,EAAE,4EAA4E;iBACtF;gBACD;oBACE,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,6BAA6B;oBAC1C,OAAO,EAAE,2DAA2D;iBACrE;gBACD;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,wCAAwC;oBACrD,OAAO,EAAE,qDAAqD;oBAC9D,OAAO,EAAE,kEAAkE;iBAC5E;gBACD;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,6BAA6B;oBAC1C,OAAO,EAAE,yCAAyC;oBAClD,OAAO,EAAE,iFAAiF;iBAC3F;gBACD;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,2BAA2B;oBACxC,OAAO,EAAE,iFAAiF;iBAC3F;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,8BAA8B;oBAC3C,OAAO,EAAE,yDAAyD;iBACnE;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,kCAAkC;oBACxC,WAAW,EAAE,8BAA8B;iBAC5C;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,IAAI,EAAE,oCAAoC;oBAC1C,WAAW,EAAE,mCAAmC;iBACjD;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,gCAAgC;iBAC9C;gBACD;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,mCAAmC;iBACjD;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,wJAAwJ;YACrK,QAAQ,EAAE;gBACR,wBAAwB;gBACxB,4BAA4B;gBAC5B,oBAAoB;gBACpB,2BAA2B;gBAC3B,mBAAmB;gBACnB,uBAAuB;gBACvB,wBAAwB;aACzB;YACD,QAAQ,EAAE;gBACR,wBAAwB;gBACxB,6BAA6B;gBAC7B,yBAAyB;gBACzB,cAAc;aACf;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,wCAAwC;oBACrD,OAAO,EAAE,uDAAuD;oBAChE,OAAO,EAAE,qKAAqK;iBAC/K;gBACD;oBACE,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,2BAA2B;oBACxC,OAAO,EAAE,qBAAqB;oBAC9B,OAAO,EAAE,2BAA2B;iBACrC;gBACD;oBACE,IAAI,EAAE,UAAU;oBAChB,WAAW,EAAE,sBAAsB;oBACnC,OAAO,EAAE,+BAA+B;oBACxC,OAAO,EAAE,0CAA0C;iBACpD;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,mCAAmC;oBAChD,OAAO,EAAE,4BAA4B;oBACrC,OAAO,EAAE,6CAA6C;iBACvD;gBACD;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,2BAA2B;oBACxC,OAAO,EAAE,wBAAwB;iBAClC;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,oBAAoB;oBACjC,OAAO,EAAE,mDAAmD;oBAC5D,OAAO,EAAE,gGAAgG;iBAC1G;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,sBAAsB;oBACnC,OAAO,EAAE,2CAA2C;oBACpD,OAAO,EAAE,qEAAqE;iBAC/E;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,sBAAsB;oBACnC,OAAO,EAAE,uBAAuB;oBAChC,OAAO,EAAE,0BAA0B;iBACpC;gBACD;oBACE,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,oBAAoB;oBACjC,OAAO,EAAE,oDAAoD;oBAC7D,OAAO,EAAE,oEAAoE;iBAC9E;aACF;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,gCAAgC;oBACtC,WAAW,EAAE,2BAA2B;iBACzC;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,iCAAiC;oBACvC,WAAW,EAAE,gCAAgC;iBAC9C;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,8BAA8B;iBAC5C;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,uBAAuB;oBAC7B,WAAW,EAAE,6BAA6B;iBAC3C;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,eAAe;oBACrB,WAAW,EAAE,8BAA8B;iBAC5C;aACF;SACF;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAEhD,0BAA0B;IAC1B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,kDAAkD;YAClD,MAAM,cAAc,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC;YAC3C,OAAO,CAAC,cAAc,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,OAAO;QACP,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,SAAiB,EAAE,UAAkB;IACjE,MAAM,OAAO,GAA2C;QACtD,qBAAqB,EAAE;YACrB,aAAa,EAAE;;;;;;;;;;;;;;CAcpB;YACK,eAAe,EAAE;;;;;;;;CAQtB;SACI;QACD,mBAAmB,EAAE;YACnB,eAAe,EAAE;;;;;;;;;;;;;;;;CAgBtB;YACK,oBAAoB,EAAE;;;;;;;;;;;CAW3B;SACI;QACD,mBAAmB,EAAE;YACnB,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBnB;YACK,cAAc,EAAE;;;;;;;;;;;;;;;;;;CAkBrB;SACI;QACD,gBAAgB,EAAE;YAChB,eAAe,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCtB;YACK,eAAe,EAAE;;;;;;;;;;;;;;;;CAgBtB;SACI;QACD,sBAAsB,EAAE;YACtB,eAAe,EAAE;;;;;;;;;;;;;;;CAetB;YACK,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBxB;SACI;QACD,mBAAmB,EAAE;YACnB,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCpB;YACK,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBrB;SACI;KACF,CAAC;IAEF,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,YAAY,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,OAAO;IACL,SAAS,MAAM,UAAU;;;;;gBAKb,UAAU;;CAEzB,CAAC;AACF,CAAC"}
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
import { type ExactSourceState } from './repository-state.js';
|
|
2
|
+
export interface DeclaredBuildInput {
|
|
3
|
+
name: string;
|
|
4
|
+
/** Repository-relative declaration; it may name an ignored generated input. */
|
|
5
|
+
path: string;
|
|
6
|
+
digest: string;
|
|
7
|
+
bytes: number;
|
|
8
|
+
}
|
|
9
|
+
export interface DeclaredToolchain {
|
|
10
|
+
name: string;
|
|
11
|
+
version: string;
|
|
12
|
+
/** Digest of the executable, image, lock, or immutable toolchain manifest. */
|
|
13
|
+
digest: string;
|
|
14
|
+
}
|
|
15
|
+
export interface BuildInputDeclaration {
|
|
16
|
+
name: string;
|
|
17
|
+
path: string;
|
|
18
|
+
}
|
|
19
|
+
export interface ToolchainDeclaration {
|
|
20
|
+
name: string;
|
|
21
|
+
version: string;
|
|
22
|
+
/** Local executable or immutable manifest to hash; not embedded in evidence. */
|
|
23
|
+
path: string;
|
|
24
|
+
}
|
|
25
|
+
export interface BuildEvidence {
|
|
26
|
+
contractVersion: 1;
|
|
27
|
+
assurance: 'declared-unsigned';
|
|
28
|
+
sourceStateId: string;
|
|
29
|
+
buildInputs: readonly DeclaredBuildInput[];
|
|
30
|
+
toolchains: readonly DeclaredToolchain[];
|
|
31
|
+
evidenceDigest: string;
|
|
32
|
+
}
|
|
33
|
+
/**
|
|
34
|
+
* Bind explicitly declared non-Git inputs and toolchains to one Git-visible
|
|
35
|
+
* source state. This does not claim completeness; policy decides which
|
|
36
|
+
* declarations are required for a release profile.
