@clossys/writer 0.3.9 → 0.5.0

package/dist/plan-authority.js

@@ -0,0 +1,126 @@
+// Whether the bytes of an Advisor plan record authorize copy a delegate
+// approved on production (issue #1586). The plan's optional
+// `delegatedCopyApproval` declares that grant, and an approval binds the plan
+// it grants for: this reads the field only through a latest decision that
+// names the plan's own canonical digest. Two files define what is read, both
+// in the public repository, not shipped in this package: the plan contract,
+// docs/contracts/advisor-plan.json (see its DELEGATED COPY APPROVAL and
+// APPROVAL BINDING sections), and the digest definition,
+// docs/contracts/advisor-plan-digest.md.
+//
+// It is a pure function of the bytes: it reads no file, keeps nothing between
+// calls and never looks at the clock, because a plan approval has no expiry
+// of its own. It takes bytes, not a parsed object, because the digest is
+// defined only over a plan that was read strictly, and an object a caller
+// built can carry getters or proxies that answer validation, the digest and
+// the scope check differently. What it does not prove is who wrote the
+// decision, or where the bytes came from: see this package's README.
+import { readContractDocument } from "./generated/contract-schema.generated.js";
+import { planViolations } from "./plan-contract.js";
+import { digestOfValidPlan } from "./plan-digest.js";
+const SUBJECT_DIGEST = /^sha256:[0-9a-f]{64}$/;
+function refuse(refusal, violations) {
+    if (violations === undefined)
+        return Object.freeze({ authorized: false, refusal });
+    return Object.freeze({ authorized: false, refusal, violations: Object.freeze(violations.map((violation) => Object.freeze({ rule: violation.rule, path: violation.path }))) });
+}
+/**
+ * The positions of the decisions made at the latest instant, by `at` and
+ * never by array position, in array order. Times are compared as instants
+ * (`Date.parse`), so `2026-09-21T00:00:00Z` and `2026-09-21T02:00:00+02:00`
+ * tie. Null when there are no decisions, or when any `at` does not parse to a
+ * finite time, because then time cannot say which is latest. Exported for
+ * tests, not from the package entry point.
+ */
+export function latestDecisionIndices(decisions) {
+    if (decisions.length === 0)
+        return null;
+    const times = decisions.map((decision) => Date.parse(decision.at));
+    if (!times.every(Number.isFinite))
+        return null;
+    // A reduce, not Math.max(...times): spreading a very long list into arguments throws a RangeError.
+    const latest = times.reduce((highest, time) => (time > highest ? time : highest), Number.NEGATIVE_INFINITY);
+    const indices = [];
+    times.forEach((time, index) => {
+        if (time === latest)
+            indices.push(index);
+    });
+    return indices;
+}
+/** True for a real `Uint8Array` (a Node `Buffer` is one), never a `DataView`, another typed array or a proxy. */
+export function isPlanBytes(value) {
+    try {
+        return value instanceof Uint8Array && ArrayBuffer.isView(value);
+    }
+    catch {
+        return false; // instanceof throws on a revoked proxy
+    }
+}
+/**
+ * Whether the bytes of a plan record authorize delegate-approved copy on
+ * production. Checks run in this order and the first that fails refuses:
+ *
+ * 1. the argument is a `Uint8Array` (`plan-not-bytes`);
+ * 2. the bytes are strict JSON (`plan-unreadable`);
+ * 3. the plan validates against the plan contract, R1-R12 included
+ *    (`plan-invalid`, with each violation's rule and position);
+ * 4. the plan declares `delegatedCopyApproval` (`delegated-copy-approval-absent`);
+ * 5-9. the plan's latest decision, found by time and never by array
+ *    position, has chosen "approved" and names one sha256 `subjectDigest`.
+ *    When several decisions share the latest instant, every one is examined:
+ *    the outcome does not depend on their order;
+ * 10. that digest equals the plan's own canonical digest, computed here from
+ *    the same bytes (`subject-digest-mismatch`). The digest covers
+ *    `delegatedCopyApproval`, so a declaration added, removed or edited after
+ *    the approval leaves the plan unapproved for this purpose.
+ *
+ * Never throws for a bad argument and never echoes plan text. The result and
+ * everything in it is frozen, and copied from the bytes, which are copied
+ * before they are read.
+ */
+export function planDelegateCopyAuthority(planBytes) {
+    if (!isPlanBytes(planBytes))
+        return refuse("plan-not-bytes");
+    // A copy, so nothing the caller does to its buffer during or after this call changes what is read.
+    const bytes = new Uint8Array(planBytes);
+    let value;
+    try {
+        value = readContractDocument(bytes);
+    }
+    catch {
+        return refuse("plan-unreadable");
+    }
+    const violations = planViolations(value);
+    if (violations.length > 0)
+        return refuse("plan-invalid", violations);
+    const plan = value;
+    if (!Object.hasOwn(plan, "delegatedCopyApproval"))
+        return refuse("delegated-copy-approval-absent");
+    if (plan.decisions.length === 0)
+        return refuse("no-decisions");
+    const latestIndices = latestDecisionIndices(plan.decisions);
+    if (latestIndices === null)
+        return refuse("decision-time-unparseable");
+    const latest = latestIndices.map((index) => plan.decisions[index]);
+    if (latest.some((decision) => decision.chosen !== "approved"))
+        return refuse("latest-decision-not-approved");
+    const subjects = latest.map((decision) => (Object.hasOwn(decision, "subjectDigest") ? decision.subjectDigest : undefined));
+    if (subjects.some((subject) => typeof subject !== "string" || !SUBJECT_DIGEST.test(subject)))
+        return refuse("approval-without-subject-digest");
+    if (subjects.some((subject) => subject !== subjects[0]))
+        return refuse("latest-decisions-disagree");
+    let digest;
+    try {
+        digest = digestOfValidPlan(plan);
+    }
+    catch {
+        return refuse("plan-invalid", []);
+    }
+    if (subjects[0] !== digest)
+        return refuse("subject-digest-mismatch");
+    const declaration = plan.delegatedCopyApproval;
+    if (!Object.hasOwn(declaration, "scopes") || declaration.scopes === undefined)
+        return Object.freeze({ authorized: true, planDigest: digest });
+    return Object.freeze({ authorized: true, planDigest: digest, scopes: Object.freeze([...declaration.scopes]) });
+}
+//# sourceMappingURL=plan-authority.js.map

