@ixo/domain.md 0.3.0

package/dist/chunk-W7MRQP7I.js

@@ -0,0 +1,862 @@
+import {
+  ORACLE_CAPSULE_CONTRACT,
+  ORACLE_CAPSULE_EXTERNAL_CHECKS,
+  ORACLE_CAPSULE_LIMITS,
+  compiled_validators_default
+} from "./chunk-G7PZJYAJ.js";
+
+// src/capsule/canonical.ts
+import { createHash } from "crypto";
+var CapsuleCanonicalizationError = class extends Error {
+  code = "capsule-canonicalization";
+};
+function canonical(value, path) {
+  if (value === null) return "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "string") {
+    for (let index = 0; index < value.length; index += 1) {
+      const code = value.charCodeAt(index);
+      if (code >= 55296 && code <= 56319) {
+        const low = value.charCodeAt(index + 1);
+        if (!Number.isInteger(low) || low < 56320 || low > 57343)
+          throw new CapsuleCanonicalizationError(`Lone high surrogate at ${path}.`);
+        index += 1;
+      } else if (code >= 56320 && code <= 57343) {
+        throw new CapsuleCanonicalizationError(`Lone low surrogate at ${path}.`);
+      }
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      throw new CapsuleCanonicalizationError(`Non-finite number at ${path}.`);
+    if (Number.isInteger(value) && !Number.isSafeInteger(value))
+      throw new CapsuleCanonicalizationError(`Unsafe integer at ${path}.`);
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((child, index) => canonical(child, `${path}/${index}`)).join(",")}]`;
+  }
+  if (typeof value === "object" && value !== void 0) {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${canonical(key, path)}:${canonical(record[key], `${path}/${key}`)}`).join(",")}}`;
+  }
+  throw new CapsuleCanonicalizationError(`Unsupported JSON value at ${path}.`);
+}
+function canonicalizeCapsuleJson(value) {
+  return canonical(value, "/");
+}
+function capsuleJcsSha256(value) {
+  return createHash("sha256").update(canonicalizeCapsuleJson(value), "utf8").digest("hex");
+}
+function oracleCapsuleReleaseProjection(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    throw new CapsuleCanonicalizationError("A capsule release must be a JSON object.");
+  const root = structuredClone(value);
+  const metadata = root.metadata;
+  if (typeof metadata !== "object" || metadata === null || Array.isArray(metadata))
+    throw new CapsuleCanonicalizationError("A capsule release must contain metadata.");
+  const projectedMetadata = { ...metadata };
+  delete projectedMetadata.release_digest;
+  root.metadata = projectedMetadata;
+  return root;
+}
+function oracleCapsuleReleaseDigest(value) {
+  return capsuleJcsSha256(oracleCapsuleReleaseProjection(value));
+}
+
+// src/capsule/json.ts
+var JsonFailure = class extends Error {
+  constructor(code, message, path, offset) {
+    super(message);
+    this.code = code;
+    this.path = path;
+    this.offset = offset;
+  }
+  code;
+  path;
+  offset;
+};
+function pointerSegment(value) {
+  return value.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function decodeInput(input) {
+  if (typeof input === "string") return input;
+  if (input[0] === 239 && input[1] === 187 && input[2] === 191)
+    throw new JsonFailure("capsule-encoding", "UTF-8 byte-order marks are forbidden.", "/", 0);
+  try {
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(input);
+  } catch {
+    throw new JsonFailure("capsule-encoding", "Input must be valid UTF-8.", "/", 0);
+  }
+}
+var StrictJsonParser = class {
+  constructor(source, options) {
+    this.source = source;
+    this.options = options;
+    for (let index = 0; index < source.length; index += 1) {
+      if (source.charCodeAt(index) === 10) this.lineStarts.push(index + 1);
+    }
+  }
+  source;
+  options;
+  offset = 0;
+  nodes = 0;
+  lineStarts = [0];
