@melra/verifier-core 0.3.0-alpha.10 → 0.3.0-alpha.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +19 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +92 -4
- package/dist/index.js.map +1 -1
- package/dist/index.test.js +14 -0
- package/dist/index.test.js.map +1 -1
- package/dist/probe.test.d.ts +2 -0
- package/dist/probe.test.d.ts.map +1 -0
- package/dist/probe.test.js +116 -0
- package/dist/probe.test.js.map +1 -0
- package/package.json +3 -3
package/dist/index.d.ts
CHANGED
|
@@ -1,9 +1,26 @@
|
|
|
1
1
|
import type { EvidencePredicate } from "@melra/protocol";
|
|
2
|
-
import type
|
|
2
|
+
import { type EvidenceItem } from "@melra/receipt-schema";
|
|
3
|
+
/**
|
|
4
|
+
* A read the verifier can make through a channel it does not own.
|
|
5
|
+
*
|
|
6
|
+
* Injected rather than imported so this package keeps no adapter dependency:
|
|
7
|
+
* whoever supplies the probe decides what a read costs and what it is allowed
|
|
8
|
+
* to reach, and the verifier only decides whether the answer matches.
|
|
9
|
+
*/
|
|
10
|
+
export type EvidenceProbe = (request: {
|
|
11
|
+
url: string;
|
|
12
|
+
method: "GET" | "HEAD";
|
|
13
|
+
timeoutMs: number;
|
|
14
|
+
}) => Promise<Record<string, unknown>>;
|
|
15
|
+
export interface VerifierOptions {
|
|
16
|
+
/** Absent means `http_resource_matches` fails rather than passes. */
|
|
17
|
+
probe?: EvidenceProbe;
|
|
18
|
+
}
|
|
3
19
|
export declare class Verifier {
|
|
4
20
|
readonly root: string;
|
|
21
|
+
private readonly probe;
|
|
5
22
|
private constructor();
|
|
6
|
-
static create(root: string): Promise<Verifier>;
|
|
23
|
+
static create(root: string, options?: VerifierOptions): Promise<Verifier>;
|
|
7
24
|
private filePath;
|
|
8
25
|
private potentiallyAbsentFilePath;
|
|
9
26
|
verify(predicates: EvidencePredicate[], result: Record<string, unknown>): Promise<{
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAwB5E;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAyCvC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,qBAAa,QAAQ;IAEjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFxB,OAAO;WAKM,MAAM,CACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,QAAQ,CAAC;YAIN,QAAQ;YAYR,yBAAyB;IA6BjC,MAAM,CACV,UAAU,EAAE,iBAAiB,EAAE,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;CAyK5D"}
|
package/dist/index.js
CHANGED
|
@@ -3,6 +3,7 @@
|
|
|
3
3
|
import { createHash } from "node:crypto";
|
|
4
4
|
import { lstat, readFile, realpath, stat } from "node:fs/promises";
|
|
5
5
|
import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
|
|
6
|
+
import { evidenceStrength } from "@melra/receipt-schema";
|
|
6
7
|
function inside(root, candidate) {
|
|
7
8
|
const rel = relative(root, candidate);
|
|
8
9
|
return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
|
|
@@ -20,13 +21,51 @@ function wildcardMatches(value, pattern) {
|
|
|
20
21
|
.replaceAll("\\*", ".*");
|
|
21
22
|
return new RegExp(`^${escaped}$`, "u").test(value);
|
|
22
23
|
}
|
|
24
|
+
/**
|
|
25
|
+
* A result with its JSON body parsed alongside the transport fields, so
|
|
26
|
+
* `json.id` reads the payload and `status` reads the response. A body that is
|
|
27
|
+
* not JSON simply has no `json`, and a path into it goes unresolved rather
|
|
28
|
+
* than throwing here.
