@nklisch/pi-enhanced 0.1.0

package/node_modules/@nklisch/pi-plugins/dist/domain/configured-values.js

@@ -0,0 +1,273 @@
+import { z } from "zod";
+import { ConfigurationKeySchema, PluginConfigurationSchema, testConfigurationPattern, } from "./configuration.js";
+import { ContentDigestSchema, hashContent } from "./content-manifest.js";
+import { PluginConfigurationRefSchema } from "./state/references.js";
+import { ScopeReferenceSchema } from "./state/scope.js";
+import { PluginKeySchema } from "./identity.js";
+const encoder = new TextEncoder();
+function hasLoneSurrogate(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff)
+                return true;
+            index += 1;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff)
+            return true;
+    }
+    return false;
+}
+function canonicalFileUrl(value) {
+    if (value.includes("\\") || value.includes("\0") || hasLoneSurrogate(value))
+        return false;
+    if (!value.startsWith("file://"))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== "file:" || parsed.hostname !== "" || parsed.username !== "" || parsed.password !== "")
+        return false;
+    if (parsed.search !== "" || parsed.hash !== "" || parsed.pathname.length === 0)
+        return false;
+    if (parsed.href !== value || !parsed.pathname.startsWith("/"))
+        return false;
+    const rawSegments = parsed.pathname.split("/");
+    for (const [index, raw] of rawSegments.entries()) {
+        if (index === 0 && raw === "")
+            continue;
+        if (raw === "")
+            return false;
+        let decoded;
+        try {
+            decoded = decodeURIComponent(raw);
+        }
+        catch {
+            return false;
+        }
+        if (decoded === "." || decoded === ".." || decoded.includes("/") || decoded.includes("\\") ||
+            decoded.includes("\0") || [...decoded].some((character) => {
+            const code = character.codePointAt(0) ?? 0;
+            return code < 0x20 || code === 0x7f;
+        }))
+            return false;
+    }
+    return true;
+}
+/** One platform-neutral, absolute path spelling. */
+export const CanonicalConfigurationPathSchema = z
+    .string()
+    .superRefine((value, context) => {
+    if (!canonicalFileUrl(value)) {
+        context.addIssue({ code: "custom", message: "configuration path must be a canonical absolute file URL" });
+    }
+})
+    .brand();
+export const ConfiguredValueSchemaRegistry = {
+    string: z.object({ kind: z.literal("string"), value: z.string() }).strict().readonly(),
+    number: z.object({ kind: z.literal("number"), value: z.number().finite() }).strict().readonly(),
+    boolean: z.object({ kind: z.literal("boolean"), value: z.boolean() }).strict().readonly(),
+    directory: z.object({ kind: z.literal("directory"), value: CanonicalConfigurationPathSchema }).strict().readonly(),
+    file: z.object({ kind: z.literal("file"), value: CanonicalConfigurationPathSchema }).strict().readonly(),
+    strings: z.object({ kind: z.literal("strings"), value: z.array(z.string()).readonly() }).strict().readonly(),
+};
+const configuredValueSchemas = Object.values(ConfiguredValueSchemaRegistry);
+export const ConfiguredValueSchema = z.discriminatedUnion("kind", configuredValueSchemas).readonly();
+export const SecretLocatorSchema = z
+    .string()
+    .regex(/^secret-v1:sha256:[0-9a-f]{64}$/)
+    .brand();
+export const ConfigurationWriteIdSchema = z
+    .string()
+    .regex(/^config-write-v1:[A-Za-z0-9_-]{22,128}$/)
+    .brand();
+const ConfigurationDocumentValueSchema = z.object({
+    key: ConfigurationKeySchema,
+    value: ConfiguredValueSchema,
+}).strict().readonly();
+const ConfigurationDocumentSecretSchema = z.object({
+    key: ConfigurationKeySchema,
+    locator: SecretLocatorSchema,
+}).strict().readonly();
+export const PluginConfigurationDocumentSchemaV1 = z.object({
+    schemaVersion: z.literal(1),
+    configurationRef: PluginConfigurationRefSchema,
+    plugin: PluginKeySchema,
+    scope: ScopeReferenceSchema,
+    descriptorDigest: ContentDigestSchema,
+    revision: ContentDigestSchema,
+    values: z.array(ConfigurationDocumentValueSchema).readonly(),
+    secrets: z.array(ConfigurationDocumentSecretSchema).readonly(),
+}).strict().readonly().superRefine((document, context) => {
+    const seen = new Set();
+    for (const [index, entry] of document.values.entries()) {
+        if (seen.has(entry.key))
+            context.addIssue({ code: "custom", path: ["values", index, "key"], message: "duplicate configuration key" });
+        seen.add(entry.key);
+    }
+    let previousValueKey;
+    for (const [index, entry] of document.values.entries()) {
+        if (previousValueKey !== undefined && utf8Compare(previousValueKey, entry.key) >= 0) {
