@clossys/launcher 0.3.0 → 0.4.0

package/dist/ledger-trust.d.ts

@@ -0,0 +1,90 @@
+import type { ChangeSetPhase, RepositoryChangeSet } from "./change-set-contract.js";
+import type { InstalledLedger, LedgerPackageIdentity } from "./ledger-contract.js";
+/** Plan package identities for one plan digest; deferred rows are trusted only against these acts. */
+export interface PlanPackageActs {
+    readonly planDigest: string;
+    readonly packages: readonly (LedgerPackageIdentity & {
+        readonly act: "install" | "pin-starter";
+    })[];
+}
+export interface TrustInstalledLedgerOptions {
+    readonly planPackageActs?: readonly PlanPackageActs[];
+}
+/**
+ * Why a ledger is not trusted. ledger-unreadable: the bytes are not a valid,
+ * exactly canonical ledger. identity: its repository.nodeId is not the
+ * observed repository's (T11). renamed: its repository.id is not exactly the
+ * observed id -- a difference in letter case alone is still a rename, because
+ * a ledger generation can never change the id's case (SUCCESSION S2 and code
+ * rule L10 both require an exact match). ledger-chain: some history entry is
+ * not a held, self-verifying, valid change set that agrees with it. and
+ * ledger-foreign-row: some row is not a write of the change set it names (T9).
+ */
+export type LedgerTrustRule = "ledger-unreadable" | "identity" | "renamed" | "ledger-chain" | "ledger-foreign-row";
+/** The trust verdict on one repository's ledger: trusted (null when the repository has none, generation 0), or refused by one rule. */
+export type LedgerTrust = {
+    readonly state: "trusted";
+    readonly ledger: InstalledLedger | null;
+} | {
+    readonly state: "refused";
+    readonly rule: LedgerTrustRule;
+};
+/**
+ * Whether the planner may build on a repository's ledger. `bytes` is the exact
+ * text of clossys/.state/installed.json at the base (null when there is none),
+ * `observed` the repository's observed id and immutable node id, and `held`
+ * the change sets the hub holds (any repository's; each is re-verified here).
+ * Checks, in order: no ledger is trusted at generation 0; unreadable bytes;
+ * node id (identity); id, compared exactly -- a difference in letter case
+ * alone is still refused as renamed (ledger-trust.ts); every history entry
+ * matched by a held, valid, self-verifying set that agrees with it on phase,
+ * planDigest, bundle, baseCommit, node id and the generation it was computed
+ * over (ledger-chain); and every row a write of its matched set
+ * (ledger-foreign-row). A refusal carries the rule only.
+ */
+export declare function trustInstalledLedger(bytes: Uint8Array | null, observed: {
+    readonly id: string;
+    readonly nodeId: string;
+}, held: readonly RepositoryChangeSet[], options?: TrustInstalledLedgerOptions): LedgerTrust;
+/** What the planner knows about one whole file it wants to write. */
+export interface WholeFileState {
+    readonly path: string;
+    /** The content digest the set wants at the path. */
+    readonly desired: string;
+    /** The trusted ledger's files row `after` at the path (compared case-insensitively), or null when it has none. */
+    readonly row: string | null;
+    /** The base's content digest at the path; null when no file is there. */
+    readonly base: string | null;
+    /** Whether the base has anything at the path: a file, or a directory holding one. */
+    readonly occupied: boolean;
+    readonly phase: ChangeSetPhase;
+    /** The base's composed-skill manifest (clossys/.state/skills.json), read by the caller, or null when absent or unreadable; `sha256` is 64 hex digits with no prefix. */
+    readonly skillsManifest: readonly {
+        readonly name: string;
+        readonly sha256: string;
+    }[] | null;
+}
+/** Whether to write a whole file and from which `before` (null: add; equal to the desired digest: keep; else update), or why not. */
+export type WholeFileOutcome = {
+    readonly write: true;
+    readonly before: string | null;
+} | {
+    readonly write: false;
+    readonly reason: "unowned-existing" | "client-edited" | "deleted";
+};
+/**
+ * The compare-and-swap table for one whole file (RFC §12.1), total over its
+ * inputs and the one place it lives:
+ *
+ *   ledger row  base                      result
+ *   none        nothing there             write, before null (add)
+ *   none        occupied, adoptable       write, before = base (adopted)
+ *   none        occupied, not adoptable   unowned-existing
+ *   h           h                         write, before h (keep or update)
+ *   h           nothing there             deleted (never folded into an update; D13)
+ *   h           occupied by other bytes   client-edited (D11)
+ *
+ * Adoption happens only in a setup set; an apply set never adopts.
+ */
+export declare function reconcileWholeFile(state: WholeFileState): WholeFileOutcome;
+//# sourceMappingURL=ledger-trust.d.ts.map

