@ornexus/neocortex 4.60.73 → 4.60.74

package/packages/client/dist/private-execution/isolated-workspace.js

@@ -1,122 +1 @@
-/** Independent checkout for a private YOLO agent; preparation has no root Git effects. */
-import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { chmodSync, existsSync, lstatSync, mkdtempSync, readFileSync, realpathSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
-export const PRIVATE_EPIC_PENDING_SIDECAR = '.neocortex/pending-epic-claims.json';
-function git(root, args) {
-    const environment = { ...process.env };
-    for (const key of [
-        'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
-        'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_COMMON_DIR', 'GIT_NAMESPACE', 'GIT_CEILING_DIRECTORIES',
-    ])
-        delete environment[key];
-    return execFileSync('git', [...args], {
-        cwd: root, env: environment, stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: 30_000, maxBuffer: 16 * 1024 * 1024,
-    });
-}
-function output(root, args) {
-    return git(root, args).toString('utf8').trim();
-}
-function cleanSource(root, headSha, branch, allowPendingEpicSidecar = false) {
-    const dirty = git(root, ['status', '--porcelain=v1', '-z', '--untracked-files=all']).toString('utf8');
-    let pendingValid = !allowPendingEpicSidecar;
-    if (allowPendingEpicSidecar) {
-        try {
-            const directory = lstatSync(join(root, '.neocortex'));
-            const entry = lstatSync(join(root, PRIVATE_EPIC_PENDING_SIDECAR));
-            pendingValid = directory.isDirectory() && !directory.isSymbolicLink()
-                && directory.uid === process.getuid?.() && (directory.mode & 0o022) === 0
-                && entry.isFile() && !entry.isSymbolicLink()
-                && entry.uid === process.getuid?.() && (entry.mode & 0o077) === 0
-                && entry.size > 0 && entry.size <= 128 * 1024;
-        }
-        catch {
-            pendingValid = false;
-        }
-    }
-    return output(root, ['rev-parse', 'HEAD']) === headSha
-        && output(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']) === branch
-        && pendingValid
-        && (dirty.length === 0 || allowPendingEpicSidecar && dirty === `?? ${PRIVATE_EPIC_PENDING_SIDECAR}\0`);
-}
-function projectStateSha256(root) {
-    const statePath = join(root, '.neocortex', 'state.json');
-    const entry = lstatSync(statePath);
-    if (!entry.isFile() || entry.isSymbolicLink())
-        throw new Error('state-invalid');
-    return createHash('sha256').update(readFileSync(statePath)).digest('hex');
-}
-/** Pin the request's physical source before projecting a private project-step snapshot. */
-export function capturePrivateProjectStepBaseline(projectRoot) {
-    try {
-        const headSha = output(projectRoot, ['rev-parse', '--verify', 'HEAD']);
-        if (!/^[a-f0-9]{40,64}$/.test(headSha))
-            throw new Error('head-invalid');
-        return Object.freeze({ headSha, stateSha256: projectStateSha256(projectRoot) });
-    }
-    catch {
-        throw new Error('private-execution-project-snapshot-unverified');
-    }
-}
-/** A later commit or state rewrite cannot execute against an older server lease. */
-export function assertPrivateProjectStepBaseline(workspace, baseline) {
-    try {
-        if (workspace.baseSha !== baseline.headSha
-            || output(workspace.sourceRoot, ['rev-parse', '--verify', 'HEAD']) !== baseline.headSha
-            || projectStateSha256(workspace.sourceRoot) !== baseline.stateSha256
-            || projectStateSha256(workspace.workspacePath) !== baseline.stateSha256) {
-            throw new Error('snapshot-mismatch');
-        }
-    }
-    catch {
-        throw new Error('private-execution-project-snapshot-unverified');
-    }
-}
-/**
- * Build a separate object store and index from a clean, committed checkout.
- * The caller must retain the workspace until its bytes are independently
- * admitted into the root; this function never stages, commits, or deletes it.
