@ornexus/neocortex 4.60.68 → 4.60.70

package/packages/client/dist/private-execution/pact-test-source.js

@@ -1,258 +1 @@
-/**
- * Static first-pass contract for isolated Pact artifacts. Parsing never runs
- * generated code. A passing result is not a Pact execution/QA receipt.
- */
-import { parse } from '@babel/parser';
-import { lstatSync, realpathSync } from 'node:fs';
-import { join, posix, resolve } from 'node:path';
-const MAX_SOURCE_BYTES = 256 * 1024;
-const MAX_AST_NODES = 100_000;
-function record(value) {
-    return !!value && typeof value === 'object' && !Array.isArray(value);
-}
-function importedNames(node) {
-    const names = new Set();
-    if (!Array.isArray(node.specifiers))
-        return names;
-    for (const specifier of node.specifiers) {
-        if (!record(specifier) || specifier.type !== 'ImportSpecifier'
-            || !record(specifier.imported) || typeof specifier.imported.name !== 'string')
-            continue;
-        names.add(specifier.imported.name);
-    }
-    return names;
-}
-function projectImportNames(node, testPath, projectRoot) {
-    const importPath = record(node.source) ? node.source.value : undefined;
-    if (typeof importPath !== 'string' || importPath.length > 240
-        || !/^\.\.?\/[A-Za-z0-9_./-]+$/.test(importPath)
-        || node.importKind === 'type' || !Array.isArray(node.specifiers)
-        || node.specifiers.length < 1 || node.specifiers.length > 16) {
-        throw new Error('private-execution-pact-source-invalid');
-    }
-    const relative = posix.normalize(posix.join(posix.dirname(testPath), importPath));
-    if (!/^(?:src|app|lib|packages|clients)\/[A-Za-z0-9_./-]+$/.test(relative)
-        || relative.split('/').some((segment) => segment === '..' || segment === '.')) {
-        throw new Error('private-execution-pact-source-invalid');
-    }
-    const root = resolve(projectRoot);
-    if (realpathSync(root) !== root || !lstatSync(root).isDirectory()) {
-        throw new Error('private-execution-pact-source-invalid');
-    }
-    const candidates = /\.(?:ts|tsx|js|mjs)$/.test(relative)
-        ? [relative, ...(relative.endsWith('.js') ? [`${relative.slice(0, -3)}.ts`,
-                `${relative.slice(0, -3)}.tsx`] : [])]
-        : [`${relative}.ts`, `${relative}.tsx`, `${relative}.js`, `${relative}.mjs`,
-            `${relative}/index.ts`, `${relative}/index.tsx`, `${relative}/index.js`];
-    const matches = [];
-    for (const candidate of candidates) {
-        let current = root;
-        try {
-            const parts = candidate.split('/');
-            for (const [index, part] of parts.entries()) {
-                current = join(current, part);
-                const entry = lstatSync(current);
-                if (entry.isSymbolicLink() || (index === parts.length - 1
-                    ? !entry.isFile() || entry.size < 1 || entry.size > 1024 * 1024
-                    : !entry.isDirectory()))
-                    throw new Error('private-execution-pact-source-invalid');
-            }
-            matches.push(candidate);
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT') {
-                throw new Error('private-execution-pact-source-invalid');
-            }
-        }
-    }
-    if (matches.length !== 1)
-        throw new Error('private-execution-pact-source-invalid');
-    const names = new Set();
-    for (const specifier of node.specifiers) {
-        if (!record(specifier) || !['ImportSpecifier', 'ImportDefaultSpecifier'].includes(specifier.type)
-            || specifier.importKind === 'type' || !record(specifier.local)
-            || specifier.local.type !== 'Identifier' || typeof specifier.local.name !== 'string') {
-            throw new Error('private-execution-pact-source-invalid');
-        }
-        names.add(specifier.local.name);
-    }
-    return names;
-}
-function memberName(node) {
-    if (!record(node) || node.type !== 'MemberExpression' || node.computed === true
-        || !record(node.property) || node.property.type !== 'Identifier')
-        return undefined;
-    return typeof node.property.name === 'string' ? node.property.name : undefined;
-}
-function requestLiterals(node) {
-    if (!record(node) || node.type !== 'ObjectExpression' || !Array.isArray(node.properties))
-        return undefined;
-    let method;
-    let path;
-    for (const property of node.properties) {
-        if (!record(property) || property.type !== 'ObjectProperty' || property.computed === true
-            || !record(property.key) || !record(property.value))
-            return undefined;
-        const name = property.key.type === 'Identifier' ? property.key.name
-            : property.key.type === 'StringLiteral' ? property.key.value : undefined;
-        if (name === 'method' || name === 'path') {
-            if (property.value.type !== 'StringLiteral' || typeof property.value.value !== 'string')
-                return undefined;
-            if (name === 'method') {
-                if (method !== undefined)
-                    return undefined;
-                method = property.value.value;
-            }
-            else {
-                if (path !== undefined)
-                    return undefined;
-                path = property.value.value;
-            }
-        }
-    }
-    return method !== undefined && path !== undefined ? { method, path } : undefined;
-}
-function matchesEndpointPath(template, actual) {
-    if (template.length > 180 || actual.length > 2048 || /[?#]/.test(actual))
-        return false;
-    const expected = template.split('/');
-    const candidate = actual.split('/');
-    if (expected.length !== candidate.length)
-        return false;
-    return expected.every((segment, index) => {
-        const value = candidate[index];
-        if (!segment.includes('{') && !segment.includes('}'))
-            return segment === value;
-        // One parameter per segment keeps matching linear and rejects ambiguous
-        // adjacent templates instead of relying on a backtracking regex.
