@dzhechkov/harness-core 0.7.0 → 0.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/.dz-manifest.json +23 -23
  2. package/README.md +3 -0
  3. package/dist/sign.d.ts +14 -2
  4. package/dist/sign.d.ts.map +1 -1
  5. package/dist/sign.js +140 -7
  6. package/dist/sign.js.map +1 -1
  7. package/package.json +5 -5
  8. package/sbom.json +22 -22
  9. package/src/sign.ts +129 -7
package/.dz-manifest.json CHANGED
@@ -9,7 +9,7 @@
9
9
  },
10
10
  {
11
11
  "path": "README.md",
12
- "sha256": "3d0f40f8e46f15d06ed65efa568ad9f34c36c519c468db401663d8a3badbb734"
12
+ "sha256": "587e7d4379b3e2e05f7d91fedefec59d1f078e4172650ca602c035c52133ea30"
13
13
  },
14
14
  {
15
15
  "path": "dist/__tests__/golden-baseline.test.d.ts",
@@ -29,19 +29,19 @@
29
29
  },
30
30
  {
31
31
  "path": "dist/agentdb-index.d.ts",
32
- "sha256": "894c24f39960080ec16a422915bd51b83b8143dd1eee656aa7df94f06014aedb"
32
+ "sha256": "afb3f3be3aac3c2f2ce0375d446b760c598f65ad1085b2c331ebd77165f58a90"
33
33
  },
34
34
  {
35
35
  "path": "dist/agentdb-index.d.ts.map",
36
- "sha256": "a5294372615bd261a12dd9908825364211218dc6344673508c2b86eb4c57d61a"
36
+ "sha256": "58b507fd43512ce3d742da84bb90206c61853f3f7dcdc5c03426238eaee036b3"
37
37
  },
38
38
  {
39
39
  "path": "dist/agentdb-index.js",
40
- "sha256": "9e042ac64c47980d74128778b6938d656afd018929410f54ff4b898a78db6a19"
40
+ "sha256": "9726a655bbff1f7f2d29177de0b9d5b6d0e08b02f431c291c01b33d632440c5c"
41
41
  },
42
42
  {
43
43
  "path": "dist/agentdb-index.js.map",
44
- "sha256": "52a324f32f021e8554332d39069bccc6dda69df1aedaa30fb87ff334cb31ed3b"
44
+ "sha256": "21ef51bfa446036c57e468ede888ae1e25fd5866f44497ab9184373e569afe83"
45
45
  },
46
46
  {
47
47
  "path": "dist/agents-policy.d.ts",
@@ -589,19 +589,19 @@
589
589
  },
590
590
  {
591
591
  "path": "dist/guard.d.ts",
592
- "sha256": "38346a2da6b27e1f735278facca8a01047fe32d213b7cc1320a8103ab034c4bd"
592
+ "sha256": "10bbc8872c4667339b9117e4bb61bccb7d0a9e3dee2d5590c4c776c931b93960"
593
593
  },
594
594
  {
595
595
  "path": "dist/guard.d.ts.map",
596
- "sha256": "df3e5197110bd8ca6ba7e3ffbb546c7278fcaa44466572089fa811bc389462b0"
596
+ "sha256": "b85d145b03c231d66a67cd60ad9d99045b552aaf53c3ced9203bd36a667b5d9f"
597
597
  },
598
598
  {
599
599
  "path": "dist/guard.js",
600
- "sha256": "23f0bfdb33528f8e9cfb900548ec1ede0979c06d8b23ae8525d6eb3ee419b718"
600
+ "sha256": "1a00572dbe4bbdbc243c6a96313a1731d340b3c83a75560d6243adb8bafb8266"
601
601
  },
602
602
  {
603
603
  "path": "dist/guard.js.map",
604
- "sha256": "557b925f9837365089505093766c3ac9601debfd0385830e429bcc8a6ffd774a"
604
+ "sha256": "93d21258144ca202d53f6c7f7e218c5960e29449dfbaf0e5818043f2b18fb532"
605
605
  },
606
606
  {
607
607
  "path": "dist/import-ecc.d.ts",
@@ -1325,19 +1325,19 @@
1325
1325
  },
1326
1326
  {
1327
1327
  "path": "dist/sign.d.ts",
1328
- "sha256": "4cc84ca3465412eff64d34183a6273f2116cd6f78b2d5605324642bbbbe4d5e8"
1328
+ "sha256": "87b934a6bebac22f37e85419dade0be6b190bac5585c6bdbbce08c63bc76578e"
1329
1329
  },
1330
1330
  {
1331
1331
  "path": "dist/sign.d.ts.map",
1332
- "sha256": "27b41a47bae61783e391382ff77edee09c5a3308d280ad86a464a8e0d1876276"
1332
+ "sha256": "8967803dd2fad95f234abab82edae0e5d778fcdf81b64016b7e462ff584270e6"
1333
1333
  },
1334
1334
  {
1335
1335
  "path": "dist/sign.js",
1336
- "sha256": "e77b891e76d20808ac01a04a6649a9c0128e9e3cbf3c1266c248948ce924bed6"
1336
+ "sha256": "71ff7442f43fc4ff4da6d71bbb7376881ce536ee931b9da2ba386ab465a2b9a0"
1337
1337
  },
1338
1338
  {
1339
1339
  "path": "dist/sign.js.map",
1340
- "sha256": "96d5c27631cdee8882e6d5da669e0cf1f5c8a1ed8b9c20510aec512d9ccb37e9"
1340
+ "sha256": "6bc020803cd8c9bbc9551b6e15850feabf6c9959dacfc20ec2428c71dcc1ae2d"
1341
1341
  },
1342
1342
  {
1343
1343
  "path": "dist/skill-drift.d.ts",
@@ -1533,19 +1533,19 @@
1533
1533
  },
1534
1534
  {
1535
1535
  "path": "dist/vector-tier.d.ts",
1536
- "sha256": "77d99aef6714a8fbc0246be15425f96c4d9da95c9545de551ee069fc89eb4de2"
1536
+ "sha256": "15c079d1fa32d9d914323ed8a9646a6906b316ace41991ca571a3f9d639d1f9c"
1537
1537
  },
1538
1538
  {
1539
1539
  "path": "dist/vector-tier.d.ts.map",
1540
- "sha256": "d34550cb15c7b10f2fd7a8009e4517d4e466a4d54e8e81d00ca34dc32a742e7b"
1540
+ "sha256": "49864c93925b27de2ada2d4eea9c24d474be7f7134efc6a90545a327c9803e3e"
1541
1541
  },
1542
1542
  {
1543
1543
  "path": "dist/vector-tier.js",
1544
- "sha256": "e45ce822673cb271d8e264f471d7ef6644ed5f689cedaf6e58d1aab3f2ebad6c"
1544
+ "sha256": "0117b20ba727e5d625366f6bb7318bb9e4495f0a3c23193b6ea374cbd358c460"
1545
1545
  },
1546
1546
  {
1547
1547
  "path": "dist/vector-tier.js.map",
1548
- "sha256": "716f08b502d77bb2be012982c09902207e75c083706a9fa7816b1306d1c0f03b"
1548
+ "sha256": "5dbad708d80c7bda481cd2d7b9d3a2072fe4ea482b443c2af518d097d28ad762"
1549
1549
  },
1550
1550
  {
1551
1551
  "path": "dist/workflow-run-dispatch.d.ts",