- */
-export function preparePrivateYoloIsolatedWorkspace(projectRoot, workspaceParent, allowPendingEpicSidecar = false) {
-    let root;
-    let parent;
-    try {
-        if (process.platform !== 'linux' || typeof process.getuid !== 'function'
-            || !isAbsolute(projectRoot) || !isAbsolute(workspaceParent)) {
-            throw new Error('path-invalid');
-        }
-        root = resolve(projectRoot);
-        parent = resolve(workspaceParent);
-        if (realpathSync(root) !== root || !lstatSync(root).isDirectory()
-            || realpathSync(parent) !== parent || !lstatSync(parent).isDirectory()
-            || lstatSync(parent).uid !== process.getuid()
-            || (lstatSync(parent).mode & 0o022) !== 0
-            || output(root, ['rev-parse', '--show-toplevel']) !== root) {
-            throw new Error('path-invalid');
-        }
-        const baseSha = output(root, ['rev-parse', 'HEAD']);
-        const executionBranch = output(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
-        if (!/^[a-f0-9]{40,64}$/.test(baseSha)
-            || !executionBranch || !cleanSource(root, baseSha, executionBranch, allowPendingEpicSidecar)) {
-            throw new Error('source-dirty');
-        }
-        const workspacePath = mkdtempSync(join(parent, 'p222-private-yolo-'));
-        chmodSync(workspacePath, 0o700);
-        git(workspacePath, ['init', '-q']);
-        git(workspacePath, ['fetch', '-q', '--no-tags', '--depth=1', root, baseSha]);
-        git(workspacePath, ['checkout', '-q', '-b', executionBranch, 'FETCH_HEAD']);
-        if (!cleanSource(root, baseSha, executionBranch, allowPendingEpicSidecar)
-            || output(workspacePath, ['rev-parse', 'HEAD']) !== baseSha
-            || output(workspacePath, ['symbolic-ref', '--quiet', '--short', 'HEAD']) !== executionBranch
-            || git(workspacePath, ['status', '--porcelain=v1', '-z', '--untracked-files=all']).byteLength !== 0
-            || existsSync(join(workspacePath, '.git', 'objects', 'info', 'alternates'))) {
-            throw new Error('physical-mismatch');
-        }
-        return Object.freeze({ schemaVersion: 1, sourceRoot: root, workspacePath, baseSha, executionBranch });
-    }
-    catch {
-        throw new Error('private-execution-isolated-workspace-unverified');
-    }
-}
+import{execFileSync as v}from"node:child_process";import{createHash as S}from"node:crypto";import{chmodSync as I,existsSync as D,lstatSync as h,mkdtempSync as _,readFileSync as w,realpathSync as l}from"node:fs";import{isAbsolute as E,join as u,resolve as d}from"node:path";const y=".neocortex/pending-epic-claims.json";function p(e,t){const s={...process.env};for(const r of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete s[r];return v("git",[...t],{cwd:e,env:s,stdio:["ignore","pipe","pipe"],timeout:3e4,maxBuffer:16*1024*1024})}function c(e,t){return p(e,t).toString("utf8").trim()}function m(e,t,s,r=!1){const n=p(e,["status","--porcelain=v1","-z","--untracked-files=all"]).toString("utf8");let a=!r;if(r)try{const i=h(u(e,".neocortex")),o=h(u(e,y));a=i.isDirectory()&&!i.isSymbolicLink()&&i.uid===process.getuid?.()&&(i.mode&18)===0&&o.isFile()&&!o.isSymbolicLink()&&o.uid===process.getuid?.()&&(o.mode&63)===0&&o.size>0&&o.size<=128*1024}catch{a=!1}return c(e,["rev-parse","HEAD"])===t&&c(e,["symbolic-ref","--quiet","--short","HEAD"])===s&&a&&(n.length===0||r&&n===`?? ${y}\0`)}function f(e){const t=u(e,".neocortex","state.json"),s=h(t);if(!s.isFile()||s.isSymbolicLink())throw new Error("state-invalid");return S("sha256").update(w(t)).digest("hex")}function g(e){try{const t=c(e,["rev-parse","--verify","HEAD"]);if(!/^[a-f0-9]{40,64}$/.test(t))throw new Error("head-invalid");return Object.freeze({headSha:t,stateSha256:f(e)})}catch{throw new Error("private-execution-project-snapshot-unverified")}}function b(e,t){try{if(e.baseSha!==t.headSha||c(e.sourceRoot,["rev-parse","--verify","HEAD"])!==t.headSha||f(e.sourceRoot)!==t.stateSha256||f(e.workspacePath)!