-        const parameter = /^([^{}]*)\{[^{}]+\}([^{}]*)$/.exec(segment);
-        if (!parameter || !value.startsWith(parameter[1]) || !value.endsWith(parameter[2]))
-            return false;
-        return value.length > parameter[1].length + parameter[2].length;
-    });
-}
-/** Reject comment-only, malformed and non-Pact files before a root patch effect. */
-export function validatePactTestSource(path, source, brokerUrl, expectedInteraction, projectRoot, matchersAggressive) {
-    const kind = path === 'tests/pact/provider/verify.test.ts' ? 'provider' : 'consumer';
-    if ((kind === 'consumer' && !/^tests\/pact\/consumer\/[a-z0-9-]+\.test\.ts$/.test(path))
-        || typeof source !== 'string' || Buffer.byteLength(source, 'utf8') < 80
-        || Buffer.byteLength(source, 'utf8') > MAX_SOURCE_BYTES
-        || brokerUrl !== null && source.includes(brokerUrl)) {
-        throw new Error('private-execution-pact-source-invalid');
-    }
-    let ast;
-    try {
-        ast = parse(source, { sourceType: 'module', plugins: ['typescript'] });
-    }
-    catch {
-        throw new Error('private-execution-pact-source-invalid');
-    }
-    const pactImports = new Set();
-    const vitestImports = new Set();
-    const appImports = new Set();
-    for (const statement of ast.program.body) {
-        if (statement.type !== 'ImportDeclaration')
-            continue;
-        const importPath = statement.source.value;
-        if (importPath !== '@pact-foundation/pact' && importPath !== 'vitest') {
-            if (kind !== 'consumer' || !projectRoot) {
-                throw new Error('private-execution-pact-source-invalid');
-            }
-            for (const name of projectImportNames(statement, path, projectRoot)) {
-                if (appImports.has(name) || ['fetch', 'describe', 'it', 'expect',
-                    'PactV3', 'MatchersV3', 'Verifier'].includes(name)) {
-                    throw new Error('private-execution-pact-source-invalid');
-                }
-                appImports.add(name);
-            }
-            continue;
-        }
-        const names = importedNames(statement);
-        for (const name of names)
-            (importPath === '@pact-foundation/pact' ? pactImports : vitestImports).add(name);
-    }
-    if (!vitestImports.has('describe') || !vitestImports.has('it')
-        || (kind === 'consumer' && (!pactImports.has('PactV3') || !vitestImports.has('expect')))
-        || (kind === 'provider' && !pactImports.has('Verifier'))
-        || [...appImports].some((name) => pactImports.has(name) || vitestImports.has(name))) {
-        throw new Error('private-execution-pact-source-invalid');
-    }
-    // The private root decision is authoritative; generated tests cannot broaden
-    // literal contracts with matcher helpers when exact correspondence was chosen.
-    if (kind === 'consumer' && matchersAggressive === false
-        && [...pactImports].some((name) => name !== 'PactV3')) {
-        throw new Error('private-execution-pact-source-invalid');
-    }
-    const calls = new Set();
-    const constructors = new Set();
-    let brokerEnv = false;
-    let expectedRequest = false;
-    let appClientCalled = false;
-    const stack = [
-        { node: ast.program, inExecuteTest: false },
-    ];
-    let visited = 0;
-    while (stack.length > 0) {
-        const item = stack.pop();
-        const current = item.node;
-        if (!record(current))
-            continue;
-        if (++visited > MAX_AST_NODES)
-            throw new Error('private-execution-pact-source-invalid');
-        if (current.type === 'NewExpression' && record(current.callee)
-            && current.callee.type === 'Identifier' && typeof current.callee.name === 'string') {
-            constructors.add(current.callee.name);
-            if (item.inExecuteTest && appImports.has(current.callee.name))
-                appClientCalled = true;
-        }
-        if (current.type === 'CallExpression') {
-            const callee = current.callee;
-            if (record(callee) && callee.type === 'Identifier' && typeof callee.name === 'string') {
-                calls.add(callee.name);
-                if (item.inExecuteTest && appImports.has(callee.name))
-                    appClientCalled = true;
-            }
-            const member = memberName(callee);
-            if (member)
-                calls.add(member);
-            if (member === 'withRequest' && expectedInteraction && Array.isArray(current.arguments)) {
-                const request = requestLiterals(current.arguments[0]);
-                expectedRequest ||= request?.method.toUpperCase() === expectedInteraction.method
-                    && matchesEndpointPath(expectedInteraction.endpointPath, request?.path ?? '');
-            }
-        }
-        if (current.type === 'MemberExpression' && memberName(current) === 'PACT_BROKER_URL'
-            && record(current.object) && memberName(current.object) === 'env'
-            && record(current.object.object) && current.object.object.type === 'Identifier'
