@deeeed/metamask-harness 0.79.0 → 0.81.0

package/dist/execution-provenance.js

@@ -1,332 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import fs, { constants as fsConstants } from "node:fs";
-import path from "node:path";
-import { getAdapterSurface } from "./adapters/surface.js";
-import { indexArtifactManifest } from "./artifact-files.js";
-import { importRecipeProtocol, runnerDir } from "./paths.js";
-const gitContexts = /* @__PURE__ */ new Map();
-let protocolPromise;
-class ProvenanceDriftError extends Error {
-  code = "PROVENANCE_DRIFT";
-  exitCode = 5;
-  userAction;
-  provenancePath;
-  drift;
-  constructor(provenancePath, drift, cause) {
-    const fields = [...new Set(drift.map((entry) => entry.field))].join(", ");
-    super(
-      `Execution inputs changed after preparation (${fields}); evidence is invalid.`,
-      cause === void 0 ? void 0 : { cause }
-    );
-    this.name = "ProvenanceDriftError";
-    this.provenancePath = provenancePath;
-    this.drift = drift;
-    this.userAction = `restore the prepared recipe, library, and product source, then rerun; inspect ${provenancePath}`;
-  }
-}
-async function captureExecutionProvenance(input, phase) {
-  const protocol = await (protocolPromise ??= importRecipeProtocol());
-  const recipeDigest = input.recipePath ? recipeFileDigest(protocol, input.recipePath) : protocol.digestRecipeDocument(input.recipeDocument);
-  const libraries = (input.librarySources ?? []).map((source, index) => ({
-    name: source.name ?? `library-${index + 1}`,
-    ...sourceSnapshot(source.root)
-  }));
-  const runnerRoot = input.runnerRoot ?? runnerDir;
-  return {
-    phase,
-    capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    recipeDigest,
-    product: sourceSnapshot(
-      input.projectRoot,
-      input.adapter,
-      input.excludedProductRoots
-    ),
-    runner: sourceSnapshot(runnerRoot, void 0, [], [
-      "src",
-      "adapters",
-      "library",
-      "bin",
-      "dist",
-      "package.json"
-    ]),
-    libraries,
-    helpers: (input.helperPaths ?? []).map((helperPath) => ({
-      path: displayPath(input.projectRoot, helperPath),
-      sourceFingerprint: fileFingerprint(helperPath)
-    }))
-  };
-}
-function executionProvenanceDrift(start, current) {
-  const drift = [];
-  if (current.phase === "start") return drift;
-  const phase = current.phase;
-  compare(drift, phase, "recipeDigest", start.recipeDigest, current.recipeDigest);
-  compareSource(drift, phase, "product", start.product, current.product);
-  compareSource(drift, phase, "runner", start.runner, current.runner);
-  if (start.libraries.length !== current.libraries.length) {
-    compare(
-      drift,
-      phase,
-      "libraries.length",
-      String(start.libraries.length),
-      String(current.libraries.length)
-    );
-  }
-  const count = Math.min(start.libraries.length, current.libraries.length);
-  for (let index = 0; index < count; index += 1) {
-    const expected = start.libraries[index];
-    const actual = current.libraries[index];
-    const prefix = `libraries[${index}]`;
-    compare(drift, phase, `${prefix}.name`, expected.name, actual.name);
-    compareSource(drift, phase, prefix, expected, actual);
-  }
-  if (start.helpers.length !== current.helpers.length) {
-    compare(
-      drift,
-      phase,
-      "helpers.length",
-      String(start.helpers.length),
-      String(current.helpers.length)
-    );
-  }
-  const helperCount = Math.min(start.helpers.length, current.helpers.length);
-  for (let index = 0; index < helperCount; index += 1) {
-    compare(drift, phase, `helpers[${index}].path`, start.helpers[index].path, current.helpers[index].path);
-    compare(
-      drift,
-      phase,
-      `helpers[${index}].sourceFingerprint`,
-      start.helpers[index].sourceFingerprint,
-      current.helpers[index].sourceFingerprint
-    );
-  }
-  return drift;
-}
-async function writeExecutionProvenance(artifactsDir, snapshots, drift, artifactManifestPath) {
