@ornexus/neocortex 4.60.72 → 4.60.73

package/packages/client/dist/private-execution/pact-test-source.js

@@ -1 +1,258 @@
-import{parse as T}from"@babel/parser";import{lstatSync as A,realpathSync as C}from"node:fs";import{join as k,posix as S,resolve as I}from"node:path";const V=256*1024,_=1e5;function a(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function O(e){const n=new Set;if(!Array.isArray(e.specifiers))return n;for(const s of e.specifiers)!a(s)||s.type!=="ImportSpecifier"||!a(s.imported)||typeof s.imported.name!="string"||n.add(s.imported.name);return n}function q(e,n,s){const t=a(e.source)?e.source.value:void 0;if(typeof t!="string"||t.length>240||!/^\.\.?\/[A-Za-z0-9_./-]+$/.test(t)||e.importKind==="type"||!Array.isArray(e.specifiers)||e.specifiers.length<1||e.specifiers.length>16)throw new Error("private-execution-pact-source-invalid");const r=S.normalize(S.join(S.dirname(n),t));if(!/^(?:src|app|lib|packages|clients)\/[A-Za-z0-9_./-]+$/.test(r)||r.split("/").some(o=>o===".."||o==="."))throw new Error("private-execution-pact-source-invalid");const m=I(s);if(C(m)!==m||!A(m).isDirectory())throw new Error("private-execution-pact-source-invalid");const c=/\.(?:ts|tsx|js|mjs)$/.test(r)?[r,...r.endsWith(".js")?[`${r.slice(0,-3)}.ts`,`${r.slice(0,-3)}.tsx`]:[]]:[`${r}.ts`,`${r}.tsx`,`${r}.js`,`${r}.mjs`,`${r}/index.ts`,`${r}/index.tsx`,`${r}/index.js`],l=[];for(const o of c){let d=m;try{const y=o.split("/");for(const[x,E]of y.entries()){d=k(d,E);const v=A(d);if(v.isSymbolicLink()||(x===y.length-1?!v.isFile()||v.size<1||v.size>1024*1024:!v.isDirectory()))throw new Error("private-execution-pact-source-invalid")}l.push(o)}catch(y){if(y.code!=="ENOENT")throw new Error("private-execution-pact-source-invalid")}}if(l.length!==1)throw new Error("private-execution-pact-source-invalid");const h=new Set;for(const o of e.specifiers){if(!a(o)||!["ImportSpecifier","ImportDefaultSpecifier"].includes(o.type)||o.importKind==="type"||!a(o.local)||o.local.type!=="Identifier"||typeof o.local.name!="string")throw new Error("private-execution-pact-source-invalid");h.add(o.local.name)}return h}function b(e){if(!(!a(e)||e.type!=="MemberExpression"||e.computed===!0||!a(e.property)||e.property.type!=="Identifier"))return typeof e.property.name=="string"?e.property.name:void 0}function z(e){if(!a(e)||e.type!=="ObjectExpression"||!Array.isArray(e.properties))return;let n,s;for(const t of e.properties){if(!a(t)||t.type!=="ObjectProperty"||t.computed===!0||!a(t.key)||!a(t.value))return;const r=t.key.type==="Identifier"?t.key.name:t.key.type==="StringLiteral"?t.key.value:void 0;if(r==="method"||r==="path"){if(t.value.type!=="StringLiteral"||typeof t.value.value!="string")return;if(r==="method"){if(n!==void 0)return;n=t.value.value}else{if(s!==void 0)return;s=t.value.value}}}return n!==void 0&&s!==void 0?{method:n,path:s}:void 0}function L(e,n){if(e.length>180||n.length>2048||/[?#]/.test(n))return!1;const s=e.split("/"),t=n.split("/");return s.length!==t.length?!1:s.every((r,m)=>{const c=t[m];if(!r.includes("{")&&!r.includes("}"))return r===c;const l=/^([^{}]*)\{[^{}]+\}([^{}]*)$/.exec(r);return!l||!c.startsWith(l[1])||!c.endsWith(l[2])?!1:c.length>l[1].length+l[2].length})}function M(e,n,s,t,r,m){const c=e==="tests/pact/provider/verify.test.ts"?"provider":"consumer";if(c==="consumer"&&!/^tests\/pact\/consumer\/[a-z0-9-]+\.test\.ts$/.test(e)||typeof n!="string"||Buffer.byteLength(n,"utf8")<80||Buffer.byteLength(n,"utf8")>V||s!==null&&n.includes(s))throw new Error("private-execution-pact-source-invalid");let l;try{l=T(n,{sourceType:"module",plugins:["typescript"]})}catch{throw new Error("private-execution-pact-source-invalid")}const h=new Set,o=new Set,d=new Set;for(const p of l.program.body){if(p.type!=="ImportDeclaration")continue;const i=p.source.value;if(i!=="@pact-foundation/pact"&&i!=="vitest"){if(c!=="consumer"||!r)throw new Error("private-execution-pact-source-invalid");for(const f of q(p,e,r)){if(d.has(f)||["fetch","describe","it","expect","PactV3","MatchersV3","Verifier"].includes(f))throw new Error("private-execution-pact-source-invalid");d.add(f)}continue}const u=O(p);for(const f of u)(i==="@pact-foundation/pact"?h:o).add(f)}if(!o.has("describe")||!o.has("it")||c==="consumer"&&(!h.has("PactV3")||!o.has("expect"))||c==="provider"&&!h.has("Verifier")||[...d].some(p=>h.has(p)||o.has(p)))throw new Error("private-execution-pact-source-invalid");if(c==="consumer"&&m===!1&&[...h].some(p=>p!=="PactV3"))throw new Error("private-execution-pact-source-invalid");const y=new Set,x=new Set;let E=!1,v=!1,j=!1;const g=[{node:l.program,inExecuteTest:!1}];let $=0;for(;g.length>0;){const p=g.pop(),i=p.node;if(a(i)){if(++$>_)throw new Error("private-execution-pact-source-invalid");if(i.type==="NewExpression"&&a(i.callee)&&i.callee.type==="Identifier"&&typeof i.callee.name=="string"&&(x.add(i.callee.name),p.inExecuteTest&&d.has(i.callee.name)&&(j=!0)),i.type==="CallExpression"){const u=i.callee;a(u)&&u.type==="Identifier"&&typeof u.name=="string"&&(y.add(u.name),p.inExecuteTest&&d.has(u.name)&&(j=!0));const f=b(u);if(f&&y.add(f),f==="withRequest"&&t&&Array.isArray(i.arguments)){const w=z(i.arguments[0]);v||=w?.method.toUpperCase()===t.method&&L(t.endpointPath,w?.path??"")