@coderifts/agent-guard 10.0.0 → 11.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/enforcement-gate.d.ts +22 -2
- package/dist/cjs/enforcement-gate.d.ts.map +1 -1
- package/dist/cjs/enforcement-gate.js +30 -9
- package/dist/cjs/enforcement-gate.js.map +1 -1
- package/dist/cjs/execution-time-fingerprint.d.ts.map +1 -1
- package/dist/cjs/execution-time-fingerprint.js +11 -7
- package/dist/cjs/execution-time-fingerprint.js.map +1 -1
- package/dist/esm/enforcement-gate.d.ts +22 -2
- package/dist/esm/enforcement-gate.d.ts.map +1 -1
- package/dist/esm/enforcement-gate.js +30 -9
- package/dist/esm/enforcement-gate.js.map +1 -1
- package/dist/esm/execution-time-fingerprint.d.ts.map +1 -1
- package/dist/esm/execution-time-fingerprint.js +11 -7
- package/dist/esm/execution-time-fingerprint.js.map +1 -1
- package/package.json +1 -1
|
@@ -14,11 +14,31 @@
|
|
|
14
14
|
* itself; receipt-binding authenticates the envelope the decision rides on.
|
|
15
15
|
*/
|
|
16
16
|
import type { IntegrityCause, Artifact } from './types.js';
|
|
17
|
+
import { type BundleFingerprintContext } from './execution-time-fingerprint.js';
|
|
17
18
|
type Action = 'CONTINUE' | 'CONTINUE_WITH_MONITORING' | 'REQUEST_APPROVAL' | 'STOP';
|
|
18
19
|
/** Local artifact_digest — byte-identical to the server change-set.js algorithm (sorted by type,id). */
|
|
19
20
|
export declare function computeArtifactDigest(artifacts: Artifact[]): string;
|
|
20
|
-
/**
|
|
21
|
-
|
|
21
|
+
/**
|
|
22
|
+
* Local crbundle.v1 bundle fingerprint — byte-identical to the server producer
|
|
23
|
+
* (coderifts-app change-set.js computeBundleFingerprint).
|
|
24
|
+
*
|
|
25
|
+
* THIS WAS WRONG AND SHIPPED WRONG. Until now this function took only `artifacts` and built its
|
|
26
|
+
* OWN preimage, which omitted two elements the server includes: the artifact COUNT, and the whole
|
|
27
|
+
* trailing context block (operation, environment, repository, branch, pull_request,
|
|
28
|
+
* policy_profile). On identical inputs it returned sha256:1a0e7470… where the server returned
|
|
29
|
+
* sha256:049650f2… — so any third party who used it to check a receipt's `fp` against their own
|
|
30
|
+
* change set got a mismatch, with nothing to tell them the verifier was at fault rather than the
|
|
31
|
+
* receipt. A verifier that is quietly wrong is worse than one that is honestly absent.
|
|
32
|
+
*
|
|
33
|
+
* The root cause was a SECOND PREIMAGE in this package: execution-time-fingerprint.ts already
|
|
34
|
+
* carried a faithful mirror, under the comment "Do NOT invent a second preimage". This function
|
|
35
|
+
* was that second preimage. It is now a thin delegation, so the package has exactly one.
|
|
36
|
+
*
|
|
37
|
+
* `context` is optional to keep the call signature source-compatible, but omitting it produces a
|
|
38
|
+
* DIFFERENT (and, for any request that carried a context, still non-matching) digest — the server
|
|
39
|
+
* folds the context in unconditionally. Pass the same context you sent with the request.
|
|
40
|
+
*/
|
|
41
|
+
export declare function computeBundleFingerprint(artifacts: Artifact[], context?: BundleFingerprintContext | null): string;
|
|
22
42
|
export type GateResult = {
|
|
23
43
|
verdict: 'allow';
|
|
24
44
|
kind: 'ALLOW' | 'MONITOR';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"enforcement-gate.d.ts","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"enforcement-gate.d.ts","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,iCAAiC,CAAC;AAGzC,KAAK,MAAM,GAAG,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAwBpF,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAMnE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,QAAQ,EAAE,EACrB,OAAO,CAAC,EAAE,wBAAwB,GAAG,IAAI,GACxC,MAAM,CAER;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,OAAO,GAAG,kBAAkB,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,eAAe,EAAE,MAAM,GAAG,MAAM,EAChC,aAAa,EAAE,QAAQ,EAAE,GACxB,UAAU,CAqEZ"}
|
|
@@ -19,6 +19,7 @@ exports.computeArtifactDigest = computeArtifactDigest;
|
|
|
19
19
|
exports.computeBundleFingerprint = computeBundleFingerprint;
|
|
20
20
|
exports.evaluateEnvelope = evaluateEnvelope;
|
|
21
21
|
const node_crypto_1 = require("node:crypto");
|
|
22
|
+
const execution_time_fingerprint_js_1 = require("./execution-time-fingerprint.js");
|
|
22
23
|
const DECISION_RANK = { ALLOW: 0, WARN: 1, REQUIRE_APPROVAL: 2, BLOCK: 3 };
|
|
23
24
|
const ACTION_TO_DECISION = {
|
|
24
25
|
CONTINUE: 'ALLOW', CONTINUE_WITH_MONITORING: 'WARN', REQUEST_APPROVAL: 'REQUIRE_APPROVAL', STOP: 'BLOCK',
|
|
@@ -32,23 +33,43 @@ function isDecision(v) {
|
|
|
32
33
|
function isAction(v) {
|
|
33
34
|
return v === 'CONTINUE' || v === 'CONTINUE_WITH_MONITORING' || v === 'REQUEST_APPROVAL' || v === 'STOP';
|
|
34
35
|
}
|
|
35
|
-
|
|
36
|
+
// US (Unit Separator, 0x1F). Named for the byte it holds — it is NOT US, which is 0x00.