==t.stateSha256)throw new Error("snapshot-mismatch")}catch{throw new Error("private-execution-project-snapshot-unverified")}}function C(e,t,s=!1){let r,n;try{if(process.platform!=="linux"||typeof process.getuid!="function"||!E(e)||!E(t))throw new Error("path-invalid");if(r=d(e),n=d(t),l(r)!==r||!h(r).isDirectory()||l(n)!==n||!h(n).isDirectory()||h(n).uid!==process.getuid()||(h(n).mode&18)!==0||c(r,["rev-parse","--show-toplevel"])!==r)throw new Error("path-invalid");const a=c(r,["rev-parse","HEAD"]),i=c(r,["symbolic-ref","--quiet","--short","HEAD"]);if(!/^[a-f0-9]{40,64}$/.test(a)||!i||!m(r,a,i,s))throw new Error("source-dirty");const o=_(u(n,"p222-private-yolo-"));if(I(o,448),p(o,["init","-q"]),p(o,["fetch","-q","--no-tags","--depth=1",r,a]),p(o,["checkout","-q","-b",i,"FETCH_HEAD"]),!m(r,a,i,s)||c(o,["rev-parse","HEAD"])!==a||c(o,["symbolic-ref","--quiet","--short","HEAD"])!==i||p(o,["status","--porcelain=v1","-z","--untracked-files=all"]).byteLength!==0||D(u(o,".git","objects","info","alternates")))throw new Error("physical-mismatch");return Object.freeze({schemaVersion:1,sourceRoot:r,workspacePath:o,baseSha:a,executionBranch:i})}catch{throw new Error("private-execution-isolated-workspace-unverified")}}export{y as PRIVATE_EPIC_PENDING_SIDECAR,b as assertPrivateProjectStepBaseline,g as capturePrivateProjectStepBaseline,C as preparePrivateYoloIsolatedWorkspace};

package/packages/client/dist/private-execution/pact-consumer-runtime.js

@@ -1,409 +1,3 @@
-/**
- * Root-owned, local-only Pact consumer proof. Untrusted generated tests run in a
- * Bubblewrap namespace containing copied, bounded project files and no host
- * credentials or external network. No test text or process output is public.
- */
-import { spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { constants } from 'node:fs';
-import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join, posix, resolve } from 'node:path';
-import { isDeepStrictEqual } from 'node:util';
-import { parse } from '@babel/parser';
-import { derivePactWriteSet } from './pact-write-set.js';
-import { validatePactTestSource } from './pact-test-source.js';
-import { inspectPactToolchain, planPactToolchainManifest } from './pact-toolchain.js';
-const MAX_SOURCE_FILES = 1024;
-const MAX_SOURCE_BYTES = 16 * 1024 * 1024;
-const MAX_REPORT_BYTES = 2 * 1024 * 1024;
-const CANARY = 'P222_APP_CONSUMER_CAUSAL_CANARY';
-const SOURCE_PREFIX = /^(?:src|app|lib|packages|clients)\//;
-const SOURCE_SUFFIX = /\.(?:ts|tsx|js|jsx|mjs|cjs|json)$/;
-class RuntimeFailure extends Error {
-    reason;
-    constructor(reason) {
-        super(reason);
-        this.reason = reason;
-    }
-}
-function fail(reason) { throw new RuntimeFailure(reason); }
-function result(reasonCode, revision, digest, expectedInteractions, passedTests = 0, mutationFailedTests = 0) {
-    const proven = reasonCode === 'consumer-proven';
-    return Object.freeze({ schemaVersion: 1, outcome: proven ? 'consumer-proven' : 'unverified',
-        reasonCode, sourceRevision: revision, filesSha256: digest, expectedInteractions,
-        passedTests, mutationFailedTests, appConsumerProven: proven,
-        providerVerified: false, qaAccepted: false, publicSafe: true });
-}
-function regularBytes(root, relative, cap) {
-    let current = root;
-    for (const part of relative.split('/').slice(0, -1)) {
-        current = join(current, part);
-        const entry = lstatSync(current);
-        if (!entry.isDirectory() || entry.isSymbolicLink())
-            fail('source-unsupported');
-    }
-    const path = join(root, relative);
-    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-    try {
-        const entry = fstatSync(fd);
-        if (!entry.isFile() || entry.size < 1 || entry.size > cap)
-            fail('source-unsupported');
-        return readFileSync(fd);
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-function git(root, args) {
-    const env = { PATH: process.env.PATH, HOME: process.env.HOME };