+  locations = /* @__PURE__ */ new Map();
+  parse() {
+    this.skipWhitespace();
+    const value = this.parseValue("/", 0);
+    this.skipWhitespace();
+    if (this.offset !== this.source.length)
+      this.fail("capsule-json-syntax", "Unexpected trailing content.", "/");
+    return value;
+  }
+  location(offset) {
+    let low = 0;
+    let high = this.lineStarts.length;
+    while (low + 1 < high) {
+      const middle = Math.floor((low + high) / 2);
+      if ((this.lineStarts[middle] ?? 0) <= offset) low = middle;
+      else high = middle;
+    }
+    return { line: low + 1, column: offset - (this.lineStarts[low] ?? 0) + 1 };
+  }
+  failureLocation(offset) {
+    return this.location(offset);
+  }
+  fail(code, message, path, offset = this.offset) {
+    throw new JsonFailure(code, message, path, offset);
+  }
+  node(path, depth) {
+    if (depth > this.options.maxDepth)
+      this.fail("capsule-limit", `JSON exceeds maximum depth ${this.options.maxDepth}.`, path);
+    this.nodes += 1;
+    if (this.nodes > this.options.maxNodes)
+      this.fail("capsule-limit", `JSON exceeds maximum node count ${this.options.maxNodes}.`, path);
+    this.locations.set(path, this.location(this.offset));
+  }
+  skipWhitespace() {
+    while (/[\t\n\r ]/.test(this.source[this.offset] ?? "")) this.offset += 1;
+  }
+  parseValue(path, depth) {
+    this.node(path, depth);
+    const character = this.source[this.offset];
+    if (character === "{") return this.parseObject(path, depth);
+    if (character === "[") return this.parseArray(path, depth);
+    if (character === '"') return this.parseString(path);
+    if (character === "-" || character !== void 0 && /[0-9]/.test(character))
+      return this.parseNumber(path);
+    if (this.source.startsWith("true", this.offset)) {
+      this.offset += 4;
+      return true;
+    }
+    if (this.source.startsWith("false", this.offset)) {
+      this.offset += 5;
+      return false;
+    }
+    if (this.source.startsWith("null", this.offset)) {
+      this.offset += 4;
+      return null;
+    }
+    return this.fail("capsule-json-syntax", "Expected a JSON value.", path);
+  }
+  parseObject(path, depth) {
+    const result = {};
+    const seen = /* @__PURE__ */ new Set();
+    this.offset += 1;
+    this.skipWhitespace();
+    if (this.source[this.offset] === "}") {
+      this.offset += 1;
+      return result;
+    }
+    while (true) {
+      if (this.source[this.offset] !== '"')
+        this.fail("capsule-json-syntax", "Object names must be JSON strings.", path);
+      const keyOffset = this.offset;
+      const key = this.parseString(path);
+      const childPath = path === "/" ? `/${pointerSegment(key)}` : `${path}/${pointerSegment(key)}`;
+      if (seen.has(key))
+        this.fail(
+          "capsule-duplicate-key",
+          `Duplicate object name ${JSON.stringify(key)}.`,
+          childPath,
+          keyOffset
+        );
+      seen.add(key);
+      this.skipWhitespace();
+      if (this.source[this.offset] !== ":")
+        this.fail("capsule-json-syntax", "Expected a colon after the object name.", childPath);
+      this.offset += 1;
+      this.skipWhitespace();
+      result[key] = this.parseValue(childPath, depth + 1);
+      this.skipWhitespace();
+      const separator = this.source[this.offset];
+      if (separator === "}") {
+        this.offset += 1;
+        return result;
+      }
+      if (separator !== ",")
+        this.fail("capsule-json-syntax", "Expected a comma or closing brace.", path);
+      this.offset += 1;
+      this.skipWhitespace();
+    }
+  }
+  parseArray(path, depth) {
+    const result = [];
+    this.offset += 1;
+    this.skipWhitespace();
+    if (this.source[this.offset] === "]") {
+      this.offset += 1;