+            context.addIssue({ code: "custom", path: ["values", index, "key"], message: "configuration values must be in unsigned UTF-8 key order" });
+        }
+        previousValueKey = entry.key;
+    }
+    let previousSecretKey;
+    for (const [index, entry] of document.secrets.entries()) {
+        if (seen.has(entry.key))
+            context.addIssue({ code: "custom", path: ["secrets", index, "key"], message: "duplicate configuration key" });
+        seen.add(entry.key);
+        if (previousSecretKey !== undefined && utf8Compare(previousSecretKey, entry.key) >= 0) {
+            context.addIssue({ code: "custom", path: ["secrets", index, "key"], message: "configuration secrets must be in unsigned UTF-8 key order" });
+        }
+        previousSecretKey = entry.key;
+    }
+});
+function utf8Compare(left, right) {
+    const a = encoder.encode(left);
+    const b = encoder.encode(right);
+    const length = Math.min(a.byteLength, b.byteLength);
+    for (let index = 0; index < length; index += 1) {
+        const difference = (a[index] ?? 0) - (b[index] ?? 0);
+        if (difference !== 0)
+            return difference;
+    }
+    return a.byteLength - b.byteLength;
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        return Object.fromEntries(Object.keys(record).sort(utf8Compare).map((key) => [key, canonicalize(record[key])]));
+    }
+    return value;
+}
+function digestJson(tag, value, sha256) {
+    return ContentDigestSchema.parse(hashContent(encoder.encode(`${tag}\0${JSON.stringify(canonicalize(value))}`), sha256));
+}
+function descriptorProjection(option) {
+    return {
+        key: option.key,
+        value: option.value,
+        required: option.required,
+        sensitive: option.sensitive,
+    };
+}
+/** Hash validation and execution descriptors, not labels or provenance. */
+export function digestConfigurationDescriptors(configuration, sha256) {
+    const valid = PluginConfigurationSchema.parse(configuration);
+    return digestJson("configuration-descriptor-v1", valid.options.map(descriptorProjection).sort((left, right) => utf8Compare(String(left.key), String(right.key))), sha256);
+}
+/** Derive a locator from all scope/config identity fields plus an unpredictable write id. */
+export function deriveSecretLocator(input, sha256) {
+    const scope = ScopeReferenceSchema.parse(input.scope);
+    const plugin = PluginKeySchema.parse(input.plugin);
+    const configurationRef = PluginConfigurationRefSchema.parse(input.configurationRef);
+    const key = ConfigurationKeySchema.parse(input.key);
+    const writeId = ConfigurationWriteIdSchema.parse(input.writeId);
+    return SecretLocatorSchema.parse(digestJson("secret-locator-v1", { scope, plugin, configurationRef, key, writeId }, sha256).replace(/^sha256:/, "secret-v1:sha256:"));
+}
+function sortDocument(document) {
+    return {
+        ...document,
+        values: [...document.values].sort((left, right) => utf8Compare(left.key, right.key)),
+        secrets: [...document.secrets].sort((left, right) => utf8Compare(left.key, right.key)),
+    };
+}
+function documentRevision(document, sha256) {
+    return digestJson("plugin-configuration-document-v1", sortDocument(document), sha256);
+}
+const ConfigurationDocumentInputSchema = z.object({
+    schemaVersion: z.literal(1),
+    configurationRef: PluginConfigurationRefSchema,
+    plugin: PluginKeySchema,
+    scope: ScopeReferenceSchema,
+    descriptorDigest: ContentDigestSchema,
+    revision: ContentDigestSchema.optional(),
+    values: z.array(ConfigurationDocumentValueSchema).readonly(),
+    secrets: z.array(ConfigurationDocumentSecretSchema).readonly(),
+}).strict();
+/** Build a sorted document and derive its CAS revision; caller claims are checked. */
+export function createPluginConfigurationDocument(input, sha256) {
+    const value = ConfigurationDocumentInputSchema.parse(input);
+    const withoutRevision = sortDocument({
+        schemaVersion: 1,
+        configurationRef: value.configurationRef,
+        plugin: value.plugin,
+        scope: value.scope,
+        descriptorDigest: value.descriptorDigest,
+        values: value.values,
+        secrets: value.secrets,
+    });
+    const revision = documentRevision(withoutRevision, sha256);
+    if (value.revision !== undefined && value.revision !== revision) {
+        throw new Error("configuration document revision does not match its content");
+    }
+    return PluginConfigurationDocumentSchemaV1.parse({ ...withoutRevision, revision });
+}
+function optionByKey(configuration) {
+    return new Map(configuration.options.map((option) => [option.key, option]));
+}
+/** Verify descriptor binding, sensitivity partition, kinds, constraints, order, and revision. */
+export function verifyPluginConfigurationDocument(input, descriptors, sha256) {
