@cs-object/cli 0.1.0

package/dist/chunk-7XCJ6AF3.js

@@ -0,0 +1,607 @@
+import {
+  parseStrictJson
+} from "./chunk-KYWIVB2V.js";
+import {
+  stringifyJson
+} from "./chunk-MOM6Q2VG.js";
+
+// src/evidence.ts
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync as readFileSync2,
+  readdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+  lstatSync
+} from "fs";
+import { basename, dirname as dirname2, join } from "path";
+import { randomUUID } from "crypto";
+import { isDeepStrictEqual } from "util";
+import {
+  BoundPreparedDocumentSchema
+} from "@cs-object/core";
+
+// src/assets.ts
+import { readFileSync, realpathSync, statSync } from "fs";
+import { dirname, isAbsolute, relative, resolve } from "path";
+import { createHash } from "crypto";
+import {
+  ResolvedAssetSchema
+} from "@cs-object/core";
+import { DocumentPreparationError } from "@cs-object/react";
+var sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function captureAssets(sourcePath, execution) {
+  const root = dirname(realpathSync(sourcePath));
+  const captures = /* @__PURE__ */ new Map();
+  return execution.assets.map((asset) => {
+    try {
+      const path = realpathSync(
+        resolve(root, dirname(asset.moduleId), asset.path)
+      );
+      const within = relative(root, path);
+      if (within === ".." || within.startsWith("../") || isAbsolute(within))
+        throw new Error("Asset resolves outside the entry source directory");
+      if (!statSync(path).isFile())
+        throw new Error("Asset is not a regular file");
+      let bytes = captures.get(path);
+      if (!bytes) {
+        bytes = readFileSync(path);
+        captures.set(path, bytes);
+      }
+      if (sha256(bytes) !== asset.sha256)
+        throw new Error("Asset bytes changed since Python capture");
+      const png = bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
+      const jpeg = bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;
+      if (asset.mediaType === "image/png" && !png)
+        throw new Error("Declared PNG has the wrong media signature");
+      if (asset.mediaType === "image/jpeg" && !jpeg)
+        throw new Error("Declared JPEG has the wrong media signature");
+      if (asset.mediaType === "image/svg+xml") {
+        const xml = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        if (png || jpeg || /<!DOCTYPE|<!ENTITY/i.test(xml) || !/^\s*(?:<\?xml[^?]*\?>\s*)?<svg[\s>]/i.test(xml))
+          throw new Error(
+            "SVG requires UTF-8 SVG markup without document types or entities"
+          );
+      }
+      return ResolvedAssetSchema.parse({
+        asset,
+        dataUrl: `data:${asset.mediaType};base64,${bytes.toString("base64")}`
+      });
+    } catch (error) {
+      throw new DocumentPreparationError([
+        {
+          code: "ASSET_CAPTURE_FAILED",
+          stage: "document",
+          message: `${asset.moduleId}:${asset.path}: ${error instanceof Error ? error.message : String(error)}`
+        }
+      ]);
+    }
+  });
+}
+
+// src/evidence.ts
+var jsonBytes = (value) => Buffer.from(`${stringifyJson(value)}
+`);
+var pointerKey = (key) => key.replaceAll("~", "~0").replaceAll("/", "~1");
+var suppliedJson = (value) => Array.isArray(value) ? value.map(suppliedJson) : value !== null && typeof value === "object" ? Object.fromEntries(
+  Object.entries(value).filter(([, entry]) => entry !== void 0).map(([key, entry]) => [key, suppliedJson(entry)])
+) : value;
+function fields(value, artifact, pointer = "") {
+  if (value !== null && typeof value === "object" && Object.keys(value).length)
+    return Object.entries(value).flatMap(
+      ([key, entry]) => fields(entry, artifact, `${pointer}/${pointerKey(key)}`)
+    );
+  return [{ artifact, pointer, sha256: sha256(jsonBytes(value)) }];
+}
+function retainSource(capture, document2) {
+  BoundPreparedDocumentSchema.parse({ execution: capture.execution, document: document2 });
+  const preparedBytes = jsonBytes(document2);
+  const roundTrip = parseStrictJson(preparedBytes.toString("utf8"));
+  if (!isDeepStrictEqual(roundTrip, suppliedJson(document2)))
+    throw new Error("Prepared data did not survive exact JSON round trip");
+  const execution = parseStrictJson(
+    new TextDecoder("utf-8", { fatal: true }).decode(capture.executionBytes)
+  );
+  const payloads = [
+    { path: "execution.json", bytes: capture.executionBytes },