+      return result;
+    }
+    while (true) {
+      const childPath = path === "/" ? `/${result.length}` : `${path}/${result.length}`;
+      result.push(this.parseValue(childPath, depth + 1));
+      this.skipWhitespace();
+      const separator = this.source[this.offset];
+      if (separator === "]") {
+        this.offset += 1;
+        return result;
+      }
+      if (separator !== ",")
+        this.fail("capsule-json-syntax", "Expected a comma or closing bracket.", path);
+      this.offset += 1;
+      this.skipWhitespace();
+    }
+  }
+  parseString(path) {
+    this.offset += 1;
+    let value = "";
+    while (this.offset < this.source.length) {
+      const code = this.source.charCodeAt(this.offset);
+      if (code === 34) {
+        this.offset += 1;
+        if (value.length > this.options.maxScalarLength)
+          this.fail(
+            "capsule-limit",
+            `String exceeds maximum length ${this.options.maxScalarLength}.`,
+            path
+          );
+        return value;
+      }
+      if (code < 32)
+        this.fail("capsule-json-syntax", "Unescaped control character in string.", path);
+      if (code === 92) {
+        value += this.parseEscape(path);
+        continue;
+      }
+      if (code >= 55296 && code <= 56319) {
+        const low = this.source.charCodeAt(this.offset + 1);
+        if (!Number.isInteger(low) || low < 56320 || low > 57343)
+          this.fail("capsule-unicode", "Lone high surrogate is not I-JSON compatible.", path);
+        value += this.source.slice(this.offset, this.offset + 2);
+        this.offset += 2;
+        continue;
+      }
+      if (code >= 56320 && code <= 57343)
+        this.fail("capsule-unicode", "Lone low surrogate is not I-JSON compatible.", path);
+      value += this.source[this.offset] ?? "";
+      this.offset += 1;
+    }
+    return this.fail("capsule-json-syntax", "Unterminated JSON string.", path);
+  }
+  parseEscape(path) {
+    this.offset += 1;
+    const escape = this.source[this.offset];
+    const simple = {
+      '"': '"',
+      "\\": "\\",
+      "/": "/",
+      b: "\b",
+      f: "\f",
+      n: "\n",
+      r: "\r",
+      t: "	"
+    };
+    if (escape !== void 0 && escape in simple) {
+      this.offset += 1;
+      return simple[escape] ?? "";
+    }
+    if (escape !== "u") return this.fail("capsule-json-syntax", "Invalid JSON escape.", path);
+    const first = this.readUnicodeEscape(path);
+    if (first >= 55296 && first <= 56319) {
+      if (this.source.slice(this.offset, this.offset + 2) !== "\\u")
+        return this.fail(
+          "capsule-unicode",
+          "Escaped high surrogate must be followed by a low surrogate.",
+          path
+        );
+      const second = this.readUnicodeEscape(path);
+      if (second < 56320 || second > 57343)
+        return this.fail(
+          "capsule-unicode",
+          "Escaped high surrogate must be followed by a low surrogate.",
+          path
+        );
+      return String.fromCharCode(first, second);
+    }
+    if (first >= 56320 && first <= 57343)
+      return this.fail("capsule-unicode", "Lone escaped low surrogate is forbidden.", path);
+    return String.fromCharCode(first);
+  }
+  readUnicodeEscape(path) {
+    const digitsAt = this.source[this.offset] === "u" ? this.offset + 1 : this.source.slice(this.offset, this.offset + 2) === "\\u" ? this.offset + 2 : -1;
+    if (digitsAt < 0) return this.fail("capsule-json-syntax", "Invalid Unicode escape.", path);
+    const hex = this.source.slice(digitsAt, digitsAt + 4);
+    if (!/^[0-9a-fA-F]{4}$/.test(hex))
+      return this.fail(
+        "capsule-json-syntax",
+        "Unicode escapes require four hexadecimal digits.",
+        path
+      );
+    this.offset = digitsAt + 4;