|
|
37
|
+
// The old name mirrored the server's, and that misnomer is what let a published document
|
|
38
|
+
// give this separator for the single-spec preimage, which actually uses 0x00. Renamed in
|
|
39
|
+
// coderifts-app 90c39cc; this mirror follows so the two still read identically side by side.
|
|
40
|
+
const US = '\x1f'; // matches the server's change-set canonical separator
|
|
36
41
|
function sha256hex(s) { return (0, node_crypto_1.createHash)('sha256').update(s).digest('hex'); }
|
|
37
42
|
function specStr(v) { return v == null ? '' : (typeof v === 'string' ? v : JSON.stringify(v)); }
|
|
38
43
|
/** Local artifact_digest — byte-identical to the server change-set.js algorithm (sorted by type,id). */
|
|
39
44
|
function computeArtifactDigest(artifacts) {
|
|
40
45
|
const preimage = artifacts.slice()
|
|
41
|
-
.sort((a, b) => (`${a.type}${
|
|
46
|
+
.sort((a, b) => (`${a.type}${US}${a.id}` < `${b.type}${US}${b.id}` ? -1 : 1))
|
|
42
47
|
.map((a) => `${sha256hex(specStr(a.before))}${sha256hex(specStr(a.after))}`)
|
|
43
|
-
.join(
|
|
48
|
+
.join(US);
|
|
44
49
|
return `sha256:${sha256hex(preimage)}`;
|
|
45
50
|
}
|
|
46
|
-
/**
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
51
|
+
/**
|
|
52
|
+
* Local crbundle.v1 bundle fingerprint — byte-identical to the server producer
|
|
53
|
+
* (coderifts-app change-set.js computeBundleFingerprint).
|
|
54
|
+
*
|
|
55
|
+
* THIS WAS WRONG AND SHIPPED WRONG. Until now this function took only `artifacts` and built its
|
|
56
|
+
* OWN preimage, which omitted two elements the server includes: the artifact COUNT, and the whole
|
|
57
|
+
* trailing context block (operation, environment, repository, branch, pull_request,
|
|
58
|
+
* policy_profile). On identical inputs it returned sha256:1a0e7470… where the server returned
|
|
59
|
+
* sha256:049650f2… — so any third party who used it to check a receipt's `fp` against their own
|
|
60
|
+
* change set got a mismatch, with nothing to tell them the verifier was at fault rather than the
|
|
61
|
+
* receipt. A verifier that is quietly wrong is worse than one that is honestly absent.
|
|
62
|
+
*
|
|
63
|
+
* The root cause was a SECOND PREIMAGE in this package: execution-time-fingerprint.ts already
|
|
64
|
+
* carried a faithful mirror, under the comment "Do NOT invent a second preimage". This function
|
|
65
|
+
* was that second preimage. It is now a thin delegation, so the package has exactly one.
|
|
66
|
+
*
|
|
67
|
+
* `context` is optional to keep the call signature source-compatible, but omitting it produces a
|
|
68
|
+
* DIFFERENT (and, for any request that carried a context, still non-matching) digest — the server
|
|
69
|
+
* folds the context in unconditionally. Pass the same context you sent with the request.