-  const provenancePath = path.join(path.resolve(artifactsDir), "execution-provenance.json");
-  const record = {
-    schemaVersion: 1,
-    valid: drift.length === 0,
-    snapshots,
-    drift
-  };
-  fs.mkdirSync(path.dirname(provenancePath), { recursive: true });
-  fs.writeFileSync(provenancePath, `${JSON.stringify(record, null, 2)}
-`);
-  if (artifactManifestPath) {
-    await indexArtifactManifest(artifactManifestPath, [
-      {
-        path: "execution-provenance.json",
-        type: "json",
-        label: "Execution provenance",
-        category: "system",
-        metadata: {
-          valid: record.valid,
-          errorCode: record.valid ? null : "PROVENANCE_DRIFT"
-        }
-      }
-    ]);
-  }
-  return provenancePath;
-}
-function recipeFileDigest(protocol, recipePath) {
-  const source = readRegularFileNoFollow(recipePath);
-  try {
-    return protocol.digestRecipeDocument(JSON.parse(source.toString("utf8")));
-  } catch {
-    return `invalid:sha256:${createHash("sha256").update(source).digest("hex")}`;
-  }
-}
-function sourceSnapshot(root, adapter, excludedRoots = [], includedRoots = []) {
-  const git = gitContext(root);
-  if (!git) {
-    return {
-      head: null,
-      status: "not-a-git-checkout",
-      sourceFingerprint: directoryFingerprint(root, excludedRoots, includedRoots)
-    };
-  }
-  const pathspecs = sourcePathspecs(git, excludedRoots, includedRoots);
-  const status = gitText(git.topLevel, [
-    "status",
-    "--porcelain=v1",
-    "--untracked-files=normal",
-    "--",
-    ...pathspecs
-  ]);
-  const head = gitBuffer(git.topLevel, ["rev-parse", "HEAD"]);
-  const platformFingerprint = adapter ? getAdapterSurface(adapter).sourceFingerprint : void 0;
-  return {
-    head: head.toString("utf8").trim() || null,
-    status,
-    sourceFingerprint: platformFingerprint && path.resolve(root) === git.topLevel ? platformFingerprint(root) : nestedGitSourceFingerprint(root, git, pathspecs, excludedRoots, includedRoots, head)
-  };
-}
-function nestedGitSourceFingerprint(root, git, pathspecs, excludedRoots, includedRoots, head) {
-  const gitFingerprint = gitSourceFingerprint(git.topLevel, pathspecs, head);
-  if (git.pathspec === "." && includedRoots.length === 0) return gitFingerprint;
-  return createHash("sha256").update(gitFingerprint).update("\0nested-source\0").update(directoryFingerprint(root, excludedRoots, includedRoots)).digest("hex");
-}
-function gitContext(root) {
-  const cacheKey = path.resolve(root);
-  if (gitContexts.has(cacheKey)) return gitContexts.get(cacheKey) ?? null;
-  try {
-    const resolved = cacheKey;
-    const topLevel = fs.realpathSync(
-      gitText(resolved, ["rev-parse", "--show-toplevel"]).trim()
-    );
-    const relative = path.relative(topLevel, fs.realpathSync(resolved));
-    const context = relative === ".." || relative.startsWith(`..${path.sep}`) ? null : { topLevel, pathspec: relative || "." };
-    gitContexts.set(cacheKey, context);
-    return context;
-  } catch {
-    gitContexts.set(cacheKey, null);
-    return null;
-  }
-}
-function gitSourceFingerprint(topLevel, pathspecs, head) {
-  const hash = createHash("sha256");
-  hash.update(head);
-  hash.update("\0diff\0");
-  hash.update(
-    gitBuffer(topLevel, [
-      "diff",
-      "--no-ext-diff",
-      "--binary",
-      head.toString("utf8").trim(),
-      "--",
-      ...pathspecs
-    ])
-  );
-  const untracked = gitText(topLevel, [
-    "ls-files",
-    "--others",
-    "--exclude-standard",
-    "-z",
-    "--",
-    ...pathspecs
-  ]).split("\0").filter(Boolean).sort();
-  for (const relative of untracked) {
-    hash.update(`\0untracked\0${relative}\0`);
-    const absolute = path.join(topLevel, relative);
-    hash.update(readPathIdentity(absolute));
-  }
-  return hash.digest("hex");
-}
-function sourcePathspecs(git, excludedRoots, includedRoots) {
-  const exclusions = excludedRoots.flatMap((root) => {