@@ -1597,7 +1597,7 @@
1597
1597
  },
1598
1598
  {
1599
1599
  "path": "package.json",
1600
- "sha256": "c326cf33638c879ea9bfacc8fe367137f69104f75b8149fdd816704356532115"
1600
+ "sha256": "52045af38109cd064cf8472418fcac0d59e54a9faa43edaddf1a3bfbc15be599"
1601
1601
  },
1602
1602
  {
1603
1603
  "path": "src/__tests__/golden-baseline.test.ts",
@@ -1605,7 +1605,7 @@
1605
1605
  },
1606
1606
  {
1607
1607
  "path": "src/agentdb-index.ts",
1608
- "sha256": "00f09dd765aad0acd26a361fd2f4a0e1e37b1e9e181fd07c9085f0d745fbd373"
1608
+ "sha256": "6aacd072352e0d626690f08e8bcc6d0f8ffd0ed612b79e6a5fe7a2fb2428c483"
1609
1609
  },
1610
1610
  {
1611
1611
  "path": "src/agents-policy.ts",
@@ -1745,7 +1745,7 @@
1745
1745
  },
1746
1746
  {
1747
1747
  "path": "src/guard.ts",
1748
- "sha256": "ed3f8254f9192f8419c1b220a500943ddc64873fc478e0b2d8ef4c0dbe3e3b8a"
1748
+ "sha256": "5a23957218cdeb81d86eb03615ddad487e06e6c33b0fd572217b3d084f3f911d"
1749
1749
  },
1750
1750
  {
1751
1751
  "path": "src/import-ecc.ts",
@@ -1925,7 +1925,7 @@
1925
1925
  },
1926
1926
  {
1927
1927
  "path": "src/sign.ts",
1928
- "sha256": "e953233fe4031c58e77a047694d22b038ad1b99ec445dea4d5aa598a0e574765"
1928
+ "sha256": "0e9f8ffac3fe0739fcf98cd73b606f70d337088f7479d6fbf1653ea6f685bc7b"
1929
1929
  },
1930
1930
  {
1931
1931
  "path": "src/skill-drift.ts",
@@ -1977,7 +1977,7 @@
1977
1977
  },
1978
1978
  {
1979
1979
  "path": "src/vector-tier.ts",
1980
- "sha256": "db2d2510d5a9297ed212f117307ad15d0900005797d1ad81aee2b3802114b473"
1980
+ "sha256": "92f8274432847f05c6b0584542dfc4a12be89e828e34e025474f2c7c0a53c925"
1981
1981
  },
1982
1982
  {
1983
1983
  "path": "src/workflow-run-dispatch.ts",
@@ -1993,5 +1993,5 @@
1993
1993
  }
1994
1994
  ]
1995
1995
  },
1996
- "signature": "KBS2tqhmS9xmXR65NLFeCbZs76WVpooOVjGRn/KFU6AfAGueAfKy6JLCXS3RHYO0QXyCaUOAoffjro30NeziCw=="
1996
+ "signature": "fQVAxbXOutFfkrhOIa1NJ0NKJV9qwec4Dq9gPo2AS+98aePGdI7BYMOsG7/sHlKnWNdJi9hfYnsvCyxR3sCIDQ=="
1997
1997
  }
package/README.md CHANGED
@@ -238,6 +238,9 @@ A count that cannot be computed is reported as `undefined` — never as `0`.
238
238
 
239
239
  ## Status
240
240
 
241
+ `0.7.2` — a signature-only republish: `0.7.0` went out without the re-signing step, so its published
242
+ manifest was stale against its own shipped files. No behaviour changes.
243
+
241
244
  `0.7.0` — the publish gate gained `review-round`, and the vector tier reports what the run did (both above): `mergeHybridHits` keeps the top
242
245
  lexical hit under `--semantic`, `HybridRecall` gains `semanticCandidates` / `semanticRanked`, and
243
246
  `VectorTierStatus` gains `mirrorWriterEnabled`, `unmirrored`, `mirroredOther` and `orphaned`.
package/dist/sign.d.ts CHANGED
@@ -36,8 +36,14 @@ export interface VerifyResult {
36
36
  readonly ok: boolean;
37
37
  readonly failures: readonly VerifyFailure[];
38
38
  }
39
+ /**
40
+ * Hash the bytes of one pack file. A packer-rewritten file is hashed canonically; everything else
41
+ * byte-for-byte. Unparseable JSON falls back to the RAW bytes rather than passing — a corrupt
42
+ * `package.json` must be a mismatch, never a free pass.
43
+ */
44
+ export declare function hashPackBytes(relPath: string, bytes: Buffer): string;
39
45
  /** sha256 of a file's bytes, hex. Follows symlinks — used only when building a manifest we control. */
40
- export declare function hashFile(absPath: string): string;
46
+ export declare function hashFile(absPath: string, relPath?: string): string;
41
47
  /**
42
48
  * Round-2 review (codex exec): `lstat` then `readFile` is a TOCTOU window — the path can be swapped
43
49
  * for a symlink between the two calls. Open ONCE with `O_NOFOLLOW`, `fstat` the descriptor, and read
@@ -45,7 +51,7 @@ export declare function hashFile(absPath: string): string;
45
51
  *
46
52
  * Returns `null` when the path is not a regular file, or is a symlink.
47
53
  */
48
- export declare function hashRegularFileNoFollow(absPath: string): string | null;
54
+ export declare function hashRegularFileNoFollow(absPath: string, relPath?: string): string | null;
49
55
  export declare function isSafeManifestPath(p: unknown): p is string;
50
56
  /** Returns an error message, or `null` when the entry list is structurally sound. */
51
57
  export declare function checkManifestEntries(files: unknown): string | null;
@@ -144,6 +150,12 @@ export interface PublishGateInput {
144
150
  readonly manifestPresent: boolean;
145
151
  readonly verifyOk: boolean;
146
152
  readonly requireSigning: boolean;
153
+ /**
154
+ * The artifact could not be produced (the packer failed), so nothing was compared against the
155
+ * signature. Distinct from `verifyOk: false`, which means a comparison RAN and disagreed — the
156
+ * gate blocks either way, but only an honest reason tells the operator which one to fix.