|
|
29
|
+
*/
|
|
30
|
+
function withParsedBody(result) {
|
|
31
|
+
if (typeof result.content !== "string")
|
|
32
|
+
return result;
|
|
33
|
+
try {
|
|
34
|
+
return { ...result, json: JSON.parse(result.content) };
|
|
35
|
+
}
|
|
36
|
+
catch {
|
|
37
|
+
return result;
|
|
38
|
+
}
|
|
39
|
+
}
|
|
40
|
+
const TOKEN = /\{\{([A-Za-z0-9_.]{1,64})\}\}/gu;
|
|
41
|
+
/**
|
|
42
|
+
* Splices values from the recorded result into a verification URL.
|
|
43
|
+
*
|
|
44
|
+
* The id of the thing to re-read is only known after the effect ran, so the
|
|
45
|
+
* URL has to be completed from the result. Tokens are bounded to a dotted path
|
|
46
|
+
* and each value is percent-encoded, so a response field carrying `../` or a
|
|
47
|
+
* `?` cannot rewrite the path the operator wrote. An unresolved token fails the
|
|
48
|
+
* predicate rather than producing a URL with a hole in it.
|
|
49
|
+
*/
|
|
50
|
+
function interpolate(template, result) {
|
|
51
|
+
const source = withParsedBody(result);
|
|
52
|
+
return template.replace(TOKEN, (_match, path) => {
|
|
53
|
+
const value = readResultPath(source, path);
|
|
54
|
+
if (value === undefined || value === null || typeof value === "object") {
|
|
55
|
+
throw new Error(`verification_token_unresolved:${path}`);
|
|
56
|
+
}
|
|
57
|
+
return encodeURIComponent(String(value));
|
|
58
|
+
});
|
|
59
|
+
}
|
|
23
60
|
export class Verifier {
|
|
24
61
|
root;
|
|
25
|
-
|
|
62
|
+
probe;
|
|
63
|
+
constructor(root, probe) {
|
|
26
64
|
this.root = root;
|
|
65
|
+
this.probe = probe;
|
|
27
66
|
}
|
|
28
|
-
static async create(root) {
|
|
29
|
-
return new Verifier(await realpath(root));
|
|
67
|
+
static async create(root, options = {}) {
|
|
68
|
+
return new Verifier(await realpath(root), options.probe);
|
|
30
69
|
}
|
|
31
70
|
async filePath(input) {
|
|
32
71
|
const candidate = resolve(this.root, input);
|
|
@@ -170,6 +209,49 @@ export class Verifier {
|
|
|
170
209
|
});
|
|
171
210
|
break;
|
|
172
211
|
}
|
|
212
|
+
case "http_resource_matches": {
|
|
213
|
+
if (this.probe === undefined) {
|
|
214
|
+
// Fails, never passes. A predicate the runtime cannot evaluate is
|
|
215
|
+
// an unanswered question, and treating it as satisfied would make
|
|
216
|
+
// the strongest evidence type the easiest one to claim.
|
|
217
|
+
throw new Error("verification_probe_unavailable");
|
|
218
|
+
}
|
|
219
|
+
const url = interpolate(predicate.url, result);
|
|
220
|
+
// Caught here rather than by the outer handler so a transport
|
|
221
|
+
// failure is not filed as the provider saying no. Both are
|
|
222
|
+
// `passed: false`; only this one is `inconclusive`, and that is
|
|
223
|
+
// what lets an unreachable provider leave a mutation
|
|
224
|
+
// `recovery_required` instead of `failed`. The interpolate above
|
|
225
|
+
// stays outside: an unresolved token is a caller error, and the
|
|
226
|
+
// provider is not implicated in it.