}}i.type==="MemberExpression"&&b(i)==="PACT_BROKER_URL"&&a(i.object)&&b(i.object)==="env"&&a(i.object.object)&&i.object.object.type==="Identifier"&&i.object.object.name==="process"&&(E=!0);for(const[u,f]of Object.entries(i)){if(u==="loc"||u==="extra"||u==="comments"||u==="leadingComments"||u==="trailingComments"||u==="innerComments")continue;const w=p.inExecuteTest||i.type==="CallExpression"&&b(i.callee)==="executeTest"&&u==="arguments";if(Array.isArray(f))for(const P of f)g.push({node:P,inExecuteTest:w});else a(f)&&g.push({node:f,inExecuteTest:w})}}}if((c==="consumer"?["describe","it","withRequest","willRespondWith","executeTest","expect"]:["describe","it","verifyProvider"]).some(p=>!y.has(p))||!x.has(c==="consumer"?"PactV3":"Verifier")||c==="consumer"&&t!==void 0&&(t.filePath!==e||!v)||c==="provider"&&s!==null&&!E)throw new Error("private-execution-pact-source-invalid");return Object.freeze({schemaVersion:1,consumerBinding:c==="provider"?"provider-template":j?"app-import-candidate":"mock-only-scaffold",executionVerified:!1,publicSafe:!0})}export{M as validatePactTestSource};
+/**
+ * Static first-pass contract for isolated Pact artifacts. Parsing never runs
+ * generated code. A passing result is not a Pact execution/QA receipt.
+ */
+import { parse } from '@babel/parser';
+import { lstatSync, realpathSync } from 'node:fs';
+import { join, posix, resolve } from 'node:path';
+const MAX_SOURCE_BYTES = 256 * 1024;
+const MAX_AST_NODES = 100_000;
+function record(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function importedNames(node) {
+    const names = new Set();
+    if (!Array.isArray(node.specifiers))
+        return names;
+    for (const specifier of node.specifiers) {
+        if (!record(specifier) || specifier.type !== 'ImportSpecifier'
+            || !record(specifier.imported) || typeof specifier.imported.name !== 'string')
+            continue;
+        names.add(specifier.imported.name);
+    }
+    return names;
+}
+function projectImportNames(node, testPath, projectRoot) {
+    const importPath = record(node.source) ? node.source.value : undefined;
+    if (typeof importPath !== 'string' || importPath.length > 240
+        || !/^\.\.?\/[A-Za-z0-9_./-]+$/.test(importPath)
+        || node.importKind === 'type' || !Array.isArray(node.specifiers)
+        || node.specifiers.length < 1 || node.specifiers.length > 16) {
+        throw new Error('private-execution-pact-source-invalid');
+    }
+    const relative = posix.normalize(posix.join(posix.dirname(testPath), importPath));
+    if (!/^(?:src|app|lib|packages|clients)\/[A-Za-z0-9_./-]+$/.test(relative)
+        || relative.split('/').some((segment) => segment === '..' || segment === '.')) {
+        throw new Error('private-execution-pact-source-invalid');
+    }
+    const root = resolve(projectRoot);
+    if (realpathSync(root) !== root || !lstatSync(root).isDirectory()) {
+        throw new Error('private-execution-pact-source-invalid');
+    }
+    const candidates = /\.(?:ts|tsx|js|mjs)$/.test(relative)
+        ? [relative, ...(relative.endsWith('.js') ? [`${relative.slice(0, -3)}.ts`,
+                `${relative.slice(0, -3)}.tsx`] : [])]
+        : [`${relative}.ts`, `${relative}.tsx`, `${relative}.js`, `${relative}.mjs`,
+            `${relative}/index.ts`, `${relative}/index.tsx`, `${relative}/index.js`];
+    const matches = [];
+    for (const candidate of candidates) {
+        let current = root;
+        try {
+            const parts = candidate.split('/');
+            for (const [index, part] of parts.entries()) {
+                current = join(current, part);
+                const entry = lstatSync(current);
+                if (entry.isSymbolicLink() || (index === parts.length - 1
+                    ? !entry.isFile() || entry.size < 1 || entry.size > 1024 * 1024
+                    : !entry.isDirectory()))
+                    throw new Error('private-execution-pact-source-invalid');
+            }
+            matches.push(candidate);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                throw new Error('private-execution-pact-source-invalid');
+            }
+        }
+    }
+    if (matches.length !== 1)
+        throw new Error('private-execution-pact-source-invalid');
+    const names = new Set();
+    for (const specifier of node.specifiers) {
+        if (!record(specifier) || !['ImportSpecifier', 'ImportDefaultSpecifier'].includes(specifier.type)
+            || specifier.importKind === 'type' || !record(specifier.local)
+            || specifier.local.type !== 'Identifier' || typeof specifier.local.name !== 'string') {
+            throw new Error('private-execution-pact-source-invalid');
+        }
+        names.add(specifier.local.name);
+    }
+    return names;
+}
+function memberName(node) {