157
+ */
158
+ readonly artifactUnavailable?: boolean;
147
159
  }
148
160
  export interface PublishGateDecision {
149
161
  readonly action: PublishGateAction;
package/dist/sign.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAED,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWtE;AAeD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAK1D;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkBlE;AAYD,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAoBpD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAc5D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAI5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAG7D;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAM5F;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,cAAc,CAMvD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,CAWtF;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACzC,SAAS,EAAE,MAAM;AACjB;;;;;;;;;;;GAWG;AACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAC/B,YAAY,CAkEd;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWvE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ5E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnF;AAED,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC/F,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAYlD;AAaD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,mBAAmB,CAiB9E;AAOD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,GAAG,aAAa,CAAC;AAEjG,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,CAKzE;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,GAAG,cAAc,CAqBhG"}
1
+ {"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AA2FD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAYpE;AAED,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAaxF;AAeD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAK1D;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkBlE;AAYD,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAoBpD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAc5D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAI5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAG7D;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAM5F;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,cAAc,CAMvD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,CAWtF;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACzC,SAAS,EAAE,MAAM;AACjB;;;;;;;;;;;GAWG;AACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAC/B,YAAY,CAkEd;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWvE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ5E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnF;AAED,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC/F,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAYlD;AAaD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,mBAAmB,CAuB9E;AAOD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,GAAG,aAAa,CAAC;AAEjG,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,CAKzE;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,GAAG,cAAc,CAqBhG"}
package/dist/sign.js CHANGED
@@ -13,13 +13,138 @@
13
13
  */
14
14
  import { createHash, sign as cryptoSign, verify as cryptoVerify, createPrivateKey, createPublicKey, generateKeyPairSync } from 'node:crypto';
15
15
  import { readFileSync, existsSync, readdirSync, openSync, fstatSync, closeSync, constants as fsConstants } from 'node:fs';
16
- import { isAbsolute, join, relative, resolve, sep } from 'node:path';
16
+ import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
17
17
  export const MANIFEST_NAME = '.dz-manifest.json';
18
18
  export const SBOM_NAME = 'sbom.json';
19
19
  export const MANIFEST_VERSION = 1;
20
+ /**
21
+ * Files the PACKER REWRITES, so their bytes are not stable across two packs of the same unchanged
22
+ * tree — hashing them raw makes a signature that can never verify.
23
+ *
24
+ * MEASURED 2026-08-22: three consecutive `pnpm pack` runs of an unchanged `@dzhechkov/harness-core`
25
+ * (14 dependencies) produced THREE different `package.json` digests; the same three runs of
26
+ * `@dzhechkov/memory` (zero dependencies) produced one. The difference is the ORDER of dependency
27
+ * keys. So a package with dependencies could never satisfy its own signature: the signer packs once,
28
+ * the publisher packs again, and the consumer receives the second one.
29
+ *
30
+ * These files are therefore hashed in a CANONICAL form — parsed, keys sorted, stable separators.
31
+ * HONEST LIMIT: a pure reordering of keys becomes invisible to the signature. It changes nothing a
32
+ * consumer can observe, and the alternative — excusing `package.json` from signing altogether — would
33
+ * leave the dependency pins and the bin map unsigned, which is the opposite of a fix. The two
34
+ * differences that a consumer COULD observe — duplicate keys and precision-losing integers — are
35
+ * refused canonicalisation outright; see `canonicalisationIsFaithful`.
36
+ */
37
+ const CANONICALISED_PACK_FILES = new Set(['package.json']);
38
+ /** Recursive, key-sorted JSON — the same bytes for any key order the packer chooses. */
39
+ function stableJson(value) {
40
+ if (Array.isArray(value))
41
+ return '[' + value.map(stableJson).join(',') + ']';
42
+ if (value !== null && typeof value === 'object') {
43
+ const keys = Object.keys(value).sort();
44
+ return '{' + keys.map((k) => JSON.stringify(k) + ':' + stableJson(value[k])).join(',') + '}';
45
+ }
46
+ return JSON.stringify(value) ?? 'null';
47
+ }
48
+ /**
49
+ * Is this JSON text one whose PARSED value is a faithful stand-in for its BYTES?
50
+ *
51
+ * Canonical hashing deliberately ignores key order and whitespace — differences no consumer can
52
+ * observe. Two differences are NOT of that kind, and a cross-family review (codex `gpt-5.6-sol`,
53
+ * 2026-08-22) named both:
54
+ *
55
+ * - DUPLICATE KEYS. `{"bin":"evil","bin":"signed"}` parses to the signed value in every JavaScript
56
+ * parser (last wins), so it would hash as clean — while a first-wins parser in another language
57
+ * reads `evil` from the same signed bytes.
58
+ * - LOSSY INTEGERS. `9007199254740993` parses to `...992`, so two different byte strings share one
59
+ * canonical form.
60
+ *
61
+ * Neither is reachable through `pnpm pack` — this is a guard against a hand-crafted artifact, not
62
+ * against the packer. On either, the caller hashes the RAW bytes instead, so an injected duplicate
63
+ * mismatches a canonical signature and the pack reads TAMPERED.
64
+ */
65
+ function canonicalisationIsFaithful(text) {
66
+ const scopes = []; // Set = inside an object, null = inside an array
67
+ let i = 0;
68
+ while (i < text.length) {
69
+ const c = text.charAt(i);
70
+ if (c === '"') {
71
+ let j = i + 1;
72
+ while (j < text.length && text.charAt(j) !== '"')
73
+ j += text.charAt(j) === '\\' ? 2 : 1;
74
+ if (j >= text.length)
75
+ return false; // unterminated — JSON.parse will reject it anyway
76
+ let key;
77
+ try {
78
+ key = JSON.parse(text.slice(i, j + 1));
79
+ }
80
+ catch {
81
+ return false;
82
+ }
83
+ i = j + 1;
84
+ let k = i;
85
+ while (k < text.length && /\s/.test(text.charAt(k)))
86
+ k++;
87
+ const scope = scopes[scopes.length - 1];
88
+ if (text.charAt(k) === ':' && scope instanceof Set) {
89
+ if (scope.has(key))
90
+ return false;
91
+ scope.add(key);
92
+ }
93
+ continue;
94
+ }
95
+ if (c === '{') {
96
+ scopes.push(new Set());
97
+ i++;
98
+ continue;
99
+ }
100
+ if (c === '[') {
101
+ scopes.push(null);
102
+ i++;
103
+ continue;
104
+ }
105
+ if (c === '}' || c === ']') {
106
+ scopes.pop();
107
+ i++;
108
+ continue;
109
+ }
110
+ if (c === '-' || (c >= '0' && c <= '9')) {
111
+ const start = i;
112
+ while (i < text.length && /[-+0-9eE.]/.test(text.charAt(i)))
113
+ i++;
114
+ const lit = text.slice(start, i);
115
+ // Only plain integers can lose precision silently; `1.0` and `1e0` spell the same value in
116
+ // every parser, so they are legitimate canonical equivalences, not a differential.