|
|
227
|
+
let observed;
|
|
228
|
+
try {
|
|
229
|
+
observed = withParsedBody(await this.probe({
|
|
230
|
+
url,
|
|
231
|
+
method: predicate.method,
|
|
232
|
+
timeoutMs: predicate.timeoutMs,
|
|
233
|
+
}));
|
|
234
|
+
}
|
|
235
|
+
catch (error) {
|
|
236
|
+
evidence.push({
|
|
237
|
+
type: predicate.type,
|
|
238
|
+
passed: false,
|
|
239
|
+
inconclusive: true,
|
|
240
|
+
summary: `independent read unavailable: ${error instanceof Error ? error.message : String(error)}`,
|
|
241
|
+
source: url,
|
|
242
|
+
});
|
|
243
|
+
break;
|
|
244
|
+
}
|
|
245
|
+
const value = readResultPath(observed, predicate.path);
|
|
246
|
+
const passed = Object.is(value, predicate.value);
|
|
247
|
+
evidence.push({
|
|
248
|
+
type: predicate.type,
|
|
249
|
+
passed,
|
|
250
|
+
summary: `independent read of ${predicate.path} ${passed ? "matched" : "did not match"} expected value`,
|
|
251
|
+
source: url,
|
|
252
|
+
});
|
|
253
|
+
break;
|
|
254
|
+
}
|
|
173
255
|
}
|
|
174
256
|
}
|
|
175
257
|
catch (error) {
|
|
@@ -182,7 +264,13 @@ export class Verifier {
|
|
|
182
264
|
}
|
|
183
265
|
return {
|
|
184
266
|
verified: evidence.every((item) => item.passed),
|
|
185
|
-
|
|
267
|
+
// Stamped once here rather than at each branch above: strength is a
|
|
268
|
+
// property of the predicate type, so deriving it in one place keeps a
|
|
269
|
+
// new branch from quietly shipping without one.
|
|
270
|
+
evidence: evidence.map((item) => ({
|
|
271
|
+
...item,
|
|
272
|
+
strength: evidenceStrength(item.type),
|
|
273
|
+
})),
|
|
186
274
|
};
|
|
187
275
|
}
|
|
188
276
|
}
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAqB,MAAM,uBAAuB,CAAC;AAE5E,SAAS,MAAM,CAAC,IAAY,EAAE,SAAiB;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,cAAc,CACrB,MAA+B,EAC/B,IAAY;IAEZ,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QAC1D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtE,OAAQ,OAAmC,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,OAAe;IACrD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC;SACtC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAeD;;;;;GAKG;AACH,SAAS,cAAc,CACrB,MAA+B;IAE/B,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,iCAAiC,CAAC;AAEhD;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,MAA+B;IACpE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,OAAO,QAAQ;IAER;IACQ;IAFnB,YACW,IAAY,EACJ,KAAgC;QADxC,SAAI,GAAJ,IAAI,CAAQ;QACJ,UAAK,GAAL,KAAK,CAA2B;IAChD,CAAC;IAEJ,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,IAAY,EACZ,UAA2B,EAAE;QAE7B,OAAO,IAAI,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,KAAa;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,KAAa;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,GAAG,SAAS,CAAC;QACtB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,KAAK,YAAY,KAAK;oBACtB,KAAK,CAAC,OAAO,KAAK,qCAAqC,EACvD,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC9B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBACzD,CAAC;gBACD,KAAK,GAAG,MAAM,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAA+B,EAC/B,MAA+B;QAE/B,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;oBACvB,KAAK,eAAe,CAAC,CAAC,CAAC;wBACrB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;wBACxD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;wBACpD,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,SAAS,CAAC,IAAI;4BACpB,MAAM;4BACN,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,iBAAiB;yBACpF,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;wBACvB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;wBACxD,MAAM,MAAM,GACV,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;wBACrE,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,SAAS,CAAC,IAAI;4BACpB,MAAM;4BACN,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,gBAAgB;yBACvF,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,WAAW,CAAC,CAAC,CAAC;wBACjB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC;wBACnD,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,SAAS,CAAC,IAAI;4BACpB,MAAM;4BACN,OAAO,EAAE,aAAa,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,IAAI,SAAS,CAAC,KAAK,EAAE;yBAChF,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,aAAa,CAAC,CAAC,CAAC;wBACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC;wBAC5B,MAAM,MAAM,GACV,OAAO,QAAQ,KAAK,QAAQ;4BAC5B,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;wBAC/C,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,SAAS,CAAC,IAAI;4BACpB,MAAM;4BACN,OAAO,EAAE,aAAa,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,mBAAmB;yBAC9E,