+    return Number.parseInt(hex, 16);
+  }
+  parseNumber(path) {
+    const remaining = this.source.slice(this.offset);
+    const match = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(remaining);
+    if (!match) return this.fail("capsule-json-syntax", "Invalid JSON number.", path);
+    const token = match[0];
+    const following = remaining[token.length];
+    if (following !== void 0 && !/[\t\n\r ,\]}]/.test(following))
+      return this.fail("capsule-json-syntax", "Invalid character after JSON number.", path);
+    this.offset += token.length;
+    const value = Number(token);
+    if (!Number.isFinite(value))
+      return this.fail("capsule-number", "Non-finite numbers are not I-JSON compatible.", path);
+    if (Number.isInteger(value) && !Number.isSafeInteger(value))
+      return this.fail(
+        "capsule-number",
+        "Integers must be within the interoperable safe-integer range.",
+        path
+      );
+    return value;
+  }
+};
+function finding(error, location2) {
+  return {
+    severity: "error",
+    code: error.code,
+    message: error.message,
+    path: error.path,
+    location: location2
+  };
+}
+function parseCapsuleJson(input, options = {}) {
+  const sourceName = options.sourceName ?? "<memory>";
+  let source;
+  try {
+    source = decodeInput(input);
+  } catch (error) {
+    const failure = error;
+    return { ok: false, findings: [finding(failure, { line: 1, column: 1 })] };
+  }
+  const maxBytes = options.maxBytes ?? ORACLE_CAPSULE_LIMITS.maxBytes;
+  if (Buffer.byteLength(source, "utf8") > maxBytes) {
+    return {
+      ok: false,
+      findings: [
+        {
+          severity: "error",
+          code: "capsule-file-too-large",
+          message: `Input exceeds ${maxBytes} bytes.`,
+          path: "/",
+          location: { line: 1, column: 1 }
+        }
+      ]
+    };
+  }
+  if (source.charCodeAt(0) === 65279) {
+    return {
+      ok: false,
+      findings: [
+        {
+          severity: "error",
+          code: "capsule-encoding",
+          message: "UTF-8 byte-order marks are forbidden.",
+          path: "/",
+          location: { line: 1, column: 1 }
+        }
+      ]
+    };
+  }
+  const parser = new StrictJsonParser(source, {
+    maxDepth: options.maxDepth ?? ORACLE_CAPSULE_LIMITS.maxDepth,
+    maxNodes: options.maxNodes ?? ORACLE_CAPSULE_LIMITS.maxNodes,
+    maxScalarLength: options.maxScalarLength ?? ORACLE_CAPSULE_LIMITS.maxScalarLength
+  });
+  try {
+    const value = parser.parse();
+    const document = {
+      value,
+      raw: source,
+      sourceName,
+      locations: parser.locations
+    };
+    return { ok: true, document, findings: [] };
+  } catch (error) {
+    const failure = error instanceof JsonFailure ? error : new JsonFailure("capsule-json-syntax", String(error), "/", 0);
+    return { ok: false, findings: [finding(failure, parser.failureLocation(failure.offset))] };
+  }
+}
+
+// src/capsule/validate.ts
+import { createHash as createHash2 } from "crypto";
+import { CID } from "multiformats/cid";
+import { sha256 } from "multiformats/hashes/sha2";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function pointerSegment2(value) {
+  return value.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function location(document, path) {
+  let candidate = path.length > 0 ? path : "/";
+  while (candidate !== "/") {
+    const found = document.locations.get(candidate);
+    if (found) return found;
+    candidate = candidate.slice(0, candidate.lastIndexOf("/")) || "/";
+  }
+  return document.locations.get("/") ?? { line: 1, column: 1 };
+}
+function add(findings, document, code, message, path = "/") {
+  findings.push({ severity: "error", code, message, path, location: location(document, path) });