+    // A persisted document must already be canonical; creation is the only API
+    // that normalizes caller ordering before deriving a revision.
+    PluginConfigurationDocumentSchemaV1.parse(input);
+    const document = createPluginConfigurationDocument(input, sha256);
+    const configuration = PluginConfigurationSchema.parse(descriptors);
+    const expectedDescriptorDigest = digestConfigurationDescriptors(configuration, sha256);
+    if (document.descriptorDigest !== expectedDescriptorDigest)
+        throw new Error("configuration descriptor digest does not match document");
+    const options = optionByKey(configuration);
+    const keys = new Set();
+    for (const entry of document.values) {
+        const option = options.get(entry.key);
+        if (option === undefined || option.sensitive || entry.value.kind !== option.value.kind)
+            throw new Error("configuration value does not match its descriptor");
+        if (!valueSatisfiesDescriptor(entry.value, option))
+            throw new Error("configuration value violates its descriptor");
+        keys.add(entry.key);
+    }
+    for (const entry of document.secrets) {
+        const option = options.get(entry.key);
+        if (option === undefined || !option.sensitive || keys.has(entry.key))
+            throw new Error("configuration secret does not match its descriptor");
+        keys.add(entry.key);
+    }
+    for (const option of configuration.options) {
+        if (option.required && !keys.has(option.key))
+            throw new Error("required configuration value is missing");
+    }
+    return document;
+}
+function valueSatisfiesDescriptor(value, option) {
+    if (value.kind !== option.value.kind)
+        return false;
+    switch (option.value.kind) {
+        case "string":
+            return value.kind === "string" &&
+                (option.value.pattern === undefined || testConfigurationPattern(option.value.pattern, value.value));
+        case "number":
+            return value.kind === "number" &&
+                (option.value.min === undefined || value.value >= option.value.min) &&
+                (option.value.max === undefined || value.value <= option.value.max);
+        case "boolean": return value.kind === "boolean";
+        case "directory":
+        case "file": return value.kind === option.value.kind;
+        case "strings":
+            return value.kind === "strings" &&
+                (option.value.minItems === undefined || value.value.length >= option.value.minItems) &&
+                (option.value.maxItems === undefined || value.value.length <= option.value.maxItems);
+        default: return assertNever(option.value);
+    }
+}
+function assertNever(value) {
+    throw new Error(`unhandled configuration descriptor: ${String(value)}`);
+}
+//# sourceMappingURL=configured-values.js.map

package/node_modules/@nklisch/pi-plugins/dist/domain/configured-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configured-values.js","sourceRoot":"","sources":["../../src/domain/configured-values.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EAGzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAsB,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAA+B,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAuB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AAGhE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,gBAAgB,CAAC,KAAa;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,MAAM,IAAI,IAAI,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YACtE,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5H,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,CAAC,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACxC,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;YACxD,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;QACtC,CAAC,CAAC;YACF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC,CAAC;KACD,KAAK,EAAgC,CAAC;AAGzC,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/F,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClH,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxG,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpG,CAAC;AAEX,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAGzE,CAAC;AACF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC;AAIrG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,EAAE;KACR,KAAK,CAAC,iCAAiC,CAAC;KACxC,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,EAAE;KACR,KAAK,CAAC,yCAAyC,CAAC;KAChD,KAAK,EAA0B,CAAC;AAGnC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,sBAAsB;IAC3B,KAAK,EAAE,qBAAqB;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AACvB,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,GAAG,EAAE,sBAAsB;IAC3B,OAAO,EAAE,mBAAmB;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,gBAAgB,EAAE,4BAA4B;