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,eAAe,CAAC,CAAC,CAAC;wBACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;wBAC7B,MAAM,MAAM,GACV,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;wBACpE,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,SAAS,CAAC,IAAI;4BACpB,MAAM;4BACN,OAAO,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,gBAAgB;yBAC1E,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,aAAa,CAAC,CAAC,CAAC;wBACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;wBACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;wBAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;wBAC3D,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,SAAS,CAAC,IAAI;4BACpB,MAAM;4BACN,OAAO,EAAE,kBAAkB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,EAAE;4BACjE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;yBAClC,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,aAAa,CAAC,CAAC,CAAC;wBACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;wBAClE,IAAI,MAAM,GAAG,KAAK,CAAC;wBACnB,IAAI,CAAC;4BACH,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;wBACpB,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,MAAM;gCACJ,KAAK,YAAY,KAAK;oCACtB,MAAM,IAAI,KAAK;oCACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;4BAC1B,IAAI,CAAC,MAAM;gCAAE,MAAM,KAAK,CAAC;wBAC3B,CAAC;wBACD,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,SAAS,CAAC,IAAI;4BACpB,MAAM;4BACN,OAAO,EAAE,kBAAkB,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE;4BAClE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;yBAClC,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,WAAW,CAAC,CAAC,CAAC;wBACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;wBACjD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;6BAChC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;6BAC5B,MAAM,CAAC,KAAK,CAAC,CAAC;wBACjB,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,MAAM,CAAC;wBAC3C,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,SAAS,CAAC,IAAI;4BACpB,MAAM;4BACN,OAAO,EAAE,aAAa,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;4BAC5D,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;4BACjC,MAAM;yBACP,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,uBAAuB,CAAC,CAAC,CAAC;wBAC7B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;4BAC7B,kEAAkE;4BAClE,kEAAkE;4BAClE,wDAAwD;4BACxD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;wBACpD,CAAC;wBACD,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;wBAC/C,8DAA8D;wBAC9D,2DAA2D;wBAC3D,gEAAgE;wBAChE,qDAAqD;wBACrD,iEAAiE;wBACjE,gEAAgE;wBAChE,oCAAoC;wBACpC,IAAI,QAAiC,CAAC;wBACtC,IAAI,CAAC;4BACH,QAAQ,GAAG,cAAc,CACvB,MAAM,IAAI,CAAC,KAAK,CAAC;gCACf,GAAG;gCACH,MAAM,EAAE,SAAS,CAAC,MAAM;gCACxB,SAAS,EAAE,SAAS,CAAC,SAAS;6BAC/B,CAAC,CACH,CAAC;wBACJ,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,SAAS,CAAC,IAAI;gCACpB,MAAM,EAAE,KAAK;gCACb,YAAY,EAAE,IAAI;gCAClB,OAAO,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gCAClG,MAAM,EAAE,GAAG;6BACZ,CAAC,CAAC;4BACH,MAAM;wBACR,CAAC;wBACD,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;wBACvD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;wBACjD,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,SAAS,CAAC,IAAI;4BACpB,MAAM;4BACN,OAAO,EAAE,uBAAuB,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,iBAAiB;4BACvG,MAAM,EAAE,GAAG;yBACZ,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAChE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/C,oEAAoE;YACpE,sEAAsE;YACtE,gDAAgD;YAChD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChC,GAAG,IAAI;gBACP,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;aACtC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF"}
|
package/dist/index.test.js
CHANGED
|
@@ -45,5 +45,19 @@ describe("Verifier", () => {
|
|
|
45
45
|
expect(escaped.verified).toBe(false);
|
|
46
46
|
expect(escaped.evidence[0]?.summary).toBe("verification_path_outside_workspace");
|
|
47
47
|
});
|
|
48
|
+
it("stamps each item with how it was established", async () => {
|
|
49
|
+
const root = await mkdtemp(join(tmpdir(), "melra-verifier-"));
|
|
50
|
+
roots.push(root);
|
|
51
|
+
await writeFile(join(root, "present.txt"), "content");
|
|
52
|
+
const verifier = await Verifier.create(root);
|
|
53
|
+
const { evidence } = await verifier.verify([
|
|
54
|
+
{ type: "file_exists", path: "present.txt" },
|
|
55
|
+
{ type: "result_equals", path: "ok", value: true },
|
|
56
|
+
], { ok: true });
|
|
57
|
+
// Same receipt, two different claims: one re-read the disk, the other only
|
|
58
|
+
// re-read what the adapter handed back.