+    if (!record(node) || node.type !== 'MemberExpression' || node.computed === true
+        || !record(node.property) || node.property.type !== 'Identifier')
+        return undefined;
+    return typeof node.property.name === 'string' ? node.property.name : undefined;
+}
+function requestLiterals(node) {
+    if (!record(node) || node.type !== 'ObjectExpression' || !Array.isArray(node.properties))
+        return undefined;
+    let method;
+    let path;
+    for (const property of node.properties) {
+        if (!record(property) || property.type !== 'ObjectProperty' || property.computed === true
+            || !record(property.key) || !record(property.value))
+            return undefined;
+        const name = property.key.type === 'Identifier' ? property.key.name
+            : property.key.type === 'StringLiteral' ? property.key.value : undefined;
+        if (name === 'method' || name === 'path') {
+            if (property.value.type !== 'StringLiteral' || typeof property.value.value !== 'string')
+                return undefined;
+            if (name === 'method') {
+                if (method !== undefined)
+                    return undefined;
+                method = property.value.value;
+            }
+            else {
+                if (path !== undefined)
+                    return undefined;
+                path = property.value.value;
+            }
+        }
+    }
+    return method !== undefined && path !== undefined ? { method, path } : undefined;
+}
+function matchesEndpointPath(template, actual) {
+    if (template.length > 180 || actual.length > 2048 || /[?#]/.test(actual))
+        return false;
+    const expected = template.split('/');
+    const candidate = actual.split('/');
+    if (expected.length !== candidate.length)
+        return false;
+    return expected.every((segment, index) => {
+        const value = candidate[index];
+        if (!segment.includes('{') && !segment.includes('}'))
+            return segment === value;
+        // One parameter per segment keeps matching linear and rejects ambiguous
+        // adjacent templates instead of relying on a backtracking regex.
+        const parameter = /^([^{}]*)\{[^{}]+\}([^{}]*)$/.exec(segment);
+        if (!parameter || !value.startsWith(parameter[1]) || !value.endsWith(parameter[2]))
+            return false;
+        return value.length > parameter[1].length + parameter[2].length;
+    });
+}
+/** Reject comment-only, malformed and non-Pact files before a root patch effect. */
+export function validatePactTestSource(path, source, brokerUrl, expectedInteraction, projectRoot, matchersAggressive) {
+    const kind = path === 'tests/pact/provider/verify.test.ts' ? 'provider' : 'consumer';
+    if ((kind === 'consumer' && !/^tests\/pact\/consumer\/[a-z0-9-]+\.test\.ts$/.test(path))
+        || typeof source !== 'string' || Buffer.byteLength(source, 'utf8') < 80
+        || Buffer.byteLength(source, 'utf8') > MAX_SOURCE_BYTES
+        || brokerUrl !== null && source.includes(brokerUrl)) {
+        throw new Error('private-execution-pact-source-invalid');
+    }
+    let ast;
+    try {
+        ast = parse(source, { sourceType: 'module', plugins: ['typescript'] });
+    }
+    catch {
+        throw new Error('private-execution-pact-source-invalid');
+    }
+    const pactImports = new Set();
+    const vitestImports = new Set();
+    const appImports = new Set();
+    for (const statement of ast.program.body) {
+        if (statement.type !== 'ImportDeclaration')
+            continue;
+        const importPath = statement.source.value;
+        if (importPath !== '@pact-foundation/pact' && importPath !== 'vitest') {
+            if (kind !== 'consumer' || !projectRoot) {
+                throw new Error('private-execution-pact-source-invalid');
+            }
+            for (const name of projectImportNames(statement, path, projectRoot)) {
+                if (appImports.has(name) || ['fetch', 'describe', 'it', 'expect',
+                    'PactV3', 'MatchersV3', 'Verifier'].includes(name)) {
+                    throw new Error('private-execution-pact-source-invalid');
+                }
+                appImports.add(name);
+            }
+            continue;
+        }
+        const names = importedNames(statement);
+        for (const name of names)
+            (importPath === '@pact-foundation/pact' ? pactImports : vitestImports).add(name);
+    }
+    if (!vitestImports.has('describe') || !vitestImports.has('it')
+        || (kind === 'consumer' && (!pactImports.has('PactV3') || !vitestImports.has('expect')))
+        || (kind === 'provider' && !pactImports.has('Verifier'))
+        || [...appImports].some((name) => pactImports.has(name) || vitestImports.has(name))) {
+        throw new Error('private-execution-pact-source-invalid');
+    }
+    // The private root decision is authoritative; generated tests cannot broaden
+    // literal contracts with matcher helpers when exact correspondence was chosen.