package/dist/ledger-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-trust.d.ts","sourceRoot":"","sources":["../src/ledger-trust.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAiB,cAAc,EAAc,mBAAmB,EAAmB,MAAM,0BAA0B,CAAC;AAGhI,OAAO,KAAK,EAAE,eAAe,EAAyD,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE1I,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,qBAAqB,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,aAAa,CAAA;KAAE,CAAC,EAAE,CAAC;CACrG;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,cAAc,GAAG,oBAAoB,CAAC;AAEnH,uIAAuI;AACvI,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AA8GlE;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,UAAU,GAAG,IAAI,EACxB,QAAQ,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC1D,IAAI,EAAE,SAAS,mBAAmB,EAAE,EACpC,OAAO,CAAC,EAAE,2BAA2B,GACpC,WAAW,CAyBb;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kHAAkH;IAClH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,wKAAwK;IACxK,QAAQ,CAAC,cAAc,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI,CAAC;CAC/F;AAED,qIAAqI;AACrI,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,GAAG,SAAS,CAAA;CAAE,CAAC;AAuBjG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,gBAAgB,CAS1E"}

package/dist/ledger-trust.js

@@ -0,0 +1,198 @@
+// Whether the apply planner may trust a repository's installed-state ledger
+// (issue #1178; docs/rfcs/apply-approved-plan.md §12.1, §12.2 and §12.8), and
+// the one compare-and-swap table for a whole file. A ledger is a claim anyone
+// with write access could have edited (TRUST in installed-ledger.json, in the
+// public repository, not shipped in this package): it is trusted only when
+// every generation it records is a change set the hub holds as a
+// self-verifying set, and every row it carries is one of those sets' own
+// writes. Anything less refuses the whole repository, never one row: RENDER
+// re-publishes every row it keeps, so a row the hub cannot account for would
+// otherwise be laundered into the next generation.
+//
+// Pure: no I/O, no clock, no randomness. The caller reads the ledger's bytes
+// and the held change sets; this module only compares them. A refusal carries
+// a rule id and nothing else, never a path, id, digest or other value.
+import { EXEMPTION_SURFACES, validateRepositoryChangeSet } from "./change-set-contract.js";
+import { changeSetDigest } from "./change-set-digest.js";
+import { readInstalledLedger } from "./ledger-contract.js";
+const isWhole = (file) => !("derived" in file);
+const isPackageItem = (item) => item.act === "install" || item.act === "pin-starter";
+/** Whether a path refusal of `set` names the item: RENDER adds no entries row for such an item. */
+function pathRefused(set, itemId) {
+    return set.refused.some((refusal) => "path" in refusal && refusal.item === itemId);
+}
+/** Whether a key refusal of `set` names the item: RENDER adds no packages row for such an item. */
+function keyRefused(set, itemId) {
+    return set.refused.some((refusal) => "pointer" in refusal && refusal.item === itemId);
+}
+/** Whether a held set is valid under its contract and its digest recomputes to the one it carries. Never throws. */
+function selfVerifying(set) {
+    try {
+        return validateRepositoryChangeSet(set).valid && changeSetDigest(set) === set.changeSetDigest;
+    }
+    catch {
+        return false;
+    }
+}
+/** The held set that wrote history[index], agreeing with the entry on everything a set carries, or undefined. */
+function matchHistoryEntry(entry, index, nodeId, held, verified) {
+    // Several held sets may share a digest and differ in `bundle`, which is outside the digest and not compared here.
+    return held.find((set) => set?.changeSetDigest === entry.changeSet &&
+        set.phase === entry.phase &&
+        set.planDigest === entry.planDigest &&
+        set.repository?.baseCommit === entry.baseCommit &&
+        set.repository?.nodeId === nodeId &&
+        set.ledger?.generation === index &&
+        verified(set));
+}
+function entryRowWritten(set, row) {
+    return set.items.some((item) => {
+        if (item.act === "exempt-release-age") {
+            return item.path === row.file && EXEMPTION_SURFACES[item.surface].key === row.key && `${item.scope}/*` === row.value && !pathRefused(set, item.id);
+        }
+        if (item.act === "declare-root-entry") {
+            return item.path === row.file && row.key === "rootEntries" && item.entries.some((entry) => entry.name === row.value) && !pathRefused(set, item.id);
+        }
+        return false;
+    });
+}
+function deferredRowWritten(ledger, row, set, planPackageActs) {
+    if (!set.deferred.some((deferral) => deferral.planItem === row.planItem))
+        return false;
+    const entry = ledger.history.find((history) => history.changeSet === row.changeSet);
+    if (entry === undefined)
+        return false;
+    const bundle = planPackageActs?.find((acts) => acts.planDigest === entry.planDigest);
+    if (bundle === undefined)
+        return false;
+    const act = bundle.packages.find((candidate) => candidate.planItem === row.planItem);
+    if (act === undefined)
+        return false;
+    return row.act === act.act && row.name === act.name && row.version === act.version && row.integrity === act.integrity && row.placement === act.placement;
+}
+/** Whether every row of the ledger is a write of the change set it names (L4 makes each name a history entry's). */
+function rowsWritten(ledger, bySet, planPackageActs) {
+    const setOf = (changeSet) => bySet.get(changeSet);
+    return (ledger.files.every((row) => {
+        const set = setOf(row.changeSet);
+        return set !== undefined && set.files.some((file) => isWhole(file) && file.path === row.path && file.mode === row.mode && file.after === row.after);
