@descryy/runtime-evidence-store 0.0.0

package/dist/replay.js

@@ -0,0 +1,104 @@
+/**
+ * Replay (plan §24).
+ *
+ * ## What this replays, and what it does not
+ *
+ * **It replays evidence, not the application.** Given an `executionId`, it
+ * returns the recorded execution, the environment it was recorded in, and its
+ * evidence in recorded order — enough to re-derive correlation, findings and
+ * an evidence package without booting anything. It does not spawn a process,
+ * drive a browser, or reissue a request, and it never will from here: those
+ * are `descry-runtime`'s live path, and a "replay" that quietly re-executed
+ * would produce a *new* observation while claiming to reproduce an old one.
+ *
+ * That distinction is the whole reason this file names its own limits at the
+ * top. §24's row was `[ ]` with the note *"having the data is not having the
+ * capability"* — the opposite error is equally available, and it is shipping
+ * something called replay that reproduces less than the name promises.
+ *
+ * ## The gap this had to close first
+ *
+ * Evidence survived a process restart. **The execution that produced it did
+ * not.** `Execution` lived in `ExecutionController`'s memory and nowhere on
+ * disk, so after a restart the store held a pile of rows keyed by an
+ * `executionId` that no longer resolved to an application, a commit, or a
+ * configuration. §24 marked "execution configuration — persisted with the
+ * execution" as done, and it was true of the object and false of the disk.
+ *
+ * `recordExecution` is that missing half. It is a **new table**, never a new
+ * column on `evidence` — an added table appears under `CREATE TABLE IF NOT
+ * EXISTS` on an existing store file, where an added column would need a
+ * migration this package has no mechanism for.
+ *
+ * ## Redaction applies here too, and that is not obvious
+ *
+ * §20's rows are all about payloads, and every one of them is about evidence.
+ * But a service command is `configuration.services[x].command`, and a command
+ * line is one of the classic places a credential is passed —
+ * `node server.mjs --api-key=…`, `DATABASE_URL=… node app.js`. The execution
+ * record goes through the same `redact()` the evidence write path uses, for
+ * the same reason and on the same terms. `redactedKeys` (RT-063) reports what
+ * it caught.
+ *
+ * ## The environment fingerprint is deliberately narrow
+ *
+ * Four fields: node version, platform, arch, and the declared service
+ * commands. **`process.env` is not captured, and its absence is the design.**
+ * §20 records that the injected process environment is not captured or
+ * filtered — *"so there is nothing to leak yet, which is not the same as
+ * filtering."* Capturing it here to improve reproducibility would create
+ * exactly the leak that row says does not exist, inside the one module whose
+ * output is meant to be safe to hand to a model. A narrower fingerprint that
+ * can be trusted beats a fuller one that cannot.
+ */
+/**
+ * The current machine's fingerprint.
+ *
+ * `serviceCommands` comes from the caller's configuration rather than being
+ * discovered, because there is nothing on a machine to discover it from — an
+ * execution's services are a property of the run, not of the host.
+ */
+export function captureEnvironment(serviceCommands = {}, runtime = process) {
+    return {
+        nodeVersion: runtime.version,
+        platform: runtime.platform,
+        arch: runtime.arch,
+        serviceCommands,
+    };
+}
+/**
+ * Differences between the environment an execution was recorded in and the
+ * one it is being replayed in.
+ *
+ * **Reported, never enforced.** A replay in a different node version is not
+ * wrong; it is a fact a reader needs when a re-derived finding disagrees with
+ * the original. Refusing to replay would be this module deciding a question
+ * it has no information about.
+ */
+export function environmentDifferences(recorded, current) {
+    const differences = [];
+    if (recorded.nodeVersion !== current.nodeVersion) {
+        differences.push(`node ${recorded.nodeVersion} → ${current.nodeVersion}`);
+    }
+    if (recorded.platform !== current.platform) {
+        differences.push(`platform ${recorded.platform} → ${current.platform}`);
+    }
+    if (recorded.arch !== current.arch) {
+        differences.push(`arch ${recorded.arch} → ${current.arch}`);
+    }
+    const names = new Set([...Object.keys(recorded.serviceCommands), ...Object.keys(current.serviceCommands)]);
+    for (const name of [...names].sort()) {
+        const before = recorded.serviceCommands[name];
+        const after = current.serviceCommands[name];
+        if (before === after)
+            continue;
+        if (before === undefined)
+            differences.push(`service "${name}" is new`);
+        else if (after === undefined)
+            differences.push(`service "${name}" is gone`);
+        else
+            differences.push(`service "${name}" command changed: ${before} → ${after}`);
+    }
+    return differences;
+}
+//# sourceMappingURL=replay.js.map

package/dist/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAiDH;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,kBAAoD,EAAE,EACtD,UAA+D,OAAO;IAEtE,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,eAAe;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgC,EAChC,OAA+B;IAE/B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QACjD,WAAW,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,WAAW,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3C,WAAW,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,QAAQ,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,WAAW,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC3G,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,KAAK;YAAE,SAAS;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC;aAClE,IAAI,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC;;YACvE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,sBAAsB,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@descryy/runtime-evidence-store",
+  "version": "0.0.0",
+  "type": "module",
+  "description": "Evidence persistence keyed by executionId, with redaction enforced on write -- there is no path to read an unredacted payload.",
+  "license": "UNLICENSED",
+  "engines": {
+    "node": ">=22.5"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "dependencies": {
+    "@descryy/runtime-contracts": "0.0.0"
+  }
+}