package/dist/plan-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-authority.js","sourceRoot":"","sources":["../src/plan-authority.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,4DAA4D;AAC5D,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,yDAAyD;AACzD,yCAAyC;AACzC,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,uEAAuE;AACvE,qEAAqE;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAyCrD,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAE/C,SAAS,MAAM,CAAC,OAAgC,EAAE,UAAwE;IACxH,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAChL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAA6C;IACjF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,mGAAmG;IACnG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC;QACH,OAAO,KAAK,YAAY,UAAU,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,uCAAuC;IACvD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAA+B;IACvE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7D,mGAAmG;IACnG,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAExC,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,KAAqB,CAAC;IAEnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,CAAC;QAAE,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IACnG,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAE/D,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAE,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAE7G,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3H,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,iCAAiC,CAAC,CAAC;IAC/I,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAEpG,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,IAAoD,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAErE,MAAM,WAAW,GAAG,IAAI,CAAC,qBAAsB,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9I,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;AACjH,CAAC"}

package/dist/plan-contract.d.ts

@@ -0,0 +1,16 @@
+import type { PlanRuleId } from "./plan-rules.js";
+/** One reason a plan is refused: `rule` is "schema" for the contract's keywords, else the code rule's id. */
+export interface PlanViolation {
+    readonly rule: "schema" | PlanRuleId;
+    /** The field at fault, like `staffing[1].repository`, or "" for the document itself. */
+    readonly path: string;
+    /** The whole message, starting with `plan` and the path; it never quotes a value. */
+    readonly message: string;
+}
+/**
+ * Every reason `value` is not a valid plan: the plan contract's schema, then,
+ * once that passes, its code rules R1-R12. Empty means valid. Never throws
+ * for a bad value, and no message echoes a value from the plan.
+ */
+export declare function planViolations(value: unknown): PlanViolation[];
+//# sourceMappingURL=plan-contract.d.ts.map

package/dist/plan-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-contract.d.ts","sourceRoot":"","sources":["../src/plan-contract.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAgB,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhE,6GAA6G;AAC7G,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IACrC,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,EAAE,CAW9D"}