-    const relative = path.relative(git.topLevel, fs.existsSync(root) ? fs.realpathSync(root) : path.resolve(root));
-    return relative !== ".." && !relative.startsWith(`..${path.sep}`) ? [`:(exclude)${relative}`] : [];
-  });
-  const inclusions = includedRoots.length > 0 ? includedRoots.map((root) => path.join(git.pathspec === "." ? "" : git.pathspec, root)) : [git.pathspec];
-  return [...inclusions, ...exclusions];
-}
-function directoryFingerprint(root, excludedRoots, includedRoots) {
-  const hash = createHash("sha256");
-  const resolvedRoot = path.resolve(root);
-  const roots = includedRoots.length > 0 ? includedRoots : [""];
-  for (const included of roots) {
-    hashDirectory(
-      hash,
-      resolvedRoot,
-      included,
-      new Set(excludedRoots.map((entry) => path.resolve(entry)))
-    );
-  }
-  return hash.digest("hex");
-}
-function hashDirectory(hash, root, relative, excludedRoots) {
-  const absolute = path.join(root, relative);
-  if ([...excludedRoots].some(
-    (excluded) => absolute === excluded || absolute.startsWith(`${excluded}${path.sep}`)
-  )) return;
-  let stat;
-  try {
-    stat = fs.lstatSync(absolute);
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      hash.update(`absent\0${relative}\0`);
-      return;
-    }
-    throw error;
-  }
-  if (stat.isDirectory()) {
-    hash.update(`directory\0${relative}\0`);
-    for (const name of fs.readdirSync(absolute).sort()) {
-      if (relative === "" && (name === ".git" || name === "node_modules" || name === "temp")) continue;
-      hashDirectory(hash, root, path.join(relative, name), excludedRoots);
-    }
-    return;
-  }
-  if (stat.isSymbolicLink()) {
-    throw new Error(`Execution provenance source must not be a symbolic link: ${absolute}`);
-  }
-  hash.update(`file\0${relative}\0`);
-  hash.update(readRegularFileNoFollow(absolute));
-  hash.update("\0");
-}
-function fileFingerprint(filePath) {
-  return createHash("sha256").update(readRegularFileNoFollow(filePath)).digest("hex");
-}
-function readPathIdentity(filePath) {
-  const stat = fs.lstatSync(filePath);
-  if (stat.isSymbolicLink()) {
-    throw new Error(`Execution provenance source must not be a symbolic link: ${filePath}`);
-  }
-  return readRegularFileNoFollow(filePath);
-}
-function readRegularFileNoFollow(filePath) {
-  let fd;
-  try {
-    fd = fs.openSync(filePath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-  } catch (error) {
-    if (error.code === "ELOOP") {
-      throw new Error(`Execution provenance source must not be a symbolic link: ${filePath}`);
-    }
-    throw error;
-  }
-  try {
-    if (!fs.fstatSync(fd).isFile()) {
-      throw new Error(`Execution provenance source is not a regular file: ${filePath}`);
-    }
-    return fs.readFileSync(fd);
-  } finally {
-    fs.closeSync(fd);
-  }
-}
-function displayPath(projectRoot, filePath) {
-  const relative = path.relative(path.resolve(projectRoot), path.resolve(filePath));
-  return relative !== ".." && !relative.startsWith(`..${path.sep}`) ? relative || "." : path.resolve(filePath);
-}
-function gitText(cwd, args) {
-  return gitBuffer(cwd, args).toString("utf8");
-}
-function gitBuffer(cwd, args) {
-  return execFileSync("git", args, {
-    cwd,
-    encoding: "buffer",
-    maxBuffer: 128 * 1024 * 1024,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-}
-function compareSource(drift, phase, prefix, start, current) {
-  compare(drift, phase, `${prefix}.head`, start.head, current.head);
-  compare(drift, phase, `${prefix}.status`, start.status, current.status);
-  compare(
-    drift,
-    phase,
-    `${prefix}.sourceFingerprint`,
-    start.sourceFingerprint,
-    current.sourceFingerprint
-  );
-}
-function compare(drift, phase, field, start, current) {
-  if (start !== current) drift.push({ phase, field, start, current });
-}
-export {
-  ProvenanceDriftError,
-  captureExecutionProvenance,
-  executionProvenanceDrift,
-  writeExecutionProvenance
-};