-            && current.object.object.name === 'process')
-            brokerEnv = true;
-        for (const [key, value] of Object.entries(current)) {
-            if (key === 'loc' || key === 'extra' || key === 'comments'
-                || key === 'leadingComments' || key === 'trailingComments' || key === 'innerComments')
-                continue;
-            const inExecuteTest = item.inExecuteTest
-                || current.type === 'CallExpression' && memberName(current.callee) === 'executeTest'
-                    && key === 'arguments';
-            if (Array.isArray(value)) {
-                for (const node of value)
-                    stack.push({ node, inExecuteTest });
-            }
-            else if (record(value))
-                stack.push({ node: value, inExecuteTest });
-        }
-    }
-    const requiredCalls = kind === 'consumer'
-        ? ['describe', 'it', 'withRequest', 'willRespondWith', 'executeTest', 'expect']
-        : ['describe', 'it', 'verifyProvider'];
-    if (requiredCalls.some((call) => !calls.has(call))
-        || !constructors.has(kind === 'consumer' ? 'PactV3' : 'Verifier')
-        || kind === 'consumer' && expectedInteraction !== undefined
-            && (expectedInteraction.filePath !== path || !expectedRequest)
-        || kind === 'provider' && brokerUrl !== null && !brokerEnv) {
-        throw new Error('private-execution-pact-source-invalid');
-    }
-    return Object.freeze({ schemaVersion: 1,
-        consumerBinding: kind === 'provider' ? 'provider-template'
-            : appClientCalled ? 'app-import-candidate' : 'mock-only-scaffold',
-        executionVerified: false, publicSafe: true });
-}
+import{parse as T}from"@babel/parser";import{lstatSync as A,realpathSync as C}from"node:fs";import{join as k,posix as S,resolve as I}from"node:path";const V=256*1024,_=1e5;function a(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function O(e){const n=new Set;if(!Array.isArray(e.specifiers))return n;for(const s of e.specifiers)!a(s)||s.type!=="ImportSpecifier"||!a(s.imported)||typeof s.imported.name!="string"||n.add(s.imported.name);return n}function q(e,n,s){const t=a(e.source)?e.source.value:void 0;if(typeof t!="string"||t.length>240||!/^\.\.?\/[A-Za-z0-9_./-]+$/.test(t)||e.importKind==="type"||!Array.isArray(e.specifiers)||e.specifiers.length<1||e.specifiers.length>16)throw new Error("private-execution-pact-source-invalid");const r=S.normalize(S.join(S.dirname(n),t));if(!/^(?:src|app|lib|packages|clients)\/[A-Za-z0-9_./-]+$/.test(r)||r.split("/").some(o=>o===".."||o==="."))throw new Error("private-execution-pact-source-invalid");const m=I(s);if(C(m)!==m||!A(m).isDirectory())throw new Error("private-execution-pact-source-invalid");const c=/\.(?:ts|tsx|js|mjs)$/.test(r)?[r,...r.endsWith(".js")?[`${r.slice(0,-3)}.ts`,`${r.slice(0,-3)}.tsx`]:[]]:[`${r}.ts`,`${r}.tsx`,`${r}.js`,`${r}.mjs`,`${r}/index.ts`,`${r}/index.tsx`,`${r}/index.js`],l=[];for(const o of c){let d=m;try{const y=o.split("/");for(const[x,E]of y.entries()){d=k(d,E);const v=A(d);if(v.isSymbolicLink()||(x===y.length-1?!v.isFile()||v.size<1||v.size>1024*1024:!v.isDirectory()))throw new Error("private-execution-pact-source-invalid")}l.push(o)}catch(y){if(y.code!=="ENOENT")throw new Error("private-execution-pact-source-invalid")}}if(l.length!==1)throw new Error("private-execution-pact-source-invalid");const h=new Set;for(const o of e.specifiers){if(!a(o)||!["ImportSpecifier","ImportDefaultSpecifier"].includes(o.type)||o.importKind==="type"||!a(o.local)||o.local.type!=="Identifier"||typeof o.local.name!="string")throw new Error("private-execution-pact-source-invalid");h.add(o.local.name)}return h}function b(e){if(!(!a(e)||e.type!=="MemberExpression"||e.computed===!0||!a(e.property)||e.property.type!=="Identifier"))return typeof e.property.name=="string"?e.property.name:void 0}function z(e){if(!a(e)||e.type!=="ObjectExpression"||!Array.isArray(e.properties))return;let n,s;for(const t of e.properties){if(!a(t)||t.type!=="ObjectProperty"||t.computed===!0||!a(t.key)||!a(t.value))return;const r=t.key.type==="Identifier"?t.key.name:t.key.type==="StringLiteral"?t.key.value:void 0;if(r==="method"||r==="path"){if(t.value.type!=="StringLiteral"||typeof t.value.value!="string")return;if(r==="method"){if(n!==void 0)return;n=t.value.value}else{if(s!==void 0)return;s=t.value.value}}}return n!==void 0&&s!==void 0?{method:n,path:s}:void 0}function L(e,n){if(e.length>180||n.length>2048||/[?#]/.test(n))return!1;const s=e.split("/"),t=n.split("/");return s.length!==t.length?!1:s.every((r,m)=>{const c=t[m];if(!r.includes("{")&&!r.includes("}"))return r===c;const l=/^([^{}]*)\{[^{}]+\}([^{}]*)$/.exec(r);return!l||!c.startsWith(l[1])||!c.endsWith(l[2])?!1:c.length>l[1].length+l[2].length})}function M(e,n,s,t,r,m){const c=e==="tests/pact/provider/verify.test.ts"?"provider":"consumer";if(c==="consumer"&&!/^tests\/pact\/consumer\/[a-z0-9-]+\.test\.ts$/.test(e)||typeof n!="string"||Buffer.byteLength(n,"utf8")<80||Buffer.byteLength(n,"utf8")>V||s!