+    { path: "verification.json", bytes: jsonBytes(capture.verification) },
+    { path: "prepared.json", bytes: preparedBytes }
+  ];
+  if (capture.referenceBytes)
+    payloads.push({ path: "reference.json", bytes: capture.referenceBytes });
+  return {
+    payloads,
+    retainedFields: [
+      ...fields(execution, "execution.json"),
+      ...fields(roundTrip, "prepared.json")
+    ]
+  };
+}
+function publishDocumentEvidence(options) {
+  const { outPath, artifact } = options;
+  const bytes = artifact.bytes;
+  mkdirSync(dirname2(outPath), { recursive: true });
+  const temporaryOutput = join(
+    dirname2(outPath),
+    `.${basename(outPath)}.${randomUUID()}.tmp`
+  );
+  try {
+    writeFileSync(temporaryOutput, bytes, { flag: "wx" });
+    if (!readFileSync2(temporaryOutput).equals(bytes)) {
+      throw new Error("Temporary document byte verification failed");
+    }
+    const evidence = options.retainEvidence === false ? void 0 : publishEvidenceBundle(options);
+    renameSync(temporaryOutput, outPath);
+    return evidence;
+  } finally {
+    try {
+      rmSync(temporaryOutput, { force: true });
+    } catch {
+    }
+  }
+}
+function publishEvidenceBundle(options) {
+  const { outPath, artifact, reportBytes, retained, presentation } = options;
+  const payloads = [
+    ...retained.payloads,
+    {
+      path: "source-audit.json",
+      bytes: jsonBytes({
+        auditVersion: "1",
+        defaultDisposition: "Retained in the named evidence artifact; only explicit engineering projections are presented.",
+        retainedFields: retained.retainedFields,
+        presentationArtifact: "prepared.json",
+        presentation
+      })
+    }
+  ];
+  const manifest = jsonBytes({
+    manifestVersion: "1",
+    [artifact.kind]: { path: outPath, sha256: sha256(artifact.bytes) },
+    prospectiveCommandReport: {
+      sha256: sha256(reportBytes),
+      publication: "Requires the actual successful stdout report and matching document; this manifest alone is not a publication receipt."
+    },
+    artifacts: payloads.map(({ path, bytes }) => ({
+      path,
+      sha256: sha256(bytes)
+    })),
+    outcomes: {
+      dataRetention: {
+        status: "passed",
+        fields: retained.retainedFields.length
+      },
+      engineeringPresentation: {
+        automatic: options.presentationCheck,
+        visualInspection: "pending"
+      },
+      sourceToDocumentConsistency: {
+        artifact: "verification.json",
+        pointer: "/checks/sourceToDocumentConsistency"
+      },
+      independentReferenceAgreement: {
+        artifact: "verification.json",
+        pointer: "/checks/independentReferenceAgreement"
+      }
+    }
+  });
+  const hash = sha256(manifest);
+  const parent = `${outPath}.evidence`;
+  const destination = join(parent, hash);
+  let temporaryEvidence;
+  try {
+    mkdirSync(parent, { recursive: true });
+    temporaryEvidence = mkdtempSync(join(parent, ".tmp-"));
+    const files = [...payloads, { path: "manifest.json", bytes: manifest }];
+    for (const file of files) {
+      const path = join(temporaryEvidence, file.path);
+      writeFileSync(path, file.bytes, { flag: "wx" });
+      if (!readFileSync2(path).equals(file.bytes))
+        throw new Error(`Evidence verification failed: ${file.path}`);
+    }
+    try {
+      renameSync(temporaryEvidence, destination);
+      temporaryEvidence = void 0;
+    } catch (error) {
+      if (!lstatSync(destination).isDirectory() || readdirSync(destination).sort().join("\0") !== files.map((file) => file.path).sort().join("\0") || files.some(
+        (file) => !lstatSync(join(destination, file.path)).isFile() || !readFileSync2(join(destination, file.path)).equals(file.bytes)
+      ))
+        throw error;
+    }
+    if (temporaryEvidence) {
+      rmSync(temporaryEvidence, { recursive: true });
+      temporaryEvidence = void 0;
+    }
+  } finally {
+    if (temporaryEvidence) {
+      try {
+        rmSync(temporaryEvidence, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+  return { path: join(destination, "manifest.json"), sha256: hash };
+}
+
+// src/prepared-html.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { createRequire } from "module";
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { PreparedFormulaSheet } from "@cs-object/react";
+function buildPreparedHtml(preparedDocument, reviewNotice) {