+    if (kind === 'consumer' && matchersAggressive === false
+        && [...pactImports].some((name) => name !== 'PactV3')) {
+        throw new Error('private-execution-pact-source-invalid');
+    }
+    const calls = new Set();
+    const constructors = new Set();
+    let brokerEnv = false;
+    let expectedRequest = false;
+    let appClientCalled = false;
+    const stack = [
+        { node: ast.program, inExecuteTest: false },
+    ];
+    let visited = 0;
+    while (stack.length > 0) {
+        const item = stack.pop();
+        const current = item.node;
+        if (!record(current))
+            continue;
+        if (++visited > MAX_AST_NODES)
+            throw new Error('private-execution-pact-source-invalid');
+        if (current.type === 'NewExpression' && record(current.callee)
+            && current.callee.type === 'Identifier' && typeof current.callee.name === 'string') {
+            constructors.add(current.callee.name);
+            if (item.inExecuteTest && appImports.has(current.callee.name))
+                appClientCalled = true;
+        }
+        if (current.type === 'CallExpression') {
+            const callee = current.callee;
+            if (record(callee) && callee.type === 'Identifier' && typeof callee.name === 'string') {
+                calls.add(callee.name);
+                if (item.inExecuteTest && appImports.has(callee.name))
+                    appClientCalled = true;
+            }
+            const member = memberName(callee);
+            if (member)
+                calls.add(member);
+            if (member === 'withRequest' && expectedInteraction && Array.isArray(current.arguments)) {
+                const request = requestLiterals(current.arguments[0]);
+                expectedRequest ||= request?.method.toUpperCase() === expectedInteraction.method
+                    && matchesEndpointPath(expectedInteraction.endpointPath, request?.path ?? '');
+            }
+        }
+        if (current.type === 'MemberExpression' && memberName(current) === 'PACT_BROKER_URL'
+            && record(current.object) && memberName(current.object) === 'env'
+            && record(current.object.object) && current.object.object.type === 'Identifier'
+            && current.object.object.name === 'process')
+            brokerEnv = true;
+        for (const [key, value] of Object.entries(current)) {
+            if (key === 'loc' || key === 'extra' || key === 'comments'
+                || key === 'leadingComments' || key === 'trailingComments' || key === 'innerComments')
+                continue;
+            const inExecuteTest = item.inExecuteTest
+                || current.type === 'CallExpression' && memberName(current.callee) === 'executeTest'
+                    && key === 'arguments';
+            if (Array.isArray(value)) {
+                for (const node of value)
+                    stack.push({ node, inExecuteTest });
+            }
+            else if (record(value))
+                stack.push({ node: value, inExecuteTest });
+        }
+    }
+    const requiredCalls = kind === 'consumer'
+        ? ['describe', 'it', 'withRequest', 'willRespondWith', 'executeTest', 'expect']
+        : ['describe', 'it', 'verifyProvider'];
+    if (requiredCalls.some((call) => !calls.has(call))
+        || !constructors.has(kind === 'consumer' ? 'PactV3' : 'Verifier')
+        || kind === 'consumer' && expectedInteraction !== undefined
+            && (expectedInteraction.filePath !== path || !expectedRequest)
+        || kind === 'provider' && brokerUrl !== null && !brokerEnv) {
+        throw new Error('private-execution-pact-source-invalid');
+    }
+    return Object.freeze({ schemaVersion: 1,
+        consumerBinding: kind === 'provider' ? 'provider-template'
+            : appClientCalled ? 'app-import-candidate' : 'mock-only-scaffold',
+        executionVerified: false, publicSafe: true });
+}

package/packages/client/dist/private-execution/pact-toolchain.js

@@ -1,3 +1,290 @@
-import{spawnSync as M}from"node:child_process";import{createHash as R}from"node:crypto";import{constants as j}from"node:fs";import{closeSync as V,fstatSync as P,lstatSync as O,mkdtempSync as I,openSync as $,readFileSync as z,realpathSync as D,rmSync as A,writeFileSync as w}from"node:fs";import{tmpdir as C}from"node:os";import{join as d,resolve as S}from"node:path";import{parseDocument as W}from"yaml";function p(o,r){return Object.freeze({schemaVersion:1,outcome:o,reasonCode:r,executionVerified:!1,publicSafe:!0})}function i(o){return!!o&&typeof o=="object"&&!Array.isArray(o)&&Object.getPrototypeOf(o)===Object.prototype}function m(o,r,e){const t=d(o,r);let n;try{n=$(t,j.O_RDONLY|j.O_NOFOLLOW)}catch(s){if(s.code==="ENOENT")return;throw new Error("pact-toolchain-path-unsafe")}try{const s=P(n);if(!s.isFile()||s.size<1||s.size>e)throw new Error("pact-toolchain-path-unsafe");return new TextDecoder("utf-8",{fatal:!0}).decode(z(n))}finally{V(n)}}function v(o){try{const r=W(o,{strict:!0,uniqueKeys:!0,schema:"core",customTags:[]});if(r.errors.length||r.warnings.length)return;const e=JSON.parse(o);return i(e)?e:void 0}catch{return}}function q(o,r){if(typeof r!