|
|
37
|
+
*/
|
|
38
|
+
export declare function createBuildEvidence(sourceState: ExactSourceState, buildInputs: readonly DeclaredBuildInput[], toolchains: readonly DeclaredToolchain[]): BuildEvidence;
|
|
39
|
+
/**
|
|
40
|
+
* Recompute declared evidence from local bytes. It does not prove the
|
|
41
|
+
* declaration set is complete and does not sign or authorize a release.
|
|
42
|
+
*/
|
|
43
|
+
export declare function captureBuildEvidence(repoPath: string, sourceState: ExactSourceState, buildInputs: readonly BuildInputDeclaration[], toolchains: readonly ToolchainDeclaration[]): BuildEvidence;
|
|
44
|
+
export declare function recomputeBuildEvidence(repoPath: string, expected: BuildEvidence, toolchains: readonly ToolchainDeclaration[]): BuildEvidence;
|
|
45
|
+
export declare function buildEvidenceMatches(expected: BuildEvidence, actual: BuildEvidence): boolean;
|
|
46
|
+
//# sourceMappingURL=build-evidence.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"build-evidence.d.ts","sourceRoot":"","sources":["../../src/harness/build-evidence.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAK/B,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,CAAC,CAAC;IACnB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC3C,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;CACxB;AAkDD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,gBAAgB,EAC7B,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAC1C,UAAU,EAAE,SAAS,iBAAiB,EAAE,GACvC,aAAa,CAiCf;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,gBAAgB,EAC7B,WAAW,EAAE,SAAS,qBAAqB,EAAE,EAC7C,UAAU,EAAE,SAAS,oBAAoB,EAAE,GAC1C,aAAa,CAwBf;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,aAAa,EACvB,UAAU,EAAE,SAAS,oBAAoB,EAAE,GAC1C,aAAa,CAWf;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAG5F"}
|
|
@@ -0,0 +1,126 @@
|
|
|
1
|
+
import { createHash } from 'node:crypto';
|
|
2
|
+
import { lstatSync, readFileSync, readlinkSync, realpathSync } from 'node:fs';
|
|
3
|
+
import { isAbsolute, relative, resolve, sep } from 'node:path';
|
|
4
|
+
import { canonicalJson, captureRepositorySourceState, } from './repository-state.js';
|
|
5
|
+
import { portableCaseFold } from './portable-case-fold.js';
|
|
6
|
+
const DIGEST = /^sha256:[0-9a-f]{64}$/;
|
|
7
|
+
function compare(left, right) {
|
|
8
|
+
return left < right ? -1 : left > right ? 1 : 0;
|
|
9
|
+
}
|
|
10
|
+
function requireText(value, label) {
|
|
11
|
+
const result = value.trim();
|
|
12
|
+
if (!result)
|
|
13
|
+
throw new Error(`${label} must be non-empty`);
|
|
14
|
+
return result;
|
|
15
|
+
}
|
|
16
|
+
function requireDigest(value, label) {
|
|
17
|
+
if (!DIGEST.test(value))
|
|
18
|
+
throw new Error(`${label} must be a canonical sha256 digest`);
|
|
19
|
+
return value;
|
|
20
|
+
}
|
|
21
|
+
function normalizePath(value) {
|
|
22
|
+
const path = requireText(value, 'build input path');
|
|
23
|
+
if (path.includes('\\')
|
|
24
|
+
|| path.startsWith('/')
|
|
25
|
+
|| path.startsWith('-')
|
|
26
|
+
|| path !== path.normalize('NFC')
|
|
27
|
+
|| path.split('/').some((part) => !part || part === '.' || part === '..')) {
|
|
28
|
+
throw new Error(`unsafe build input path: ${value}`);
|
|
29
|
+
}
|
|
30
|
+
return path;
|
|
31
|
+
}
|
|
32
|
+
function sha256(value) {
|
|
33
|
+
return `sha256:${createHash('sha256').update(value).digest('hex')}`;
|
|
34
|
+
}
|
|
35
|
+
function digestPath(path, followSymlink) {
|
|
36
|
+
const resolved = followSymlink ? realpathSync(path) : path;
|
|
37
|
+
const stat = lstatSync(resolved);
|
|
38
|
+
const content = stat.isSymbolicLink()
|
|
39
|
+
? Buffer.from(readlinkSync(resolved), 'utf8')
|
|
40
|
+
: stat.isFile()
|
|
41
|
+
? readFileSync(resolved)
|
|
42
|
+
: undefined;
|
|
43
|
+
if (!content)
|
|
44
|
+
throw new Error(`build evidence path is not a file or symlink: ${path}`);
|
|
45
|
+
return {
|
|
46
|
+
digest: `sha256:${createHash('sha256').update(content).digest('hex')}`,
|
|
47
|
+
bytes: content.byteLength,
|
|
48
|
+
};
|
|
49
|
+
}
|
|
50
|
+
/**
|
|
51
|
+
* Bind explicitly declared non-Git inputs and toolchains to one Git-visible
|
|
52
|
+
* source state. This does not claim completeness; policy decides which
|
|
53
|
+
* declarations are required for a release profile.