+  const css = readFileSync3(
+    createRequire(import.meta.url).resolve("@cs-object/react/style.css"),
+    "utf8"
+  );
+  const markup = renderToStaticMarkup(
+    createElement(PreparedFormulaSheet, { document: preparedDocument })
+  );
+  const notice = reviewNotice ? renderToStaticMarkup(
+    createElement(
+      "p",
+      {
+        "data-cso-review-notice": true,
+        style: {
+          fontSize: "10pt",
+          margin: "0 0 4mm",
+          padding: "2mm",
+          border: "1px solid #bbb"
+        }
+      },
+      reviewNotice
+    )
+  ) : "";
+  return [
+    '<!doctype html><html lang="en"><head><meta charset="utf-8">',
+    renderToStaticMarkup(createElement("title", null, preparedDocument.title)),
+    `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:">`,
+    `<meta name="viewport" content="width=device-width, initial-scale=1"><style>${css}</style></head><body class="formula-sheet-printing cso-standalone-report">`,
+    `<div data-formula-sheet-print-root="true">${notice}${markup}</div></body></html>`
+  ].join("");
+}
+
+// src/pdf-rendering.ts
+import { chromium } from "playwright";
+var LayoutInspectionError = class extends Error {
+  constructor(diagnostics) {
+    super(diagnostics.map((diagnostic) => diagnostic.message).join("\n"));
+    this.diagnostics = diagnostics;
+  }
+};
+function assertPassiveSvgAssetsInPage(assets) {
+  for (const resolved of assets) {
+    if (resolved.asset.mediaType !== "image/svg+xml") continue;
+    const xml = new TextDecoder("utf-8", { fatal: true }).decode(
+      Uint8Array.from(
+        atob(resolved.dataUrl.split(",")[1]),
+        (c) => c.charCodeAt(0)
+      )
+    );
+    const parsed = new DOMParser().parseFromString(xml, "image/svg+xml");
+    if (parsed.querySelector("parsererror") || parsed.documentElement.localName !== "svg" || parsed.documentElement.namespaceURI !== "http://www.w3.org/2000/svg")
+      throw new Error("Invalid SVG XML");
+    const forbidden = /* @__PURE__ */ new Set([
+      "script",
+      "foreignobject",
+      "iframe",
+      "object",
+      "embed",
+      "audio",
+      "video",
+      "a",
+      "animate",
+      "animatetransform",
+      "animatemotion",
+      "discard",
+      "set",
+      "style"
+    ]);
+    for (const element of parsed.querySelectorAll("*")) {
+      if (element.namespaceURI !== "http://www.w3.org/2000/svg" || forbidden.has(element.localName.toLowerCase()))
+        throw new Error(`Active SVG element ${element.localName}`);
+      for (const attr of element.attributes) {
+        const name = attr.localName.toLowerCase();
+        if (name.startsWith("on") || name === "style" || name === "base" || (name === "href" || name === "src") && !/^#[^\s]*$/.test(attr.value) || /url\s*\(/i.test(attr.value) && !/^url\(\s*#[A-Za-z_][\w.-]*\s*\)$/.test(attr.value))
+          throw new Error(`Active or external SVG attribute ${attr.name}`);
+      }
+    }
+  }
+}
+async function waitForPrintAssetsInPage() {
+  let timer;
+  try {
+    await Promise.race([
+      Promise.all([
+        document.fonts.ready,
+        ...Array.from(document.images, async (image) => {
+          await image.decode();
+          if (!image.naturalWidth || !image.naturalHeight)
+            throw new Error("Image decoded without dimensions");
+        })
+      ]),
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("Image/font readiness timed out")),
+          15e3
+        );
+      })
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function presentationInput(preparedDocument) {
+  return {
+    sections: preparedDocument.sections.map((section) => ({
+      id: section.id,
+      title: section.title,
+      sourcePlacementId: section.sourcePlacementId,
+      items: section.items.map((item) => ({
+        kind: item.kind,
+        sourcePlacementId: item.sourcePlacementId,
+        text: item.kind === "text" ? item.text.content : void 0,
+        figure: item.kind === "figure" ? item.figure : void 0
+      }))
+    })),
+    assets: preparedDocument.assets.map(({ asset }) => asset)
+  };
+}
+function inspectPreparedPresentationInPage(prepared) {
+  const mappings = [
+    { pointer: "/title", role: "document title", selector: "h1" }
+  ];
+  const placements = Array.from(
+    document.querySelectorAll("[data-source-placement]")
+  );
+  function mapItemPlacement(item, itemPointer) {