="boolean")return p("unsupported","manifest-invalid");const e=S(o);try{if(D(e)!==e||!O(e).isDirectory())return p("unsupported","manifest-invalid");for(const T of["pnpm-lock.yaml","yarn.lock","bun.lock","bun.lockb"])if(m(e,T,8*1024*1024)!==void 0)return p("unsupported","package-manager-unsupported");const t=m(e,"package.json",1024*1024);if(t===void 0)return p("requires-root-integration","manifest-missing");const n=v(t);if(!n)return p("unsupported","manifest-invalid");if(n.packageManager!==void 0&&(typeof n.packageManager!="string"||!/^npm@[0-9]+(?:\.[0-9]+){0,2}$/.test(n.packageManager)))return p("unsupported","package-manager-unsupported");const s=n.scripts;if(!i(s)||typeof s["pact:consumer"]!="string"||!/^vitest run(?: --maxWorkers=1)? tests\/pact\/consumer\/$/.test(s["pact:consumer"])||r&&(typeof s["pact:provider"]!="string"||!/^vitest run(?: --maxWorkers=1)? tests\/pact\/provider\/$/.test(s["pact:provider"])))return p("requires-root-integration","scripts-missing");const c=n.devDependencies;if(!i(c)||typeof c["@pact-foundation/pact"]!="string"||typeof c.vitest!="string")return p("requires-root-integration","dependencies-missing");const u=/^(?:\^|~)?[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.-]+)?$/;if(!u.test(c["@pact-foundation/pact"])||!u.test(c.vitest))return p("unsupported","dependency-spec-unsupported");const f=m(e,"package-lock.json",8*1024*1024);if(f===void 0)return p("requires-root-integration","lockfile-missing");const a=v(f);if(!a||!i(a.packages)||!i(a.packages[""])||![2,3].includes(a.lockfileVersion))return p("unsupported","lockfile-invalid");const l=a.packages[""].devDependencies,k=a.packages["node_modules/@pact-foundation/pact"],h=a.packages["node_modules/vitest"];return!i(l)||l["@pact-foundation/pact"]!==c["@pact-foundation/pact"]||l.vitest!==c.vitest||!i(k)||typeof k.version!="string"||!u.test(k.version)||!i(h)||typeof h.version!="string"||!u.test(h.version)?p("requires-root-integration","lockfile-drift"):p("manifest-aligned","manifest-aligned-unverified")}catch{return p("unsupported","manifest-invalid")}}const F="17.1.4",H="3.2.4",_="vitest run --maxWorkers=1 tests/pact/consumer/",N="vitest run --maxWorkers=1 tests/pact/provider/",E=/^(?:\^|~)?[0-9]+\.[0-9]+\.[0-9]+$/;function L(o){const r=v(o);if(!r||![2,3].includes(r.lockfileVersion)||!i(r.packages)||Object.keys(r.packages).length>1e4)return!1;for(const e of Object.values(r.packages)){if(!i(e)||e.link===!0)return!1;if(e.resolved!==void 0){if(typeof e.resolved!="string"||typeof e.integrity!="string"||!/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(e.integrity))return!1;try{const t=new URL(e.resolved);if(t.protocol!=="https:"||t.hostname!=="registry.npmjs.org"||t.port||t.username||t.password||t.search||t.hash||!t.pathname.startsWith("/")||t.pathname.includes(".."))return!1}catch{return!1}}}return!0}function U(o,r){try{if(process.platform!=="linux"||typeof r!="boolean")throw new Error("unsupported");const e=S(o);if(D(e)!==e||!O(e).isDirectory())throw new Error("root");for(const y of[".npmrc","npm-shrinkwrap.json","pnpm-lock.yaml","yarn.lock","bun.lock","bun.lockb"])try{throw O(d(e,y)),new Error("alternate")}catch(g){if(g.code!=="ENOENT")throw g}const t=m(e,"package.json",1024*1024);if(!t)throw new Error("manifest");const n=v(t);if(!n||typeof n.name!="string"||!/^[a-z0-9@][a-z0-9@._/-]{0,213}$/.test(n.name)||typeof n.version!="string"||!E.test(n.version)||n.workspaces!==void 0||n.overrides!==void 0||n.packageManager!==void 0&&(typeof n.packageManager!="string"||!/^npm@[0-9]+(?:\.[0-9]+){0,2}$/.test(n.packageManager)))throw new Error("manifest");for(const y of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){const g=n[y];if(g!==void 0&&(!i(g)||Object.values(g).some(b=>typeof b!="string"||!E.test(b))))throw new Error("dependency")}const s=n.dependencies;if(i(s)&&(s["@pact-foundation/pact"]!==void 0||s.vitest!==void 0))throw new Error("placement");const c=n.scripts;if(c!==void 0&&!i(c))throw new Error("scripts");const u=i(c)?c:{};for(const y of["prepact:consumer","postpact:consumer","prepact:provider","postpact:provider"])if(u[y]!==void 0)throw new Error("lifecycle");if(u["pact:consumer"]!==void 0&&u["pact:consumer"]!==_||r&&u["pact:provider"]!==void 0&&u["pact:provider"]!==N)throw new Error("script-conflict");const f=i(n.devDependencies)?n.devDependencies:{},a=f["@pact-foundation/pact"]??F,l=f.vitest??H;if(typeof a!="string"||!E.test(a)||typeof l!="string"||!E.test(l))throw new Error("version");const k={...n,scripts:{...u,"pact:consumer":_,...r?{"pact:provider":N}:{}},devDependencies:{...f,"@pact-foundation/pact":a,vitest:l}},h=/^\{\r?\n([ \t]+)\S/m.exec(t)?.[1]??"  ",T=JSON.stringify(k,null,h)+(t.endsWith(`
-`)?`