+    }) &&
+        ledger.keys.every((row) => {
+            const set = setOf(row.changeSet);
+            return set !== undefined && set.keys.some((key) => key.file === row.file && key.pointer === row.pointer && key.after === row.value);
+        }) &&
+        ledger.packages.every((row) => {
+            const set = setOf(row.changeSet);
+            return (set !== undefined &&
+                set.items.some((item) => isPackageItem(item) &&
+                    item.planItem === row.planItem &&
+                    item.act === row.act &&
+                    item.package.name === row.name &&
+                    item.package.version === row.version &&
+                    item.package.integrity === row.integrity &&
+                    item.placement === row.placement &&
+                    !keyRefused(set, item.id)));
+        }) &&
+        ledger.entries.every((row) => {
+            const set = setOf(row.changeSet);
+            return set !== undefined && entryRowWritten(set, row);
+        }) &&
+        ledger.deferred.every((row) => {
+            const set = setOf(row.changeSet);
+            return set !== undefined && deferredRowWritten(ledger, row, set, planPackageActs);
+        }));
+}
+/**
+ * Whether the planner may build on a repository's ledger. `bytes` is the exact
+ * text of clossys/.state/installed.json at the base (null when there is none),
+ * `observed` the repository's observed id and immutable node id, and `held`
+ * the change sets the hub holds (any repository's; each is re-verified here).
+ * Checks, in order: no ledger is trusted at generation 0; unreadable bytes;
+ * node id (identity); id, compared exactly -- a difference in letter case
+ * alone is still refused as renamed (ledger-trust.ts); every history entry
+ * matched by a held, valid, self-verifying set that agrees with it on phase,
+ * planDigest, bundle, baseCommit, node id and the generation it was computed
+ * over (ledger-chain); and every row a write of its matched set
+ * (ledger-foreign-row). A refusal carries the rule only.
+ */
+export function trustInstalledLedger(bytes, observed, held, options) {
+    const refuse = (rule) => ({ state: "refused", rule });
+    if (bytes === null)
+        return { state: "trusted", ledger: null };
+    const ledger = readInstalledLedger(bytes);
+    if (ledger === null)
+        return refuse("ledger-unreadable");
+    if (ledger.repository.nodeId !== observed.nodeId)
+        return refuse("identity");
+    if (ledger.repository.id !== observed.id)
+        return refuse("renamed");
+    const checked = new Map();
+    const verified = (set) => {
+        let result = checked.get(set);
+        if (result === undefined) {
+            result = selfVerifying(set);
+            checked.set(set, result);
+        }
+        return result;
+    };
+    const bySet = new Map();
+    for (const [index, entry] of ledger.history.entries()) {
+        const set = matchHistoryEntry(entry, index, ledger.repository.nodeId, held, verified);
+        if (set === undefined)
+            return refuse("ledger-chain");
+        bySet.set(entry.changeSet, set);
+    }
+    if (!rowsWritten(ledger, bySet, options?.planPackageActs))
+        return refuse("ledger-foreign-row");
+    return { state: "trusted", ledger };
+}
+const SKILL_FILE = /^\.agents\/skills\/clossys-([^/]+)\/skill\.md$/iu;
+/**
+ * The generation-0 adoption pass (RFC §12.2): only in a setup set, only over
+ * a file that is there, and only when its bytes provably are flow output --
+ * the bytes the set would write, or a composed skill whose digest the base's
+ * skills manifest records. clossys/.state/skills.json itself is client
+ * controlled and proves nothing about its own bytes, so it is adopted only
+ * through the first branch, when its base already holds the bytes the set
+ * would write; nothing else about it is ever adopted.
+ */
+function adoptable(state) {
+    const { base } = state;
+    if (state.phase !== "setup" || base === null)
+        return false;
+    if (base === state.desired)
+        return true;
+    const manifest = state.skillsManifest;
+    if (manifest === null)
+        return false;
+    const role = SKILL_FILE.exec(state.path)?.[1]?.toLowerCase();
+    return role !== undefined && manifest.some((entry) => entry.name === role && `sha256:${entry.sha256}` === base);
+}
+/**
+ * The compare-and-swap table for one whole file (RFC §12.1), total over its
+ * inputs and the one place it lives:
+ *
+ *   ledger row  base                      result
+ *   none        nothing there             write, before null (add)
+ *   none        occupied, adoptable       write, before = base (adopted)
+ *   none        occupied, not adoptable   unowned-existing
+ *   h           h                         write, before h (keep or update)
+ *   h           nothing there             deleted (never folded into an update; D13)
+ *   h           occupied by other bytes   client-edited (D11)
+ *
+ * Adoption happens only in a setup set; an apply set never adopts.
+ */
+export function reconcileWholeFile(state) {
+    const occupied = state.occupied || state.base !== null;
+    if (state.row === null) {
+        if (!occupied)
+            return { write: true, before: null };
+        return adoptable(state) ? { write: true, before: state.base } : { write: false, reason: "unowned-existing" };
+    }
+    if (state.base === state.row)
+        return { write: true, before: state.row };
+    if (!occupied)
+        return { write: false, reason: "deleted" };
+    return { write: false, reason: "client-edited" };
+}
+//# sourceMappingURL=ledger-trust.js.map