+}
+function schemaPath(error) {
+  const base = error.instancePath || "/";
+  if (error.keyword !== "required") return base;
+  const missing = error.params.missingProperty;
+  if (!missing) return base;
+  return base === "/" || base === "" ? `/${pointerSegment2(missing)}` : `${base}/${pointerSegment2(missing)}`;
+}
+function addSchemaFindings(findings, document, errors, label) {
+  for (const error of errors ?? []) {
+    const path = schemaPath(error);
+    add(findings, document, "capsule-schema", `${label}: ${error.message ?? error.keyword}.`, path);
+  }
+}
+function sha(bytes2) {
+  return createHash2("sha256").update(bytes2).digest("hex");
+}
+function bytes(value) {
+  return typeof value === "string" ? Buffer.from(value, "utf8") : value;
+}
+function records(value) {
+  return Array.isArray(value) ? value.filter(isRecord) : [];
+}
+function artifactRecords(value, path = "/") {
+  const result = [];
+  if (Array.isArray(value)) {
+    value.forEach((child, index) => result.push(...artifactRecords(child, `${path}/${index}`)));
+  } else if (isRecord(value)) {
+    if (typeof value.cid === "string" && typeof value.sha256 === "string" && typeof value.uri === "string") {
+      result.push([value, path]);
+    }
+    for (const [key, child] of Object.entries(value)) {
+      result.push(...artifactRecords(child, `${path === "/" ? "" : path}/${pointerSegment2(key)}`));
+    }
+  }
+  return result;
+}
+function validateArtifactIdentity(artifact, path, document, findings) {
+  const declaredCid = artifact.cid;
+  const declaredSha = artifact.sha256;
+  if (typeof declaredCid !== "string" || typeof declaredSha !== "string") return;
+  try {
+    const cid = CID.parse(declaredCid);
+    if (cid.version !== 1 || cid.code !== 85 || cid.multihash.code !== sha256.code) {
+      add(
+        findings,
+        document,
+        "capsule-cid",
+        "Only CIDv1 raw sha2-256 content addresses are supported.",
+        `${path}/cid`
+      );
+      return;
+    }
+    if (!Buffer.from(cid.multihash.digest).equals(Buffer.from(declaredSha, "hex"))) {
+      add(
+        findings,
+        document,
+        "capsule-integrity",
+        "CID multihash and declared SHA-256 identify different bytes.",
+        path
+      );
+    }
+  } catch {
+    add(findings, document, "capsule-cid", "CID is not a valid CIDv1 value.", `${path}/cid`);
+  }
+  const uri = artifact.uri;
+  if (typeof uri === "string") {
+    try {
+      const parsed = new URL(uri);
+      if (parsed.username || parsed.password || parsed.search) {
+        add(
+          findings,
+          document,
+          "capsule-uri-policy",
+          "Credential-bearing and query-bearing artifact URIs are forbidden.",
+          `${path}/uri`
+        );
+      }
+    } catch {
+      add(findings, document, "capsule-uri-policy", "Artifact URI is invalid.", `${path}/uri`);
+    }
+  }
+}
+function validateExpectedIdentity(input, expected, document, findings) {
+  const content = bytes(input);
+  const actualSha = sha(content);
+  if (actualSha !== expected.sha256.toLowerCase() || expected.bytes !== void 0 && expected.bytes !== content.byteLength) {
+    add(
+      findings,
+      document,
+      "capsule-integrity",
+      "Manifest exact bytes do not match the expected SHA-256 or byte length.",
+      "/"
+    );
+  }
+  try {
+    const cid = CID.parse(expected.cid);
+    if (cid.version !== 1 || cid.code !== 85 || cid.multihash.code !== sha256.code || !Buffer.from(cid.multihash.digest).equals(Buffer.from(actualSha, "hex"))) {
+      add(
+        findings,
+        document,
+        "capsule-integrity",
+        "Manifest exact bytes do not match the expected CIDv1 raw sha2-256 address.",
+        "/"
+      );
+    }
+  } catch {