|
|
54
|
+
*/
|
|
55
|
+
export function createBuildEvidence(sourceState, buildInputs, toolchains) {
|
|
56
|
+
const inputs = buildInputs.map((input) => ({
|
|
57
|
+
name: requireText(input.name, 'build input name'),
|
|
58
|
+
path: normalizePath(input.path),
|
|
59
|
+
digest: requireDigest(input.digest, 'build input digest'),
|
|
60
|
+
bytes: input.bytes,
|
|
61
|
+
})).sort((left, right) => compare(left.path, right.path) || compare(left.name, right.name));
|
|
62
|
+
const tools = toolchains.map((toolchain) => ({
|
|
63
|
+
name: requireText(toolchain.name, 'toolchain name'),
|
|
64
|
+
version: requireText(toolchain.version, 'toolchain version'),
|
|
65
|
+
digest: requireDigest(toolchain.digest, 'toolchain digest'),
|
|
66
|
+
})).sort((left, right) => compare(left.name, right.name) || compare(left.version, right.version));
|
|
67
|
+
if (inputs.some(({ bytes }) => !Number.isSafeInteger(bytes) || bytes < 0)) {
|
|
68
|
+
throw new Error('build input bytes must be a non-negative safe integer');
|
|
69
|
+
}
|
|
70
|
+
const inputKeys = inputs.map(({ name, path }) => `${name}\0${path}`);
|
|
71
|
+
if (new Set(inputKeys).size !== inputKeys.length)
|
|
72
|
+
throw new Error('duplicate declared build input');
|
|
73
|
+
const foldedPaths = inputs.map(({ path }) => portableCaseFold(path));
|
|
74
|
+
if (new Set(foldedPaths).size !== foldedPaths.length) {
|
|
75
|
+
throw new Error('case-fold collision in declared build inputs');
|
|
76
|
+
}
|
|
77
|
+
const toolKeys = tools.map(({ name, version }) => `${name}\0${version}`);
|
|
78
|
+
if (new Set(toolKeys).size !== toolKeys.length)
|
|
79
|
+
throw new Error('duplicate declared toolchain');
|
|
80
|
+
const body = {
|
|
81
|
+
contractVersion: 1,
|
|
82
|
+
assurance: 'declared-unsigned',
|
|
83
|
+
sourceStateId: requireDigest(sourceState.sourceStateId, 'source state id'),
|
|
84
|
+
buildInputs: inputs,
|
|
85
|
+
toolchains: tools,
|
|
86
|
+
};
|
|
87
|
+
return { ...body, evidenceDigest: sha256(canonicalJson(body)) };
|
|
88
|
+
}
|
|
89
|
+
/**
|
|
90
|
+
* Recompute declared evidence from local bytes. It does not prove the
|
|
91
|
+
* declaration set is complete and does not sign or authorize a release.
|
|
92
|
+
*/
|
|
93
|
+
export function captureBuildEvidence(repoPath, sourceState, buildInputs, toolchains) {
|
|
94
|
+
const repoRoot = realpathSync(resolve(repoPath));
|
|
95
|
+
if (captureRepositorySourceState(repoRoot).sourceStateId !== sourceState.sourceStateId) {
|
|
96
|
+
throw new Error('Git-visible source state does not match the build evidence request');
|
|
97
|
+
}
|
|
98
|
+
const inputs = buildInputs.map((declaration) => {
|
|
99
|
+
const path = normalizePath(declaration.path);
|
|
100
|
+
const absolute = resolve(repoRoot, path);
|
|
101
|
+
const real = realpathSync(absolute);
|
|
102
|
+
const rel = relative(repoRoot, real);
|
|
103
|
+
if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
|
|
104
|
+
throw new Error(`build input escapes repository: ${path}`);
|
|
105
|
+
}
|
|
106
|
+
return { name: declaration.name, path, ...digestPath(real, true) };
|
|
107
|
+
});
|
|
108
|
+
const tools = toolchains.map((declaration) => ({
|
|
109
|
+
name: declaration.name,
|
|
110
|
+
version: declaration.version,
|
|
111
|
+
digest: digestPath(isAbsolute(declaration.path) ? declaration.path : resolve(repoRoot, declaration.path), true).digest,
|
|
112
|
+
}));
|
|
113
|
+
return createBuildEvidence(sourceState, inputs, tools);
|
|
114
|
+
}
|
|
115
|
+
export function recomputeBuildEvidence(repoPath, expected, toolchains) {
|
|
116
|
+
const sourceState = captureRepositorySourceState(repoPath);
|
|
117
|
+
if (sourceState.sourceStateId !== expected.sourceStateId) {
|
|
118
|
+
throw new Error('Git-visible source state changed before build evidence recomputation');
|
|
119
|
+
}
|
|
120
|
+
return captureBuildEvidence(repoPath, sourceState, expected.buildInputs.map(({ name, path }) => ({ name, path })), toolchains);
|
|
121
|
+
}
|
|
122
|
+
export function buildEvidenceMatches(expected, actual) {
|
|
123
|
+
return expected.evidenceDigest === actual.evidenceDigest
|
|
124
|
+
&& expected.sourceStateId === actual.sourceStateId;
|
|
125
|
+
}
|
|
126
|
+
//# sourceMappingURL=build-evidence.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"build-evidence.js","sourceRoot":"","sources":["../../src/harness/build-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EACL,aAAa,EACb,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAsCvC,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACpD,IACE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;WAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;WACpB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;WACpB,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;WAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,aAAsB;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;YACb,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;IACvF,OAAO;QACL,MAAM,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACtE,KAAK,EAAE,OAAO,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA6B,EAC7B,WAA0C,EAC1C,UAAwC;IAExC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,kBAAkB,CAAC;QACjD,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/B,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC;QACzD,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC;QACnD,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;QAC5D,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC;KAC5D,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAElG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IACzE,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAEhG,MAAM,IAAI,GAAG;QACX,eAAe,EAAE,CAAU;QAC3B,SAAS,EAAE,mBAA4B;QACvC,aAAa,EAAE,aAAa,CAAC,WAAW,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAC1E,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,KAAK;KAClB,CAAC;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,WAA6B,EAC7B,WAA6C,EAC7C,UAA2C;IAE3C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAsB,EAAE;QACjE,MAAM,IAAI,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,WAAW,EAAqB,EAAE,CAAC,CAAC;QAChE,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,MAAM,EAAE,UAAU,CAChB,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,EACrF,IAAI,CACL,CAAC,MAAM;KACT,CAAC,CAAC,CAAC;IACJ,OAAO,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,QAAuB,EACvB,UAA2C;IAE3C,MAAM,WAAW,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,oBAAoB,CACzB,QAAQ,EACR,WAAW,EACX,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9D,UAAU,CACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAuB,EAAE,MAAqB;IACjF,OAAO,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;WACnD,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,CAAC;AACvD,CAAC"}
|
|
@@ -0,0 +1,153 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Advisory repository-harness contract.