|
|
70
|
+
*/
|
|
71
|
+
function computeBundleFingerprint(artifacts, context) {
|
|
72
|
+
return (0, execution_time_fingerprint_js_1.computeCanonicalBundleFingerprint)(artifacts, context);
|
|
52
73
|
}
|
|
53
74
|
/**
|
|
54
75
|
* Reconcile an envelope's decision fail-closed. Order:
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"enforcement-gate.js","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;
|
|
1
|
+
{"version":3,"file":"enforcement-gate.js","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAmCH,sDAMC;AAsBD,4DAKC;AAuBD,4CA0EC;AAnKD,6CAAyC;AAEzC,mFAGyC;AAKzC,MAAM,aAAa,GAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACrG,MAAM,kBAAkB,GAA6B;IACnD,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO;CACzG,CAAC;AACF,MAAM,kBAAkB,GAA6B;IACnD,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM;CACzG,CAAC;AACF,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,OAAO,CAAC;AACpF,CAAC;AACD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,0BAA0B,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,MAAM,CAAC;AAC1G,CAAC;AAED,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,6FAA6F;AAC7F,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,sDAAsD;AACzE,SAAS,SAAS,CAAC,CAAS,IAAY,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9F,SAAS,OAAO,CAAC,CAAU,IAAY,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH,wGAAwG;AACxG,SAAgB,qBAAqB,CAAC,SAAqB;IACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE;SAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;SAC3E,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,UAAU,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,wBAAwB,CACtC,SAAqB,EACrB,OAAyC;IAEzC,OAAO,IAAA,iEAAiC,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAOD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,gBAAgB,CAC9B,QAAiB,EACjB,QAAiC,EACjC,eAAgC,EAChC,aAAyB;IAEzB,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElG,kFAAkF;IAClF,+FAA+F;IAC/F,4FAA4F;IAC5F,MAAM,UAAU,GAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACjG,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS,CAAC,iBAAiB;QACnF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,aAAa;gBACtB,KAAK,EAAE,+BAA+B;gBACtC,MAAM,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,uCAAuC;aACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;IAClI,CAAC;IAED,4DAA4D;IAC5D,MAAM,MAAM,GAAG,eAAyB,CAAC;IAEzC,uFAAuF;IACvF,MAAM,OAAO,GAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;QAC/D,2FAA2F;QAC3F,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAyC,EAAE,CAAC;IAC1F,CAAC;IAED,mGAAmG;IACnG,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,GAAG,uBAAuB,MAAM,EAAE,EAAE,CAAC;IAC5H,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC/H,CAAC;IAED,mEAAmE;IACnE,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAgB,CAAC;IAClD,IAAI,QAAQ,CAAC,iBAAiB,KAAK,KAAK;WACjC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;WAC9D,QAAQ,CAAC,QAAQ,KAAK,IAAI;WAC1B,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAC1G,CAAC;IAED,6FAA6F;IAC7F,sGAAsG;IACtG,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;WACrD,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ;WAC5C,QAAQ,CAAC,eAAe,KAAK,qBAAqB,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IACzI,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACjF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"execution-time-fingerprint.d.ts","sourceRoot":"","sources":["../../src/execution-time-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"execution-time-fingerprint.d.ts","sourceRoot":"","sources":["../../src/execution-time-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAwB3C,+EAA+E;AAC/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,QAAQ,EAAE,EACrB,OAAO,CAAC,EAAE,wBAAwB,GAAG,IAAI,GACxC,MAAM,CAwBR;AAED,+FAA+F;AAC/F,eAAO,MAAM,yBAAyB;;IAEpC,6EAA6E;;IAE7E,6EAA6E;;;;EAIpE,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAK1E;AAED,0FAA0F;AAC1F,eAAO,MAAM,iCAAiC,4EACwB,CAAC;AAEvE,MAAM,MAAM,+BAA+B,GAAG;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,qBAAqB,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACnD,MAAM,GAAG,IAAI,CAYf;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC9C,gFAAgF;IAChF,SAAS,EAAE,QAAQ,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IACzC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC1C,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,iCAA4D,GACjE,+BAA+B,CAyCjC"}
|
|
@@ -17,8 +17,12 @@ exports.isUnmeasurableExecutionStateReason = isUnmeasurableExecutionStateReason;
|
|
|
17
17
|
exports.authorizedFingerprintFromEnvelope = authorizedFingerprintFromEnvelope;
|
|
18
18
|
exports.checkExecutionTimeFingerprint = checkExecutionTimeFingerprint;
|
|
19
19
|
const node_crypto_1 = require("node:crypto");
|
|
20
|
-
/** Matches server change-set.js
|
|
21
|
-
|
|
20
|
+
/** Matches the server change-set.js US separator. */
|
|
21
|
+
// US (Unit Separator, 0x1F). Named for the byte it holds — it is NOT US, which is 0x00.
|
|
22
|
+
// The old name mirrored the server's, and that misnomer is what let a published document
|
|
23
|
+
// give this separator for the single-spec preimage, which actually uses 0x00. Renamed in
|
|
24
|
+
// coderifts-app 90c39cc; this mirror follows so the two still read identically side by side.
