@hardkas/artifacts 0.8.3-alpha → 0.8.5-alpha

package/dist/index.d.ts

@@ -843,6 +843,7 @@ declare const TxPlanSchema: z.ZodObject<{
     rpcUrl: z.ZodOptional<z.ZodString>;
     networkProfileRef: z.ZodOptional<z.ZodString>;
     policyRef: z.ZodOptional<z.ZodString>;
+    policyRefs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     assumptionRef: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     version: "1.0.0-alpha";
@@ -905,6 +906,7 @@ declare const TxPlanSchema: z.ZodObject<{
     rpcUrl?: string | undefined;
     networkProfileRef?: string | undefined;
     policyRef?: string | undefined;
+    policyRefs?: string[] | undefined;
     assumptionRef?: string | undefined;
 }, {
     version: "1.0.0-alpha";
@@ -967,6 +969,7 @@ declare const TxPlanSchema: z.ZodObject<{
     rpcUrl?: string | undefined;
     networkProfileRef?: string | undefined;
     policyRef?: string | undefined;
+    policyRefs?: string[] | undefined;
     assumptionRef?: string | undefined;
 }>;
 declare const DagContextSchema: z.ZodObject<{
@@ -2670,6 +2673,7 @@ interface TxPlanArtifact extends BaseArtifact<"txPlan"> {
     } | undefined;
     networkProfileRef?: string | undefined;
     policyRef?: string | undefined;
+    policyRefs?: string[] | undefined;
     assumptionRef?: string | undefined;
 }
 interface SignedTxArtifact extends BaseArtifact<"signedTx"> {
@@ -2894,6 +2898,9 @@ interface VerificationContext {
     strict?: boolean;
     networkId?: NetworkId;
     parent?: unknown;
+    artifactsDir?: string;
+    enforceMetadata?: boolean;
+    resolveArtifact?: (id: string) => any;
 }
 type VerificationSeverity = CorruptionSeverity | "info" | "critical";
 type VerificationIssue = {
@@ -2918,7 +2925,12 @@ type ArtifactVerificationResult = {
  */
 declare function sortUtxosByOutpoint<T>(utxos: T[]): T[];
 /**
- * Verifies an artifact's integrity.
+ * Verifies an artifact's integrity synchronously.
+ * Can take a raw object or a file path.
+ */
+declare function verifyArtifactIntegritySync(artifactOrPath: unknown): ArtifactVerificationResult;
+/**
+ * Verifies an artifact's integrity asynchronously.
  * Can take a raw object or a file path.
  */
 declare function verifyArtifactIntegrity(artifactOrPath: unknown): Promise<ArtifactVerificationResult>;
@@ -3413,4 +3425,4 @@ declare function listDeployments(rootDir: string, networkId?: string): Promise<D
 declare function updateDeployment(rootDir: string, networkId: string, label: string, update: Partial<DeploymentRecord>): Promise<DeploymentRecord>;
 declare function deleteDeployment(rootDir: string, networkId: string, label: string): Promise<boolean>;
 
-export { ARTIFACT_SCHEMAS, ARTIFACT_VERSION, AccountRefSchema, type ArtifactDiff, type ArtifactExplanation, ArtifactLineageSchema, type ArtifactLookup, type ArtifactPayload, type ArtifactValidationResult, type ArtifactVerificationResult, type Assumption, type AssumptionArtifact, type AssumptionLevel, AssumptionSchema, type BaseArtifact, BaseArtifactSchema, BasicCorrelationInvariant, BasicLineageInvariant, CURRENT_HASH_VERSION, type Clock, type CreateTxPlanArtifactOptions, type DagContext, DagContextSchema, type DeploymentIndex, type DeploymentRecord, type DeploymentSummary, type DiffEntry, type DraftArtifact, type FeeAuditResult, HARDKAS_VERSION, type HardkasArtifactBase, type HardkasArtifactMode, type HardkasArtifactSchema, HashInvariant, type IgraSignedTxArtifact, type IgraTxPlanArtifact, type IgraTxReceiptArtifact, type IgraTxRequestArtifact, type Invariant, type InvariantContext, type InvariantViolation, InvariantWatcher, LifecycleInvariant, type LineageOptions, type LineageValidationResult, LocalnetUtxoSchemaV2, type MigrationReceipt, type MigrationReceiptArtifact, MigrationReceiptSchema, MigrationRequiredError, type MigrationResult, type MigrationStep, NetworkInvariant, type NetworkProfile, type NetworkProfileArtifact, NetworkProfileSchema, type Policy, type PolicyArtifact, PolicySchema, ReplayInvariant, type RuntimeSession, RuntimeSessionSchema, SEMANTIC_EXCLUSIONS, STRICT_PATH_KEYS, SchemaInvariant, type ScriptCapability, ScriptCapabilitySchema, ScriptMetadataSchema, SignatureEntrySchema, SignatureMetadataEntrySchema, type