-`:""),x=m(e,"package-lock.json",8*1024*1024)??null;if(x!==null&&!L(x))throw new Error("lock");return Object.freeze({sourceText:t,candidateText:T,sourceLockText:x})}catch{throw new Error("pact-toolchain-manifest-unsupported")}}function X(o,r){const e=U(o,r),t=I(d(C(),"p222-pact-toolchain-"));try{w(d(t,"package.json"),e.candidateText,{mode:384}),w(d(t,"user.npmrc"),"",{mode:384}),w(d(t,"global.npmrc"),"",{mode:384}),e.sourceLockText!==null&&w(d(t,"package-lock.json"),e.sourceLockText,{mode:384});const n=M("npm",["install","--package-lock-only","--ignore-scripts","--no-audit","--no-fund","--registry=https://registry.npmjs.org/",`--userconfig=${d(t,"user.npmrc")}`,`--globalconfig=${d(t,"global.npmrc")}`],{cwd:t,encoding:"utf8",timeout:12e4,maxBuffer:256*1024,env:{PATH:process.env.PATH,HOME:t,TMPDIR:t,npm_config_cache:d(t,".npm-cache"),CI:"true",NO_UPDATE_NOTIFIER:"1"},stdio:["ignore","pipe","pipe"]});if(n.error||n.status!==0)throw new Error("npm");const s=m(t,"package.json",1024*1024),c=m(t,"package-lock.json",8*1024*1024),u=q(t,r);if(s!==e.candidateText||!c||!L(c)||u.outcome!=="manifest-aligned")throw new Error("candidate");const f=S(o);if(m(f,"package.json",1024*1024)!==e.sourceText||(m(f,"package-lock.json",8*1024*1024)??null)!==e.sourceLockText)throw new Error("source-raced");const a=l=>R("sha256").update(l).digest("hex");return Object.freeze({schemaVersion:1,outcome:"candidate-unverified",sourceManifestSha256:a(e.sourceText),sourceLockSha256:e.sourceLockText===null?null:a(e.sourceLockText),manifestText:s,lockText:c,executionVerified:!1})}catch{throw new Error("pact-toolchain-candidate-unavailable")}finally{A(t,{recursive:!0,force:!0})}}export{q as inspectPactToolchain,U as planPactToolchainManifest,X as preparePactToolchainCandidate};
+/**
+ * Root-owned Pact toolchain inspection and scratch-only npm candidate planning.
+ * A matching manifest and lockfile are configuration evidence, never a
+ * test-execution/QA receipt.
+ */
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { closeSync, fstatSync, lstatSync, mkdtempSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { parseDocument } from 'yaml';
+function result(outcome, reasonCode) {
+    return Object.freeze({ schemaVersion: 1, outcome, reasonCode,
+        executionVerified: false, publicSafe: true });
+}
+function record(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value)
+        && Object.getPrototypeOf(value) === Object.prototype;
+}
+function readRegular(root, relative, maxBytes) {
+    const path = join(root, relative);
+    let handle;
+    try {
+        handle = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw new Error('pact-toolchain-path-unsafe');
+    }
+    try {
+        const entry = fstatSync(handle);
+        if (!entry.isFile() || entry.size < 1 || entry.size > maxBytes) {
+            throw new Error('pact-toolchain-path-unsafe');
+        }
+        return new TextDecoder('utf-8', { fatal: true }).decode(readFileSync(handle));
+    }
+    finally {
+        closeSync(handle);
+    }
+}
+function parseStrictJson(text) {
+    try {
+        const document = parseDocument(text, { strict: true, uniqueKeys: true,
+            schema: 'core', customTags: [] });
+        if (document.errors.length || document.warnings.length)
+            return undefined;
+        const parsed = JSON.parse(text);
+        return record(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** No project mutation, dependency installation, script execution, or private values. */
+export function inspectPactToolchain(projectRoot, generateProvider) {
+    if (typeof generateProvider !== 'boolean') {
+        return result('unsupported', 'manifest-invalid');
+    }
+    const root = resolve(projectRoot);
+    try {
+        if (realpathSync(root) !== root || !lstatSync(root).isDirectory()) {
+            return result('unsupported', 'manifest-invalid');
+        }
+        for (const alternate of ['pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb']) {
+            if (readRegular(root, alternate, 8 * 1024 * 1024) !== undefined) {
+                return result('unsupported', 'package-manager-unsupported');
+            }
+        }
+        const manifestText = readRegular(root, 'package.json', 1024 * 1024);
+        if (manifestText === undefined)
+            return result('requires-root-integration', 'manifest-missing');
+        const manifest = parseStrictJson(manifestText);
+        if (!manifest)
+            return result('unsupported', 'manifest-invalid');
+        if (manifest.packageManager !== undefined
+            && (typeof manifest.packageManager !== 'string'
+                || !/^npm@[0-9]+(?:\.[0-9]+){0,2}$/.test(manifest.packageManager))) {
+            return result('unsupported', 'package-manager-unsupported');
+        }
+        const scripts = manifest.scripts;
+        if (!record(scripts) || typeof scripts['pact:consumer'] !== 'string'
+            || !/^vitest run(?: --maxWorkers=1)? tests\/pact\/consumer\/$/.test(scripts['pact:consumer'])
+            || generateProvider && (typeof scripts['pact:provider'] !== 'string'
+                || !/^vitest run(?: --maxWorkers=1)? tests\/pact\/provider\/$/.test(scripts['pact:provider']))) {
+            return result('requires-root-integration', 'scripts-missing');
+        }
+        const devDependencies = manifest.devDependencies;
+        if (!record(devDependencies)
+            || typeof devDependencies['@pact-foundation/pact'] !== 'string'
+            || typeof devDependencies.vitest !== 'string') {
+            return result('requires-root-integration', 'dependencies-missing');