==null&&n.includes(s))throw new Error("private-execution-pact-source-invalid");let l;try{l=T(n,{sourceType:"module",plugins:["typescript"]})}catch{throw new Error("private-execution-pact-source-invalid")}const h=new Set,o=new Set,d=new Set;for(const p of l.program.body){if(p.type!=="ImportDeclaration")continue;const i=p.source.value;if(i!=="@pact-foundation/pact"&&i!=="vitest"){if(c!=="consumer"||!r)throw new Error("private-execution-pact-source-invalid");for(const f of q(p,e,r)){if(d.has(f)||["fetch","describe","it","expect","PactV3","MatchersV3","Verifier"].includes(f))throw new Error("private-execution-pact-source-invalid");d.add(f)}continue}const u=O(p);for(const f of u)(i==="@pact-foundation/pact"?h:o).add(f)}if(!o.has("describe")||!o.has("it")||c==="consumer"&&(!h.has("PactV3")||!o.has("expect"))||c==="provider"&&!h.has("Verifier")||[...d].some(p=>h.has(p)||o.has(p)))throw new Error("private-execution-pact-source-invalid");if(c==="consumer"&&m===!1&&[...h].some(p=>p!=="PactV3"))throw new Error("private-execution-pact-source-invalid");const y=new Set,x=new Set;let E=!1,v=!1,j=!1;const g=[{node:l.program,inExecuteTest:!1}];let $=0;for(;g.length>0;){const p=g.pop(),i=p.node;if(a(i)){if(++$>_)throw new Error("private-execution-pact-source-invalid");if(i.type==="NewExpression"&&a(i.callee)&&i.callee.type==="Identifier"&&typeof i.callee.name=="string"&&(x.add(i.callee.name),p.inExecuteTest&&d.has(i.callee.name)&&(j=!0)),i.type==="CallExpression"){const u=i.callee;a(u)&&u.type==="Identifier"&&typeof u.name=="string"&&(y.add(u.name),p.inExecuteTest&&d.has(u.name)&&(j=!0));const f=b(u);if(f&&y.add(f),f==="withRequest"&&t&&Array.isArray(i.arguments)){const w=z(i.arguments[0]);v||=w?.method.toUpperCase()===t.method&&L(t.endpointPath,w?.path??"")}}i.type==="MemberExpression"&&b(i)==="PACT_BROKER_URL"&&a(i.object)&&b(i.object)==="env"&&a(i.object.object)&&i.object.object.type==="Identifier"&&i.object.object.name==="process"&&(E=!0);for(const[u,f]of Object.entries(i)){if(u==="loc"||u==="extra"||u==="comments"||u==="leadingComments"||u==="trailingComments"||u==="innerComments")continue;const w=p.inExecuteTest||i.type==="CallExpression"&&b(i.callee)==="executeTest"&&u==="arguments";if(Array.isArray(f))for(const P of f)g.push({node:P,inExecuteTest:w});else a(f)&&g.push({node:f,inExecuteTest:w})}}}if((c==="consumer"?["describe","it","withRequest","willRespondWith","executeTest","expect"]:["describe","it","verifyProvider"]).some(p=>!y.has(p))||!x.has(c==="consumer"?"PactV3":"Verifier")||c==="consumer"&&t!==void 0&&(t.filePath!==e||!v)||c==="provider"&&s!==null&&!E)throw new Error("private-execution-pact-source-invalid");return Object.freeze({schemaVersion:1,consumerBinding:c==="provider"?"provider-template":j?"app-import-candidate":"mock-only-scaffold",executionVerified:!1,publicSafe:!0})}export{M as validatePactTestSource};

package/packages/client/dist/private-execution/pact-toolchain.js

@@ -1,290 +1,3 @@
-/**
- * Root-owned Pact toolchain inspection and scratch-only npm candidate planning.
- * A matching manifest and lockfile are configuration evidence, never a
- * test-execution/QA receipt.
- */
-import { spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { constants } from 'node:fs';
-import { closeSync, fstatSync, lstatSync, mkdtempSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, resolve } from 'node:path';
-import { parseDocument } from 'yaml';
-function result(outcome, reasonCode) {
-    return Object.freeze({ schemaVersion: 1, outcome, reasonCode,
-        executionVerified: false, publicSafe: true });
-}
-function record(value) {
-    return !!value && typeof value === 'object' && !Array.isArray(value)
-        && Object.getPrototypeOf(value) === Object.prototype;
-}
-function readRegular(root, relative, maxBytes) {
-    const path = join(root, relative);
-    let handle;
-    try {
-        handle = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return undefined;
-        throw new Error('pact-toolchain-path-unsafe');
-    }
-    try {
-        const entry = fstatSync(handle);
-        if (!entry.isFile() || entry.size < 1 || entry.size > maxBytes) {
-            throw new Error('pact-toolchain-path-unsafe');
-        }
-        return new TextDecoder('utf-8', { fatal: true }).decode(readFileSync(handle));
-    }
-    finally {
-        closeSync(handle);
-    }
-}
-function parseStrictJson(text) {
-    try {
-        const document = parseDocument(text, { strict: true, uniqueKeys: true,
-            schema: 'core', customTags: [] });
-        if (document.errors.length || document.warnings.length)
-            return undefined;
-        const parsed = JSON.parse(text);
-        return record(parsed) ? parsed : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** No project mutation, dependency installation, script execution, or private values. */
-export function inspectPactToolchain(projectRoot, generateProvider) {
-    if (typeof generateProvider !== 'boolean') {
-        return result('unsupported', 'manifest-invalid');
-    }
-    const root = resolve(projectRoot);
-    try {
-        if (realpathSync(root) !== root || !lstatSync(root).isDirectory()) {