IAC9C,MAAM,EAAE,eAAe;IACvB,KAAK,EAAE,oBAAoB;IAC3B,gBAAgB,EAAE,mBAAmB;IACrC,QAAQ,EAAE,mBAAmB;IAC7B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC5D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACtI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,gBAAoC,CAAC;IACzC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,gBAAgB,KAAK,SAAS,IAAI,WAAW,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;QAC5I,CAAC;QACD,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC;IAC/B,CAAC;IACD,IAAI,iBAAqC,CAAC;IAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACvI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,iBAAiB,KAAK,SAAS,IAAI,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,2DAA2D,EAAE,CAAC,CAAC;QAC9I,CAAC;QACD,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC;IAChC,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACpD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,KAAc,EAAE,MAAc;IAC7D,OAAO,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAC1C,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAChE,MAAM,CACP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA2B;IACvD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,8BAA8B,CAC5C,aAAkC,EAClC,MAAc;IAEd,MAAM,KAAK,GAAG,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,OAAO,UAAU,CACf,6BAA6B,EAC7B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAC/G,MAAM,CACP,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CACjC,KAME,EACF,MAAc;IAEd,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO,mBAAmB,CAAC,KAAK,CAAC,UAAU,CACzC,mBAAmB,EACnB,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,EACjD,MAAM,CACP,CAAC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,QAAuD;IAC3E,OAAO;QACL,GAAG,QAAQ;QACX,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACpF,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;KACvF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAuD,EAAE,MAAc;IAC/F,OAAO,UAAU,CAAC,kCAAkC,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,gBAAgB,EAAE,4BAA4B;IAC9C,MAAM,EAAE,eAAe;IACvB,KAAK,EAAE,oBAAoB;IAC3B,gBAAgB,EAAE,mBAAmB;IACrC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACxC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC5D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,sFAAsF;AACtF,MAAM,UAAU,iCAAiC,CAAC,KAAc,EAAE,MAAc;IAC9E,MAAM,KAAK,GAAG,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,aAAa,EAAE,CAAC;QAChB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,mCAAmC,CAAC,KAAK,CAAC,EAAE,GAAG,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,aAAkC;IACrD,OAAO,IAAI,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,iCAAiC,CAC/C,KAAc,EACd,WAAgC,EAChC,MAAc;IAEd,2EAA2E;IAC3E,8DAA8D;IAC9D,mCAAmC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,iCAAiC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,wBAAwB,GAAG,8BAA8B,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvF,IAAI,QAAQ,CAAC,gBAAgB,KAAK,wBAAwB;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACvI,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC7J,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnH,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC5I,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAsB,EAAE,MAA2B;IACnF,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACnD,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAC5B,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAC5B,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;gBACnE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxE,KAAK,SAAS,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAChD,KAAK,WAAW,CAAC;QACjB,KAAK,MAAM,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACrD,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS;gBAC7B,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACpF,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzF,SAAS,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/domain/content-manifest.d.ts

@@ -0,0 +1,72 @@
+import { z } from "zod";
+import type { Sha256 } from "./source.js";
+/** Limits for the public manifest verifier. They protect callers even when a
+ * manifest did not come from the filesystem writer. */
+export declare const DEFAULT_CONTENT_MANIFEST_LIMITS: Readonly<{
+    maxEntries: 20000;
+    maxPathBytes: 1024;
+    maxSegmentBytes: 255;
+    maxTotalPathBytes: number;
+}>;
+export type ContentManifestLimits = Readonly<{
+    [K in keyof typeof DEFAULT_CONTENT_MANIFEST_LIMITS]: number;
+}>;
+export declare const ContentDigestSchema: z.core.$ZodBranded<z.ZodString, "ContentDigest", "out">;
+export type ContentDigest = z.infer<typeof ContentDigestSchema>;
+/**
+ * Content paths are a format-level contract rather than a host path. Keeping
+ * this check here lets manifest verification reject a forged tree without
+ * importing a platform path module.