SignedTx, type SignedTxArtifact, type SignedTxArtifactV1, SignedTxSchema, type Snapshot, type SnapshotArtifact, SnapshotSchema, type TxOutputArtifact, type TxPlan, type TxPlanArtifact, type TxPlanArtifactV1, TxPlanSchema, type TxReceipt, type TxReceiptArtifact, type TxReceiptArtifactV1, TxReceiptSchema, type TxTrace, type TxTraceArtifact, type TxTraceArtifactV1, TxTraceSchema, type UtxoArtifact, type VerificationContext, type VerificationIssue, type VerificationSeverity, type WatcherOptions, type Workflow, type WorkflowArtifact, WorkflowSchema, assertDecimalBigIntString, assertEvmAddress, assertEvmTxHash, assertHexData, assertValidIgraSignedTxArtifact, assertValidIgraTxPlanArtifact, assertValidIgraTxReceiptArtifact, assertValidSignedTxArtifact, assertValidTxPlanArtifact, assertValidTxReceiptArtifact, bigIntReplacer, calculateContentHash, canMigrate, canonicalStringify, createDeploymentRecord, createIgraDeployPlanId, createIgraPlanId, createIgraSignedId, createSimulatedSignedTxArtifact, createSimulatedTxReceipt, createTxPlanArtifact, defaultClock, deleteDeployment, detectArtifactVersion, diffArtifacts, explainArtifact, formatSignedTxArtifact, formatTxPlanArtifact, formatTxReceiptArtifact, generateMigrationReceipt, getBroadcastableSignedTransaction, getDefaultL2ReceiptsDir, getDefaultReceiptPath, getL2ReceiptPath, getMigrationPath, getRegisteredMigrationSteps, isIgraTxPlanArtifact, listDeployments, listIgraTxReceiptArtifacts, loadDeployment, loadIgraTxReceiptArtifact, migrateArtifactPayload, migrateToCanonical, readArtifact, readSignedTxArtifact, readTxPlanArtifact, readTxReceiptArtifact, recomputeMass, registerMigrationStep, saveDeployment, saveIgraTxReceiptArtifact, sortUtxosByOutpoint, txOutputFromArtifact, txOutputToArtifact, updateDeployment, updateDeploymentStatus, utxoFromArtifact, utxoToArtifact, validateArtifact, validateIgraSignedTxArtifact, validateIgraTxPlanArtifact, validateIgraTxReceiptArtifact, validateSignedTxArtifact, validateTxPlanArtifact, validateTxReceiptArtifact, verifyArtifact, verifyArtifactFile, verifyArtifactIntegrity, verifyArtifactReplay, verifyArtifactSemantics, verifyFeeSemantics, verifyLineage, writeArtifact };
+export { ARTIFACT_SCHEMAS, ARTIFACT_VERSION, AccountRefSchema, type ArtifactDiff, type ArtifactExplanation, ArtifactLineageSchema, type ArtifactLookup, type ArtifactPayload, type ArtifactValidationResult, type ArtifactVerificationResult, type Assumption, type AssumptionArtifact, type AssumptionLevel, AssumptionSchema, type BaseArtifact, BaseArtifactSchema, BasicCorrelationInvariant, BasicLineageInvariant, CURRENT_HASH_VERSION, type Clock, type CreateTxPlanArtifactOptions, type DagContext, DagContextSchema, type DeploymentIndex, type DeploymentRecord, type DeploymentSummary, type DiffEntry, type DraftArtifact, type FeeAuditResult, HARDKAS_VERSION, type HardkasArtifactBase, type HardkasArtifactMode, type HardkasArtifactSchema, HashInvariant, type IgraSignedTxArtifact, type IgraTxPlanArtifact, type IgraTxReceiptArtifact, type IgraTxRequestArtifact, type Invariant, type InvariantContext, type InvariantViolation, InvariantWatcher, LifecycleInvariant, type LineageOptions, type LineageValidationResult, LocalnetUtxoSchemaV2, type MigrationReceipt, type MigrationReceiptArtifact, MigrationReceiptSchema, MigrationRequiredError, type MigrationResult, type MigrationStep, NetworkInvariant, type NetworkProfile, type NetworkProfileArtifact, NetworkProfileSchema, type Policy, type PolicyArtifact, PolicySchema, ReplayInvariant, type RuntimeSession, RuntimeSessionSchema, SEMANTIC_EXCLUSIONS, STRICT_PATH_KEYS, SchemaInvariant, type ScriptCapability, ScriptCapabilitySchema, ScriptMetadataSchema, SignatureEntrySchema, SignatureMetadataEntrySchema, type SignedTx, type SignedTxArtifact, type SignedTxArtifactV1, SignedTxSchema, type Snapshot, type SnapshotArtifact, SnapshotSchema, type TxOutputArtifact, type TxPlan, type TxPlanArtifact, type TxPlanArtifactV1, TxPlanSchema, type TxReceipt, type TxReceiptArtifact, type TxReceiptArtifactV1, TxReceiptSchema, type TxTrace, type TxTraceArtifact, type TxTraceArtifactV1, TxTraceSchema, type UtxoArtifact, type VerificationContext, type VerificationIssue, type VerificationSeverity, type