-            return result('unsupported', 'manifest-invalid');
-        }
-        for (const alternate of ['pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb']) {
-            if (readRegular(root, alternate, 8 * 1024 * 1024) !== undefined) {
-                return result('unsupported', 'package-manager-unsupported');
-            }
-        }
-        const manifestText = readRegular(root, 'package.json', 1024 * 1024);
-        if (manifestText === undefined)
-            return result('requires-root-integration', 'manifest-missing');
-        const manifest = parseStrictJson(manifestText);
-        if (!manifest)
-            return result('unsupported', 'manifest-invalid');
-        if (manifest.packageManager !== undefined
-            && (typeof manifest.packageManager !== 'string'
-                || !/^npm@[0-9]+(?:\.[0-9]+){0,2}$/.test(manifest.packageManager))) {
-            return result('unsupported', 'package-manager-unsupported');
-        }
-        const scripts = manifest.scripts;
-        if (!record(scripts) || typeof scripts['pact:consumer'] !== 'string'
-            || !/^vitest run(?: --maxWorkers=1)? tests\/pact\/consumer\/$/.test(scripts['pact:consumer'])
-            || generateProvider && (typeof scripts['pact:provider'] !== 'string'
-                || !/^vitest run(?: --maxWorkers=1)? tests\/pact\/provider\/$/.test(scripts['pact:provider']))) {
-            return result('requires-root-integration', 'scripts-missing');
-        }
-        const devDependencies = manifest.devDependencies;
-        if (!record(devDependencies)
-            || typeof devDependencies['@pact-foundation/pact'] !== 'string'
-            || typeof devDependencies.vitest !== 'string') {
-            return result('requires-root-integration', 'dependencies-missing');
-        }
-        const boundedVersion = /^(?:\^|~)?[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.-]+)?$/;
-        if (!boundedVersion.test(devDependencies['@pact-foundation/pact'])
-            || !boundedVersion.test(devDependencies.vitest)) {
-            return result('unsupported', 'dependency-spec-unsupported');
-        }
-        const lockText = readRegular(root, 'package-lock.json', 8 * 1024 * 1024);
-        if (lockText === undefined)
-            return result('requires-root-integration', 'lockfile-missing');
-        const lock = parseStrictJson(lockText);
-        if (!lock || !record(lock.packages) || !record(lock.packages[''])
-            || ![2, 3].includes(lock.lockfileVersion)) {
-            return result('unsupported', 'lockfile-invalid');
-        }
-        const lockedDeps = lock.packages[''].devDependencies;
-        const lockedPact = lock.packages['node_modules/@pact-foundation/pact'];
-        const lockedVitest = lock.packages['node_modules/vitest'];
-        if (!record(lockedDeps)
-            || lockedDeps['@pact-foundation/pact'] !== devDependencies['@pact-foundation/pact']
-            || lockedDeps.vitest !== devDependencies.vitest
-            || !record(lockedPact) || typeof lockedPact.version !== 'string'
-            || !boundedVersion.test(lockedPact.version)
-            || !record(lockedVitest) || typeof lockedVitest.version !== 'string'
-            || !boundedVersion.test(lockedVitest.version)) {
-            return result('requires-root-integration', 'lockfile-drift');
-        }
-        return result('manifest-aligned', 'manifest-aligned-unverified');
-    }
-    catch {
-        return result('unsupported', 'manifest-invalid');
-    }
-}
-const PACT_VERSION = '17.1.4';
-const VITEST_VERSION = '3.2.4';
-const CONSUMER_SCRIPT = 'vitest run --maxWorkers=1 tests/pact/consumer/';
-const PROVIDER_SCRIPT = 'vitest run --maxWorkers=1 tests/pact/provider/';
-const BOUNDED_NPM_SPEC = /^(?:\^|~)?[0-9]+\.[0-9]+\.[0-9]+$/;
-function safeRegistryLock(text) {
-    const lock = parseStrictJson(text);
-    if (!lock || ![2, 3].includes(lock.lockfileVersion)
-        || !record(lock.packages) || Object.keys(lock.packages).length > 10_000)
-        return false;
-    for (const value of Object.values(lock.packages)) {
-        if (!record(value) || value.link === true)
-            return false;
-        if (value.resolved === undefined)
-            continue;
-        if (typeof value.resolved !== 'string' || typeof value.integrity !== 'string'
-            || !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(value.integrity))
-            return false;
-        try {
-            const url = new URL(value.resolved);
-            if (url.protocol !== 'https:' || url.hostname !== 'registry.npmjs.org'
-                || url.port || url.username || url.password || url.search || url.hash
-                || !url.pathname.startsWith('/') || url.pathname.includes('..'))
-                return false;
-        }
-        catch {
-            return false;
-        }
-    }
-    return true;
-}
-/**
- * Root-owned manifest proposal. It preserves unrelated keys and refuses
- * conflicting scripts, non-registry dependencies and unsupported workspaces.
- * No filesystem effect occurs here.