-    const command = spawnSync('git', args, { cwd: root, env, timeout: 30_000,
-        maxBuffer: 2 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'] });
-    if (command.error || command.status !== 0 || !Buffer.isBuffer(command.stdout))
-        fail('source-unsupported');
-    return command.stdout;
-}
-function appImportBindings(path, source, tracked) {
-    const modules = new Map();
-    const ast = parse(source, { sourceType: 'module', plugins: ['typescript'] });
-    for (const statement of ast.program.body) {
-        if (statement.type !== 'ImportDeclaration'
-            || statement.source.value === '@pact-foundation/pact'
-            || statement.source.value === 'vitest')
-            continue;
-        const specifier = statement.source.value;
-        if (!/^\.\.?\/[A-Za-z0-9_./-]{1,240}$/.test(specifier))
-            fail('source-unsupported');
-        const relative = posix.normalize(posix.join(posix.dirname(path), specifier));
-        if (!SOURCE_PREFIX.test(relative) || relative.split('/').includes('..'))
-            fail('source-unsupported');
-        const candidates = /\.(?:ts|tsx|js|mjs)$/.test(relative)
-            ? [relative, ...(relative.endsWith('.js') ? [`${relative.slice(0, -3)}.ts`,
-                    `${relative.slice(0, -3)}.tsx`] : [])]
-            : [`${relative}.ts`, `${relative}.tsx`, `${relative}.js`, `${relative}.mjs`,
-                `${relative}/index.ts`, `${relative}/index.tsx`, `${relative}/index.js`];
-        const matches = candidates.filter((candidate) => tracked.has(candidate));
-        if (matches.length !== 1)
-            fail('source-unsupported');
-        const names = modules.get(matches[0]) ?? new Set();
-        for (const imported of statement.specifiers) {
-            if (imported.type === 'ImportNamespaceSpecifier')
-                fail('source-unsupported');
-            const name = imported.type === 'ImportDefaultSpecifier' ? 'default'
-                : imported.imported.type === 'Identifier' ? imported.imported.name : imported.imported.value;
-            if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name))
-                fail('source-unsupported');
-            names.add(name);
-        }
-        if (names.size === 0)
-            fail('source-unsupported');
-        modules.set(matches[0], names);
-    }
-    return modules;
-}
-/** Pact's default output or the generator's explicit local output, never a dynamic path. */
-function pactArtifactDirectory(source) {
-    const ast = parse(source, { sourceType: 'module', plugins: ['typescript'] });
-    const stack = [ast.program];
-    let directory = null;
-    let visited = 0;
-    while (stack.length > 0) {
-        const node = stack.pop();
-        if (!node || typeof node !== 'object' || Array.isArray(node))
-            continue;
-        if (++visited > 100_000)
-            fail('source-unsupported');
-        const value = node;
-        if (value.type === 'NewExpression' && value.callee && typeof value.callee === 'object'
-            && value.callee.type === 'Identifier'
-            && value.callee.name === 'PactV3') {
-            if (directory !== null || !Array.isArray(value.arguments) || value.arguments.length !== 1) {
-                fail('source-unsupported');
-            }
-            const options = value.arguments[0];
-            if (!options || options.type !== 'ObjectExpression' || !Array.isArray(options.properties)) {
-                fail('source-unsupported');
-            }
-            let selected = 'pacts';
-            let seenDir = false;
-            for (const entry of options.properties) {
-                const property = entry;
-                if (property.type !== 'ObjectProperty' || property.computed === true) {
-                    fail('source-unsupported');
-                }
-                const key = property.key;
-                const name = key.type === 'Identifier' ? key.name
-                    : key.type === 'StringLiteral' ? key.value : undefined;