WatcherOptions, type Workflow, type WorkflowArtifact, WorkflowSchema, assertDecimalBigIntString, assertEvmAddress, assertEvmTxHash, assertHexData, assertValidIgraSignedTxArtifact, assertValidIgraTxPlanArtifact, assertValidIgraTxReceiptArtifact, assertValidSignedTxArtifact, assertValidTxPlanArtifact, assertValidTxReceiptArtifact, bigIntReplacer, calculateContentHash, canMigrate, canonicalStringify, createDeploymentRecord, createIgraDeployPlanId, createIgraPlanId, createIgraSignedId, createSimulatedSignedTxArtifact, createSimulatedTxReceipt, createTxPlanArtifact, defaultClock, deleteDeployment, detectArtifactVersion, diffArtifacts, explainArtifact, formatSignedTxArtifact, formatTxPlanArtifact, formatTxReceiptArtifact, generateMigrationReceipt, getBroadcastableSignedTransaction, getDefaultL2ReceiptsDir, getDefaultReceiptPath, getL2ReceiptPath, getMigrationPath, getRegisteredMigrationSteps, isIgraTxPlanArtifact, listDeployments, listIgraTxReceiptArtifacts, loadDeployment, loadIgraTxReceiptArtifact, migrateArtifactPayload, migrateToCanonical, readArtifact, readSignedTxArtifact, readTxPlanArtifact, readTxReceiptArtifact, recomputeMass, registerMigrationStep, saveDeployment, saveIgraTxReceiptArtifact, sortUtxosByOutpoint, txOutputFromArtifact, txOutputToArtifact, updateDeployment, updateDeploymentStatus, utxoFromArtifact, utxoToArtifact, validateArtifact, validateIgraSignedTxArtifact, validateIgraTxPlanArtifact, validateIgraTxReceiptArtifact, validateSignedTxArtifact, validateTxPlanArtifact, validateTxReceiptArtifact, verifyArtifact, verifyArtifactFile, verifyArtifactIntegrity, verifyArtifactIntegritySync, verifyArtifactReplay, verifyArtifactSemantics, verifyFeeSemantics, verifyLineage, writeArtifact };

package/dist/index.js

@@ -1,7 +1,7 @@
 // package.json
 var package_default = {
   name: "@hardkas/artifacts",
-  version: "0.8.3-alpha",
+  version: "0.8.5-alpha",
   type: "module",
   license: "MIT",
   author: "Javier Rodriguez",
@@ -20,7 +20,11 @@ var package_default = {
     "LICENSE"
   ],
   exports: {
-    ".": "./dist/index.js"
+    ".": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js",
+      default: "./dist/index.js"
+    }
   },
   types: "./dist/index.d.ts",
   scripts: {
@@ -38,7 +42,8 @@ var package_default = {
     tsup: "^8.3.5",
     typescript: "^5.6.3",
     vitest: "^2.1.4"
-  }
+  },
+  main: "./dist/index.js"
 };
 
 // src/constants.ts
@@ -416,6 +421,7 @@ var TxPlanSchema = BaseArtifactSchema.extend({
   rpcUrl: z.string().optional(),
   networkProfileRef: z.string().optional(),
   policyRef: z.string().optional(),
+  policyRefs: z.array(z.string()).optional(),
   assumptionRef: z.string().optional()
 });
 var DagContextSchema = z.object({
@@ -581,6 +587,7 @@ var RuntimeSessionSchema = BaseArtifactSchema.extend({
 
 // src/verify.ts
 import fs from "fs";
+import path from "path";
 
 // src/feeVerify.ts
 import {
@@ -815,15 +822,15 @@ function sortUtxosByOutpoint(utxos) {
     return deterministicCompare2(aId, bId);
   });
 }
-async function verifyArtifactIntegrity(artifactOrPath) {
+function verifyArtifactIntegritySync(artifactOrPath) {
   const result = {
     ok: false,
     errors: [],
     issues: []
   };
-  const addError = (code, message, path4) => {
+  const addError = (code, message, path5) => {
     result.errors.push(message);
-    result.issues.push({ code, severity: "error", message, path: path4 });
+    result.issues.push({ code, severity: "error", message, path: path5 });
   };
   let artifact;
   try {
@@ -937,6 +944,37 @@ async function verifyArtifactIntegrity(artifactOrPath) {
     return result;
   }
 }
+async function verifyArtifactIntegrity(artifactOrPath) {
+  return verifyArtifactIntegritySync(artifactOrPath);
+}
+function findFileByHash(hash, dirs) {
+  const shortHash = hash.startsWith("plan-") || hash.startsWith("signed-") ? hash : hash.slice(0, 16);
+  for (const dir of dirs) {
+    if (!fs.existsSync(dir)) continue;
+    try {
+      const files = fs.readdirSync(dir);
+      if (files.includes(`${hash}.json`)) {
+        return path.join(dir, `${hash}.json`);
+      }
+      for (const file of files) {
+        if (!file.endsWith(".json")) continue;