+    add(findings, document, "capsule-cid", "Expected manifest CID is invalid.", "/");
+  }
+}
+function uniqueIds(entries, path, document, findings) {
+  const ids = /* @__PURE__ */ new Set();
+  entries.forEach((entry, index) => {
+    if (typeof entry.id !== "string") return;
+    if (ids.has(entry.id))
+      add(
+        findings,
+        document,
+        "capsule-duplicate-id",
+        `Duplicate id ${JSON.stringify(entry.id)}.`,
+        `${path}/${index}/id`
+      );
+    ids.add(entry.id);
+  });
+  return ids;
+}
+function validateComponentGraph(root, document, findings) {
+  const components = records(root.components);
+  const ids = uniqueIds(components, "/components", document, findings);
+  const graph = /* @__PURE__ */ new Map();
+  components.forEach((component, index) => {
+    if (typeof component.id !== "string") return;
+    const dependencies = Array.isArray(component.dependencies) ? component.dependencies.filter((item) => typeof item === "string") : [];
+    graph.set(component.id, dependencies);
+    for (const dependency of dependencies) {
+      if (!ids.has(dependency))
+        add(
+          findings,
+          document,
+          "capsule-reference",
+          `Unknown component dependency ${JSON.stringify(dependency)}.`,
+          `/components/${index}/dependencies`
+        );
+      if (dependency === component.id)
+        add(
+          findings,
+          document,
+          "capsule-dependency-cycle",
+          "A component cannot depend on itself.",
+          `/components/${index}/dependencies`
+        );
+    }
+  });
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const visit = (id) => {
+    if (visiting.has(id)) return true;
+    if (visited.has(id)) return false;
+    visiting.add(id);
+    for (const dependency of graph.get(id) ?? []) {
+      if (graph.has(dependency) && visit(dependency)) return true;
+    }
+    visiting.delete(id);
+    visited.add(id);
+    return false;
+  };
+  for (const id of graph.keys()) {
+    if (visit(id)) {
+      add(
+        findings,
+        document,
+        "capsule-dependency-cycle",
+        "Component dependency graph contains a cycle.",
+        "/components"
+      );
+      break;
+    }
+  }
+  const toolIds = uniqueIds(records(root.tools), "/tools", document, findings);
+  const capabilityIds = uniqueIds(
+    records(root.requestedCapabilities),
+    "/requestedCapabilities",
+    document,
+    findings
+  );
+  void capabilityIds;
+  records(root.requestedCapabilities).forEach((request, index) => {
+    if (typeof request.tool === "string" && !toolIds.has(request.tool))
+      add(
+        findings,
+        document,
+        "capsule-reference",
+        `Requested capability names unknown tool ${JSON.stringify(request.tool)}.`,
+        `/requestedCapabilities/${index}/tool`
+      );
+  });
+}
+function externalChecks() {
+  const definitions = {
+    "oracle-identity-current": [
+      "identity",
+      "Resolve the current Oracle DID/IID document and revocation state."
+    ],
+    "subject-domain-current": [
+      "identity",
+      "Resolve each subject domain and its current canonical resources."
+    ],
+    "capability-current-and-unrevoked": [
+      "authorization",
+      "Verify live grants, audience, scope, expiry and revocation before each call."
+    ],
+    "trusted-time-available": [
+      "time",
+      "Evaluate time-bound policy against an approved trusted clock."
+    ],
+    "private-resource-access-authorized": [
+      "privacy",
+      "Verify consent, disclosure and decryption rights before reading private evidence."
+    ],
+    "human-review-authorized": [
+      "review",
+      "Verify the named independent reviewer and exact approved output digest."