+ */
+export declare function normalizeContentPath(path: string): string;
+export declare const ContentManifestEntrySchema: z.ZodDiscriminatedUnion<[z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"directory">;
+    path: z.ZodString;
+    mode: z.ZodLiteral<493>;
+}, z.core.$strict>>, z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"file">;
+    path: z.ZodString;
+    mode: z.ZodUnion<readonly [z.ZodLiteral<420>, z.ZodLiteral<493>]>;
+    size: z.ZodNumber;
+    digest: z.core.$ZodBranded<z.ZodString, "ContentDigest", "out">;
+}, z.core.$strict>>, z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"symlink">;
+    path: z.ZodString;
+    mode: z.ZodLiteral<511>;
+    target: z.ZodString;
+    digest: z.core.$ZodBranded<z.ZodString, "ContentDigest", "out">;
+}, z.core.$strict>>], "kind">;
+export type ContentManifestEntry = z.infer<typeof ContentManifestEntrySchema>;
+export declare function hashContent(bytes: Uint8Array, sha256: Sha256): ContentDigest;
+/** Bind a verified source identity to the exact retained tree digest. */
+export declare function createMaterializationBinding(sourceHash: string, contentRootDigest: ContentDigest, sha256: Sha256): ContentDigest;
+export declare const ContentManifestSchema: z.ZodReadonly<z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"sha256">;
+    entries: z.ZodReadonly<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodReadonly<z.ZodObject<{
+        kind: z.ZodLiteral<"directory">;
+        path: z.ZodString;
+        mode: z.ZodLiteral<493>;
+    }, z.core.$strict>>, z.ZodReadonly<z.ZodObject<{
+        kind: z.ZodLiteral<"file">;
+        path: z.ZodString;
+        mode: z.ZodUnion<readonly [z.ZodLiteral<420>, z.ZodLiteral<493>]>;
+        size: z.ZodNumber;
+        digest: z.core.$ZodBranded<z.ZodString, "ContentDigest", "out">;
+    }, z.core.$strict>>, z.ZodReadonly<z.ZodObject<{
+        kind: z.ZodLiteral<"symlink">;
+        path: z.ZodString;
+        mode: z.ZodLiteral<511>;
+        target: z.ZodString;
+        digest: z.core.$ZodBranded<z.ZodString, "ContentDigest", "out">;
+    }, z.core.$strict>>], "kind">>>;
+    rootDigest: z.core.$ZodBranded<z.ZodString, "ContentDigest", "out">;
+}, z.core.$strict>>;
+export type ContentManifest = z.infer<typeof ContentManifestSchema>;
+export declare function createContentManifest(entries: readonly ContentManifestEntry[], sha256: Sha256, limits?: Partial<ContentManifestLimits>): ContentManifest;
+export declare function verifyContentManifest(input: unknown, sha256: Sha256, inputLimits?: Partial<ContentManifestLimits>): ContentManifest;
+/** Used by the filesystem adapter to validate an archive or source link target. */
+export declare function normalizeContentLinkTarget(path: string, target: string): Readonly<{
+    target: string;
+    resolvedPath: string;
+}>;