+        if (file.includes(hash) || file.includes(shortHash) || file.includes(hash.slice(0, 8))) {
+          const filePath = path.join(dir, file);
+          try {
+            const content = fs.readFileSync(filePath, "utf-8");
+            const obj = JSON.parse(content);
+            if (obj.contentHash === hash || obj.artifactId === hash || obj.planId === hash || obj.signedId === hash || obj.txId === hash) {
+              return filePath;
+            }
+          } catch {
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  return null;
+}
 function verifyArtifactSemantics(artifact, context = {}) {
   const result = {
     ok: true,
@@ -962,6 +1000,225 @@ function verifyArtifactSemantics(artifact, context = {}) {
     });
   }
   const v = artifact;
+  let parentObj = null;
+  if (strict) {
+    const searchDirs = [];
+    if (context.artifactsDir) {
+      searchDirs.push(context.artifactsDir);
+    }
+    searchDirs.push(path.join(process.cwd(), ".hardkas", "artifacts"));
+    searchDirs.push(path.join(process.cwd(), "artifacts"));
+    const policyRefs = [];
+    if (Array.isArray(v.policyRefs)) {
+      policyRefs.push(...v.policyRefs);
+    } else if (typeof v.policyRef === "string") {
+      policyRefs.push(v.policyRef);
+    }
+    for (const ref of policyRefs) {
+      let refObj = context.resolveArtifact ? context.resolveArtifact(ref) : null;
+      if (!refObj) {
+        const refFile = findFileByHash(ref, searchDirs);
+        if (refFile) {
+          try {
+            const content = fs.readFileSync(refFile, "utf-8");
+            refObj = JSON.parse(content);
+          } catch (e) {
+            addIssue({
+              code: "REFERENCE_CORRUPT",
+              severity: "error",
+              message: `Failed to read policy ${ref}: ${e.message}`
+            });
+          }
+        }
+      }
+      if (!refObj) {
+        addIssue({
+          code: "REFERENCE_MISSING",
+          severity: "error",
+          message: `Referenced policy artifact ${ref} not found in workspace`
+        });
+      } else {
+        try {
+          const integrity = verifyArtifactIntegritySync(refObj);
+          if (!integrity.ok) {
+            addIssue({
+              code: "REFERENCE_HASH_MISMATCH",
+              severity: "error",
+              message: `Referenced policy ${ref} integrity check failed: ${integrity.errors.join(", ")}`
+            });
+          } else if (refObj.contentHash !== ref && refObj.artifactId !== ref) {
+            addIssue({
+              code: "REFERENCE_HASH_MISMATCH",
+              severity: "error",
+              message: `Policy reference mismatch: expected ${ref}, got ${refObj.contentHash}`
+            });
+          } else {
+            if (refObj.schema === "hardkas.policy.v1") {
+              if (refObj.decision === "DENY") {
+                addIssue({
+                  code: "POLICY_VIOLATION",
+                  severity: "error",
+                  message: `Policy evaluation rejected: decision is DENY`
+                });
+              } else if (refObj.decision !== "ALLOW") {
+                addIssue({
+                  code: "POLICY_VIOLATION",
+                  severity: "error",
+                  message: `Policy evaluation rejected: decision is invalid (${refObj.decision})`
+                });
+              }
+              const failedRules = refObj.rules?.filter((r) => r.result === "FAIL") || [];
+              if (failedRules.length > 0) {
+                addIssue({
+                  code: "POLICY_VIOLATION",
+                  severity: "error",
+                  message: `Policy rules failed: ${failedRules.map((r) => r.id).join(", ")}`
+                });
+              }
+            }
+          }
+        } catch (e) {
+          addIssue({
+            code: "REFERENCE_CORRUPT",
+            severity: "error",
+            message: `Failed to read/verify policy ${ref}: ${e.message}`
+          });
+        }
+      }
+    }
+    if (typeof v.networkProfileRef === "string") {
+      const ref = v.networkProfileRef;
+      let refObj = context.resolveArtifact ? context.resolveArtifact(ref) : null;
+      if (!refObj) {
+        const refFile = findFileByHash(ref, searchDirs);