- */
-export function planPactToolchainManifest(projectRoot, generateProvider) {
-    try {
-        if (process.platform !== 'linux' || typeof generateProvider !== 'boolean') {
-            throw new Error('unsupported');
-        }
-        const root = resolve(projectRoot);
-        if (realpathSync(root) !== root || !lstatSync(root).isDirectory())
-            throw new Error('root');
-        for (const alternate of ['.npmrc', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock',
-            'bun.lock', 'bun.lockb']) {
-            try {
-                lstatSync(join(root, alternate));
-                throw new Error('alternate');
-            }
-            catch (error) {
-                if (error.code !== 'ENOENT')
-                    throw error;
-            }
-        }
-        const sourceText = readRegular(root, 'package.json', 1024 * 1024);
-        if (!sourceText)
-            throw new Error('manifest');
-        const manifest = parseStrictJson(sourceText);
-        if (!manifest || typeof manifest.name !== 'string' || !/^[a-z0-9@][a-z0-9@._/-]{0,213}$/.test(manifest.name)
-            || typeof manifest.version !== 'string' || !BOUNDED_NPM_SPEC.test(manifest.version)
-            || manifest.workspaces !== undefined || manifest.overrides !== undefined
-            || (manifest.packageManager !== undefined
-                && (typeof manifest.packageManager !== 'string'
-                    || !/^npm@[0-9]+(?:\.[0-9]+){0,2}$/.test(manifest.packageManager)))) {
-            throw new Error('manifest');
-        }
-        for (const section of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
-            const dependencies = manifest[section];
-            if (dependencies !== undefined && (!record(dependencies)
-                || Object.values(dependencies).some((value) => typeof value !== 'string'
-                    || !BOUNDED_NPM_SPEC.test(value))))
-                throw new Error('dependency');
-        }
-        const runtimeDeps = manifest.dependencies;
-        if (record(runtimeDeps) && (runtimeDeps['@pact-foundation/pact'] !== undefined
-            || runtimeDeps.vitest !== undefined))
-            throw new Error('placement');
-        const scripts = manifest.scripts;
-        if (scripts !== undefined && !record(scripts))
-            throw new Error('scripts');
-        const existingScripts = record(scripts) ? scripts : {};
-        for (const name of ['prepact:consumer', 'postpact:consumer', 'prepact:provider', 'postpact:provider']) {
-            if (existingScripts[name] !== undefined)
-                throw new Error('lifecycle');
-        }
-        if ((existingScripts['pact:consumer'] !== undefined
-            && existingScripts['pact:consumer'] !== CONSUMER_SCRIPT)
-            || (generateProvider && existingScripts['pact:provider'] !== undefined
-                && existingScripts['pact:provider'] !== PROVIDER_SCRIPT))
-            throw new Error('script-conflict');
-        const devDependencies = record(manifest.devDependencies) ? manifest.devDependencies : {};
-        const pact = devDependencies['@pact-foundation/pact'] ?? PACT_VERSION;
-        const vitest = devDependencies.vitest ?? VITEST_VERSION;
-        if (typeof pact !== 'string' || !BOUNDED_NPM_SPEC.test(pact)
-            || typeof vitest !== 'string' || !BOUNDED_NPM_SPEC.test(vitest))
-            throw new Error('version');
-        const candidate = { ...manifest,
-            scripts: { ...existingScripts, 'pact:consumer': CONSUMER_SCRIPT,
-                ...(generateProvider ? { 'pact:provider': PROVIDER_SCRIPT } : {}) },
-            devDependencies: { ...devDependencies, '@pact-foundation/pact': pact, vitest },
-        };
-        const indentation = /^\{\r?\n([ \t]+)\S/m.exec(sourceText)?.[1] ?? '  ';
-        const candidateText = JSON.stringify(candidate, null, indentation)
-            + (sourceText.endsWith('\n') ? '\n' : '');
-        const sourceLockText = readRegular(root, 'package-lock.json', 8 * 1024 * 1024) ?? null;
-        if (sourceLockText !== null && !safeRegistryLock(sourceLockText))
-            throw new Error('lock');
-        return Object.freeze({ sourceText, candidateText, sourceLockText });
-    }
-    catch {
-        throw new Error('pact-toolchain-manifest-unsupported');
-    }
-}
-/**
- * Resolve a lockfile from metadata alone in a private temporary directory.
- * npm never sees project source, local credentials, .npmrc or generated tests;
- * ignore-scripts and package-lock-only prevent package code execution.