package/dist/plan-contract.js

@@ -0,0 +1,33 @@
+// Reads a plan record (issue #1586) against the shared plan contract
+// docs/contracts/advisor-plan.json -- in the public repository, not shipped in
+// this package. This package's build packs that contract into src/generated/
+// as plain data, with a generated copy of the one contract checker every
+// other reader of a plan also uses (packages/advisor/src/contract-schema.ts,
+// likewise in the public repository, not shipped in this package), so
+// Writer validates against the same definition with no runtime dependency on
+// any other package.
+import { ADVISOR_PLAN_CONTRACT } from "./generated/advisor-plan-contract.generated.js";
+import { formatContractViolation, validateAgainstContract } from "./generated/contract-schema.generated.js";
+import { planRuleViolations } from "./plan-rules.js";
+/** The plan contract refers to no other contract file, so every name is refused. */
+function refuseEveryName(name) {
+    throw new Error(`the plan contract refers to no other contract, but the checker asked for ${JSON.stringify(name)}`);
+}
+/**
+ * Every reason `value` is not a valid plan: the plan contract's schema, then,
+ * once that passes, its code rules R1-R12. Empty means valid. Never throws
+ * for a bad value, and no message echoes a value from the plan.
+ */
+export function planViolations(value) {
+    const schema = validateAgainstContract(ADVISOR_PLAN_CONTRACT, value, refuseEveryName);
+    if (schema.length > 0) {
+        return schema.map((violation) => ({ rule: "schema", path: violation.path, message: formatContractViolation("plan", violation) }));
+    }
+    // The code rules relate fields to one another, so they run only on a plan whose shape is known good.
+    return planRuleViolations(value).map((violation) => ({
+        rule: violation.rule,
+        path: violation.path,
+        message: `plan.${violation.path} ${violation.message} (rule ${violation.rule})`,
+    }));
+}
+//# sourceMappingURL=plan-contract.js.map

package/dist/plan-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-contract.js","sourceRoot":"","sources":["../src/plan-contract.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,sEAAsE;AACtE,6EAA6E;AAC7E,qBAAqB;AAErB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAC5G,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAYrD,oFAAoF;AACpF,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,KAAK,CAAC,4EAA4E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,uBAAuB,CAAC,qBAAqB,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACpI,CAAC;IACD,qGAAqG;IACrG,OAAO,kBAAkB,CAAC,KAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,OAAO,EAAE,QAAQ,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,IAAI,GAAG;KAChF,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/plan-digest.d.ts

@@ -0,0 +1,23 @@
+/** The top-level plan members the digest leaves out: when the file was written, and the decisions an approval is recorded in. */
+export declare const PLAN_DIGEST_EXCLUDED_FIELDS: readonly string[];
+/**
+ * RFC 8785 (JSON Canonicalization Scheme) serialization: no whitespace,
+ * object members sorted by UTF-16 code units, strings escaped only where
+ * JSON requires, numbers as ECMAScript writes them. Throws on anything JSON
+ * cannot carry (undefined, a function, a bigint, a non-finite number, a hole
+ * in an array) and on a lone surrogate, rather than silently dropping or
+ * repairing it.
+ */
+export declare function canonicalJson(value: unknown): string;
+/**
+ * `sha256:` and the lowercase hex SHA-256 of the canonical JSON of a plan
+ * without `asOf` and `decisions`. Assumes `plan` already passed
+ * `planViolations()`: it checks nothing itself.
+ */
+export declare function digestOfValidPlan(plan: Readonly<Record<string, unknown>>): string;
+/**
+ * The plan digest. Throws when the plan does not validate against the plan
+ * contract, rules included: an invalid plan has no digest.
+ */
+export declare function planDigest(plan: unknown): string;
+//# sourceMappingURL=plan-digest.d.ts.map

package/dist/plan-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-digest.d.ts","sourceRoot":"","sources":["../src/plan-digest.ts"],"names":[],"mappings":"AAcA,iIAAiI;AACjI,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAA0B,CAAC;AAUpF;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CA0BpD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAIjF;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAIhD"}