|
|
3
|
+
*
|
|
4
|
+
* Repository harnesses coordinate local ownership and collect evidence. They do
|
|
5
|
+
* not grant Ruflo policy capabilities. Existing harnesses can implement only
|
|
6
|
+
* `describe`; omitted operations remain unavailable and the descriptor
|
|
7
|
+
* normalizes to observe-only compatibility mode.
|
|
8
|
+
*/
|
|
9
|
+
import type { ExactSourceState } from './repository-state.js';
|
|
10
|
+
import type { BuildEvidence } from './build-evidence.js';
|
|
11
|
+
export type HarnessMode = 'observe' | 'enforce';
|
|
12
|
+
export type HarnessCapability = 'sessions' | 'leases' | 'lease-fencing' | 'messages' | 'message-acknowledgement' | 'run-evidence' | 'exact-source-state' | 'release-decisions';
|
|
13
|
+
interface HarnessDescriptorBase {
|
|
14
|
+
contractVersion: 1;
|
|
15
|
+
harnessId: string;
|
|
16
|
+
}
|
|
17
|
+
export interface InMemoryReferenceHarnessDescriptor extends HarnessDescriptorBase {
|
|
18
|
+
mode: 'observe';
|
|
19
|
+
capabilities: readonly Exclude<HarnessCapability, 'release-decisions'>[];
|
|
20
|
+
advisory: true;
|
|
21
|
+
assurance: 'in-memory-reference';
|
|
22
|
+
}
|
|
23
|
+
export interface ExternalAuthorityHarnessDescriptor extends HarnessDescriptorBase {
|
|
24
|
+
mode: HarnessMode;
|
|
25
|
+
capabilities: readonly HarnessCapability[];
|
|
26
|
+
advisory: false;
|
|
27
|
+
assurance: 'external-authority';
|
|
28
|
+
}
|
|
29
|
+
export type HarnessDescriptor = InMemoryReferenceHarnessDescriptor | ExternalAuthorityHarnessDescriptor;
|
|
30
|
+
/** Shape accepted from pre-contract local harnesses. */
|
|
31
|
+
export interface LegacyHarnessDescriptor {
|
|
32
|
+
harnessId?: string;
|
|
33
|
+
name?: string;
|
|
34
|
+
mode?: HarnessMode;
|
|
35
|
+
capabilities?: readonly string[];
|
|
36
|
+
}
|
|
37
|
+
export interface StartSessionRequest {
|
|
38
|
+
sessionId: string;
|
|
39
|
+
workloadId: string;
|
|
40
|
+
repositoryId: string;
|
|
41
|
+
worktreeId: string;
|
|
42
|
+
readOnly: boolean;
|
|
43
|
+
}
|
|
44
|
+
export interface HarnessSession {
|
|
45
|
+
sessionId: string;
|
|
46
|
+
workloadId: string;
|
|
47
|
+
repositoryId: string;
|
|
48
|
+
worktreeId: string;
|
|
49
|
+
startedAt: string;
|
|
50
|
+
}
|
|
51
|
+
export interface LeaseRequest {
|
|
52
|
+
sessionId: string;
|
|
53
|
+
repositoryId: string;
|
|
54
|
+
worktreeId: string;
|
|
55
|
+
kind: 'path' | 'resource';
|
|
56
|
+
scopes: readonly string[];
|
|
57
|
+
ttlMs: number;
|
|
58
|
+
}
|
|
59
|
+
export interface FencedLease {
|
|
60
|
+
leaseId: string;
|
|
61
|
+
repositoryId: string;
|
|
62
|
+
sessionId: string;
|
|
63
|
+
workloadId: string;
|
|
64
|
+
worktreeId: string;
|
|
65
|
+
kind: 'path' | 'resource';
|
|
66
|
+
scopes: readonly string[];
|
|
67
|
+
/** Decimal strings avoid losing 64-bit epochs when receipts cross JSON. */
|
|
68
|
+
epoch: string;
|
|
69
|
+
version: string;
|
|
70
|
+
issuedAt: string;
|
|
71
|
+
expiresAt: string;
|
|
72
|
+
advisory: boolean;
|
|
73
|
+
}
|
|
74
|
+
export interface HarnessMessage {
|
|
75
|
+
messageId: string;
|
|
76
|
+
issuer: string;
|
|
77
|
+
audience: string;
|
|
78
|
+
correlationId?: string;
|
|
79
|
+
causationId?: string;
|
|
80
|
+
sequence: string;
|
|
81
|
+
expiresAt?: string;
|
|
82
|
+
contentDigest: string;
|
|
83
|
+
content: unknown;
|
|
84
|
+
}
|
|
85
|
+
export interface MessageReceipt {
|
|
86
|
+
messageId: string;
|
|
87
|
+
acceptedAt: string;
|
|
88
|
+
duplicate: boolean;
|
|
89
|
+
}
|
|
90
|
+
export interface RunEvidence {
|
|
91
|
+
executionId: string;
|
|
92
|
+
sessionId: string;
|
|
93
|
+
workloadId: string;
|
|
94
|
+
sourceState: ExactSourceState;
|
|
95
|
+
/** Optional for legacy/debug runs; release policy may require it. */
|
|
96
|
+
buildEvidence?: BuildEvidence;
|
|
97
|
+
commandDigest: string;
|
|
98
|
+
scope: string;
|
|
99
|
+
profile: 'focused' | 'integration' | 'release';
|
|
100
|
+
startedAt: string;
|
|
101
|
+
completedAt: string;
|
|
102
|
+
exitCode: number;
|
|
103
|
+
evidenceDigest: string;
|
|
104
|
+
policyReceiptId?: string;
|
|
105
|
+
leaseEpochs?: Readonly<Record<string, string>>;
|
|
106
|
+
}
|
|
107
|
+
export interface RunReceipt extends RunEvidence {