- */
-export function preparePactToolchainCandidate(projectRoot, generateProvider) {
-    const planned = planPactToolchainManifest(projectRoot, generateProvider);
-    const scratch = mkdtempSync(join(tmpdir(), 'p222-pact-toolchain-'));
-    try {
-        writeFileSync(join(scratch, 'package.json'), planned.candidateText, { mode: 0o600 });
-        writeFileSync(join(scratch, 'user.npmrc'), '', { mode: 0o600 });
-        writeFileSync(join(scratch, 'global.npmrc'), '', { mode: 0o600 });
-        if (planned.sourceLockText !== null) {
-            writeFileSync(join(scratch, 'package-lock.json'), planned.sourceLockText, { mode: 0o600 });
-        }
-        const command = spawnSync('npm', ['install', '--package-lock-only', '--ignore-scripts',
-            '--no-audit', '--no-fund', '--registry=https://registry.npmjs.org/',
-            `--userconfig=${join(scratch, 'user.npmrc')}`,
-            `--globalconfig=${join(scratch, 'global.npmrc')}`], {
-            cwd: scratch, encoding: 'utf8', timeout: 120_000, maxBuffer: 256 * 1024,
-            env: { PATH: process.env.PATH, HOME: scratch, TMPDIR: scratch,
-                npm_config_cache: join(scratch, '.npm-cache'), CI: 'true', NO_UPDATE_NOTIFIER: '1' },
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-        if (command.error || command.status !== 0)
-            throw new Error('npm');
-        const manifestText = readRegular(scratch, 'package.json', 1024 * 1024);
-        const lockText = readRegular(scratch, 'package-lock.json', 8 * 1024 * 1024);
-        const inspection = inspectPactToolchain(scratch, generateProvider);
-        if (manifestText !== planned.candidateText || !lockText || !safeRegistryLock(lockText)
-            || inspection.outcome !== 'manifest-aligned') {
-            throw new Error('candidate');
-        }
-        const root = resolve(projectRoot);
-        if (readRegular(root, 'package.json', 1024 * 1024) !== planned.sourceText
-            || (readRegular(root, 'package-lock.json', 8 * 1024 * 1024) ?? null) !== planned.sourceLockText) {
-            throw new Error('source-raced');
-        }
-        const sha = (value) => createHash('sha256').update(value).digest('hex');
-        return Object.freeze({ schemaVersion: 1, outcome: 'candidate-unverified',
-            sourceManifestSha256: sha(planned.sourceText),
-            sourceLockSha256: planned.sourceLockText === null ? null : sha(planned.sourceLockText),
-            manifestText, lockText, executionVerified: false });
-    }
-    catch {
-        throw new Error('pact-toolchain-candidate-unavailable');
-    }
-    finally {
-        rmSync(scratch, { recursive: true, force: true });
-    }
-}
+import{spawnSync as M}from"node:child_process";import{createHash as R}from"node:crypto";import{constants as j}from"node:fs";import{closeSync as V,fstatSync as P,lstatSync as O,mkdtempSync as I,openSync as $,readFileSync as z,realpathSync as D,rmSync as A,writeFileSync as w}from"node:fs";import{tmpdir as C}from"node:os";import{join as d,resolve as S}from"node:path";import{parseDocument as W}from"yaml";function p(o,r){return Object.freeze({schemaVersion:1,outcome:o,reasonCode:r,executionVerified:!1,publicSafe:!0})}function i(o){return!!o&&typeof o=="object"&&!Array.isArray(o)&&Object.getPrototypeOf(o)===Object.prototype}function m(o,r,e){const t=d(o,r);let n;try{n=$(t,j.O_RDONLY|j.O_NOFOLLOW)}catch(s){if(s.code==="ENOENT")return;throw new Error("pact-toolchain-path-unsafe")}try{const s=P(n);if(!s.isFile()||s.size<1||s.size>e)throw new Error("pact-toolchain-path-unsafe");return new TextDecoder("utf-8",{fatal:!0}).decode(z(n))}finally{V(n)}}function v(o){try{const r=W(o,{strict:!0,uniqueKeys:!0,schema:"core",customTags:[]});if(r.errors.length||r.warnings.length)return;const e=JSON.parse(o);return i(e)?e:void 0}catch{return}}function q(o,r){if(typeof r!="boolean")return p("unsupported","manifest-invalid");const e=S(o);try{if(D(e)!==e||!O(e).isDirectory())return p("unsupported","manifest-invalid");for(const T of["pnpm-lock.yaml","yarn.lock","bun.lock","bun.lockb"])if(m(e,T,8*1024*1024)!==void 0)return p("unsupported","package-manager-unsupported");const t=m(e,"package.json",1024*1024);if(t===void 0)return p("requires-root-integration","manifest-missing");const n=v(t);if(!n)return p("unsupported","manifest-invalid");if(n.packageManager!==void 0&&(typeof n.packageManager!="string"||!/^npm@[0-9]+(?:\.[0-9]+){0,2}$/.test(n.packageManager)))return p("unsupported","package-manager-unsupported");const s=n.scripts;if(!i(s)||typeof s["pact:consumer"]!="string"||!/^vitest run(?: --maxWorkers=1)? tests\/pact\/consumer\/$/.test(s["pact:consumer"])||r&&(typeof s["pact:provider"]!="string"||!/^vitest run(?: --maxWorkers=1)? tests\/pact\/provider\/$/.test(s["pact:provider"])))return p("requires-root-integration","scripts-missing");const c=n.devDependencies;if(!i(c)||typeof c["@pact-foundation/pact"]!="string"||typeof c.vitest!="string")return p("requires-root-integration","dependencies-missing");const u=/^(?:\^|~)?[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.-]+)?