+        }
+        const boundedVersion = /^(?:\^|~)?[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.-]+)?$/;
+        if (!boundedVersion.test(devDependencies['@pact-foundation/pact'])
+            || !boundedVersion.test(devDependencies.vitest)) {
+            return result('unsupported', 'dependency-spec-unsupported');
+        }
+        const lockText = readRegular(root, 'package-lock.json', 8 * 1024 * 1024);
+        if (lockText === undefined)
+            return result('requires-root-integration', 'lockfile-missing');
+        const lock = parseStrictJson(lockText);
+        if (!lock || !record(lock.packages) || !record(lock.packages[''])
+            || ![2, 3].includes(lock.lockfileVersion)) {
+            return result('unsupported', 'lockfile-invalid');
+        }
+        const lockedDeps = lock.packages[''].devDependencies;
+        const lockedPact = lock.packages['node_modules/@pact-foundation/pact'];
+        const lockedVitest = lock.packages['node_modules/vitest'];
+        if (!record(lockedDeps)
+            || lockedDeps['@pact-foundation/pact'] !== devDependencies['@pact-foundation/pact']
+            || lockedDeps.vitest !== devDependencies.vitest
+            || !record(lockedPact) || typeof lockedPact.version !== 'string'
+            || !boundedVersion.test(lockedPact.version)
+            || !record(lockedVitest) || typeof lockedVitest.version !== 'string'
+            || !boundedVersion.test(lockedVitest.version)) {
+            return result('requires-root-integration', 'lockfile-drift');
+        }
+        return result('manifest-aligned', 'manifest-aligned-unverified');
+    }
+    catch {
+        return result('unsupported', 'manifest-invalid');
+    }
+}
+const PACT_VERSION = '17.1.4';
+const VITEST_VERSION = '3.2.4';
+const CONSUMER_SCRIPT = 'vitest run --maxWorkers=1 tests/pact/consumer/';
+const PROVIDER_SCRIPT = 'vitest run --maxWorkers=1 tests/pact/provider/';
+const BOUNDED_NPM_SPEC = /^(?:\^|~)?[0-9]+\.[0-9]+\.[0-9]+$/;
+function safeRegistryLock(text) {
+    const lock = parseStrictJson(text);
+    if (!lock || ![2, 3].includes(lock.lockfileVersion)
+        || !record(lock.packages) || Object.keys(lock.packages).length > 10_000)
+        return false;
+    for (const value of Object.values(lock.packages)) {
+        if (!record(value) || value.link === true)
+            return false;
+        if (value.resolved === undefined)
+            continue;
+        if (typeof value.resolved !== 'string' || typeof value.integrity !== 'string'
+            || !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(value.integrity))
+            return false;
+        try {
+            const url = new URL(value.resolved);
+            if (url.protocol !== 'https:' || url.hostname !== 'registry.npmjs.org'
+                || url.port || url.username || url.password || url.search || url.hash
+                || !url.pathname.startsWith('/') || url.pathname.includes('..'))
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Root-owned manifest proposal. It preserves unrelated keys and refuses
+ * conflicting scripts, non-registry dependencies and unsupported workspaces.
+ * No filesystem effect occurs here.
+ */
+export function planPactToolchainManifest(projectRoot, generateProvider) {
+    try {
+        if (process.platform !== 'linux' || typeof generateProvider !== 'boolean') {
+            throw new Error('unsupported');
+        }
+        const root = resolve(projectRoot);
+        if (realpathSync(root) !== root || !lstatSync(root).isDirectory())
+            throw new Error('root');
+        for (const alternate of ['.npmrc', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock',
+            'bun.lock', 'bun.lockb']) {
+            try {
+                lstatSync(join(root, alternate));
+                throw new Error('alternate');
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        const sourceText = readRegular(root, 'package.json', 1024 * 1024);
+        if (!sourceText)
+            throw new Error('manifest');
+        const manifest = parseStrictJson(sourceText);
+        if (!manifest || typeof manifest.name !== 'string' || !/^[a-z0-9@][a-z0-9@._/-]{0,213}$/.test(manifest.name)
+            || typeof manifest.version !== 'string' || !BOUNDED_NPM_SPEC.test(manifest.version)
+            || manifest.workspaces !== undefined || manifest.overrides !== undefined
+            || (manifest.packageManager !== undefined
+                && (typeof manifest.packageManager !== 'string'
+                    || !/^npm@[0-9]+(?:\.[0-9]+){0,2}$/.test(manifest.packageManager)))) {
+            throw new Error('manifest');
+        }
+        for (const section of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
+            const dependencies = manifest[section];
+            if (dependencies !== undefined && (!record(dependencies)
+                || Object.values(dependencies).some((value) => typeof value !== 'string'
+                    || !BOUNDED_NPM_SPEC.test(value))))
+                throw new Error('dependency');
+        }
+        const runtimeDeps = manifest.dependencies;