|
|
25
|
+
const US = '\x1f';
|
|
22
26
|
/** Matches server change-set.js BUNDLE_FP_DOMAIN. */
|
|
23
27
|
const BUNDLE_FP_DOMAIN = 'crbundle.v1';
|
|
24
28
|
function sha256hex(s) {
|
|
@@ -39,13 +43,13 @@ function scalar(v) {
|
|
|
39
43
|
*/
|
|
40
44
|
function computeCanonicalBundleFingerprint(artifacts, context) {
|
|
41
45
|
const sorted = artifacts.slice().sort((x, y) => {
|
|
42
|
-
const kx = `${x.type}${
|
|
43
|
-
const ky = `${y.type}${
|
|
46
|
+
const kx = `${x.type}${US}${x.id}`;
|
|
47
|
+
const ky = `${y.type}${US}${y.id}`;
|
|
44
48
|
return kx < ky ? -1 : (kx > ky ? 1 : 0);
|
|
45
49
|
});
|
|
46
50
|
const parts = [BUNDLE_FP_DOMAIN, String(artifacts.length)];
|
|
47
51
|
for (const a of sorted) {
|
|
48
|
-
parts.push([a.type, a.id, sha256hex(specStr(a.before)), sha256hex(specStr(a.after))].join(
|
|
52
|
+
parts.push([a.type, a.id, sha256hex(specStr(a.before)), sha256hex(specStr(a.after))].join(US));
|
|
49
53
|
}
|
|
50
54
|
const ctx = context || {};
|
|
51
55
|
parts.push([
|
|
@@ -55,8 +59,8 @@ function computeCanonicalBundleFingerprint(artifacts, context) {
|
|
|
55
59
|
scalar(ctx.branch),
|
|
56
60
|
scalar(ctx.pull_request),
|
|
57
61
|
scalar(ctx.policy_profile),
|
|
58
|
-
].join(
|
|
59
|
-
return `sha256:${sha256hex(parts.join(
|
|
62
|
+
].join(US));
|
|
63
|
+
return `sha256:${sha256hex(parts.join(US))}`;
|
|
60
64
|
}
|
|
61
65
|
/** Stable reason codes (greppable; align with app verdict-core/execution-time-fingerprint). */
|
|
62
66
|
exports.EXECUTION_TIME_FP_REASONS = Object.freeze({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"execution-time-fingerprint.js","sourceRoot":"","sources":["../../src/execution-time-fingerprint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;
|
|
1
|
+
{"version":3,"file":"execution-time-fingerprint.js","sourceRoot":"","sources":["../../src/execution-time-fingerprint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA0CH,8EA2BC;AAqBD,gFAKC;AAiBD,8EAcC;AAiBD,sEA2CC;AAxLD,6CAAyC;AAGzC,qDAAqD;AACrD,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,6FAA6F;AAC7F,MAAM,EAAE,GAAG,MAAM,CAAC;AAClB,qDAAqD;AACrD,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAYD;;;;GAIG;AACH,SAAgB,iCAAiC,CAC/C,SAAqB,EACrB,OAAyC;IAEzC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;QACnC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,IAAI,EAAE,CAAC;IAC1B,KAAK,CAAC,IAAI,CACR;QACE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;KAC3B,CAAC,IAAI,CAAC,EAAE,CAAC,CACX,CAAC;IACF,OAAO,UAAU,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,+FAA+F;AAClF,QAAA,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,OAAO;IACd,6EAA6E;IAC7E,4BAA4B,EAAE,8BAA8B;IAC5D,6EAA6E;IAC7E,qBAAqB,EAAE,uBAAuB;IAC9C,8BAA8B,EAAE,gCAAgC;IAChE,iBAAiB,EAAE,mBAAmB;CAC9B,CAAC,CAAC;AAKZ;;;;GAIG;AACH,SAAgB,kCAAkC,CAAC,MAAc;IAC/D,OAAO,CACL,MAAM,KAAK,iCAAyB,CAAC,iBAAiB;WACnD,MAAM,KAAK,iCAAyB,CAAC,8BAA8B,CACvE,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC7E,QAAA,iCAAiC,GAC5C,oEAAoE,CAAC;AASvE;;;GAGG;AACH,SAAgB,iCAAiC,CAC/C,QAAoD;IAEpD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,QAAQ,CAAC,WAAW,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC,iBAAiB,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,mBAAmB,KAAK,QAAQ,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACrF,OAAO,QAAQ,CAAC,mBAAmB,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAaD;;;GAGG;AACH,SAAgB,6BAA6B,CAC3C,OAA0C,EAAE,SAAS,EAAE,SAAS,EAAE;IAElE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACrE,MAAM,UAAU,GACd,OAAO,qBAAqB,KAAK,QAAQ,IAAI,qBAAqB;QAChE,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAElD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,iCAAyB,CAAC,iBAAiB;YACnD,mBAAmB,EAAE,IAAI;YACzB,sBAAsB,EAAE,UAAU;SACnC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAClD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,iCAAyB,CAAC,8BAA8B;YAChE,mBAAmB,EAAE,IAAI;YACzB,sBAAsB,EAAE,IAAI;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iCAAiC,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,iCAAyB,CAAC,4BAA4B;YAC9D,mBAAmB,EAAE,OAAO;YAC5B,sBAAsB,EAAE,UAAU;SACnC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,iCAAyB,CAAC,KAAK;QACvC,mBAAmB,EAAE,OAAO;QAC5B,sBAAsB,EAAE,UAAU;KACnC,CAAC;AACJ,CAAC"}
|
|
@@ -14,11 +14,31 @@
|
|
|
14
14
|
* itself; receipt-binding authenticates the envelope the decision rides on.