117
+ if (/^-?\d+$/.test(lit) && String(Number(lit)) !== lit)
118
+ return false;
119
+ continue;
120
+ }
121
+ i++;
122
+ }
123
+ return true;
124
+ }
125
+ /**
126
+ * Hash the bytes of one pack file. A packer-rewritten file is hashed canonically; everything else
127
+ * byte-for-byte. Unparseable JSON falls back to the RAW bytes rather than passing — a corrupt
128
+ * `package.json` must be a mismatch, never a free pass.
129
+ */
130
+ export function hashPackBytes(relPath, bytes) {
131
+ const rel = relPath.split(sep).join('/');
132
+ if (CANONICALISED_PACK_FILES.has(rel)) {
133
+ try {
134
+ const text = bytes.toString('utf-8');
135
+ if (!canonicalisationIsFaithful(text))
136
+ throw new Error('not canonicalisable');
137
+ return createHash('sha256').update(Buffer.from(stableJson(JSON.parse(text)), 'utf-8')).digest('hex');
138
+ }
139
+ catch {
140
+ /* fall through to the raw bytes */
141
+ }
142
+ }
143
+ return createHash('sha256').update(bytes).digest('hex');
144
+ }
20
145
  /** sha256 of a file's bytes, hex. Follows symlinks — used only when building a manifest we control. */
21
- export function hashFile(absPath) {
22
- return createHash('sha256').update(readFileSync(absPath)).digest('hex');
146
+ export function hashFile(absPath, relPath) {
147
+ return hashPackBytes(relPath ?? basename(absPath), readFileSync(absPath));
23
148
  }
24
149
  /**
25
150
  * Round-2 review (codex exec): `lstat` then `readFile` is a TOCTOU window — the path can be swapped
@@ -28,13 +153,15 @@ export function hashFile(absPath) {
28
153
  *
29
154
  * Returns `null` when the path is not a regular file, or is a symlink.
30
155
  */
31
- export function hashRegularFileNoFollow(absPath) {
156
+ export function hashRegularFileNoFollow(absPath, relPath) {
32
157
  let fd;
33
158
  try {
34
159
  fd = openSync(absPath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
35
160
  if (!fstatSync(fd).isFile())
36
161
  return null;
37
- return createHash('sha256').update(readFileSync(fd)).digest('hex');
162
+ // Canonicalise the bytes ALREADY READ from this descriptor — never re-open, or the TOCTOU
163
+ // window this function exists to close would be reopened by the fix.
164
+ return hashPackBytes(relPath ?? basename(absPath), readFileSync(fd));
38
165
  }
39
166
  catch {
40
167
  return null; // ELOOP on a symlink, ENOENT, EACCES — all fail closed
@@ -173,7 +300,7 @@ export function canonicalizeSigned(manifest) {
173
300
  export function buildManifest(root, pack, files) {
174
301
  const entries = files.map((rel) => ({
175
302
  path: rel.split(sep).join('/'),
176
- sha256: hashFile(join(root, rel)),
303
+ sha256: hashFile(join(root, rel), rel),
177
304
  }));
178
305
  return { version: MANIFEST_VERSION, pack, files: entries };
179
306
  }
@@ -268,7 +395,7 @@ shippedPaths) {
268
395
  continue;
269
396
  }
270
397
  // One open, O_NOFOLLOW, fstat the descriptor, hash from it: no symlink follow, no TOCTOU window.
271
- const digest = hashRegularFileNoFollow(abs);
398
+ const digest = hashRegularFileNoFollow(abs, entry.path);
272
399
  if (digest === null) {
273
400
  failures.push({ path: entry.path, reason: 'is a symlink or not a regular file — refusing to hash it' });
274
401
  continue;
@@ -346,6 +473,12 @@ export function decidePublishGate(input) {
346
473
  if (!input.manifestPresent) {
347
474
  return { action: 'block', reason: 'trust root is present but the pack carries no signature manifest' };
348
475
  }
476
+ if (input.artifactUnavailable === true) {
477
+ return {
478
+ action: 'block',
479
+ reason: 'the artifact could not be packed, so its signature was never checked against what ships',
480
+ };
481
+ }
349
482
  if (!input.verifyOk) {
350
483
  return { action: 'block', reason: 'the pack does not match its signed manifest' };
351
484
  }
package/dist/sign.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"sign.js","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,IAAI,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC7I,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErE,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AA6BlC,uGAAuG;AACvG,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,uDAAuD;IACtE,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAC9D,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAU,+CAA+C;IACvG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,iCAAiC,CAAC;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAyC,CAAC;QACxE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;YAAE,OAAO,qCAAqC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjG,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,4CAA4C,GAAG,GAAG,CAAC;QACtH,+FAA+F;QAC/F,mGAAmG;QACnG,iGAAiG;QACjG,qEAAqE;QACrE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,iBAAiB,GAAG,GAAG,GAAG,oEAAoE,CAAC;QAC1H,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9E,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAC9C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1D,0FAA0F;YAC1F,0FAA0F;YAC1F,wFAAwF;YACxF,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5C,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAClC,oGAAoG;YACpG,sGAAsG;YACtG,uFAAuF;;gBAClF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAC9C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1D,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5C,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;iBAC7B,IAAI,CAAC,CAAC,MAAM,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA+B;IAClE,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,MAAM,MAAM,GAAG,uBAAuB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,KAAwB;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;KAClC,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1E,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,aAAqB;IACpE,oGAAoG;IACpG,oGAAoG;IACpG,yFAAyF;IACzF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAClI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC5G,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,UAAU,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,MAAyC,EACzC,SAAiB;AACjB;;;;;;;;;;;GAWG;AACH,YAAgC;IAEhC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAE3G,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACjG,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,EAAE,gCAAgC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC;IAC5E,CAAC;IAED,4FAA4F;IAC5F,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAClB,IAAI,EACJ,kBAAkB,CAAC,QAAQ,CAAC,EAC5B,eAAe,CAAC,SAAS,CAAC,EAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,iGAAiG;QACjG,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC,CAAC;YACxG,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,MAAM,OAAO,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,mGAAmG;QACnG,qCAAqC;QACrC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,8FAA8F;IAC9F,qEAAqE;IACrE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IACpE,IAAI,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,OAAO,CAAC,OAAO,CAAC;YAChB,2FAA2F,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAgBD,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,QAAkB;IAC1C,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE;QACjE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,MAAe;YACrB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,SAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SACzD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AA2BD,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;QACrG,CAAC;QACD,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,iFAAiF;SAC1F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;AAC5F,CAAC;AAuBD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAsB;IACrD,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AASD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,cAAuB;IAC9E,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,oIAAoI;SAC7I,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,cAAc;YACnB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0DAA0D,EAAE;YACxF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,cAAc;QACnB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mDAAmD,EAAE;QACjF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;AACtE,CAAC"}
1
+ {"version":3,"file":"sign.js","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,IAAI,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC7I,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AA8BlC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAEhF,wFAAwF;AACxF,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC7E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,UAAU,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC5H,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,MAAM,GAA8B,EAAE,CAAC,CAAC,iDAAiD;IAC/F,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,CAAC,kDAAkD;YACtF,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAW,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;YACD,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACV,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;gBACnD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACjC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACjC,2FAA2F;YAC3F,mFAAmF;YACnF,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YACrE,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,KAAa;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAC9E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvG,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,OAAgB;IACxD,OAAO,aAAa,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAgB;IACvE,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QACzC,0FAA0F;QAC1F,qEAAqE;QACrE,OAAO,aAAa,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,uDAAuD;IACtE,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAC9D,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAU,+CAA+C;IACvG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,iCAAiC,CAAC;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAyC,CAAC;QACxE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;YAAE,OAAO,qCAAqC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjG,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,4CAA4C,GAAG,GAAG,CAAC;QACtH,+FAA+F;QAC/F,mGAAmG;QACnG,iGAAiG;QACjG,qEAAqE;QACrE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,iBAAiB,GAAG,GAAG,GAAG,oEAAoE,CAAC;QAC1H,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9E,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAC9C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1D,0FAA0F;YAC1F,0FAA0F;YAC1F,wFAAwF;YACxF,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5C,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAClC,oGAAoG;YACpG,sGAAsG;YACtG,uFAAuF;;gBAClF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAC9C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1D,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5C,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;iBAC7B,IAAI,CAAC,CAAC,MAAM,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA+B;IAClE,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,MAAM,MAAM,GAAG,uBAAuB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,KAAwB;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC;KACvC,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1E,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,aAAqB;IACpE,oGAAoG;IACpG,oGAAoG;IACpG,yFAAyF;IACzF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAClI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC5G,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,UAAU,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,MAAyC,EACzC,SAAiB;AACjB;;;;;;;;;;;GAWG;AACH,YAAgC;IAEhC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAE3G,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACjG,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,EAAE,gCAAgC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC;IAC5E,CAAC;IAED,4FAA4F;IAC5F,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAClB,IAAI,EACJ,kBAAkB,CAAC,QAAQ,CAAC,EAC5B,eAAe,CAAC,SAAS,CAAC,EAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,iGAAiG;QACjG,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC,CAAC;YACxG,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,MAAM,OAAO,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,mGAAmG;QACnG,qCAAqC;QACrC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,8FAA8F;IAC9F,qEAAqE;IACrE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IACpE,IAAI,