$/;if(!u.test(c["@pact-foundation/pact"])||!u.test(c.vitest))return p("unsupported","dependency-spec-unsupported");const f=m(e,"package-lock.json",8*1024*1024);if(f===void 0)return p("requires-root-integration","lockfile-missing");const a=v(f);if(!a||!i(a.packages)||!i(a.packages[""])||![2,3].includes(a.lockfileVersion))return p("unsupported","lockfile-invalid");const l=a.packages[""].devDependencies,k=a.packages["node_modules/@pact-foundation/pact"],h=a.packages["node_modules/vitest"];return!i(l)||l["@pact-foundation/pact"]!==c["@pact-foundation/pact"]||l.vitest!==c.vitest||!i(k)||typeof k.version!="string"||!u.test(k.version)||!i(h)||typeof h.version!="string"||!u.test(h.version)?p("requires-root-integration","lockfile-drift"):p("manifest-aligned","manifest-aligned-unverified")}catch{return p("unsupported","manifest-invalid")}}const F="17.1.4",H="3.2.4",_="vitest run --maxWorkers=1 tests/pact/consumer/",N="vitest run --maxWorkers=1 tests/pact/provider/",E=/^(?:\^|~)?[0-9]+\.[0-9]+\.[0-9]+$/;function L(o){const r=v(o);if(!r||![2,3].includes(r.lockfileVersion)||!i(r.packages)||Object.keys(r.packages).length>1e4)return!1;for(const e of Object.values(r.packages)){if(!i(e)||e.link===!0)return!1;if(e.resolved!==void 0){if(typeof e.resolved!="string"||typeof e.integrity!="string"||!/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(e.integrity))return!1;try{const t=new URL(e.resolved);if(t.protocol!=="https:"||t.hostname!=="registry.npmjs.org"||t.port||t.username||t.password||t.search||t.hash||!t.pathname.startsWith("/")||t.pathname.includes(".."))return!1}catch{return!1}}}return!0}function U(o,r){try{if(process.platform!=="linux"||typeof r!="boolean")throw new Error("unsupported");const e=S(o);if(D(e)!==e||!O(e).isDirectory())throw new Error("root");for(const y of[".npmrc","npm-shrinkwrap.json","pnpm-lock.yaml","yarn.lock","bun.lock","bun.lockb"])try{throw O(d(e,y)),new Error("alternate")}catch(g){if(g.code!=="ENOENT")throw g}const t=m(e,"package.json",1024*1024);if(!t)throw new Error("manifest");const n=v(t);if(!n||typeof n.name!="string"||!/^[a-z0-9@][a-z0-9@._/-]{0,213}$/.test(n.name)||typeof n.version!="string"||!E.test(n.version)||n.workspaces!==void 0||n.overrides!==void 0||n.packageManager!==void 0&&(typeof n.packageManager!="string"||!/^npm@[0-9]+(?:\.[0-9]+){0,2}$/.test(n.packageManager)))throw new Error("manifest");for(const y of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){const g=n[y];if(g!==void 0&&(!i(g)||Object.values(g).some(b=>typeof b!="string"||!E.test(b))))throw new Error("dependency")}const s=n.dependencies;if(i(s)&&(s["@pact-foundation/pact"]!==void 0||s.vitest!==void 0))throw new Error("placement");const c=n.scripts;if(c!==void 0&&!i(c))throw new Error("scripts");const u=i(c)?c:{};for(const y of["prepact:consumer","postpact:consumer","prepact:provider","postpact:provider"])if(u[y]!==void 0)throw new Error("lifecycle");if(u["pact:consumer"]!==void 0&&u["pact:consumer"]!==_||r&&u["pact:provider"]!==void 0&&u["pact:provider"]!==N)throw new Error("script-conflict");const f=i(n.devDependencies)?n.devDependencies:{},a=f["@pact-foundation/pact"]??F,l=f.vitest??H;if(typeof a!="string"||!E.test(a)||typeof l!="string"||!E.test(l))throw new Error("version");const k={...n,scripts:{...u,"pact:consumer":_,...r?{"pact:provider":N}:{}},devDependencies:{...f,"@pact-foundation/pact":a,vitest:l}},h=/^\{\r?\n([ \t]+)\S/m.exec(t)?.[1]??"  ",T=JSON.stringify(k,null,h)+(t.endsWith(`
+`)?`
+`:""),x=m(e,"package-lock.json",8*1024*1024)??null;if(x!==null&&!L(x))throw new Error("lock");return Object.freeze({sourceText:t,candidateText:T,sourceLockText:x})}catch{throw new Error("pact-toolchain-manifest-unsupported")}}function X(o,r){const e=U(o,r),t=I(d(C(),"p222-pact-toolchain-"));try{w(d(t,"package.json"),e.candidateText,{mode:384}),w(d(t,"user.npmrc"),"",{mode:384}),w(d(t,"global.npmrc"),"",{mode:384}),e.sourceLockText!==null&&w(d(t,"package-lock.json"),e.sourceLockText,{mode:384});const n=M("npm",["install","--package-lock-only","--ignore-scripts","--no-audit","--no-fund","--registry=https://registry.npmjs.org/",`--userconfig=${d(t,"user.npmrc")}`,`--globalconfig=${d(t,"global.npmrc")}`],{cwd:t,encoding:"utf8",timeout:12e4,maxBuffer:256*1024,env:{PATH:process.env.PATH,HOME:t,TMPDIR:t,npm_config_cache:d(t,".npm-cache"),CI:"true",NO_UPDATE_NOTIFIER:"1"},stdio:["ignore","pipe","pipe"]});if(n.error||n.status!==0)throw new Error("npm");const s=m(t,"package.json",1024*1024),c=m(t,"package-lock.json",8*1024*1024),u=q(t,r);if(s!==e.candidateText||!c||!L(c)||u.outcome!=="manifest-aligned")throw new Error("candidate");const f=S(o);if(m(f,"package.json",1024*1024)!==e.sourceText||(m(f,"package-lock.json",8*1024*1024)??null)!==e.sourceLockText)throw new Error("source-raced");const a=l=>R("sha256").update(l).digest("hex");return Object.freeze({schemaVersion:1,outcome:"candidate-unverified",sourceManifestSha256:a(e.sourceText),sourceLockSha256:e.sourceLockText===null?null:a(e.sourceLockText),manifestText:s,lockText:c,executionVerified:!1})}catch{throw new Error("pact-toolchain-candidate-unavailable")}finally{A(t,{recursive:!0,force:!0})}}export{q as inspectPactToolchain,U as planPactToolchainManifest,X as preparePactToolchainCandidate};