-                if (name !== 'dir')
-                    continue;
-                if (seenDir)
-                    fail('source-unsupported');
-                seenDir = true;
-                const literal = property.value;
-                if (literal.type !== 'StringLiteral' || typeof literal.value !== 'string') {
-                    fail('source-unsupported');
-                }
-                if (literal.value === './pact-files' || literal.value === 'pact-files')
-                    selected = 'pact-files';
-                else if (literal.value !== './pacts' && literal.value !== 'pacts')
-                    fail('source-unsupported');
-            }
-            directory = selected;
-        }
-        for (const [key, child] of Object.entries(value)) {
-            if (['loc', 'extra', 'comments', 'leadingComments', 'trailingComments', 'innerComments'].includes(key))
-                continue;
-            if (Array.isArray(child))
-                stack.push(...child);
-            else if (child && typeof child === 'object')
-                stack.push(child);
-        }
-    }
-    if (directory === null)
-        fail('source-unsupported');
-    return directory;
-}
-function sandboxArgs(scratch, report) {
-    const args = ['--die-with-parent', '--new-session', '--unshare-all', '--clearenv',
-        '--setenv', 'HOME', '/work', '--setenv', 'TMPDIR', '/tmp',
-        '--setenv', 'PATH', '/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin',
-        '--setenv', 'CI', 'true', '--setenv', 'NODE_ENV', 'test',
-        '--ro-bind', '/usr', '/usr', '--ro-bind', '/lib', '/lib',
-        '--ro-bind', '/lib64', '/lib64', '--ro-bind', '/bin', '/bin',
-        '--ro-bind', '/etc', '/etc'];
-    if (existsSync('/home/linuxbrew/.linuxbrew')) {
-        args.push('--ro-bind', '/home/linuxbrew/.linuxbrew', '/home/linuxbrew/.linuxbrew');
-    }
-    return [...args, '--dev', '/dev', '--proc', '/proc', '--tmpfs', '/tmp',
-        '--bind', scratch, '/work', '--chdir', '/work', '--', process.execPath,
-        'node_modules/vitest/vitest.mjs', 'run', '--maxWorkers=1',
-        'tests/pact/consumer/', '--reporter=json', `--outputFile=/work/${report}`];
-}
-function runSandbox(scratch, report) {
-    const command = spawnSync('/usr/bin/bwrap', sandboxArgs(scratch, report), {
-        env: { PATH: '/usr/bin:/bin' }, timeout: 180_000,
-        stdio: 'ignore',
-    });
-    if (command.error || command.signal || command.status === null)
-        fail('sandbox-unavailable');
-    return command.status;
-}
-function reportAssertions(scratch, name, paths) {
-    if (!existsSync(join(scratch, name)))
-        fail('sandbox-unavailable');
-    let parsed;
-    try {
-        parsed = JSON.parse(regularBytes(scratch, name, MAX_REPORT_BYTES).toString('utf8'));
-    }
-    catch {
-        fail('consumer-failed');
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-        fail('consumer-failed');
-    const files = parsed.testResults;
-    if (!Array.isArray(files) || files.length !== paths.length)
-        fail('consumer-failed');
-    const byPath = new Map();
-    for (const value of files) {
-        if (!value || typeof value !== 'object' || Array.isArray(value))
-            fail('consumer-failed');
-        const file = value;
-        if (typeof file.name !== 'string' || !paths.some((path) => file.name === `/work/${path}`)
-            || byPath.has(file.name) || !Array.isArray(file.assertionResults)
-            || file.assertionResults.length < 1)
-            fail('consumer-failed');
-        byPath.set(file.name, file);
-    }
-    return paths.flatMap((path) => byPath.get(`/work/${path}`).assertionResults);
-}
-function matchesPath(template, actual) {
-    const expected = template.split('/');
-    const candidate = actual.split('/');
-    return expected.length === candidate.length && expected.every((segment, index) => {
-        const value = candidate[index];
-        if (!segment.includes('{'))