package/dist/plan-digest.js

@@ -0,0 +1,82 @@
+// The canonical plan digest (issue #1586), implemented from its one
+// definition, docs/contracts/advisor-plan-digest.md -- in the public repository, not shipped in this package.
+// An approval binds this value, so it names exactly which plan was approved.
+// Every other reader of a plan implements the same definition separately, and
+// each is tested against the same fixture corpus,
+// docs/contracts/advisor-plan-digest.fixture.json (likewise in the public repository, not shipped in this package),
+// so all of them compute identical digests.
+// This is a third, separate reading of RFC 8785: strings go through
+// JSON.stringify, whose output for well-formed text is exactly the escaping
+// RFC 8785 requires, with a lone surrogate refused before it.
+import { createHash } from "node:crypto";
+import { planViolations } from "./plan-contract.js";
+/** The top-level plan members the digest leaves out: when the file was written, and the decisions an approval is recorded in. */
+export const PLAN_DIGEST_EXCLUDED_FIELDS = ["asOf", "decisions"];
+const LONE_SURROGATE_CHECK = /[\uD800-\uDFFF]/u;
+/** A string as RFC 8785 writes it. Throws on a string that is not well-formed Unicode. */
+function canonicalString(text) {
+    if (LONE_SURROGATE_CHECK.test(text))
+        throw new TypeError("canonical JSON refuses a string that is not well-formed Unicode (a lone surrogate)");
+    return JSON.stringify(text);
+}
+/**
+ * RFC 8785 (JSON Canonicalization Scheme) serialization: no whitespace,
+ * object members sorted by UTF-16 code units, strings escaped only where
+ * JSON requires, numbers as ECMAScript writes them. Throws on anything JSON
+ * cannot carry (undefined, a function, a bigint, a non-finite number, a hole
+ * in an array) and on a lone surrogate, rather than silently dropping or
+ * repairing it.
+ */
+export function canonicalJson(value) {
+    if (value === null)
+        return "null";
+    switch (typeof value) {
+        case "boolean":
+            return value ? "true" : "false";
+        case "number":
+            if (!Number.isFinite(value))
+                throw new TypeError("canonical JSON refuses a non-finite number");
+            return String(value);
+        case "string":
+            return canonicalString(value);
+        case "object": {
+            if (Array.isArray(value)) {
+                const items = [];
+                for (let index = 0; index < value.length; index += 1)
+                    items.push(canonicalJson(value[index]));
+                return `[${items.join(",")}]`;
+            }
+            const record = value;
+            // The default sort compares UTF-16 code units, which is the order RFC 8785 requires.
+            const members = Object.keys(record)
+                .sort()
+                .map((key) => `${canonicalString(key)}:${canonicalJson(record[key])}`);
+            return `{${members.join(",")}}`;
+        }
+        default:
+            throw new TypeError(`canonical JSON refuses a value of type ${typeof value}`);
+    }
+}
+/**
+ * `sha256:` and the lowercase hex SHA-256 of the canonical JSON of a plan
+ * without `asOf` and `decisions`. Assumes `plan` already passed
+ * `planViolations()`: it checks nothing itself.
+ */
+export function digestOfValidPlan(plan) {
+    const subject = {};
+    for (const key of Object.keys(plan))
+        if (!PLAN_DIGEST_EXCLUDED_FIELDS.includes(key))
+            subject[key] = plan[key];
+    return `sha256:${createHash("sha256").update(canonicalJson(subject), "utf8").digest("hex")}`;
+}
+/**
+ * The plan digest. Throws when the plan does not validate against the plan
+ * contract, rules included: an invalid plan has no digest.
+ */
+export function planDigest(plan) {
+    const violations = planViolations(plan);
+    if (violations.length > 0)
+        throw new TypeError(`an invalid plan has no digest: ${violations.map((violation) => violation.message).join("; ")}`);
+    return digestOfValidPlan(plan);
+}
+//# sourceMappingURL=plan-digest.js.map

package/dist/plan-digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-digest.js","sourceRoot":"","sources":["../src/plan-digest.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,8GAA8G;AAC9G,6EAA6E;AAC7E,8EAA8E;AAC9E,kDAAkD;AAClD,oHAAoH;AACpH,4CAA4C;AAC5C,oEAAoE;AACpE,4EAA4E;AAC5E,8DAA8D;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,iIAAiI;AACjI,MAAM,CAAC,MAAM,2BAA2B,GAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAEpF,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD,0FAA0F;AAC1F,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,oFAAoF,CAAC,CAAC;IAC/I,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;YAC/F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9F,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YACD,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,qFAAqF;YACrF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;iBAChC,IAAI,EAAE;iBACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACzE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,CAAC;QACD;YACE,MAAM,IAAI,SAAS,CAAC,0CAA0C,OAAO,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAuC;IACvE,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9G,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChJ,OAAO,iBAAiB,CAAC,IAAyC,CAAC,CAAC;AACtE,CAAC"}