+    const element = placements.find(
+      (element2) => element2.dataset.sourcePlacement === item.sourcePlacementId
+    );
+    if (!element)
+      throw new Error(`Missing ordered placement ${item.sourcePlacementId}`);
+    const itemSelector = `[data-source-placement=${JSON.stringify(item.sourcePlacementId)}]`;
+    switch (item.kind) {
+      case "text":
+        if (!element.textContent?.includes(item.text ?? ""))
+          throw new Error("Missing authored text");
+        mappings.push({
+          pointer: `${itemPointer}/text/content`,
+          role: "authored text",
+          selector: itemSelector
+        });
+        break;
+      case "figure":
+        if (element.querySelector("img")?.alt !== item.figure?.alt || element.dataset.assetSha256 !== prepared.assets.find((asset) => asset.id === item.figure?.assetId)?.sha256)
+          throw new Error("Figure identity mismatch");
+        mappings.push({
+          pointer: `${itemPointer}/figure`,
+          role: "figure with caption and alt text",
+          selector: itemSelector
+        });
+        break;
+      case "symbol":
+      case "symbolRef":
+        if (!element.querySelector("math"))
+          throw new Error("Missing mathematical notation");
+        mappings.push({
+          pointer: item.kind === "symbol" ? `${itemPointer}/symbol` : `${itemPointer}/id`,
+          role: "engineering row projection: glyph, description, units, active formula, substitution, result and comment; internal fields remain evidence",
+          selector: itemSelector
+        });
+        break;
+      case "section":
+        break;
+    }
+  }
+  for (const [sectionIndex, section] of prepared.sections.entries()) {
+    const pointer = `/sections/${sectionIndex}`;
+    const heading = placements.find(
+      (element) => element.dataset.sourcePlacement === section.sourcePlacementId
+    );
+    if (!heading || heading.textContent !== section.title)
+      throw new Error(`Missing section ${section.id}`);
+    const selector = `[data-source-placement=${JSON.stringify(section.sourcePlacementId)}]`;
+    mappings.push({
+      pointer: `${pointer}/title`,
+      role: "section title",
+      selector
+    });
+    for (const [itemIndex, item] of section.items.entries()) {
+      mapItemPlacement(item, `${pointer}/items/${itemIndex}`);
+    }
+  }
+  for (const element of document.querySelectorAll(
+    "[data-engineering-value]"
+  )) {
+    const pointer = element.dataset.engineeringValue;
+    if (pointer)
+      mappings.push({
+        pointer,
+        role: "selected engineering context",
+        selector: `[data-engineering-value=${JSON.stringify(pointer)}]`
+      });
+  }
+  return mappings;
+}
+function inspectLayoutInPage(media) {
+  const sheet = document.querySelector("[data-formula-sheet]");
+  if (!sheet) throw new Error("Missing formula sheet");
+  const sheetBounds = sheet.getBoundingClientRect();
+  const findings = /* @__PURE__ */ new Map();
+  function recordOverflow({
+    element,
+    bounds,
+    containerLeft,
+    containerRight,
+    placement,
+    fallback,
+    message
+  }) {
+    if (!bounds.width || !bounds.height) return;
+    const overflowPx = Math.max(
+      0,
+      containerLeft - bounds.left,
+      bounds.right - containerRight
+    );
+    if (overflowPx <= 2) return;
+    const key = placement ?? fallback;
+    const previous = findings.get(key);
+    if (previous && (previous.layout?.overflowPx ?? 0) >= overflowPx) return;
+    const sourcePlacementId = placement?.getAttribute("data-source-placement") ?? void 0;
+    const selector = sourcePlacementId ? `[data-source-placement=${JSON.stringify(sourcePlacementId)}]` : "[data-formula-sheet]";
+    findings.set(key, {
+      code: "DOCUMENT_LAYOUT_OVERFLOW",
+      stage: "rendering",
+      check: "rendering",
+      message: `${message} in ${media} layout: ${selector}, ${element.tagName}, ${overflowPx.toFixed(2)}px beyond content bounds.`,
+      layout: {
+        media,
+        sourcePlacementId,
+        selector,
+        left: bounds.left,
+        right: bounds.right,
+        containerLeft,
+        containerRight,
+        overflowPx
+      }
+    });
+  }
+  for (const math of sheet.querySelectorAll("math")) {
+    const placement = math.closest("[data-source-placement]");
+    const row = math.closest(".cso-symbol-row") ?? sheet;
+    const cell = math.closest("td") ?? row;