|
|
108
|
+
receiptId: string;
|
|
109
|
+
recordedAt: string;
|
|
110
|
+
}
|
|
111
|
+
export interface ReleaseRequest {
|
|
112
|
+
repositoryId: string;
|
|
113
|
+
sourceStateId: string;
|
|
114
|
+
artifactDigest: string;
|
|
115
|
+
runReceiptIds: readonly string[];
|
|
116
|
+
/** Optional for compatibility; enforce-mode release policy may require it. */
|
|
117
|
+
buildEvidence?: BuildEvidence;
|
|
118
|
+
capabilityId?: string;
|
|
119
|
+
}
|
|
120
|
+
export interface ReleaseDecision {
|
|
121
|
+
allowed: boolean;
|
|
122
|
+
dryRun: boolean;
|
|
123
|
+
reason: string;
|
|
124
|
+
policyReceiptId?: string;
|
|
125
|
+
}
|
|
126
|
+
/**
|
|
127
|
+
* Progressive adapter surface. Optional methods preserve compatibility with
|
|
128
|
+
* local harnesses that predate sessions, fencing, durable messages, or exact
|
|
129
|
+
* source-state receipts. Callers must feature-detect every optional operation.
|
|
130
|
+
*/
|
|
131
|
+
export interface RepositoryHarnessAdapter {
|
|
132
|
+
describe(): Promise<HarnessDescriptor | LegacyHarnessDescriptor>;
|
|
133
|
+
start?(request: StartSessionRequest): Promise<HarnessSession>;
|
|
134
|
+
acquire?(request: LeaseRequest): Promise<FencedLease>;
|
|
135
|
+
renew?(lease: FencedLease): Promise<FencedLease>;
|
|
136
|
+
release?(lease: FencedLease): Promise<void>;
|
|
137
|
+
send?(message: HarnessMessage): Promise<MessageReceipt>;
|
|
138
|
+
receive?(cursor?: string): AsyncIterable<HarnessMessage>;
|
|
139
|
+
acknowledge?(messageId: string): Promise<void>;
|
|
140
|
+
recordRun?(run: RunEvidence): Promise<RunReceipt>;
|
|
141
|
+
authorizeRelease?(request: ReleaseRequest): Promise<ReleaseDecision>;
|
|
142
|
+
end?(sessionId: string): Promise<void>;
|
|
143
|
+
}
|
|
144
|
+
/**
|
|
145
|
+
* Convert an older descriptor to the safe v1 reference baseline.
|
|
146
|
+
*
|
|
147
|
+
* Unknown and authority-bearing capabilities are ignored. A legacy descriptor
|
|
148
|
+
* can never self-assert enforce or release authority through this compatibility
|
|
149
|
+
* function. A separately verified external adapter is required for that.
|
|
150
|
+
*/
|
|
151
|
+
export declare function normalizeHarnessDescriptor(input: HarnessDescriptor | LegacyHarnessDescriptor): InMemoryReferenceHarnessDescriptor;
|
|
152
|
+
export {};
|
|
153
|
+
//# sourceMappingURL=contract.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/harness/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAChD,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,QAAQ,GACR,eAAe,GACf,UAAU,GACV,yBAAyB,GACzB,cAAc,GACd,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,UAAU,qBAAqB;IAC7B,eAAe,EAAE,CAAC,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kCAAmC,SAAQ,qBAAqB;IAC/E,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,EAAE,SAAS,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,EAAE,CAAC;IACzE,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,MAAM,WAAW,kCAAmC,SAAQ,qBAAqB;IAC/E,IAAI,EAAE,WAAW,CAAC;IAClB,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,oBAAoB,CAAC;CACjC;AAED,MAAM,MAAM,iBAAiB,GACzB,kCAAkC,GAClC,kCAAkC,CAAC;AAEvC,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,qEAAqE;IACrE,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8EAA8E;IAC9E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,IAAI,OAAO,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,CAAC;IACjE,KAAK,CAAC,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,KAAK,CAAC,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IACzD,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAClD,gBAAgB,CAAC,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrE,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,iBAAiB,GAAG,uBAAuB,GACjD,kCAAkC,CAuBpC"}
|
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Advisory repository-harness contract.
|
|
3
|
+
*
|
|
4
|
+
* Repository harnesses coordinate local ownership and collect evidence. They do
|
|
5
|
+
* not grant Ruflo policy capabilities. Existing harnesses can implement only
|
|
6
|
+
* `describe`; omitted operations remain unavailable and the descriptor
|
|
7
|
+
* normalizes to observe-only compatibility mode.