package/dist/plan-rules.d.ts

@@ -0,0 +1,54 @@
+/** A code rule of the plan contract. */
+export type PlanRuleId = "R1" | "R2" | "R3" | "R4" | "R5" | "R6" | "R7" | "R8" | "R9" | "R10" | "R11" | "R12";
+/**
+ * The roles whose package lives in the engagement hub only, read from the
+ * packed plan contract's `definitions.hubOnlyRoles`, the one list every
+ * reader of a plan uses. Code rules R2 and R11 use it. A packed contract
+ * without a well-formed list is a build defect, so loading this module throws
+ * rather than judge plans against a guess.
+ */
+export declare const HUB_ONLY_ROLES: readonly string[];
+/**
+ * The members of a plan these rules and the authority read, and no more. A
+ * plan that passed the contract's schema has this shape; it is a structural
+ * view, not the contract, and it validates nothing.
+ */
+export interface PlanDocument {
+    readonly mandate: {
+        readonly roles: readonly string[];
+    };
+    readonly staffing?: readonly {
+        readonly repository: string;
+        readonly roles: readonly string[];
+    }[];
+    readonly packages?: readonly {
+        readonly planItem: string;
+        readonly repository: string;
+        readonly act: string;
+        readonly name: string;
+        readonly placement: string;
+    }[];
+    readonly kits?: readonly {
+        readonly id: string;
+    }[];
+    readonly resolution?: unknown;
+    readonly delegatedCopyApproval?: {
+        readonly target: "production";
+        readonly scopes?: readonly string[];
+    };
+    readonly decisions: readonly {
+        readonly at: string;
+        readonly chosen: string;
+        readonly subjectDigest?: string;
+    }[];
+}
+export interface PlanRuleViolation {
+    readonly rule: PlanRuleId;
+    /** The field at fault, such as `staffing[1].repository`. */
+    readonly path: string;
+    /** What is wrong, by position only. */
+    readonly message: string;
+}
+/** Every violation of R1-R12, for a plan that already passed the plan contract's schema. */
+export declare function planRuleViolations(plan: PlanDocument): PlanRuleViolation[];
+//# sourceMappingURL=plan-rules.d.ts.map

package/dist/plan-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-rules.d.ts","sourceRoot":"","sources":["../src/plan-rules.ts"],"names":[],"mappings":"AAmBA,wCAAwC;AACxC,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAE9G;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAOxC,CAAC;AAEL;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAClG,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;IACJ,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACxG,QAAQ,CAAC,SAAS,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAClH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AA0BD,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,iBAAiB,EAAE,CAsF1E"}