|
|
15
15
|
*/
|
|
16
16
|
import type { IntegrityCause, Artifact } from './types.js';
|
|
17
|
+
import { type BundleFingerprintContext } from './execution-time-fingerprint.js';
|
|
17
18
|
type Action = 'CONTINUE' | 'CONTINUE_WITH_MONITORING' | 'REQUEST_APPROVAL' | 'STOP';
|
|
18
19
|
/** Local artifact_digest — byte-identical to the server change-set.js algorithm (sorted by type,id). */
|
|
19
20
|
export declare function computeArtifactDigest(artifacts: Artifact[]): string;
|
|
20
|
-
/**
|
|
21
|
-
|
|
21
|
+
/**
|
|
22
|
+
* Local crbundle.v1 bundle fingerprint — byte-identical to the server producer
|
|
23
|
+
* (coderifts-app change-set.js computeBundleFingerprint).
|
|
24
|
+
*
|
|
25
|
+
* THIS WAS WRONG AND SHIPPED WRONG. Until now this function took only `artifacts` and built its
|
|
26
|
+
* OWN preimage, which omitted two elements the server includes: the artifact COUNT, and the whole
|
|
27
|
+
* trailing context block (operation, environment, repository, branch, pull_request,
|
|
28
|
+
* policy_profile). On identical inputs it returned sha256:1a0e7470… where the server returned
|
|
29
|
+
* sha256:049650f2… — so any third party who used it to check a receipt's `fp` against their own
|
|
30
|
+
* change set got a mismatch, with nothing to tell them the verifier was at fault rather than the
|
|
31
|
+
* receipt. A verifier that is quietly wrong is worse than one that is honestly absent.
|
|
32
|
+
*
|
|
33
|
+
* The root cause was a SECOND PREIMAGE in this package: execution-time-fingerprint.ts already
|
|
34
|
+
* carried a faithful mirror, under the comment "Do NOT invent a second preimage". This function
|
|
35
|
+
* was that second preimage. It is now a thin delegation, so the package has exactly one.
|
|
36
|
+
*
|
|
37
|
+
* `context` is optional to keep the call signature source-compatible, but omitting it produces a
|
|
38
|
+
* DIFFERENT (and, for any request that carried a context, still non-matching) digest — the server
|
|
39
|
+
* folds the context in unconditionally. Pass the same context you sent with the request.
|
|
40
|
+
*/
|
|
41
|
+
export declare function computeBundleFingerprint(artifacts: Artifact[], context?: BundleFingerprintContext | null): string;
|
|
22
42
|
export type GateResult = {
|
|
23
43
|
verdict: 'allow';
|
|
24
44
|
kind: 'ALLOW' | 'MONITOR';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"enforcement-gate.d.ts","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"enforcement-gate.d.ts","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,iCAAiC,CAAC;AAGzC,KAAK,MAAM,GAAG,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAwBpF,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAMnE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,QAAQ,EAAE,EACrB,OAAO,CAAC,EAAE,wBAAwB,GAAG,IAAI,GACxC,MAAM,CAER;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,OAAO,GAAG,kBAAkB,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,eAAe,EAAE,MAAM,GAAG,MAAM,EAChC,aAAa,EAAE,QAAQ,EAAE,GACxB,UAAU,CAqEZ"}
|
|
@@ -14,6 +14,7 @@
|
|
|
14
14
|
* itself; receipt-binding authenticates the envelope the decision rides on.