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,OAAO,CAAC,OAAO,CAAC;YAChB,2FAA2F,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAgBD,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,QAAkB;IAC1C,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE;QACjE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,MAAe;YACrB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,SAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SACzD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAiCD,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;QACrG,CAAC;QACD,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,iFAAiF;SAC1F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACvC,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,yFAAyF;SAClG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;AAC5F,CAAC;AAuBD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAsB;IACrD,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AASD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,cAAuB;IAC9E,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,oIAAoI;SAC7I,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,cAAc;YACnB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0DAA0D,EAAE;YACxF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,cAAc;QACnB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mDAAmD,EAAE;QACjF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;AACtE,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@dzhechkov/harness-core",
3
- "version": "0.7.0",
3
+ "version": "0.7.2",
4
4
  "description": "Shared harness logic - skill loading, additive apply, and the init/sync/verify/doctor operations.",
5
5
  "type": "module",
6
6
  "license": "MIT",
@@ -35,12 +35,12 @@
35
35
  "proper-lockfile": "^4.1.2",
36
36
  "yaml": "^2.0.0",
37
37
  "@dzhechkov/adapter-agents-md": "0.1.1",
38
- "@dzhechkov/adapter-windsurf": "0.1.1",
39
38
  "@dzhechkov/adapter-copilot": "0.1.1",
40
- "@dzhechkov/adapter-cursor": "0.1.1",
41
39
  "@dzhechkov/adapter-gemini": "0.1.1",
42
- "@dzhechkov/memory": "0.2.11",
43
- "@dzhechkov/core": "0.2.15"
40
+ "@dzhechkov/core": "0.2.15",
41
+ "@dzhechkov/adapter-cursor": "0.1.1",
42
+ "@dzhechkov/memory": "0.2.13",
43
+ "@dzhechkov/adapter-windsurf": "0.1.1"
44
44
  },
45
45
  "peerDependenciesMeta": {
46
46
  "@ruvector/rvf": {
package/sbom.json CHANGED
@@ -25,7 +25,7 @@
25
25
  "hashes": [
26
26
  {
27
27
  "alg": "SHA-256",
28
- "content": "3d0f40f8e46f15d06ed65efa568ad9f34c36c519c468db401663d8a3badbb734"
28
+ "content": "587e7d4379b3e2e05f7d91fedefec59d1f078e4172650ca602c035c52133ea30"
29
29
  }
30
30
  ]
31
31
  },
@@ -75,7 +75,7 @@
75
75
  "hashes": [
76
76
  {
77
77
  "alg": "SHA-256",
78
- "content": "894c24f39960080ec16a422915bd51b83b8143dd1eee656aa7df94f06014aedb"
78
+ "content": "afb3f3be3aac3c2f2ce0375d446b760c598f65ad1085b2c331ebd77165f58a90"
79
79
  }
80
80
  ]
81
81
  },
@@ -85,7 +85,7 @@
85
85
  "hashes": [
86
86
  {
87
87
  "alg": "SHA-256",
88
- "content": "a5294372615bd261a12dd9908825364211218dc6344673508c2b86eb4c57d61a"
88
+ "content": "58b507fd43512ce3d742da84bb90206c61853f3f7dcdc5c03426238eaee036b3"
89
89
  }
90
90
  ]
91
91
  },
@@ -95,7 +95,7 @@
95
95
  "hashes": [
96
96
  {
97
97
  "alg": "SHA-256",
98
- "content": "9e042ac64c47980d74128778b6938d656afd018929410f54ff4b898a78db6a19"
98
+ "content": "9726a655bbff1f7f2d29177de0b9d5b6d0e08b02f431c291c01b33d632440c5c"
99
99
  }
100
100
  ]
101
101
  },
@@ -105,7 +105,7 @@
105
105
  "hashes": [
106
106
  {
107
107
  "alg": "SHA-256",
108
- "content": "52a324f32f021e8554332d39069bccc6dda69df1aedaa30fb87ff334cb31ed3b"
108
+ "content": "21ef51bfa446036c57e468ede888ae1e25fd5866f44497ab9184373e569afe83"
109
109
  }
110
110
  ]
111
111
  },
@@ -1475,7 +1475,7 @@
1475
1475
  "hashes": [
1476
1476
  {
1477
1477
  "alg": "SHA-256",
1478
- "content": "38346a2da6b27e1f735278facca8a01047fe32d213b7cc1320a8103ab034c4bd"
1478
+ "content": "10bbc8872c4667339b9117e4bb61bccb7d0a9e3dee2d5590c4c776c931b93960"
1479
1479
  }
1480
1480
  ]
1481
1481
  },
@@ -1485,7 +1485,7 @@
1485
1485
  "hashes": [
1486
1486
  {
1487
1487
  "alg": "SHA-256",
1488
- "content": "df3e5197110bd8ca6ba7e3ffbb546c7278fcaa44466572089fa811bc389462b0"
1488
+ "content": "b85d145b03c231d66a67cd60ad9d99045b552aaf53c3ced9203bd36a667b5d9f"
1489
1489
  }
1490
1490
  ]
1491
1491
  },
@@ -1495,7 +1495,7 @@
1495
1495
  "hashes": [
1496
1496
  {
1497
1497
  "alg": "SHA-256",
1498
- "content": "23f0bfdb33528f8e9cfb900548ec1ede0979c06d8b23ae8525d6eb3ee419b718"
1498
+ "content": "1a00572dbe4bbdbc243c6a96313a1731d340b3c83a75560d6243adb8bafb8266"
1499
1499
  }
1500
1500
  ]
1501
1501
  },
@@ -1505,7 +1505,7 @@
1505
1505
  "hashes": [
1506
1506
  {
1507
1507
  "alg": "SHA-256",
1508
- "content": "557b925f9837365089505093766c3ac9601debfd0385830e429bcc8a6ffd774a"
1508
+ "content": "93d21258144ca202d53f6c7f7e218c5960e29449dfbaf0e5818043f2b18fb532"
1509
1509
  }
1510
1510
  ]
1511
1511
  },
@@ -3315,7 +3315,7 @@
3315
3315
  "hashes": [
3316
3316
  {
3317
3317
  "alg": "SHA-256",
3318
- "content": "4cc84ca3465412eff64d34183a6273f2116cd6f78b2d5605324642bbbbe4d5e8"
3318
+ "content": "87b934a6bebac22f37e85419dade0be6b190bac5585c6bdbbce08c63bc76578e"
3319
3319
  }
3320
3320
  ]
3321
3321
  },
@@ -3325,7 +3325,7 @@
3325
3325
  "hashes": [
3326
3326
  {
3327
3327
  "alg": "SHA-256",
3328
- "content": "27b41a47bae61783e391382ff77edee09c5a3308d280ad86a464a8e0d1876276"
3328
+ "content": "8967803dd2fad95f234abab82edae0e5d778fcdf81b64016b7e462ff584270e6"
3329
3329
  }
3330
3330
  ]
3331
3331
  },
@@ -3335,7 +3335,7 @@
3335
3335
  "hashes": [
3336
3336
  {
3337
3337
  "alg": "SHA-256",
3338
- "content": "e77b891e76d20808ac01a04a6649a9c0128e9e3cbf3c1266c248948ce924bed6"
3338
+ "content": "71ff7442f43fc4ff4da6d71bbb7376881ce536ee931b9da2ba386ab465a2b9a0"
3339
3339
  }
3340
3340
  ]
3341
3341
  },
@@ -3345,7 +3345,7 @@
3345
3345
  "hashes": [
3346
3346
  {
3347
3347
  "alg": "SHA-256",
3348
- "content": "96d5c27631cdee8882e6d5da669e0cf1f5c8a1ed8b9c20510aec512d9ccb37e9"
3348
+ "content": "6bc020803cd8c9bbc9551b6e15850feabf6c9959dacfc20ec2428c71dcc1ae2d"
3349
3349
  }
3350
3350
  ]
3351
3351
  },
@@ -3835,7 +3835,7 @@
3835
3835
  "hashes": [
3836
3836
  {
3837
3837
  "alg": "SHA-256",
3838