package/dist/ledger-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-trust.js","sourceRoot":"","sources":["../src/ledger-trust.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,iEAAiE;AACjE,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,mDAAmD;AACnD,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AAEvE,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAE3F,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAgC3D,MAAM,OAAO,GAAG,CAAC,IAAgB,EAA2B,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AACpF,MAAM,aAAa,GAAG,CAAC,IAAmB,EAAuB,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC;AAEzH,mGAAmG;AACnG,SAAS,WAAW,CAAC,GAAwB,EAAE,MAAc;IAC3D,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AACrF,CAAC;AAED,mGAAmG;AACnG,SAAS,UAAU,CAAC,GAAwB,EAAE,MAAc;IAC1D,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AACxF,CAAC;AAED,oHAAoH;AACpH,SAAS,aAAa,CAAC,GAAwB;IAC7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,eAAe,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iHAAiH;AACjH,SAAS,iBAAiB,CACxB,KAAyB,EACzB,KAAa,EACb,MAAc,EACd,IAAoC,EACpC,QAA+C;IAE/C,kHAAkH;IAClH,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,EAAE,eAAe,KAAK,KAAK,CAAC,SAAS;QACxC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QACzB,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACnC,GAAG,CAAC,UAAU,EAAE,UAAU,KAAK,KAAK,CAAC,UAAU;QAC/C,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM;QACjC,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,KAAK;QAChC,QAAQ,CAAC,GAAG,CAAC,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAwB,EAAE,GAAmB;IACpE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC,GAAG,KAAK,oBAAoB,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACrJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,KAAK,oBAAoB,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,aAAa,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACrJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAuB,EAAE,GAAsB,EAAE,GAAwB,EAAE,eAAuD;IAC5J,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC;IACpF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,MAAM,GAAG,eAAe,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;IACrF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC;AAC3J,CAAC;AAED,oHAAoH;AACpH,SAAS,WAAW,CAAC,MAAuB,EAAE,KAA+C,EAAE,eAAuD;IACpJ,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1D,OAAO,CACL,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACtJ,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;QACtI,CAAC,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,OAAO,CACL,GAAG,KAAK,SAAS;gBACjB,GAAG,CAAC,KAAK,CAAC,IAAI,CACZ,CAAC,IAAI,EAAE,EAAE,CACP,aAAa,CAAC,IAAI,CAAC;oBACnB,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;oBAC9B,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG;oBACpB,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;oBAC9B,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;oBACpC,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;oBACxC,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;oBAChC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAC5B,CACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,OAAO,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,OAAO,GAAG,KAAK,SAAS,IAAI,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;QACpF,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAwB,EACxB,QAA0D,EAC1D,IAAoC,EACpC,OAAqC;IAErC,MAAM,MAAM,GAAG,CAAC,IAAqB,EAAe,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAEnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IACxD,MAAM,QAAQ,GAAG,CAAC,GAAwB,EAAE,EAAE;QAC5C,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtF,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;QACrD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC/F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAuBD,MAAM,UAAU,GAAG,kDAAkD,CAAC;AAEtE;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAqB;IACtC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,IAAI,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC;IACtC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7D,OAAO,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,UAAU,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;AAClH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAqB;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;IACvD,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACxE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACnD,CAAC"}