+        if (refFile) {
+          try {
+            refObj = JSON.parse(fs.readFileSync(refFile, "utf-8"));
+          } catch {
+          }
+        }
+      }
+      if (!refObj) {
+        addIssue({
+          code: "REFERENCE_MISSING",
+          severity: "error",
+          message: `Referenced network profile ${ref} not found in workspace`
+        });
+      } else {
+        try {
+          const integrity = verifyArtifactIntegritySync(refObj);
+          if (!integrity.ok) {
+            addIssue({
+              code: "REFERENCE_HASH_MISMATCH",
+              severity: "error",
+              message: `Referenced profile ${ref} integrity check failed`
+            });
+          } else if (refObj.contentHash !== ref && refObj.artifactId !== ref) {
+            addIssue({
+              code: "REFERENCE_HASH_MISMATCH",
+              severity: "error",
+              message: `Profile reference mismatch: expected ${ref}, got ${refObj.contentHash}`
+            });
+          }
+        } catch (e) {
+          addIssue({
+            code: "REFERENCE_CORRUPT",
+            severity: "error",
+            message: `Failed to verify profile ${ref}`
+          });
+        }
+      }
+    }
+    if (typeof v.assumptionRef === "string") {
+      const ref = v.assumptionRef;
+      let refObj = context.resolveArtifact ? context.resolveArtifact(ref) : null;
+      if (!refObj) {
+        const refFile = findFileByHash(ref, searchDirs);
+        if (refFile) {
+          try {
+            refObj = JSON.parse(fs.readFileSync(refFile, "utf-8"));
+          } catch {
+          }
+        }
+      }
+      if (!refObj) {
+        addIssue({
+          code: "REFERENCE_MISSING",
+          severity: "error",
+          message: `Referenced assumption ${ref} not found in workspace`
+        });
+      } else {
+        try {
+          const integrity = verifyArtifactIntegritySync(refObj);
+          if (!integrity.ok) {
+            addIssue({
+              code: "REFERENCE_HASH_MISMATCH",
+              severity: "error",
+              message: `Referenced assumption ${ref} integrity check failed`
+            });
+          } else if (refObj.contentHash !== ref && refObj.artifactId !== ref) {
+            addIssue({
+              code: "REFERENCE_HASH_MISMATCH",
+              severity: "error",
+              message: `Assumption reference mismatch: expected ${ref}, got ${refObj.contentHash}`
+            });
+          }
+        } catch (e) {
+          addIssue({
+            code: "REFERENCE_CORRUPT",
+            severity: "error",
+            message: `Failed to verify assumption ${ref}`
+          });
+        }
+      }
+    }
+    let parentId;
+    const lineage = v.lineage;
+    if (lineage?.parentArtifactId && lineage?.parentArtifactId !== lineage?.artifactId) {
+      parentId = lineage?.parentArtifactId;
+    } else if (v.schema === "hardkas.signedTx") {
+      parentId = v.sourcePlanId;
+    } else if (v.schema === "hardkas.txReceipt") {
+      parentId = v.sourceSignedId || lineage?.parentArtifactId;
+    }
+    if (parentId) {
+      parentObj = context.resolveArtifact ? context.resolveArtifact(parentId) : null;
+      if (!parentObj) {
+        const parentFile = findFileByHash(parentId, searchDirs);
+        if (parentFile) {
+          try {
+            parentObj = JSON.parse(fs.readFileSync(parentFile, "utf-8"));
+          } catch (e) {
+            addIssue({
+              code: "PARENT_CORRUPT",
+              severity: "error",
+              message: `Failed to read parent ${parentId}: ${e.message}`
+            });
+          }
+        }
+      }
+      if (!parentObj) {
+        addIssue({
+          code: "PARENT_MISSING",
+          severity: "warning",
+          message: `Parent artifact ${parentId} not found in workspace`
+        });
+      } else {
+        try {
+          const parentSem = verifyArtifactSemantics(parentObj, { ...context, strict: true });
+          if (!parentSem.ok) {
+            parentSem.issues.forEach((issue) => addIssue(issue));
+          }
+        } catch (e) {
+          addIssue({
+            code: "PARENT_CORRUPT",