package/dist/plan-rules.js

@@ -0,0 +1,145 @@
+// The plan contract's code rules R1-R12 (issue #1178, read here for issue
+// #1586): the checks the contract's JSON Schema keywords cannot express,
+// because each one relates one field to another. They are defined once, as
+// prose in the description of the shared contract
+// docs/contracts/advisor-plan.json -- in the public repository, not shipped
+// in this package. This is @clossys/writer's own implementation, written from
+// that text; every other reader of a plan implements the rules separately,
+// and each is tested against one corpus,
+// docs/contracts/advisor-plan-rules.fixture.json (likewise in the public
+// repository, not shipped in this package), so a plan one of them accepts,
+// they all accept, and the reverse.
+//
+// These functions assume the value already passed the plan contract's
+// schema: plan-contract.ts runs them only then. A violation names its rule and
+// the position of the field at fault, never a value, because a plan can carry
+// founder text.
+import { ADVISOR_PLAN_CONTRACT } from "./generated/advisor-plan-contract.generated.js";
+/**
+ * The roles whose package lives in the engagement hub only, read from the
+ * packed plan contract's `definitions.hubOnlyRoles`, the one list every
+ * reader of a plan uses. Code rules R2 and R11 use it. A packed contract
+ * without a well-formed list is a build defect, so loading this module throws
+ * rather than judge plans against a guess.
+ */
+export const HUB_ONLY_ROLES = (() => {
+    const definitions = ADVISOR_PLAN_CONTRACT.definitions;
+    const roles = definitions?.hubOnlyRoles?.const;
+    if (!Array.isArray(roles) || roles.some((role) => typeof role !== "string")) {
+        throw new Error("the packed plan contract has no well-formed definitions.hubOnlyRoles");
+    }
+    return Object.freeze([...roles]);
+})();
+/**
+ * The position of every item whose key an earlier item already had, with the
+ * position of the first item that had it. Items keep their order.
+ */
+function repeats(keys) {
+    const seenAt = new Map();
+    const found = [];
+    keys.forEach((key, index) => {
+        const first = seenAt.get(key);
+        if (first === undefined)
+            seenAt.set(key, index);
+        else
+            found.push({ index, first });
+    });
+    return found;
+}
+/**
+ * A plan's own member, or undefined. The schema checker sees only own
+ * members, so these rules read only those too: a member inherited from a
+ * prototype is ignored, never judged.
+ */
+function ownMember(document, name) {
+    return Object.hasOwn(document, name) ? document[name] : undefined;
+}
+/** Every violation of R1-R12, for a plan that already passed the plan contract's schema. */
+export function planRuleViolations(plan) {
+    const found = [];
+    const report = (rule, path, message) => {
+        found.push({ rule, path, message });
+    };
+    const staffing = ownMember(plan, "staffing");
+    const acts = ownMember(plan, "packages");
+    const kits = ownMember(plan, "kits");
+    const mandateRoles = plan.mandate.roles;
+    const lower = (text) => text.toLowerCase();
+    if (staffing !== undefined) {
+        // R1: one staffing entry per repository; ids compare case-insensitively.
+        for (const { index, first } of repeats(staffing.map((entry) => lower(entry.repository)))) {
+            report("R1", `staffing[${index}].repository`, `names the same repository as staffing[${first}].repository (repository ids compare case-insensitively)`);
+        }
+        // R2: staffed roles and mandate roles agree in both directions; a hub-only role is never required to be staffed.
+        const mandated = new Set(mandateRoles);
+        const staffed = new Set(staffing.flatMap((entry) => entry.roles));
+        staffing.forEach((entry, index) => {
+            entry.roles.forEach((role, position) => {
+                if (!mandated.has(role))
+                    report("R2", `staffing[${index}].roles[${position}]`, "is not one of mandate.roles");
+            });
+        });
+        mandateRoles.forEach((role, position) => {
+            if (!staffed.has(role) && !HUB_ONLY_ROLES.includes(role))
+                report("R2", `mandate.roles[${position}]`, "is not staffed in any staffing entry");
+        });
+        staffing.forEach((entry, index) => {
+            // R8: no role twice within one staffing entry.
+            for (const { index: position, first } of repeats(entry.roles)) {
+                report("R8", `staffing[${index}].roles[${position}]`, `repeats staffing[${index}].roles[${first}]`);
+            }
+            // R11: a hub-only role is never staffed in a repository.
+            entry.roles.forEach((role, position) => {
+                if (HUB_ONLY_ROLES.includes(role))
+                    report("R11", `staffing[${index}].roles[${position}]`, "is a hub-only role, which works from the hub and is never staffed in a repository");
+            });
+        });
+    }
+    if (acts !== undefined) {
+        // R3: every act names a staffed repository, spelled exactly the same.
+        const staffedRepositories = new Set((staffing ?? []).map((entry) => entry.repository));
+        acts.forEach((act, index) => {
+            if (!staffedRepositories.has(act.repository))
+                report("R3", `packages[${index}].repository`, "is not spelled exactly as any staffing[].repository");
+        });
+        // R4: planItem ids are unique.
+        for (const { index, first } of repeats(acts.map((act) => act.planItem))) {
+            report("R4", `packages[${index}].planItem`, `repeats packages[${first}].planItem`);
+        }
+        // R5: one act per (repository, name); repositories compare case-insensitively.
+        for (const { index, first } of repeats(acts.map((act) => JSON.stringify([lower(act.repository), act.name])))) {
+            report("R5", `packages[${index}].name`, `repeats the repository and name of packages[${first}] (repositories compare case-insensitively)`);
+        }
+        // R12: every planItem is exactly its act's repository, a colon and its name, in the same letter case.
+        acts.forEach((act, index) => {
+            if (act.planItem !== `${act.repository}:${act.name}`)
+                report("R12", `packages[${index}].planItem`, "is not this act's repository, a colon and its name, in the same letter case");
+        });
+        // R10: at most one pin-starter act per repository (compared case-insensitively), and it is a devDependency.
+        const pinAt = acts.flatMap((act, index) => (act.act === "pin-starter" ? [index] : []));
+        for (const { index, first } of repeats(pinAt.map((position) => lower(acts[position].repository)))) {
+            report("R10", `packages[${pinAt[index]}].act`, `is a second act of this kind for the repository of packages[${pinAt[first]}] (repositories compare case-insensitively)`);
+        }
+        for (const position of pinAt) {
+            if (acts[position].placement !== "devDependencies")
+                report("R10", `packages[${position}].placement`, "must be devDependencies for a pin-starter act");
+        }
+    }
+    // R6: resolution is present exactly when packages is.
+    const hasPackages = Object.hasOwn(plan, "packages");
+    const hasResolution = Object.hasOwn(plan, "resolution");
+    if (hasPackages && !hasResolution)
+        report("R6", "resolution", "is required when packages is present");
+    if (!hasPackages && hasResolution)
+        report("R6", "resolution", "must be absent when there are no packages");
+    // R7: kit ids are unique.
+    for (const { index, first } of repeats((kits ?? []).map((kit) => kit.id))) {
+        report("R7", `kits[${index}].id`, `repeats kits[${first}].id`);
+    }
+    // R9: no role twice in mandate.roles.
+    for (const { index, first } of repeats(mandateRoles)) {
+        report("R9", `mandate.roles[${index}]`, `repeats mandate.roles[${first}]`);
+    }
+    return found;
+}
+//# sourceMappingURL=plan-rules.js.map