|
|
8
|
+
*/
|
|
9
|
+
const CAPABILITIES = new Set([
|
|
10
|
+
'sessions',
|
|
11
|
+
'leases',
|
|
12
|
+
'lease-fencing',
|
|
13
|
+
'messages',
|
|
14
|
+
'message-acknowledgement',
|
|
15
|
+
'run-evidence',
|
|
16
|
+
'exact-source-state',
|
|
17
|
+
'release-decisions',
|
|
18
|
+
]);
|
|
19
|
+
/**
|
|
20
|
+
* Convert an older descriptor to the safe v1 reference baseline.
|
|
21
|
+
*
|
|
22
|
+
* Unknown and authority-bearing capabilities are ignored. A legacy descriptor
|
|
23
|
+
* can never self-assert enforce or release authority through this compatibility
|
|
24
|
+
* function. A separately verified external adapter is required for that.
|
|
25
|
+
*/
|
|
26
|
+
export function normalizeHarnessDescriptor(input) {
|
|
27
|
+
const harnessId = input.harnessId ?? ('name' in input ? input.name : undefined);
|
|
28
|
+
if (typeof harnessId !== 'string' || harnessId.trim().length === 0) {
|
|
29
|
+
throw new Error('repository harness descriptor requires a non-empty harnessId');
|
|
30
|
+
}
|
|
31
|
+
const requested = Array.isArray(input.capabilities) ? input.capabilities : [];
|
|
32
|
+
const capabilities = [...new Set(requested.filter((value) => (CAPABILITIES.has(value)
|
|
33
|
+
&& value !== 'release-decisions')))];
|
|
34
|
+
capabilities.sort();
|
|
35
|
+
return {
|
|
36
|
+
contractVersion: 1,
|
|
37
|
+
harnessId: harnessId.trim(),
|
|
38
|
+
mode: 'observe',
|
|
39
|
+
capabilities,
|
|
40
|
+
advisory: true,
|
|
41
|
+
assurance: 'in-memory-reference',
|
|
42
|
+
};
|
|
43
|
+
}
|
|
44
|
+
//# sourceMappingURL=contract.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/harness/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAqKH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAoB;IAC9C,UAAU;IACV,QAAQ;IACR,eAAe;IACf,UAAU;IACV,yBAAyB;IACzB,cAAc;IACd,oBAAoB;IACpB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAkD;IAElD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,YAAY,GAA2D,CAAC,GAAG,IAAI,GAAG,CACtF,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,CACtD,YAAY,CAAC,GAAG,CAAC,KAA0B,CAAC;eACzC,KAAK,KAAK,mBAAmB,CACjC,CAAC,CACH,CAA2D,CAAC;IAC7D,YAAY,CAAC,IAAI,EAAE,CAAC;IAEpB,OAAO;QACL,eAAe,EAAE,CAAC;QAClB,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;QAC3B,IAAI,EAAE,SAAS;QACf,YAAY;QACZ,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,qBAAqB;KACjC,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
import type { FencedLease, LeaseRequest } from './contract.js';
|
|
2
|
+
export interface FencedLeaseRequest extends LeaseRequest {
|
|
3
|
+
workloadId: string;
|
|
4
|
+
}
|
|
5
|
+
export type InMemoryFenceRefusal = 'invalid-request' | 'scope-conflict' | 'stale-fence' | 'expired-fence' | 'unknown-lease';
|
|
6
|
+
export declare class InMemoryFenceReferenceError extends Error {
|
|
7
|
+
readonly reason: InMemoryFenceRefusal;
|
|
8
|
+
constructor(reason: InMemoryFenceRefusal, detail: string);
|
|
9
|
+
}
|
|
10
|
+
/**
|
|
11
|
+
* Unsigned, non-durable, single-process conformance reference.
|
|
12
|
+
*
|
|
13
|
+
* JavaScript executes each method without an await boundary, so compare,
|
|
14
|
+
* validate, and mutate form one atomic critical section. Distributed adapters
|
|
15
|
+
* must provide the same semantics with a CP store. This class cannot satisfy an
|
|
16
|
+
* enforce-mode policy decision or authorize release/external side effects.