- "content": "77d99aef6714a8fbc0246be15425f96c4d9da95c9545de551ee069fc89eb4de2"
3838
+ "content": "15c079d1fa32d9d914323ed8a9646a6906b316ace41991ca571a3f9d639d1f9c"
3839
3839
  }
3840
3840
  ]
3841
3841
  },
@@ -3845,7 +3845,7 @@
3845
3845
  "hashes": [
3846
3846
  {
3847
3847
  "alg": "SHA-256",
3848
- "content": "d34550cb15c7b10f2fd7a8009e4517d4e466a4d54e8e81d00ca34dc32a742e7b"
3848
+ "content": "49864c93925b27de2ada2d4eea9c24d474be7f7134efc6a90545a327c9803e3e"
3849
3849
  }
3850
3850
  ]
3851
3851
  },
@@ -3855,7 +3855,7 @@
3855
3855
  "hashes": [
3856
3856
  {
3857
3857
  "alg": "SHA-256",
3858
- "content": "e45ce822673cb271d8e264f471d7ef6644ed5f689cedaf6e58d1aab3f2ebad6c"
3858
+ "content": "0117b20ba727e5d625366f6bb7318bb9e4495f0a3c23193b6ea374cbd358c460"
3859
3859
  }
3860
3860
  ]
3861
3861
  },
@@ -3865,7 +3865,7 @@
3865
3865
  "hashes": [
3866
3866
  {
3867
3867
  "alg": "SHA-256",
3868
- "content": "716f08b502d77bb2be012982c09902207e75c083706a9fa7816b1306d1c0f03b"
3868
+ "content": "5dbad708d80c7bda481cd2d7b9d3a2072fe4ea482b443c2af518d097d28ad762"
3869
3869
  }
3870
3870
  ]
3871
3871
  },
@@ -3995,7 +3995,7 @@
3995
3995
  "hashes": [
3996
3996
  {
3997
3997
  "alg": "SHA-256",
3998
- "content": "c326cf33638c879ea9bfacc8fe367137f69104f75b8149fdd816704356532115"
3998
+ "content": "52045af38109cd064cf8472418fcac0d59e54a9faa43edaddf1a3bfbc15be599"
3999
3999
  }
4000
4000
  ]
4001
4001
  },
@@ -4015,7 +4015,7 @@
4015
4015
  "hashes": [
4016
4016
  {
4017
4017
  "alg": "SHA-256",
4018
- "content": "00f09dd765aad0acd26a361fd2f4a0e1e37b1e9e181fd07c9085f0d745fbd373"
4018
+ "content": "6aacd072352e0d626690f08e8bcc6d0f8ffd0ed612b79e6a5fe7a2fb2428c483"
4019
4019
  }
4020
4020
  ]
4021
4021
  },
@@ -4365,7 +4365,7 @@
4365
4365
  "hashes": [
4366
4366
  {
4367
4367
  "alg": "SHA-256",
4368
- "content": "ed3f8254f9192f8419c1b220a500943ddc64873fc478e0b2d8ef4c0dbe3e3b8a"
4368
+ "content": "5a23957218cdeb81d86eb03615ddad487e06e6c33b0fd572217b3d084f3f911d"
4369
4369
  }
4370
4370
  ]
4371
4371
  },
@@ -4815,7 +4815,7 @@
4815
4815
  "hashes": [
4816
4816
  {
4817
4817
  "alg": "SHA-256",
4818
- "content": "e953233fe4031c58e77a047694d22b038ad1b99ec445dea4d5aa598a0e574765"
4818
+ "content": "0e9f8ffac3fe0739fcf98cd73b606f70d337088f7479d6fbf1653ea6f685bc7b"
4819
4819
  }
4820
4820
  ]
4821
4821
  },
@@ -4945,7 +4945,7 @@
4945
4945
  "hashes": [
4946
4946
  {
4947
4947
  "alg": "SHA-256",
4948
- "content": "db2d2510d5a9297ed212f117307ad15d0900005797d1ad81aee2b3802114b473"
4948
+ "content": "92f8274432847f05c6b0584542dfc4a12be89e828e34e025474f2c7c0a53c925"
4949
4949
  }
4950
4950
  ]
4951
4951
  },
package/src/sign.ts CHANGED
@@ -14,7 +14,7 @@
14
14
 
15
15
  import { createHash, sign as cryptoSign, verify as cryptoVerify, createPrivateKey, createPublicKey, generateKeyPairSync } from 'node:crypto';
16
16
  import { readFileSync, existsSync, readdirSync, openSync, fstatSync, closeSync, constants as fsConstants } from 'node:fs';
17
- import { isAbsolute, join, relative, resolve, sep } from 'node:path';
17
+ import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
18
18
 
19
19
  export const MANIFEST_NAME = '.dz-manifest.json';
20
20
  export const SBOM_NAME = 'sbom.json';
@@ -47,9 +47,117 @@ export interface VerifyResult {
47
47
  readonly failures: readonly VerifyFailure[];
48
48
  }
49
49
 
50
+
51
+ /**
52
+ * Files the PACKER REWRITES, so their bytes are not stable across two packs of the same unchanged
53
+ * tree — hashing them raw makes a signature that can never verify.
54
+ *
55
+ * MEASURED 2026-08-22: three consecutive `pnpm pack` runs of an unchanged `@dzhechkov/harness-core`
56
+ * (14 dependencies) produced THREE different `package.json` digests; the same three runs of
57
+ * `@dzhechkov/memory` (zero dependencies) produced one. The difference is the ORDER of dependency
58
+ * keys. So a package with dependencies could never satisfy its own signature: the signer packs once,
59
+ * the publisher packs again, and the consumer receives the second one.
60
+ *
61
+ * These files are therefore hashed in a CANONICAL form — parsed, keys sorted, stable separators.
62
+ * HONEST LIMIT: a pure reordering of keys becomes invisible to the signature. It changes nothing a
63
+ * consumer can observe, and the alternative — excusing `package.json` from signing altogether — would
64
+ * leave the dependency pins and the bin map unsigned, which is the opposite of a fix. The two
65
+ * differences that a consumer COULD observe — duplicate keys and precision-losing integers — are
66
+ * refused canonicalisation outright; see `canonicalisationIsFaithful`.
67
+ */
68
+ const CANONICALISED_PACK_FILES: ReadonlySet<string> = new Set(['package.json']);
69
+
70
+ /** Recursive, key-sorted JSON — the same bytes for any key order the packer chooses. */
71
+ function stableJson(value: unknown): string {
72
+ if (Array.isArray(value)) return '[' + value.map(stableJson).join(',') + ']';
73
+ if (value !== null && typeof value === 'object') {
74
+ const keys = Object.keys(value as Record<string, unknown>).sort();
75
+ return '{' + keys.map((k) => JSON.stringify(k) + ':' + stableJson((value as Record<string, unknown>)[k])).join(',') + '}';
76
+ }
77
+ return JSON.stringify(value) ?? 'null';
78
+ }
79
+
80
+ /**
81
+ * Is this JSON text one whose PARSED value is a faithful stand-in for its BYTES?
82
+ *
83
+ * Canonical hashing deliberately ignores key order and whitespace — differences no consumer can
84
+ * observe. Two differences are NOT of that kind, and a cross-family review (codex `gpt-5.6-sol`,
85
+ * 2026-08-22) named both:
86
+ *
87
+ * - DUPLICATE KEYS. `{"bin":"evil","bin":"signed"}` parses to the signed value in every JavaScript
88
+ * parser (last wins), so it would hash as clean — while a first-wins parser in another language
89
+ * reads `evil` from the same signed bytes.
90
+ * - LOSSY INTEGERS. `9007199254740993` parses to `...992`, so two different byte strings share one
91
+ * canonical form.
92
+ *
93
+ * Neither is reachable through `pnpm pack` — this is a guard against a hand-crafted artifact, not
94
+ * against the packer. On either, the caller hashes the RAW bytes instead, so an injected duplicate
95
+ * mismatches a canonical signature and the pack reads TAMPERED.