package/dist/plan-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-rules.js","sourceRoot":"","sources":["../src/plan-rules.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,kDAAkD;AAClD,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,yCAAyC;AACzC,yEAAyE;AACzE,2EAA2E;AAC3E,oCAAoC;AACpC,EAAE;AACF,sEAAsE;AACtE,+EAA+E;AAC/E,8EAA8E;AAC9E,gBAAgB;AAEhB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAKvF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE;IACrD,MAAM,WAAW,GAAG,qBAAqB,CAAC,WAA8D,CAAC;IACzG,MAAM,KAAK,GAAG,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAI,KAAkB,CAAC,CAAC,CAAC;AACjD,CAAC,CAAC,EAAE,CAAC;AA+BL;;;GAGG;AACH,SAAS,OAAO,CAAC,IAAuB;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;;YAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAsC,QAAW,EAAE,IAAO;IAC1E,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,IAAY,EAAE,OAAe,EAAQ,EAAE;QACvE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAE3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,yEAAyE;QACzE,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc,EAAE,yCAAyC,KAAK,0DAA0D,CAAC,CAAC;QAC1J,CAAC;QAED,iHAAiH;QACjH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,IAAI,EAAE,YAAY,KAAK,WAAW,QAAQ,GAAG,EAAE,6BAA6B,CAAC,CAAC;YAChH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;YACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,QAAQ,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAC/I,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,+CAA+C;YAC/C,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9D,MAAM,CAAC,IAAI,EAAE,YAAY,KAAK,WAAW,QAAQ,GAAG,EAAE,oBAAoB,KAAK,WAAW,KAAK,GAAG,CAAC,CAAC;YACtG,CAAC;YACD,yDAAyD;YACzD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACrC,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,KAAK,EAAE,YAAY,KAAK,WAAW,QAAQ,GAAG,EAAE,mFAAmF,CAAC,CAAC;YACjL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,sEAAsE;QACtE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC1B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,MAAM,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc,EAAE,qDAAqD,CAAC,CAAC;QACrJ,CAAC,CAAC,CAAC;QACH,+BAA+B;QAC/B,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,EAAE,YAAY,KAAK,YAAY,EAAE,oBAAoB,KAAK,YAAY,CAAC,CAAC;QACrF,CAAC;QACD,+EAA+E;QAC/E,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,MAAM,CAAC,IAAI,EAAE,YAAY,KAAK,QAAQ,EAAE,+CAA+C,KAAK,6CAA6C,CAAC,CAAC;QAC7I,CAAC;QACD,sGAAsG;QACtG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,EAAE;gBAAE,MAAM,CAAC,KAAK,EAAE,YAAY,KAAK,YAAY,EAAE,6EAA6E,CAAC,CAAC;QACpL,CAAC,CAAC,CAAC;QACH,4GAA4G;QAC5G,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,MAAM,CAAC,KAAK,EAAE,YAAY,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,+DAA+D,KAAK,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC3K,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,QAAQ,CAAE,CAAC,SAAS,KAAK,iBAAiB;gBAAE,MAAM,CAAC,KAAK,EAAE,YAAY,QAAQ,aAAa,EAAE,+CAA+C,CAAC,CAAC;QACzJ,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACxD,IAAI,WAAW,IAAI,CAAC,aAAa;QAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,sCAAsC,CAAC,CAAC;IACtG,IAAI,CAAC,WAAW,IAAI,aAAa;QAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,2CAA2C,CAAC,CAAC;IAE3G,0BAA0B;IAC1B,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,EAAE,gBAAgB,KAAK,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,sCAAsC;IACtC,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,EAAE,iBAAiB,KAAK,GAAG,EAAE,yBAAyB,KAAK,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/render-registry-parity.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Ensures the registry file `writer-check` reads is the same store a surface
+ * passes to `createCopyResolver` at render — never a second, request-scoped
+ * module the CLI does not scan.
+ */
+import type { CopyRegistry } from "./types.js";
+export type RenderRegistryParityReason = "render-registry-path-mismatch" | "record-not-copy-registry";
+export interface RenderRegistryParityResult {
+    ok: boolean;
+    reason?: RenderRegistryParityReason;
+    detail?: string;
+    registry?: CopyRegistry;
+}
+/**
+ * Confirms `recordFile` is a `CopyRegistry` and, when `renderRegistryFile`
+ * is supplied, that both paths resolve to the same file (the render store
+ * and the gate store must be one file).
+ */
+export declare function checkRenderRegistryParity(recordFile: string, recordValue: unknown, renderRegistryFile?: string): RenderRegistryParityResult;
+//# sourceMappingURL=render-registry-parity.d.ts.map