+    ],
+    "runtime-distribution-trusted": [
+      "distribution",
+      "Verify the installed kernel and adapters against an external trust anchor."
+    ],
+    "receipt-signer-current-and-unrevoked": [
+      "signer",
+      "Verify the external receipt signer key and current revocation status."
+    ]
+  };
+  return ORACLE_CAPSULE_EXTERNAL_CHECKS.map((code) => ({
+    code,
+    category: definitions[code]?.[0] ?? "authorization",
+    reason: definitions[code]?.[1] ?? "Runtime verification is required."
+  }));
+}
+function validateSourceLock(manifest, manifestDocument, sourceLock, lockedFiles, findings) {
+  const parsed = parseCapsuleJson(sourceLock, {
+    sourceName: `${manifestDocument.sourceName}#source-lock`
+  });
+  if (!parsed.document) {
+    findings.push(...parsed.findings);
+    return;
+  }
+  const lockDocument = parsed.document;
+  const valid = compiled_validators_default.sourceLock(lockDocument.value);
+  if (!valid) {
+    addSchemaFindings(findings, lockDocument, compiled_validators_default.sourceLock.errors, "Source lock schema");
+    return;
+  }
+  if (!isRecord(lockDocument.value)) return;
+  const lock = lockDocument.value;
+  const componentId = lock.component;
+  const component = records(manifest.components).find((entry) => entry.id === componentId);
+  if (!component || !isRecord(component.artifact)) {
+    add(
+      findings,
+      lockDocument,
+      "capsule-lock",
+      "Source lock component does not resolve in the manifest.",
+      "/component"
+    );
+    return;
+  }
+  const lockBytes = bytes(sourceLock);
+  const sourceLockReference = component.artifact.source_lock;
+  if (isRecord(sourceLockReference)) {
+    if (sourceLockReference.sha256 !== sha(lockBytes) || sourceLockReference.bytes !== lockBytes.byteLength) {
+      add(
+        findings,
+        manifestDocument,
+        "capsule-integrity",
+        "Source lock exact bytes do not match the manifest reference.",
+        "/components"
+      );
+    }
+  }
+  const lockArtifact = lock.artifact;
+  if (isRecord(lockArtifact) && (lockArtifact.cid !== component.artifact.cid || lockArtifact.sha256 !== component.artifact.sha256 || lockArtifact.bytes !== component.artifact.bytes)) {
+    add(
+      findings,
+      lockDocument,
+      "capsule-lock",
+      "Source lock artifact identity differs from its manifest component.",
+      "/artifact"
+    );
+  }
+  const files = records(lock.files);
+  const paths = /* @__PURE__ */ new Set();
+  const portablePaths = /* @__PURE__ */ new Set();
+  let totalBytes = 0;
+  files.forEach((file, index) => {
+    if (typeof file.path !== "string" || typeof file.bytes !== "number" || typeof file.sha256 !== "string")
+      return;
+    if (paths.has(file.path))
+      add(
+        findings,
+        lockDocument,
+        "capsule-duplicate-path",
+        `Duplicate locked path ${JSON.stringify(file.path)}.`,
+        `/files/${index}/path`
+      );
+    const portablePath = file.path.toLowerCase();
+    if (portablePaths.has(portablePath) && !paths.has(file.path))
+      add(
+        findings,
+        lockDocument,
+        "capsule-path-collision",
+        `Locked path ${JSON.stringify(file.path)} collides on case-insensitive hosts.`,
+        `/files/${index}/path`
+      );
+    paths.add(file.path);
+    portablePaths.add(portablePath);
+    totalBytes += file.bytes;
+    if (totalBytes > ORACLE_CAPSULE_LIMITS.maxLockedBytes)
+      add(
+        findings,
+        lockDocument,
+        "capsule-limit",
+        `Locked files exceed ${ORACLE_CAPSULE_LIMITS.maxLockedBytes} bytes.`,
+        "/files"
+      );