96
+ */
97
+ function canonicalisationIsFaithful(text: string): boolean {
98
+ const scopes: Array<Set<string> | null> = []; // Set = inside an object, null = inside an array
99
+ let i = 0;
100
+ while (i < text.length) {
101
+ const c = text.charAt(i);
102
+ if (c === '"') {
103
+ let j = i + 1;
104
+ while (j < text.length && text.charAt(j) !== '"') j += text.charAt(j) === '\\' ? 2 : 1;
105
+ if (j >= text.length) return false; // unterminated — JSON.parse will reject it anyway
106
+ let key: string;
107
+ try {
108
+ key = JSON.parse(text.slice(i, j + 1)) as string;
109
+ } catch {
110
+ return false;
111
+ }
112
+ i = j + 1;
113
+ let k = i;
114
+ while (k < text.length && /\s/.test(text.charAt(k))) k++;
115
+ const scope = scopes[scopes.length - 1];
116
+ if (text.charAt(k) === ':' && scope instanceof Set) {
117
+ if (scope.has(key)) return false;
118
+ scope.add(key);
119
+ }
120
+ continue;
121
+ }
122
+ if (c === '{') { scopes.push(new Set()); i++; continue; }
123
+ if (c === '[') { scopes.push(null); i++; continue; }
124
+ if (c === '}' || c === ']') { scopes.pop(); i++; continue; }
125
+ if (c === '-' || (c >= '0' && c <= '9')) {
126
+ const start = i;
127
+ while (i < text.length && /[-+0-9eE.]/.test(text.charAt(i))) i++;
128
+ const lit = text.slice(start, i);
129
+ // Only plain integers can lose precision silently; `1.0` and `1e0` spell the same value in
130
+ // every parser, so they are legitimate canonical equivalences, not a differential.
131
+ if (/^-?\d+$/.test(lit) && String(Number(lit)) !== lit) return false;
132
+ continue;
133
+ }
134
+ i++;
135
+ }
136
+ return true;
137
+ }
138
+
139
+ /**
140
+ * Hash the bytes of one pack file. A packer-rewritten file is hashed canonically; everything else
141
+ * byte-for-byte. Unparseable JSON falls back to the RAW bytes rather than passing — a corrupt
142
+ * `package.json` must be a mismatch, never a free pass.
143
+ */
144
+ export function hashPackBytes(relPath: string, bytes: Buffer): string {
145
+ const rel = relPath.split(sep).join('/');
146
+ if (CANONICALISED_PACK_FILES.has(rel)) {
147
+ try {
148
+ const text = bytes.toString('utf-8');
149
+ if (!canonicalisationIsFaithful(text)) throw new Error('not canonicalisable');
150
+ return createHash('sha256').update(Buffer.from(stableJson(JSON.parse(text)), 'utf-8')).digest('hex');
151
+ } catch {
152
+ /* fall through to the raw bytes */
153
+ }
154
+ }
155
+ return createHash('sha256').update(bytes).digest('hex');
156
+ }
157
+
50
158
  /** sha256 of a file's bytes, hex. Follows symlinks — used only when building a manifest we control. */
51
- export function hashFile(absPath: string): string {
52
- return createHash('sha256').update(readFileSync(absPath)).digest('hex');
159
+ export function hashFile(absPath: string, relPath?: string): string {
160
+ return hashPackBytes(relPath ?? basename(absPath), readFileSync(absPath));
53
161
  }
54
162
 
55
163
  /**
@@ -59,12 +167,14 @@ export function hashFile(absPath: string): string {
59
167
  *
60
168
  * Returns `null` when the path is not a regular file, or is a symlink.
61
169
  */
62
- export function hashRegularFileNoFollow(absPath: string): string | null {
170
+ export function hashRegularFileNoFollow(absPath: string, relPath?: string): string | null {
63
171
  let fd: number | undefined;
64
172
  try {
65
173
  fd = openSync(absPath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
66
174
  if (!fstatSync(fd).isFile()) return null;
67
- return createHash('sha256').update(readFileSync(fd)).digest('hex');
175
+ // Canonicalise the bytes ALREADY READ from this descriptor — never re-open, or the TOCTOU
176
+ // window this function exists to close would be reopened by the fix.
177
+ return hashPackBytes(relPath ?? basename(absPath), readFileSync(fd));
68
178
  } catch {
69
179
  return null; // ELOOP on a symlink, ENOENT, EACCES — all fail closed
70
180
  } finally {
@@ -192,7 +302,7 @@ export function canonicalizeSigned(manifest: Manifest): Buffer {
192
302
  export function buildManifest(root: string, pack: string, files: readonly string[]): Manifest {
193
303
  const entries = files.map((rel) => ({
194
304
  path: rel.split(sep).join('/'),
195
- sha256: hashFile(join(root, rel)),
305
+ sha256: hashFile(join(root, rel), rel),
196
306
  }));
197
307
  return { version: MANIFEST_VERSION, pack, files: entries };
198
308
  }
@@ -302,7 +412,7 @@ export function verifyManifest(
302
412
  continue;
303
413
  }
304
414
  // One open, O_NOFOLLOW, fstat the descriptor, hash from it: no symlink follow, no TOCTOU window.
305
- const digest = hashRegularFileNoFollow(abs);
415
+ const digest = hashRegularFileNoFollow(abs, entry.path);
306
416
  if (digest === null) {
307
417
  failures.push({ path: entry.path, reason: 'is a symlink or not a regular file — refusing to hash it' });
308
418
  continue;
@@ -401,6 +511,12 @@ export interface PublishGateInput {
401
511
  readonly manifestPresent: boolean;
402
512
  readonly verifyOk: boolean;
403
513
  readonly requireSigning: boolean;
514
+ /**
515
+ * The artifact could not be produced (the packer failed), so nothing was compared against the
516
+ * signature. Distinct from `verifyOk: false`, which means a comparison RAN and disagreed — the
517
+ * gate blocks either way, but only an honest reason tells the operator which one to fix.
518
+ */
519
+ readonly artifactUnavailable?: boolean;
404
520
  }
405
521
 
406
522
  export interface PublishGateDecision {
@@ -421,6 +537,12 @@ export function decidePublishGate(input: PublishGateInput): PublishGateDecision
421
537
  if (!input.manifestPresent) {
422
538
  return { action: 'block', reason: 'trust root is present but the pack carries no signature manifest' };
423
539
  }
540
+ if (input.artifactUnavailable === true) {
541
+ return {
542
+ action: 'block',
543
+ reason: 'the artifact could not be packed, so its signature was never checked against what ships',
544
+ };
545
+ }
424
546
  if (!input.verifyOk) {
425
547
  return { action: 'block', reason: 'the pack does not match its signed manifest' };
426
548
  }