|
|
59
|
+
expect(evidence[0]?.strength).toBe("state");
|
|
60
|
+
expect(evidence[1]?.strength).toBe("execution");
|
|
61
|
+
});
|
|
48
62
|
});
|
|
49
63
|
//# sourceMappingURL=index.test.js.map
|
package/dist/index.test.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,KAAK,GAAa,EAAE,CAAC;AAE3B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAClC;YACE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;YACvD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;YAC3C;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D;SACF,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAClC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAChE,EAAE,MAAM,EAAE,WAAW,EAAE,CACxB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAClC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAC9C,EAAE,CACH,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CACnC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EACjD,EAAE,CACH,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CACvC,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,KAAK,GAAa,EAAE,CAAC;AAE3B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAClC;YACE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;YACvD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;YAC3C;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D;SACF,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAClC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAChE,EAAE,MAAM,EAAE,WAAW,EAAE,CACxB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAClC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAC9C,EAAE,CACH,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CACnC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EACjD,EAAE,CACH,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CACvC,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CACxC;YACE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;YAC5C,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;SACnD,EACD,EAAE,EAAE,EAAE,IAAI,EAAE,CACb,CAAC;QACF,2EAA2E;QAC3E,wCAAwC;QACxC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"probe.test.d.ts","sourceRoot":"","sources":["../src/probe.test.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,116 @@
|
|
|
1
|
+
// Copyright 2026 XAGI Labs Private Limited
|
|
2
|
+
// SPDX-License-Identifier: Apache-2.0
|
|
3
|
+
// The independent-channel predicate, with the probe stubbed.
|
|
4
|
+
//
|
|
5
|
+
// What is worth pinning here is not that a match passes — it is what the URL
|
|
6
|
+
// is allowed to be built out of, and what happens when the channel is missing.