+            severity: "error",
+            message: `Failed to verify parent ${parentId}: ${e.message}`
+          });
+        }
+      }
+    }
+  }
   if (v.createdAt && typeof v.createdAt === "string") {
     const created = new Date(v.createdAt).getTime();
     const now = clock.now();
@@ -980,31 +1237,47 @@ function verifyArtifactSemantics(artifact, context = {}) {
       });
     }
   }
-  const lineageAudit = verifyLineage(v, context.parent, { strict });
+  const lineageAudit = verifyLineage(v, parentObj || context.parent, { strict });
   if (!lineageAudit.ok || strict && !v.lineage && v.schema !== "hardkas.workflow.v1") {
     lineageAudit.issues.forEach((issue) => {
       addIssue(issue);
     });
   }
   if (strict) {
-    if (!v.workflowId)
-      addIssue({
-        code: "MISSING_WORKFLOW_ID",
-        severity: "error",
-        message: "Strict mode requires workflowId"
-      });
-    if (!v.assumptionLevel && v.schema !== "hardkas.workflow.v1")
-      addIssue({
-        code: "MISSING_ASSUMPTION_LEVEL",
-        severity: "error",
-        message: "Strict mode requires assumptionLevel"
-      });
-    if (!v.executionMode && !v.mode)
-      addIssue({
-        code: "MISSING_EXECUTION_MODE",
-        severity: "error",
-        message: "Strict mode requires executionMode"
-      });
+    const enforceMetadata = context.enforceMetadata ?? true;
+    if (enforceMetadata) {
+      if (!v.workflowId)
+        addIssue({
+          code: "MISSING_WORKFLOW_ID",
+          severity: "error",
+          message: "Strict mode requires workflowId"
+        });
+      if (!v.assumptionLevel && v.schema !== "hardkas.workflow.v1")
+        addIssue({
+          code: "MISSING_ASSUMPTION_LEVEL",
+          severity: "error",
+          message: "Strict mode requires assumptionLevel"
+        });
+      if (!v.executionMode && !v.mode)
+        addIssue({
+          code: "MISSING_EXECUTION_MODE",
+          severity: "error",
+          message: "Strict mode requires executionMode"
+        });
+    } else {
+      if (!v.workflowId)
+        addIssue({
+          code: "MISSING_WORKFLOW_ID",
+          severity: "warning",
+          message: "Missing workflowId"
+        });
+      if (!v.assumptionLevel && v.schema !== "hardkas.workflow.v1")
+        addIssue({
+          code: "MISSING_ASSUMPTION_LEVEL",
+          severity: "warning",
+          message: "Missing assumptionLevel"
+        });
+    }
   } else {
     if (!v.workflowId)
       addIssue({
@@ -1375,8 +1648,8 @@ function canMigrate(artifact, targetVersion = ARTIFACT_VERSION) {
   if (currentVersion === targetVersion) {
     return true;
   }
-  const path4 = getMigrationPath(currentVersion, targetVersion);
-  return path4.length > 0;
+  const path5 = getMigrationPath(currentVersion, targetVersion);
+  return path5.length > 0;
 }
 function migrateArtifactPayload(artifact, targetVersion = ARTIFACT_VERSION, options) {
   const currentVersion = detectArtifactVersion(artifact);
@@ -1391,8 +1664,8 @@ function migrateArtifactPayload(artifact, targetVersion = ARTIFACT_VERSION, opti
   if (options?.strictPolicy) {
     throw new MigrationRequiredError(currentVersion, targetVersion);
   }
-  const path4 = getMigrationPath(currentVersion, targetVersion);
-  if (path4.length === 0) {
+  const path5 = getMigrationPath(currentVersion, targetVersion);
+  if (path5.length === 0) {
     throw new Error(
       `No migration path from version "${currentVersion}" to "${targetVersion}". Registered steps: [${migrationRegistry.map((s) => `${s.fromVersion}\u2192${s.toVersion}`).join(", ")}]`
     );
@@ -1401,7 +1674,7 @@ function migrateArtifactPayload(artifact, targetVersion = ARTIFACT_VERSION, opti
   const originalLineage = artifact.lineage;
   let current = { ...artifact };
   const appliedSteps = [];
-  for (const step of path4) {
+  for (const step of path5) {
     current = step.transform(current);
     appliedSteps.push({
       fromVersion: step.fromVersion,
@@ -1478,7 +1751,7 @@ function generateMigrationReceipt(oldArtifact, newArtifact, migrationId) {
 
 // src/io.ts
 import fs2 from "fs/promises";
-import path from "path";
+import path2 from "path";