|
|
15
15
|
*/
|
|
16
16
|
import { createHash } from 'node:crypto';
|
|
17
|
+
import { computeCanonicalBundleFingerprint, } from './execution-time-fingerprint.js';
|
|
17
18
|
const DECISION_RANK = { ALLOW: 0, WARN: 1, REQUIRE_APPROVAL: 2, BLOCK: 3 };
|
|
18
19
|
const ACTION_TO_DECISION = {
|
|
19
20
|
CONTINUE: 'ALLOW', CONTINUE_WITH_MONITORING: 'WARN', REQUEST_APPROVAL: 'REQUIRE_APPROVAL', STOP: 'BLOCK',
|
|
@@ -27,23 +28,43 @@ function isDecision(v) {
|
|
|
27
28
|
function isAction(v) {
|
|
28
29
|
return v === 'CONTINUE' || v === 'CONTINUE_WITH_MONITORING' || v === 'REQUEST_APPROVAL' || v === 'STOP';
|
|
29
30
|
}
|
|
30
|
-
|
|
31
|
+
// US (Unit Separator, 0x1F). Named for the byte it holds — it is NOT US, which is 0x00.
|
|
32
|
+
// The old name mirrored the server's, and that misnomer is what let a published document
|
|
33
|
+
// give this separator for the single-spec preimage, which actually uses 0x00. Renamed in
|
|
34
|
+
// coderifts-app 90c39cc; this mirror follows so the two still read identically side by side.
|
|
35
|
+
const US = '\x1f'; // matches the server's change-set canonical separator
|
|
31
36
|
function sha256hex(s) { return createHash('sha256').update(s).digest('hex'); }
|
|
32
37
|
function specStr(v) { return v == null ? '' : (typeof v === 'string' ? v : JSON.stringify(v)); }
|
|
33
38
|
/** Local artifact_digest — byte-identical to the server change-set.js algorithm (sorted by type,id). */
|
|
34
39
|
export function computeArtifactDigest(artifacts) {
|
|
35
40
|
const preimage = artifacts.slice()
|
|
36
|
-
.sort((a, b) => (`${a.type}${
|
|
41
|
+
.sort((a, b) => (`${a.type}${US}${a.id}` < `${b.type}${US}${b.id}` ? -1 : 1))
|
|
37
42
|
.map((a) => `${sha256hex(specStr(a.before))}${sha256hex(specStr(a.after))}`)
|
|
38
|
-
.join(
|
|
43
|
+
.join(US);
|
|
39
44
|
return `sha256:${sha256hex(preimage)}`;
|
|
40
45
|
}
|
|
41
|
-
/**
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
46
|
+
/**
|
|
47
|
+
* Local crbundle.v1 bundle fingerprint — byte-identical to the server producer
|
|
48
|
+
* (coderifts-app change-set.js computeBundleFingerprint).
|
|
49
|
+
*
|
|
50
|
+
* THIS WAS WRONG AND SHIPPED WRONG. Until now this function took only `artifacts` and built its
|
|
51
|
+
* OWN preimage, which omitted two elements the server includes: the artifact COUNT, and the whole
|
|
52
|
+
* trailing context block (operation, environment, repository, branch, pull_request,
|
|
53
|
+
* policy_profile). On identical inputs it returned sha256:1a0e7470… where the server returned
|
|
54
|
+
* sha256:049650f2… — so any third party who used it to check a receipt's `fp` against their own
|
|
55
|
+
* change set got a mismatch, with nothing to tell them the verifier was at fault rather than the
|
|
56
|
+
* receipt. A verifier that is quietly wrong is worse than one that is honestly absent.
|
|
57
|
+
*
|
|
58
|
+
* The root cause was a SECOND PREIMAGE in this package: execution-time-fingerprint.ts already
|
|
59
|
+
* carried a faithful mirror, under the comment "Do NOT invent a second preimage". This function
|
|
60
|
+
* was that second preimage. It is now a thin delegation, so the package has exactly one.
|
|
61
|
+
*
|
|
62
|
+
* `context` is optional to keep the call signature source-compatible, but omitting it produces a
|
|
63
|
+
* DIFFERENT (and, for any request that carried a context, still non-matching) digest — the server
|
|
64
|
+
* folds the context in unconditionally. Pass the same context you sent with the request.