|
|
7
|
+
import { mkdtemp, rm } from "node:fs/promises";
|
|
8
|
+
import { tmpdir } from "node:os";
|
|
9
|
+
import { join } from "node:path";
|
|
10
|
+
import { afterAll, beforeAll, describe, expect, it } from "vitest";
|
|
11
|
+
import { EvidencePredicateSchema } from "@melra/protocol";
|
|
12
|
+
import { Verifier } from "./index.js";
|
|
13
|
+
let root;
|
|
14
|
+
/** Every URL the probe was asked for, in order. */
|
|
15
|
+
let asked;
|
|
16
|
+
beforeAll(async () => {
|
|
17
|
+
root = await mkdtemp(join(tmpdir(), "melra-probe-"));
|
|
18
|
+
});
|
|
19
|
+
afterAll(async () => {
|
|
20
|
+
await rm(root, { recursive: true, force: true });
|
|
21
|
+
});
|
|
22
|
+
const probeReturning = (body, status = 200) => {
|
|
23
|
+
asked = [];
|
|
24
|
+
return async (request) => {
|
|
25
|
+
asked.push(request.url);
|
|
26
|
+
return { success: status < 300, status, content: JSON.stringify(body) };
|
|
27
|
+
};
|
|
28
|
+
};
|
|
29
|
+
const predicate = (over = {}) => EvidencePredicateSchema.parse({
|
|
30
|
+
type: "http_resource_matches",
|
|
31
|
+
url: "https://api.example.com/refunds/{{json.id}}",
|
|
32
|
+
path: "json.state",
|
|
33
|
+
value: "succeeded",
|
|
34
|
+
...over,
|
|
35
|
+
});
|
|
36
|
+
/** What the operation being verified returned: a refund was created. */
|
|
37
|
+
const created = { status: 201, content: JSON.stringify({ id: "rf_123" }) };
|
|
38
|
+
describe("verification through a channel that did not act", () => {
|
|
39
|
+
it("re-reads the resource the effect named and compares provider state", async () => {
|
|
40
|
+
const verifier = await Verifier.create(root, {
|
|
41
|
+
probe: probeReturning({ state: "succeeded" }),
|
|
42
|
+
});
|
|
43
|
+
const { verified, evidence } = await verifier.verify([predicate()], created);
|
|
44
|
+
expect(verified).toBe(true);
|
|
45
|
+
expect(asked).toEqual(["https://api.example.com/refunds/rf_123"]);
|
|
46
|
+
// The point of the whole predicate: this is the one item a caller can rank
|
|
47
|
+
// above the acting channel's own word.
|
|
48
|
+
expect(evidence[0]?.strength).toBe("independent");
|
|
49
|
+
});
|
|
50
|
+
it("fails when the provider never got there, even though the call succeeded", async () => {
|
|
51
|
+
const verifier = await Verifier.create(root, {
|
|
52
|
+
probe: probeReturning({ state: "pending" }),
|
|
53
|
+
});
|
|
54
|
+
const { verified } = await verifier.verify([predicate()], created);
|
|
55
|
+
expect(verified).toBe(false);
|
|
56
|
+
});
|
|
57
|
+
it("fails rather than passes when there is no channel to ask", async () => {
|
|
58
|
+
const verifier = await Verifier.create(root);
|
|
59
|
+
const { verified, evidence } = await verifier.verify([predicate()], created);
|
|
60
|
+
expect(verified).toBe(false);
|
|
61
|
+
expect(evidence[0]?.summary).toBe("verification_probe_unavailable");
|
|
62
|
+
});
|
|
63
|
+
it("percent-encodes what it splices, so a response cannot rewrite the path", async () => {
|
|
64
|
+
const verifier = await Verifier.create(root, {
|
|
65
|
+
probe: probeReturning({ state: "succeeded" }),
|
|
66
|
+
});
|
|
67
|
+
await verifier.verify([predicate()], {
|
|
68
|
+
status: 201,
|
|
69
|
+
content: JSON.stringify({ id: "../../admin?all=1" }),
|
|
70
|
+
});
|
|
71
|
+
expect(asked).toEqual([
|
|
72
|
+
"https://api.example.com/refunds/..%2F..%2Fadmin%3Fall%3D1",
|
|
73
|
+
]);
|
|
74
|
+
});
|
|
75
|
+
it("fails when the token names nothing in the result", async () => {
|
|
76
|
+
const verifier = await Verifier.create(root, {
|
|
77
|
+
probe: probeReturning({ state: "succeeded" }),
|
|
78
|
+
});
|
|
79
|
+
const { verified, evidence } = await verifier.verify([predicate()], {
|
|
80
|
+
status: 201,
|
|
81
|
+
content: JSON.stringify({ reference: "rf_123" }),
|
|
82
|
+
});
|
|
83
|
+
expect(verified).toBe(false);
|
|
84
|
+
expect(evidence[0]?.summary).toBe("verification_token_unresolved:json.id");
|
|
85
|
+
// Nothing was fetched: a URL with a hole in it is not a destination.