+    if (lockedFiles) {
+      const content = lockedFiles[file.path];
+      if (content === void 0) {
+        add(
+          findings,
+          lockDocument,
+          "capsule-lock",
+          `Locked file ${JSON.stringify(file.path)} is missing.`,
+          `/files/${index}/path`
+        );
+      } else {
+        const contentBytes = bytes(content);
+        if (contentBytes.byteLength !== file.bytes || sha(contentBytes) !== file.sha256)
+          add(
+            findings,
+            lockDocument,
+            "capsule-integrity",
+            `Locked file ${JSON.stringify(file.path)} failed byte-length or SHA-256 verification.`,
+            `/files/${index}`
+          );
+      }
+    }
+  });
+  if (lockedFiles) {
+    for (const path of Object.keys(lockedFiles)) {
+      if (!paths.has(path))
+        add(
+          findings,
+          lockDocument,
+          "capsule-lock",
+          `Unlocked file ${JSON.stringify(path)} is forbidden.`,
+          "/files"
+        );
+    }
+  }
+}
+function validateOracleCapsule(input, options = {}) {
+  const parsed = parseCapsuleJson(input, options);
+  const checks = externalChecks();
+  if (!parsed.document) {
+    return {
+      tool: "@ixo/domain.md",
+      contract: ORACLE_CAPSULE_CONTRACT,
+      sourceName: options.sourceName ?? "<memory>",
+      status: "fail",
+      ok: false,
+      findings: parsed.findings,
+      externalChecksRequired: checks
+    };
+  }
+  const findings = [...parsed.findings];
+  if (options.expectedIdentity)
+    validateExpectedIdentity(input, options.expectedIdentity, parsed.document, findings);
+  const validator = compiled_validators_default.manifest;
+  if (!validator(parsed.document.value))
+    addSchemaFindings(findings, parsed.document, validator.errors, "Manifest schema");
+  if (isRecord(parsed.document.value)) {
+    for (const [artifact, path] of artifactRecords(parsed.document.value))
+      validateArtifactIdentity(artifact, path, parsed.document, findings);
+    validateComponentGraph(parsed.document.value, parsed.document, findings);
+    const metadata = parsed.document.value.metadata;
+    if (isRecord(metadata) && typeof metadata.release_digest === "string") {
+      try {
+        const actual = oracleCapsuleReleaseDigest(parsed.document.value);
+        if (metadata.release_digest !== actual)
+          add(
+            findings,
+            parsed.document,
+            "capsule-release-digest",
+            `Release digest mismatch; expected ${actual}.`,
+            "/metadata/release_digest"
+          );
+      } catch (error) {
+        add(
+          findings,
+          parsed.document,
+          "capsule-canonicalization",
+          error instanceof Error ? error.message : String(error),
+          "/"
+        );
+      }
+    }
+    if (options.sourceLock)
+      validateSourceLock(
+        parsed.document.value,
+        parsed.document,
+        options.sourceLock,
+        options.lockedFiles,
+        findings
+      );
+  }
+  const ok = !findings.some((finding2) => finding2.severity === "error");
+  return {
+    tool: "@ixo/domain.md",
+    contract: ORACLE_CAPSULE_CONTRACT,
+    sourceName: parsed.document.sourceName,
+    status: ok ? "static-pass" : "fail",
+    ok,
+    findings,
+    externalChecksRequired: checks,
+    manifest: parsed.document.value
+  };
+}
+
+export {
+  CapsuleCanonicalizationError,
+  canonicalizeCapsuleJson,
+  capsuleJcsSha256,
+  oracleCapsuleReleaseProjection,
+  oracleCapsuleReleaseDigest,
+  parseCapsuleJson,
+  validateOracleCapsule
+};
+//# sourceMappingURL=chunk-W7MRQP7I.js.map