package/dist/render-registry-parity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-registry-parity.d.ts","sourceRoot":"","sources":["../src/render-registry-parity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,MAAM,0BAA0B,GAClC,+BAA+B,GAC/B,0BAA0B,CAAC;AAE/B,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,0BAA0B,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,OAAO,EACpB,kBAAkB,CAAC,EAAE,MAAM,GAC1B,0BAA0B,CAyB5B"}

package/dist/render-registry-parity.js

@@ -0,0 +1,45 @@
+/**
+ * Ensures the registry file `writer-check` reads is the same store a surface
+ * passes to `createCopyResolver` at render — never a second, request-scoped
+ * module the CLI does not scan.
+ */
+import { realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { validateCopyRegistryShape } from "./schema.js";
+/**
+ * Confirms `recordFile` is a `CopyRegistry` and, when `renderRegistryFile`
+ * is supplied, that both paths resolve to the same file (the render store
+ * and the gate store must be one file).
+ */
+export function checkRenderRegistryParity(recordFile, recordValue, renderRegistryFile) {
+    const registryFindings = validateCopyRegistryShape(recordValue);
+    if (registryFindings.length > 0) {
+        const detail = registryFindings.map((f) => f.message).join("; ");
+        return {
+            ok: false,
+            reason: "record-not-copy-registry",
+            detail: `record-file is not a CopyRegistry (the store createCopyResolver reads): ${detail}`,
+        };
+    }
+    if (renderRegistryFile !== undefined) {
+        const recordReal = safeRealpath(resolve(recordFile));
+        const renderReal = safeRealpath(resolve(renderRegistryFile));
+        if (recordReal !== renderReal) {
+            return {
+                ok: false,
+                reason: "render-registry-path-mismatch",
+                detail: "record-file and --render-registry must be the same file — a second approved store the CLI does not read is not an approved registry.",
+            };
+        }
+    }
+    return { ok: true, registry: recordValue };
+}
+function safeRealpath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+//# sourceMappingURL=render-registry-parity.js.map

package/dist/render-registry-parity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-registry-parity.js","sourceRoot":"","sources":["../src/render-registry-parity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAcxD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAkB,EAClB,WAAoB,EACpB,kBAA2B;IAE3B,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,2EAA2E,MAAM,EAAE;SAC5F,CAAC;IACJ,CAAC;IAED,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7D,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,+BAA+B;gBACvC,MAAM,EACJ,sIAAsI;aACzI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAA2B,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}