|
|
17
|
+
*/
|
|
18
|
+
export declare class InMemoryFencedLeaseReference {
|
|
19
|
+
private readonly now;
|
|
20
|
+
/** This model is local, unsigned, and never an enforce-mode policy authority. */
|
|
21
|
+
readonly referenceOnly = true;
|
|
22
|
+
private readonly leases;
|
|
23
|
+
private readonly repositoryEpoch;
|
|
24
|
+
constructor(now?: () => number);
|
|
25
|
+
acquire(request: FencedLeaseRequest): FencedLease;
|
|
26
|
+
renew(presented: FencedLease, ttlMs: number): FencedLease;
|
|
27
|
+
release(presented: FencedLease): void;
|
|
28
|
+
assertCurrentFence(presented: FencedLease): void;
|
|
29
|
+
current(repositoryId?: string): FencedLease[];
|
|
30
|
+
private assertStoredFence;
|
|
31
|
+
private pruneExpired;
|
|
32
|
+
}
|
|
33
|
+
//# sourceMappingURL=in-memory-fenced-lease-reference.d.ts.map
|
package/node_modules/@claude-flow/codex/dist/harness/in-memory-fenced-lease-reference.d.ts.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"in-memory-fenced-lease-reference.d.ts","sourceRoot":"","sources":["../../src/harness/in-memory-fenced-lease-reference.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAI/D,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,gBAAgB,GAChB,aAAa,GACb,eAAe,GACf,eAAe,CAAC;AAEpB,qBAAa,2BAA4B,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,oBAAoB;gBAA5B,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM;CAGlE;AAsDD;;;;;;;GAOG;AACH,qBAAa,4BAA4B;IAM3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IALhC,iFAAiF;IACjF,QAAQ,CAAC,aAAa,QAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;gBAEhC,GAAG,GAAE,MAAM,MAAiB;IAEzD,OAAO,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW;IA4CjD,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW;IAwBzD,OAAO,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI;IAKrC,kBAAkB,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI;IAQhD,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE;IAS7C,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,YAAY;CAKrB"}
|
|
@@ -0,0 +1,175 @@
|
|
|
1
|
+
import { randomUUID } from 'node:crypto';
|
|
2
|
+
import { portableCaseFold } from './portable-case-fold.js';
|
|
3
|
+
import { parseCanonicalUnsigned } from './unsigned-integer.js';
|
|
4
|
+
export class InMemoryFenceReferenceError extends Error {
|
|
5
|
+
reason;
|
|
6
|
+
constructor(reason, detail) {
|
|
7
|
+
super(detail);
|
|
8
|
+
this.reason = reason;
|
|
9
|
+
}
|
|
10
|
+
}
|
|
11
|
+
function compare(left, right) {
|
|
12
|
+
return left < right ? -1 : left > right ? 1 : 0;
|
|
13
|
+
}
|
|
14
|
+
function text(value, label) {
|
|
15
|
+
const result = value.trim();
|
|
16
|
+
if (!result)
|
|
17
|
+
throw new InMemoryFenceReferenceError('invalid-request', `${label} must be non-empty`);
|
|
18
|
+
return result;
|
|
19
|
+
}
|
|
20
|
+
function normalizeScope(kind, value) {
|
|
21
|
+
const scope = text(value, 'lease scope');
|
|
22
|
+
if (scope.startsWith('-') || scope.includes('\\') || scope !== scope.normalize('NFC')) {
|
|
23
|
+
throw new InMemoryFenceReferenceError('invalid-request', `unsafe lease scope: ${value}`);
|
|
24
|
+
}
|
|
25
|
+
if (kind === 'resource') {
|
|
26
|
+
if (scope.includes('/') || scope === '.' || scope === '..') {
|
|
27
|
+
throw new InMemoryFenceReferenceError('invalid-request', `invalid named resource: ${value}`);
|
|
28
|
+
}
|
|
29
|
+
return scope;
|
|
30
|
+
}
|
|
31
|
+
if (scope.startsWith('/')
|
|
32
|
+
|| scope.split('/').some((part) => !part || part === '.' || part === '..')) {
|
|
33
|
+
throw new InMemoryFenceReferenceError('invalid-request', `invalid path scope: ${value}`);
|
|
34
|
+
}
|
|
35
|
+
return scope;
|
|
36
|
+
}
|
|
37
|
+
function overlaps(kind, left, right) {
|
|
38
|
+
if (kind === 'resource')
|
|
39
|
+
return left === right;
|
|
40
|
+
const foldedLeft = portableCaseFold(left);
|
|
41
|
+
const foldedRight = portableCaseFold(right);
|
|
42
|
+
return foldedLeft === foldedRight
|
|
43
|
+
|| foldedLeft.startsWith(`${foldedRight}/`)
|
|
44
|
+
|| foldedRight.startsWith(`${foldedLeft}/`);
|
|
45
|
+
}
|
|
46
|
+
function sameStrings(left, right) {
|
|
47
|
+
return left.length === right.length && left.every((value, index) => value === right[index]);
|
|
48
|
+
}
|
|
49
|
+
function copyLease(lease) {
|
|
50
|
+
return { ...lease, scopes: [...lease.scopes] };
|
|
51
|
+
}
|
|
52
|
+
/**
|
|
53
|
+
* Unsigned, non-durable, single-process conformance reference.
|
|
54
|
+
*
|
|
55
|
+
* JavaScript executes each method without an await boundary, so compare,
|
|
56
|
+
* validate, and mutate form one atomic critical section. Distributed adapters
|
|
57
|
+
* must provide the same semantics with a CP store. This class cannot satisfy an
|
|
58
|
+
* enforce-mode policy decision or authorize release/external side effects.
|
|
59
|
+
*/
|
|
60
|
+
export class InMemoryFencedLeaseReference {
|
|
61
|
+
now;
|
|
62
|
+
/** This model is local, unsigned, and never an enforce-mode policy authority. */
|
|
63
|
+
referenceOnly = true;
|
|
64
|
+
leases = new Map();
|
|
65
|
+
repositoryEpoch = new Map();
|
|
66
|
+
constructor(now = Date.now) {
|
|
67
|
+
this.now = now;
|
|
68
|
+
}
|
|
69
|
+
acquire(request) {
|
|
70
|
+