 import { writeFileAtomic } from "@hardkas/core";
 var bigIntReplacer = (_key, value) => typeof value === "bigint" ? value.toString() : value;
 async function writeArtifact(filePath, artifact) {
@@ -1489,10 +1762,10 @@ async function writeArtifact(filePath, artifact) {
       const artifactObj = typeof artifact === "string" ? JSON.parse(artifact) : artifact;
       const id = artifactObj.planId || artifactObj.signedId || artifactObj.txId || Date.now().toString(36);
       const prefix = artifactObj.schema ? artifactObj.schema.split(".")[1] || "artifact" : "artifact";
-      targetPath = path.join(filePath, `${prefix}-${id}.json`);
+      targetPath = path2.join(filePath, `${prefix}-${id}.json`);
       console.log(
         `
-Note: Provided path is a directory. Auto-generating artifact filename: ${path.basename(targetPath)}`
+Note: Provided path is a directory. Auto-generating artifact filename: ${path2.basename(targetPath)}`
       );
     }
   } catch (e) {
@@ -1500,14 +1773,14 @@ Note: Provided path is a directory. Auto-generating artifact filename: ${path.ba
       const artifactObj = typeof artifact === "string" ? JSON.parse(artifact) : artifact;
       const id = artifactObj.planId || artifactObj.signedId || artifactObj.txId || Date.now().toString(36);
       const prefix = artifactObj.schema ? artifactObj.schema.split(".")[1] || "artifact" : "artifact";
-      targetPath = path.join(filePath, `${prefix}-${id}.json`);
+      targetPath = path2.join(filePath, `${prefix}-${id}.json`);
     }
   }
   const content = typeof artifact === "string" ? artifact : JSON.stringify(artifact, bigIntReplacer, 2) + "\n";
   await writeFileAtomic(targetPath, content);
 }
 function getDefaultReceiptPath(txId, cwd = process.cwd()) {
-  return path.join(cwd, "artifacts", "receipts", `${txId}.json`);
+  return path2.join(cwd, "artifacts", "receipts", `${txId}.json`);
 }
 async function readArtifact(filePath) {
   try {
@@ -2040,15 +2313,15 @@ async function explainArtifact(artifactUnknown) {
 
 // src/igra-io.ts
 import fs3 from "fs/promises";
-import path2 from "path";
+import path3 from "path";
 import { deterministicCompare as deterministicCompare3 } from "@hardkas/core";
 function getDefaultL2ReceiptsDir(cwd = process.cwd()) {
-  return path2.join(cwd, ".hardkas", "l2-receipts");
+  return path3.join(cwd, ".hardkas", "l2-receipts");
 }
 function getL2ReceiptPath(txHash, options) {
   validateTxHash(txHash);
   const dir = getDefaultL2ReceiptsDir(options?.cwd);
-  return path2.join(dir, `${txHash}.igra.receipt.json`);
+  return path3.join(dir, `${txHash}.igra.receipt.json`);
 }
 async function saveIgraTxReceiptArtifact(receipt, options) {
   assertValidIgraTxReceiptArtifact(receipt);
@@ -2070,7 +2343,7 @@ async function listIgraTxReceiptArtifacts(options) {
     const receipts = [];
     for (const file of receiptFiles) {
       try {
-        const data = await readArtifact(path2.join(dir, file));
+        const data = await readArtifact(path3.join(dir, file));
         if (data && typeof data === "object" && data.schema === "hardkas.igraTxReceipt.v1") {
           receipts.push(data);
         }
@@ -2103,26 +2376,26 @@ function diffArtifacts(left, right) {
     entries
   };
 }
-function compareRecursive(left, right, path4, entries) {
+function compareRecursive(left, right, path5, entries) {
   if (isPrimitive(left) || isPrimitive(right)) {
     if (left !== right) {
-      entries.push({ path: path4, kind: "changed", left, right });
+      entries.push({ path: path5, kind: "changed", left, right });
     }
     return;
   }
   if (Array.isArray(left) || Array.isArray(right)) {
     if (!Array.isArray(left) || !Array.isArray(right)) {
-      entries.push({ path: path4, kind: "changed", left, right });
+      entries.push({ path: path5, kind: "changed", left, right });
       return;
     }
     const maxLength = Math.max(left.length, right.length);
     for (let i = 0; i < maxLength; i++) {
       if (i >= left.length) {
-        entries.push({ path: `${path4}[${i}]`, kind: "added", right: right[i] });
+        entries.push({ path: `${path5}[${i}]`, kind: "added", right: right[i] });
       } else if (i >= right.length) {