|
|
86
|
+
expect(asked).toEqual([]);
|
|
87
|
+
});
|
|
88
|
+
it("only reads — the schema has no verb that could change anything", () => {
|
|
89
|
+
expect(() => predicate({ method: "DELETE" })).toThrow();
|
|
90
|
+
});
|
|
91
|
+
it("separates a provider that answered no from one that did not answer", async () => {
|
|
92
|
+
const verifier = await Verifier.create(root, {
|
|
93
|
+
probe: async () => {
|
|
94
|
+
throw new Error("ECONNREFUSED");
|
|
95
|
+
},
|
|
96
|
+
});
|
|
97
|
+
const { verified, evidence } = await verifier.verify([predicate()], created);
|
|
98
|
+
// Unproven is not proven, so the task still does not verify — but "no such
|
|
99
|
+
// refund" and "could not ask" are different facts, and only the first is
|
|
100
|
+
// grounds to call the effect failed.
|
|
101
|
+
expect(verified).toBe(false);
|
|
102
|
+
expect(evidence[0]).toMatchObject({
|
|
103
|
+
passed: false,
|
|
104
|
+
inconclusive: true,
|
|
105
|
+
source: "https://api.example.com/refunds/rf_123",
|
|
106
|
+
});
|
|
107
|
+
});
|
|
108
|
+
it("does not call a value mismatch inconclusive", async () => {
|
|
109
|
+
const verifier = await Verifier.create(root, {
|
|
110
|
+
probe: probeReturning({ state: "pending" }),
|
|
111
|
+
});
|
|
112
|
+
const { evidence } = await verifier.verify([predicate()], created);
|
|
113
|
+
expect(evidence[0]?.inconclusive).toBeUndefined();
|
|
114
|
+
});
|
|
115
|
+
});
|
|
116
|
+
//# sourceMappingURL=probe.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"probe.test.js","sourceRoot":"","sources":["../src/probe.test.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,6DAA6D;AAC7D,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAE/E,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAsB,MAAM,YAAY,CAAC;AAE1D,IAAI,IAAY,CAAC;AACjB,mDAAmD;AACnD,IAAI,KAAe,CAAC;AAEpB,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AACH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAiB,EAAE;IACpE,KAAK,GAAG,EAAE,CAAC;IACX,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1E,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,OAAgC,EAAE,EAAE,EAAE,CACvD,uBAAuB,CAAC,KAAK,CAAC;IAC5B,IAAI,EAAE,uBAAuB;IAC7B,GAAG,EAAE,6CAA6C;IAClD,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,WAAW;IAClB,GAAG,IAAI;CACR,CAAC,CAAC;AAEL,wEAAwE;AACxE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAE3E,QAAQ,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC/D,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7E,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC;QAClE,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7E,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE;YACnC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACpB,2DAA2D;SAC5D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE;YAClE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAC3E,qEAAqE;QACrE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3C,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAClC,CAAC;SACF,CAAC,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,qCAAqC;QACrC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAChC,MAAM,EAAE,KAAK;YACb,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,wCAAwC;SACjD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,aAAa,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@melra/verifier-core",
|
|
3
|
-
"version": "0.3.0-alpha.
|
|
3
|
+
"version": "0.3.0-alpha.11",
|
|
4
4
|
"description": "Deterministic evidence predicates and result verification for MELRA.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -21,8 +21,8 @@
|
|
|
21
21
|
"dist"
|
|
22
22
|
],
|
|
23
23
|
"dependencies": {
|
|
24
|
-
"@melra/protocol": "0.3.0-alpha.
|
|
25
|
-
"@melra/receipt-schema": "0.3.0-alpha.
|
|
24
|
+
"@melra/protocol": "0.3.0-alpha.11",
|
|
25
|
+
"@melra/receipt-schema": "0.3.0-alpha.11"
|
|
26
26
|
},
|
|
27
27
|
"scripts": {
|
|
28
28
|
"build": "tsc -p tsconfig.json",
|