|
|
65
|
+
*/
|
|
66
|
+
export function computeBundleFingerprint(artifacts, context) {
|
|
67
|
+
return computeCanonicalBundleFingerprint(artifacts, context);
|
|
47
68
|
}
|
|
48
69
|
/**
|
|
49
70
|
* Reconcile an envelope's decision fail-closed. Order:
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"enforcement-gate.js","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"enforcement-gate.js","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,iCAAiC,GAElC,MAAM,iCAAiC,CAAC;AAKzC,MAAM,aAAa,GAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACrG,MAAM,kBAAkB,GAA6B;IACnD,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO;CACzG,CAAC;AACF,MAAM,kBAAkB,GAA6B;IACnD,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM;CACzG,CAAC;AACF,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,OAAO,CAAC;AACpF,CAAC;AACD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,0BAA0B,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,MAAM,CAAC;AAC1G,CAAC;AAED,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,6FAA6F;AAC7F,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,sDAAsD;AACzE,SAAS,SAAS,CAAC,CAAS,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9F,SAAS,OAAO,CAAC,CAAU,IAAY,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CAAC,SAAqB;IACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE;SAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;SAC3E,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,UAAU,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAqB,EACrB,OAAyC;IAEzC,OAAO,iCAAiC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAOD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAiB,EACjB,QAAiC,EACjC,eAAgC,EAChC,aAAyB;IAEzB,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElG,kFAAkF;IAClF,+FAA+F;IAC/F,4FAA4F;IAC5F,MAAM,UAAU,GAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACjG,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS,CAAC,iBAAiB;QACnF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,aAAa;gBACtB,KAAK,EAAE,+BAA+B;gBACtC,MAAM,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,uCAAuC;aACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;IAClI,CAAC;IAED,4DAA4D;IAC5D,MAAM,MAAM,GAAG,eAAyB,CAAC;IAEzC,uFAAuF;IACvF,MAAM,OAAO,GAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;QAC/D,2FAA2F;QAC3F,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAyC,EAAE,CAAC;IAC1F,CAAC;IAED,mGAAmG;IACnG,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,GAAG,uBAAuB,MAAM,EAAE,EAAE,CAAC;IAC5H,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC/H,CAAC;IAED,mEAAmE;IACnE,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAgB,CAAC;IAClD,IAAI,QAAQ,CAAC,iBAAiB,KAAK,KAAK;WACjC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;WAC9D,QAAQ,CAAC,QAAQ,KAAK,IAAI;WAC1B,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAC1G,CAAC;IAED,6FAA6F;IAC7F,sGAAsG;IACtG,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;WACrD,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ;WAC5C,QAAQ,CAAC,eAAe,KAAK,qBAAqB,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IACzI,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACjF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"execution-time-fingerprint.d.ts","sourceRoot":"","sources":["../../src/execution-time-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"execution-time-fingerprint.d.ts","sourceRoot":"","sources":["../../src/execution-time-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAwB3C,+EAA+E;AAC/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,QAAQ,EAAE,EACrB,OAAO,CAAC,EAAE,wBAAwB,GAAG,IAAI,GACxC,MAAM,CAwBR;AAED,+FAA+F;AAC/F,eAAO,MAAM,yBAAyB;;IAEpC,6EAA6E;;IAE7E,6EAA6E;;;;EAIpE,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAK1E;AAED,0FAA0F;AAC1F,eAAO,MAAM,iCAAiC,4EACwB,CAAC;AAEvE,MAAM,MAAM,+BAA+B,GAAG;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,qBAAqB,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACnD,MAAM,GAAG,IAAI,CAYf;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC9C,gFAAgF;IAChF,SAAS,EAAE,QAAQ,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IACzC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC1C,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,iCAA4D,GACjE,+BAA+B,CAyCjC"}
|
|
@@ -10,8 +10,12 @@
|
|
|
10
10
|
* (guard@8 default true — fail-closed; false / 'warn' are explicit opt-down).
|
|
11
11
|
*/
|
|
12
12
|
import { createHash } from 'node:crypto';
|
|
13
|
-
/** Matches server change-set.js
|
|
14
|
-
|
|
13
|
+
/** Matches the server change-set.js US separator. */
|
|
14
|
+
// US (Unit Separator, 0x1F). Named for the byte it holds — it is NOT US, which is 0x00.
|
|
15
|
+
// The old name mirrored the server's, and that misnomer is what let a published document
|
|
16
|
+
// give this separator for the single-spec preimage, which actually uses 0x00. Renamed in
|
|
17
|
+
// coderifts-app 90c39cc; this mirror follows so the two still read identically side by side.