package/dist/lockfile-invariants.d.ts

@@ -0,0 +1,48 @@
+import type { DependencyPlacement } from "./change-set-contract.js";
+import type { LockfileFormat, LockfileUnreadableReason } from "./lockfile-readers.js";
+export type LockfileInvariantId = "I1" | "I2" | "I3" | "I4" | "I5";
+/** One approved package the regenerated lockfile must resolve exactly. */
+export interface LockfileInvariantPackage {
+    readonly name: string;
+    readonly version: string;
+    readonly integrity: string;
+    readonly placement: DependencyPlacement;
+}
+export interface LockfileInvariantInput {
+    readonly format: LockfileFormat;
+    readonly base: string;
+    readonly regenerated: string;
+    readonly packages: readonly LockfileInvariantPackage[];
+    /** Defaults to PACKAGE_SCOPE. */
+    readonly publishing?: {
+        readonly scope: string;
+        readonly registry: string;
+    };
+}
+export interface LockfileInvariantViolation {
+    readonly invariant: LockfileInvariantId;
+    /** The package name this violation is about; "" for I4, whose violation is about the lockfile format as a whole, not one package. */
+    readonly name: string;
+}
+export interface TransitiveCounts {
+    /** `name@version` present after and not before. */
+    readonly added: number;
+    /** `name@version` present before and not after. */
+    readonly removed: number;
+}
+export type LockfileInvariantResult = {
+    readonly verdict: "satisfied";
+    readonly violations: readonly [];
+    readonly transitive: TransitiveCounts;
+} | {
+    readonly verdict: "violated";
+    readonly violations: readonly LockfileInvariantViolation[];
+    readonly transitive: TransitiveCounts;
+} | {
+    readonly verdict: "indeterminate";
+    readonly reason: LockfileUnreadableReason;
+    readonly side: "base" | "regenerated";
+};
+/** Checks I1 to I5 between a base and a regenerated lockfile. Pure; never throws. */
+export declare function checkLockfileInvariants(input: LockfileInvariantInput): LockfileInvariantResult;
+//# sourceMappingURL=lockfile-invariants.d.ts.map

package/dist/lockfile-invariants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile-invariants.d.ts","sourceRoot":"","sources":["../src/lockfile-invariants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGpE,OAAO,KAAK,EAAiB,cAAc,EAAE,wBAAwB,EAAgC,MAAM,uBAAuB,CAAC;AAGnI,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnE,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACvD,iCAAiC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,qIAAqI;IACrI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GAC1G;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GACnI;IAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAA;CAAE,CAAC;AAoX5H,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,CAM9F"}