+        if (record(runtimeDeps) && (runtimeDeps['@pact-foundation/pact'] !== undefined
+            || runtimeDeps.vitest !== undefined))
+            throw new Error('placement');
+        const scripts = manifest.scripts;
+        if (scripts !== undefined && !record(scripts))
+            throw new Error('scripts');
+        const existingScripts = record(scripts) ? scripts : {};
+        for (const name of ['prepact:consumer', 'postpact:consumer', 'prepact:provider', 'postpact:provider']) {
+            if (existingScripts[name] !== undefined)
+                throw new Error('lifecycle');
+        }
+        if ((existingScripts['pact:consumer'] !== undefined
+            && existingScripts['pact:consumer'] !== CONSUMER_SCRIPT)
+            || (generateProvider && existingScripts['pact:provider'] !== undefined
+                && existingScripts['pact:provider'] !== PROVIDER_SCRIPT))
+            throw new Error('script-conflict');
+        const devDependencies = record(manifest.devDependencies) ? manifest.devDependencies : {};
+        const pact = devDependencies['@pact-foundation/pact'] ?? PACT_VERSION;
+        const vitest = devDependencies.vitest ?? VITEST_VERSION;
+        if (typeof pact !== 'string' || !BOUNDED_NPM_SPEC.test(pact)
+            || typeof vitest !== 'string' || !BOUNDED_NPM_SPEC.test(vitest))
+            throw new Error('version');
+        const candidate = { ...manifest,
+            scripts: { ...existingScripts, 'pact:consumer': CONSUMER_SCRIPT,
+                ...(generateProvider ? { 'pact:provider': PROVIDER_SCRIPT } : {}) },
+            devDependencies: { ...devDependencies, '@pact-foundation/pact': pact, vitest },
+        };
+        const indentation = /^\{\r?\n([ \t]+)\S/m.exec(sourceText)?.[1] ?? '  ';
+        const candidateText = JSON.stringify(candidate, null, indentation)
+            + (sourceText.endsWith('\n') ? '\n' : '');
+        const sourceLockText = readRegular(root, 'package-lock.json', 8 * 1024 * 1024) ?? null;
+        if (sourceLockText !== null && !safeRegistryLock(sourceLockText))
+            throw new Error('lock');
+        return Object.freeze({ sourceText, candidateText, sourceLockText });
+    }
+    catch {
+        throw new Error('pact-toolchain-manifest-unsupported');
+    }
+}
+/**
+ * Resolve a lockfile from metadata alone in a private temporary directory.
+ * npm never sees project source, local credentials, .npmrc or generated tests;
+ * ignore-scripts and package-lock-only prevent package code execution.
+ */
+export function preparePactToolchainCandidate(projectRoot, generateProvider) {
+    const planned = planPactToolchainManifest(projectRoot, generateProvider);
+    const scratch = mkdtempSync(join(tmpdir(), 'p222-pact-toolchain-'));
+    try {
+        writeFileSync(join(scratch, 'package.json'), planned.candidateText, { mode: 0o600 });
+        writeFileSync(join(scratch, 'user.npmrc'), '', { mode: 0o600 });
+        writeFileSync(join(scratch, 'global.npmrc'), '', { mode: 0o600 });
+        if (planned.sourceLockText !== null) {
+            writeFileSync(join(scratch, 'package-lock.json'), planned.sourceLockText, { mode: 0o600 });
+        }
+        const command = spawnSync('npm', ['install', '--package-lock-only', '--ignore-scripts',
+            '--no-audit', '--no-fund', '--registry=https://registry.npmjs.org/',
+            `--userconfig=${join(scratch, 'user.npmrc')}`,
+            `--globalconfig=${join(scratch, 'global.npmrc')}`], {
+            cwd: scratch, encoding: 'utf8', timeout: 120_000, maxBuffer: 256 * 1024,
+            env: { PATH: process.env.PATH, HOME: scratch, TMPDIR: scratch,
+                npm_config_cache: join(scratch, '.npm-cache'), CI: 'true', NO_UPDATE_NOTIFIER: '1' },
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        if (command.error || command.status !== 0)
+            throw new Error('npm');
+        const manifestText = readRegular(scratch, 'package.json', 1024 * 1024);
+        const lockText = readRegular(scratch, 'package-lock.json', 8 * 1024 * 1024);
+        const inspection = inspectPactToolchain(scratch, generateProvider);
+        if (manifestText !== planned.candidateText || !lockText || !safeRegistryLock(lockText)
+            || inspection.outcome !== 'manifest-aligned') {
+            throw new Error('candidate');
+        }
+        const root = resolve(projectRoot);
+        if (readRegular(root, 'package.json', 1024 * 1024) !== planned.sourceText
+            || (readRegular(root, 'package-lock.json', 8 * 1024 * 1024) ?? null) !== planned.sourceLockText) {
+            throw new Error('source-raced');
+        }
+        const sha = (value) => createHash('sha256').update(value).digest('hex');
+        return Object.freeze({ schemaVersion: 1, outcome: 'candidate-unverified',
+            sourceManifestSha256: sha(planned.sourceText),
+            sourceLockSha256: planned.sourceLockText === null ? null : sha(planned.sourceLockText),
+            manifestText, lockText, executionVerified: false });
+    }
+    catch {
+        throw new Error('pact-toolchain-candidate-unavailable');
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}