|
|
18
|
+
const US = '\x1f';
|
|
15
19
|
/** Matches server change-set.js BUNDLE_FP_DOMAIN. */
|
|
16
20
|
const BUNDLE_FP_DOMAIN = 'crbundle.v1';
|
|
17
21
|
function sha256hex(s) {
|
|
@@ -32,13 +36,13 @@ function scalar(v) {
|
|
|
32
36
|
*/
|
|
33
37
|
export function computeCanonicalBundleFingerprint(artifacts, context) {
|
|
34
38
|
const sorted = artifacts.slice().sort((x, y) => {
|
|
35
|
-
const kx = `${x.type}${
|
|
36
|
-
const ky = `${y.type}${
|
|
39
|
+
const kx = `${x.type}${US}${x.id}`;
|
|
40
|
+
const ky = `${y.type}${US}${y.id}`;
|
|
37
41
|
return kx < ky ? -1 : (kx > ky ? 1 : 0);
|
|
38
42
|
});
|
|
39
43
|
const parts = [BUNDLE_FP_DOMAIN, String(artifacts.length)];
|
|
40
44
|
for (const a of sorted) {
|
|
41
|
-
parts.push([a.type, a.id, sha256hex(specStr(a.before)), sha256hex(specStr(a.after))].join(
|
|
45
|
+
parts.push([a.type, a.id, sha256hex(specStr(a.before)), sha256hex(specStr(a.after))].join(US));
|
|
42
46
|
}
|
|
43
47
|
const ctx = context || {};
|
|
44
48
|
parts.push([
|
|
@@ -48,8 +52,8 @@ export function computeCanonicalBundleFingerprint(artifacts, context) {
|
|
|
48
52
|
scalar(ctx.branch),
|
|
49
53
|
scalar(ctx.pull_request),
|
|
50
54
|
scalar(ctx.policy_profile),
|
|
51
|
-
].join(
|
|
52
|
-
return `sha256:${sha256hex(parts.join(
|
|
55
|
+
].join(US));
|
|
56
|
+
return `sha256:${sha256hex(parts.join(US))}`;
|
|
53
57
|
}
|
|
54
58
|
/** Stable reason codes (greppable; align with app verdict-core/execution-time-fingerprint). */
|
|
55
59
|
export const EXECUTION_TIME_FP_REASONS = Object.freeze({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"execution-time-fingerprint.js","sourceRoot":"","sources":["../../src/execution-time-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,
|
|
1
|
+
{"version":3,"file":"execution-time-fingerprint.js","sourceRoot":"","sources":["../../src/execution-time-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,qDAAqD;AACrD,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,6FAA6F;AAC7F,MAAM,EAAE,GAAG,MAAM,CAAC;AAClB,qDAAqD;AACrD,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,SAAqB,EACrB,OAAyC;IAEzC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;QACnC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,IAAI,EAAE,CAAC;IAC1B,KAAK,CAAC,IAAI,CACR;QACE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;KAC3B,CAAC,IAAI,CAAC,EAAE,CAAC,CACX,CAAC;IACF,OAAO,UAAU,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,OAAO;IACd,6EAA6E;IAC7E,4BAA4B,EAAE,8BAA8B;IAC5D,6EAA6E;IAC7E,qBAAqB,EAAE,uBAAuB;IAC9C,8BAA8B,EAAE,gCAAgC;IAChE,iBAAiB,EAAE,mBAAmB;CAC9B,CAAC,CAAC;AAKZ;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAAc;IAC/D,OAAO,CACL,MAAM,KAAK,yBAAyB,CAAC,iBAAiB;WACnD,MAAM,KAAK,yBAAyB,CAAC,8BAA8B,CACvE,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,iCAAiC,GAC5C,oEAAoE,CAAC;AASvE;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAC/C,QAAoD;IAEpD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,QAAQ,CAAC,WAAW,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC,iBAAiB,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,mBAAmB,KAAK,QAAQ,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACrF,OAAO,QAAQ,CAAC,mBAAmB,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA0C,EAAE,SAAS,EAAE,SAAS,EAAE;IAElE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACrE,MAAM,UAAU,GACd,OAAO,qBAAqB,KAAK,QAAQ,IAAI,qBAAqB;QAChE,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAElD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,yBAAyB,CAAC,iBAAiB;YACnD,mBAAmB,EAAE,IAAI;YACzB,sBAAsB,EAAE,UAAU;SACnC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAClD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,yBAAyB,CAAC,8BAA8B;YAChE,mBAAmB,EAAE,IAAI;YACzB,sBAAsB,EAAE,IAAI;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iCAAiC,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,yBAAyB,CAAC,4BAA4B;YAC9D,mBAAmB,EAAE,OAAO;YAC5B,sBAAsB,EAAE,UAAU;SACnC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,yBAAyB,CAAC,KAAK;QACvC,mBAAmB,EAAE,OAAO;QAC5B,sBAAsB,EAAE,UAAU;KACnC,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@coderifts/agent-guard",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "11.0.1",
|
|
4
4
|
"description": "Fail-closed guard for AI agent tool calls — preflight contract changes before they execute. Security core frozen (agent-guard-api v1.0); v1.1 adds client-side enforcement: receipt→envelope binding, decision↔action reconciliation, safe_for_agent + degraded fail-closed, and enforced⟺executed (P0 client-enforcement pack).",
|
|
5
5
|
"main": "./dist/cjs/index.js",
|
|
6
6
|
"module": "./dist/esm/index.js",
|