-        entries.push({ path: `${path4}[${i}]`, kind: "removed", left: left[i] });
+        entries.push({ path: `${path5}[${i}]`, kind: "removed", left: left[i] });
       } else {
-        compareRecursive(left[i], right[i], `${path4}[${i}]`, entries);
+        compareRecursive(left[i], right[i], `${path5}[${i}]`, entries);
       }
     }
     return;
@@ -2131,7 +2404,7 @@ function compareRecursive(left, right, path4, entries) {
   const rightKeys = Object.keys(right).filter((k) => !SEMANTIC_EXCLUSIONS.has(k));
   const allKeys = /* @__PURE__ */ new Set([...leftKeys, ...rightKeys]);
   for (const key of allKeys) {
-    const nextPath = path4 === "$" ? key : `${path4}.${key}`;
+    const nextPath = path5 === "$" ? key : `${path5}.${key}`;
     if (!leftKeys.includes(key)) {
       entries.push({ path: nextPath, kind: "added", right: right[key] });
     } else if (!rightKeys.includes(key)) {
@@ -2195,16 +2468,16 @@ function updateDeploymentStatus(record, newStatus, txId) {
 // src/deployment-store.ts
 import fs4 from "fs/promises";
 import { existsSync } from "fs";
-import path3 from "path";
+import path4 from "path";
 import { writeFileAtomic as writeFileAtomic2 } from "@hardkas/core";
 async function saveDeployment(rootDir, record) {
-  const deploymentsDir = path3.join(rootDir, ".hardkas", "deployments", record.networkId);
-  const targetPath = path3.join(deploymentsDir, `${record.label}.json`);
+  const deploymentsDir = path4.join(rootDir, ".hardkas", "deployments", record.networkId);
+  const targetPath = path4.join(deploymentsDir, `${record.label}.json`);
   await writeFileAtomic2(targetPath, JSON.stringify(record, null, 2));
   return targetPath;
 }
 async function loadDeployment(rootDir, networkId, label) {
-  const targetPath = path3.join(
+  const targetPath = path4.join(
     rootDir,
     ".hardkas",
     "deployments",
@@ -2216,18 +2489,18 @@ async function loadDeployment(rootDir, networkId, label) {
   return JSON.parse(content);
 }
 async function listDeployments(rootDir, networkId) {
-  const baseDir = path3.join(rootDir, ".hardkas", "deployments");
+  const baseDir = path4.join(rootDir, ".hardkas", "deployments");
   if (!existsSync(baseDir)) return [];
   const summaries = [];
   const networks = networkId ? [networkId] : await fs4.readdir(baseDir);
   for (const net of networks) {
-    const netDir = path3.join(baseDir, net);
+    const netDir = path4.join(baseDir, net);
     if (!existsSync(netDir)) continue;
     const files = await fs4.readdir(netDir);
     for (const file of files) {
       if (!file.endsWith(".json")) continue;
       try {
-        const content = await fs4.readFile(path3.join(netDir, file), "utf-8");
+        const content = await fs4.readFile(path4.join(netDir, file), "utf-8");
         const record = JSON.parse(content);
         const summary = {
           label: record.label,
@@ -2260,7 +2533,7 @@ async function updateDeployment(rootDir, networkId, label, update) {
   return updated;
 }
 async function deleteDeployment(rootDir, networkId, label) {
-  const targetPath = path3.join(
+  const targetPath = path4.join(
     rootDir,
     ".hardkas",
     "deployments",
@@ -2375,6 +2648,7 @@ export {
   verifyArtifact,
   verifyArtifactFile,
   verifyArtifactIntegrity,
+  verifyArtifactIntegritySync,
   verifyArtifactReplay,
   verifyArtifactSemantics,
   verifyFeeSemantics,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hardkas/artifacts",
-  "version": "0.8.3-alpha",
+  "version": "0.8.5-alpha",
   "type": "module",
   "license": "MIT",
   "author": "Javier Rodriguez",
@@ -19,19 +19,24 @@
     "LICENSE"
   ],
   "exports": {
-    ".": "./dist/index.js"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
   },
   "types": "./dist/index.d.ts",
   "dependencies": {
     "zod": "^3.24.1",
-    "@hardkas/core": "0.8.3-alpha",
-    "@hardkas/tx-builder": "0.8.3-alpha"
+    "@hardkas/core": "0.8.5-alpha",
+    "@hardkas/tx-builder": "0.8.5-alpha"
   },
   "devDependencies": {
     "tsup": "^8.3.5",
     "typescript": "^5.6.3",
     "vitest": "^2.1.4"
   },
+  "main": "./dist/index.js",
   "scripts": {
     "build": "tsup src/index.ts --format esm --dts --clean",
     "dev": "tsup src/index.ts --format esm --watch --dts",