+    const rowBounds = cell.getBoundingClientRect();
+    let containerLeft = Math.max(sheetBounds.left, rowBounds.left);
+    let containerRight = Math.min(sheetBounds.right, rowBounds.right);
+    const parent = math.closest("td") ?? math.parentElement;
+    const parentOverflow = parent && math.getBoundingClientRect().width > parent.getBoundingClientRect().width + 2;
+    if (parentOverflow && parent) {
+      const parentBounds = parent.getBoundingClientRect();
+      containerLeft = Math.max(containerLeft, parentBounds.left);
+      containerRight = Math.min(containerRight, parentBounds.right);
+    }
+    for (const element of [math, ...math.querySelectorAll("*")]) {
+      recordOverflow({
+        element,
+        bounds: element.getBoundingClientRect(),
+        containerLeft,
+        containerRight,
+        placement,
+        fallback: row,
+        message: "Mathematical notation overflows its cell or sheet"
+      });
+    }
+  }
+  for (const element of sheet.querySelectorAll("*")) {
+    if (element.closest("math") || element.closest("svg")) continue;
+    const rectangles = [element.getBoundingClientRect()];
+    for (const node of element.childNodes) {
+      if (node.nodeType !== Node.TEXT_NODE || !node.textContent?.trim())
+        continue;
+      const range = document.createRange();
+      range.selectNodeContents(node);
+      rectangles.push(...range.getClientRects());
+    }
+    for (const bounds of rectangles) {
+      recordOverflow({
+        element,
+        bounds,
+        containerLeft: sheetBounds.left,
+        containerRight: sheetBounds.right,
+        placement: element.closest("[data-source-placement]"),
+        fallback: sheet,
+        message: "Document content exceeds printable sheet width"
+      });
+    }
+  }
+  return [...findings.values()];
+}
+async function withPreparedPage(document2, html, usePage, signal) {
+  const browser = await chromium.launch({ headless: true, timeout: 3e4 });
+  const abort = () => {
+    void browser.close().catch(() => {
+    });
+  };
+  signal?.addEventListener("abort", abort, { once: true });
+  try {
+    signal?.throwIfAborted();
+    const page = await browser.newPage();
+    page.setDefaultTimeout(15e3);
+    const requests = [];
+    await page.route("**/*", (route) => {
+      requests.push(route.request().url());
+      return route.abort();
+    });
+    await page.evaluate(assertPassiveSvgAssetsInPage, document2.assets);
+    await page.setContent(html, { waitUntil: "load", timeout: 15e3 });
+    const diagnostics = [];
+    for (const media of ["screen", "print"]) {
+      await page.emulateMedia({ media });
+      await page.evaluate(waitForPrintAssetsInPage);
+      diagnostics.push(...await page.evaluate(inspectLayoutInPage, media));
+    }
+    if (requests.length)
+      throw new Error(
+        `Document attempted external requests: ${requests.join(", ")}`
+      );
+    if (diagnostics.length) throw new LayoutInspectionError(diagnostics);
+    const presentation = await page.evaluate(
+      inspectPreparedPresentationInPage,
+      presentationInput(document2)
+    );
+    return await usePage(page, presentation);
+  } finally {
+    signal?.removeEventListener("abort", abort);
+    await browser.close();
+  }
+}
+function inspectPreparedHtml(document2, html) {
+  return withPreparedPage(
+    document2,
+    html,
+    async (_page, presentation) => presentation
+  );
+}
+function renderPreparedPdf(document2, html = buildPreparedHtml(document2), signal) {
+  return withPreparedPage(
+    document2,
+    html,
+    async (page, presentation) => {
+      let printTimer;
+      try {
+        const pdf = await Promise.race([
+          page.pdf({
+            format: "A4",
+            printBackground: true,
+            margin: { top: "0", right: "0", bottom: "0", left: "0" }
+          }),
+          new Promise((_, reject) => {
+            printTimer = setTimeout(
+              () => reject(new Error("PDF printing timed out")),
+              3e4
+            );
+          })
+        ]);
+        return { pdf, presentation };
+      } finally {
+        clearTimeout(printTimer);
+      }
+    },
+    signal
+  );
+}
+
+export {
+  sha256,
+  captureAssets,
+  jsonBytes,
+  retainSource,
+  publishDocumentEvidence,
+  buildPreparedHtml,
+  LayoutInspectionError,
+  inspectPreparedHtml,
+  renderPreparedPdf
+};