-            return segment === value;
-        const parameter = /^([^{}]*)\{[^{}]+\}([^{}]*)$/.exec(segment);
-        return !!parameter && value.startsWith(parameter[1]) && value.endsWith(parameter[2])
-            && value.length > parameter[1].length + parameter[2].length;
-    });
-}
-function pactInteractions(scratch, artifactDirectory, expected) {
-    const dir = join(scratch, artifactDirectory);
-    if (!existsSync(dir) || !lstatSync(dir).isDirectory())
-        return false;
-    const files = readdirSync(dir).filter((path) => /^[A-Za-z0-9_.-]+\.json$/.test(path));
-    if (files.length < 1 || files.length > 16)
-        return false;
-    const actual = [];
-    for (const file of files) {
-        let parsed;
-        try {
-            parsed = JSON.parse(regularBytes(dir, file, 1024 * 1024).toString('utf8'));
-        }
-        catch {
-            return false;
-        }
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-            return false;
-        const interactions = parsed.interactions;
-        if (!Array.isArray(interactions))
-            return false;
-        for (const interaction of interactions) {
-            if (!interaction || typeof interaction !== 'object' || Array.isArray(interaction))
-                return false;
-            const request = interaction.request;
-            if (!request || typeof request !== 'object' || Array.isArray(request))
-                return false;
-            const { method, path } = request;
-            if (typeof method !== 'string' || typeof path !== 'string')
-                return false;
-            actual.push({ method, path });
-        }
-    }
-    const remaining = [...actual];
-    for (const row of expected) {
-        const match = remaining.findIndex((item) => item.method.toUpperCase() === row.method
-            && matchesPath(row.endpointPath, item.path));
-        if (match === -1)
-            return false;
-        remaining.splice(match, 1);
-    }
-    return remaining.length === 0;
-}
-/** Only aggregate causal evidence leaves this process; private reports are removed. */
-export function verifyPactConsumerRuntime(projectRoot, expectedWriteSet, generateProvider) {
-    let revision = null;
-    let filesSha256 = null;
-    let passedTests = 0;
-    let mutationFailedTests = 0;
-    const expectedInteractions = expectedWriteSet.interactions.length;
-    let scratch;
-    try {
-        if (process.platform !== 'linux' || !existsSync('/usr/bin/bwrap'))
-            fail('sandbox-unavailable');
-        const root = resolve(projectRoot);
-        if (realpathSync(root) !== root || !lstatSync(root).isDirectory())
-            fail('source-unsupported');
-        revision = git(root, ['rev-parse', 'HEAD']).toString('utf8').trim();
-        if (!/^[a-f0-9]{40,64}$/.test(revision)
-            || git(root, ['rev-parse', '--show-toplevel']).toString('utf8').trim() !== root)
-            fail('source-unsupported');
-        const projection = derivePactWriteSet(root, generateProvider);
-        if (projection.outcome !== 'ready' || !isDeepStrictEqual(projection.writeSet, expectedWriteSet)) {
-            fail('source-unsupported');
-        }
-        if (inspectPactToolchain(root, generateProvider).outcome !== 'manifest-aligned') {
-            fail('toolchain-unavailable');
-        }
-        planPactToolchainManifest(root, generateProvider);
-        const tracked = new Set(git(root, ['ls-files', '-z', '--', 'src', 'app', 'lib', 'packages', 'clients'])
-            .toString('utf8').split('\0').filter(Boolean));
-        const sourcePaths = [...tracked].filter((path) => SOURCE_PREFIX.test(path) && SOURCE_SUFFIX.test(path));
-        if (sourcePaths.length > MAX_SOURCE_FILES || [...tracked].some((path) => path.includes('\\') || path.split('/').some((part) => !part || part === '.' || part === '..'))) {
-            fail('source-unsupported');
-        }
-        const consumerPaths = expectedWriteSet.interactions.map((row) => row.filePath);