const repositoryId = text(request.repositoryId, 'repositoryId');
|
|
71
|
+
const scopes = [...new Set(request.scopes.map((scope) => normalizeScope(request.kind, scope)))]
|
|
72
|
+
.sort(compare);
|
|
73
|
+
if (!scopes.length || !Number.isSafeInteger(request.ttlMs) || request.ttlMs <= 0) {
|
|
74
|
+
throw new InMemoryFenceReferenceError('invalid-request', 'lease requires scopes and a positive safe ttlMs');
|
|
75
|
+
}
|
|
76
|
+
const now = this.now();
|
|
77
|
+
this.pruneExpired(now);
|
|
78
|
+
for (const stored of this.leases.values()) {
|
|
79
|
+
const current = stored.lease;
|
|
80
|
+
if (current.repositoryId !== repositoryId || current.kind !== request.kind)
|
|
81
|
+
continue;
|
|
82
|
+
if (current.scopes.some((held) => scopes.some((wanted) => overlaps(request.kind, held, wanted)))) {
|
|
83
|
+
throw new InMemoryFenceReferenceError('scope-conflict', `scope conflicts with active lease ${current.leaseId}`);
|
|
84
|
+
}
|
|
85
|
+
}
|
|
86
|
+
const epoch = (this.repositoryEpoch.get(repositoryId) ?? 0n) + 1n;
|
|
87
|
+
this.repositoryEpoch.set(repositoryId, epoch);
|
|
88
|
+
const expiresAtMs = now + request.ttlMs;
|
|
89
|
+
if (!Number.isSafeInteger(expiresAtMs)) {
|
|
90
|
+
throw new InMemoryFenceReferenceError('invalid-request', 'lease expiry exceeds safe timestamp range');
|
|
91
|
+
}
|
|
92
|
+
const lease = {
|
|
93
|
+
leaseId: `lease-${randomUUID()}`,
|
|
94
|
+
repositoryId,
|
|
95
|
+
sessionId: text(request.sessionId, 'sessionId'),
|
|
96
|
+
workloadId: text(request.workloadId, 'workloadId'),
|
|
97
|
+
worktreeId: text(request.worktreeId, 'worktreeId'),
|
|
98
|
+
kind: request.kind,
|
|
99
|
+
scopes,
|
|
100
|
+
epoch: epoch.toString(),
|
|
101
|
+
version: '1',
|
|
102
|
+
issuedAt: new Date(now).toISOString(),
|
|
103
|
+
expiresAt: new Date(expiresAtMs).toISOString(),
|
|
104
|
+
advisory: true,
|
|
105
|
+
};
|
|
106
|
+
this.leases.set(lease.leaseId, { lease, expiresAtMs });
|
|
107
|
+
return copyLease(lease);
|
|
108
|
+
}
|
|
109
|
+
renew(presented, ttlMs) {
|
|
110
|
+
if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0) {
|
|
111
|
+
throw new InMemoryFenceReferenceError('invalid-request', 'renewal requires a positive safe ttlMs');
|
|
112
|
+
}
|
|
113
|
+
const stored = this.assertStoredFence(presented);
|
|
114
|
+
const now = this.now();
|
|
115
|
+
if (stored.expiresAtMs <= now) {
|
|
116
|
+
this.leases.delete(presented.leaseId);
|
|
117
|
+
throw new InMemoryFenceReferenceError('expired-fence', `lease ${presented.leaseId} expired`);
|
|
118
|
+
}
|
|
119
|
+
const expiresAtMs = now + ttlMs;
|
|
120
|
+
if (!Number.isSafeInteger(expiresAtMs)) {
|
|
121
|
+
throw new InMemoryFenceReferenceError('invalid-request', 'lease expiry exceeds safe timestamp range');
|
|
122
|
+
}
|
|
123
|
+
const lease = {
|
|
124
|
+
...stored.lease,
|
|
125
|
+
version: (parseCanonicalUnsigned(stored.lease.version, 'lease version') + 1n).toString(),
|
|
126
|
+
expiresAt: new Date(expiresAtMs).toISOString(),
|
|
127
|
+
scopes: [...stored.lease.scopes],
|
|
128
|
+
};
|
|
129
|
+
this.leases.set(lease.leaseId, { lease, expiresAtMs });
|
|
130
|
+
return copyLease(lease);
|
|
131
|
+
}
|
|
132
|
+
release(presented) {
|
|
133
|
+
this.assertCurrentFence(presented);
|
|
134
|
+
this.leases.delete(presented.leaseId);
|
|
135
|
+
}
|
|
136
|
+
assertCurrentFence(presented) {
|
|
137
|
+
const stored = this.assertStoredFence(presented);
|
|
138
|
+
if (stored.expiresAtMs <= this.now()) {
|
|
139
|
+
this.leases.delete(presented.leaseId);
|
|
140
|
+
throw new InMemoryFenceReferenceError('expired-fence', `lease ${presented.leaseId} expired`);
|
|
141
|
+
}
|
|
142
|
+
}
|
|
143
|
+
current(repositoryId) {
|
|
144
|
+
this.pruneExpired(this.now());
|
|
145
|
+
return [...this.leases.values()]
|
|
146
|
+
.map(({ lease }) => lease)
|
|
147
|
+
.filter((lease) => repositoryId === undefined || lease.repositoryId === repositoryId)
|
|
148
|
+
.sort((left, right) => compare(left.leaseId, right.leaseId))
|
|
149
|
+
.map(copyLease);
|
|
150
|
+
}
|
|
151
|
+
assertStoredFence(presented) {
|
|
152
|
+
const stored = this.leases.get(presented.leaseId);
|
|
153
|
+
if (!stored)
|
|
154
|
+
throw new InMemoryFenceReferenceError('unknown-lease', `unknown lease ${presented.leaseId}`);
|
|
155
|
+
const current = stored.lease;
|
|
156
|
+
if (current.repositoryId !== presented.repositoryId
|
|
157
|
+
|| current.sessionId !== presented.sessionId
|
|
158
|
+
|| current.workloadId !== presented.workloadId
|
|
159
|
+
|| current.worktreeId !== presented.worktreeId
|
|
160
|
+
|| current.kind !== presented.kind
|
|
161
|
+
|| !sameStrings(current.scopes, presented.scopes)
|
|
162
|
+
|| current.epoch !== presented.epoch
|
|
163
|
+
|| current.version !== presented.version) {
|
|
164
|
+
throw new InMemoryFenceReferenceError('stale-fence', `stale or altered fence ${presented.leaseId}`);
|
|
165
|
+
}
|
|
166
|
+
return stored;
|
|
167
|
+
}
|
|
168
|
+
pruneExpired(now) {
|
|
169
|
+
for (const [leaseId, stored] of this.leases) {
|
|
170
|
+
if (stored.expiresAtMs <= now)
|
|
171
|
+
this.leases.delete(leaseId);
|
|
172
|
+
}
|
|
173
|
+
}
|
|
174
|
+
}
|
|
175
|
+
//# sourceMappingURL=in-memory-fenced-lease-reference.js.map
|