-        if (new Set(consumerPaths).size !== consumerPaths.length || consumerPaths.length < 1) {
-            fail('source-unsupported');
-        }
-        const testBytes = new Map();
-        const mutation = new Map();
-        let artifactDirectory = null;
-        for (const row of expectedWriteSet.interactions) {
-            const bytes = regularBytes(root, row.filePath, 256 * 1024);
-            const source = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-            const inspected = validatePactTestSource(row.filePath, source, null, row, root);
-            if (inspected.consumerBinding !== 'app-import-candidate')
-                fail('app-binding-missing');
-            const testDirectory = pactArtifactDirectory(source);
-            if (artifactDirectory !== null && artifactDirectory !== testDirectory)
-                fail('source-unsupported');
-            artifactDirectory = testDirectory;
-            for (const [path, names] of appImportBindings(row.filePath, source, tracked)) {
-                const set = mutation.get(path) ?? new Set();
-                for (const name of names)
-                    set.add(name);
-                mutation.set(path, set);
-            }
-            testBytes.set(row.filePath, bytes);
-        }
-        if (mutation.size < 1 || artifactDirectory === null)
-            fail('app-binding-missing');
-        const files = new Map([
-            ['package.json', regularBytes(root, 'package.json', 1024 * 1024)],
-            ['package-lock.json', regularBytes(root, 'package-lock.json', 8 * 1024 * 1024)],
-            ...[...testBytes.entries()],
-        ]);
-        for (const path of sourcePaths)
-            files.set(path, regularBytes(root, path, 1024 * 1024));
-        if ([...files.values()].reduce((sum, bytes) => sum + bytes.length, 0) > MAX_SOURCE_BYTES) {
-            fail('source-unsupported');
-        }
-        const hash = createHash('sha256');
-        for (const [path, bytes] of [...files.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
-            hash.update(path).update('\0').update(bytes).update('\0');
-        }
-        filesSha256 = hash.digest('hex');
-        scratch = mkdtempSync(join(tmpdir(), 'p222-pact-runtime-'));
-        for (const path of ['package.json', 'package-lock.json']) {
-            writeFileSync(join(scratch, path), files.get(path), { mode: 0o600 });
-        }
-        writeFileSync(join(scratch, 'user.npmrc'), '', { mode: 0o600 });
-        writeFileSync(join(scratch, 'global.npmrc'), '', { mode: 0o600 });
-        const installed = spawnSync('npm', ['ci', '--ignore-scripts', '--no-audit', '--no-fund',
-            '--registry=https://registry.npmjs.org/', `--userconfig=${join(scratch, 'user.npmrc')}`,
-            `--globalconfig=${join(scratch, 'global.npmrc')}`], {
-            cwd: scratch, env: { PATH: process.env.PATH, HOME: scratch, TMPDIR: scratch,
-                npm_config_cache: join(scratch, '.npm-cache'), CI: 'true', NO_UPDATE_NOTIFIER: '1' },
-            timeout: 180_000, stdio: 'ignore',
-        });
-        if (installed.error || installed.status !== 0)
-            fail('install-failed');
-        for (const [path, bytes] of files) {
-            if (path === 'package.json' || path === 'package-lock.json')
-                continue;
-            mkdirSync(join(scratch, dirname(path)), { recursive: true, mode: 0o700 });
-            writeFileSync(join(scratch, path), bytes, { mode: 0o600 });
-        }
-        const positive = runSandbox(scratch, 'positive.json');
-        if (positive !== 0)
-            fail(existsSync(join(scratch, 'positive.json'))
-                ? 'consumer-failed' : 'sandbox-unavailable');
-        const assertions = reportAssertions(scratch, 'positive.json', consumerPaths);
-        if (assertions.some((row) => row.status !== 'passed')
-            || !pactInteractions(scratch, artifactDirectory, expectedWriteSet.interactions)) {
-            fail('pact-artifact-missing');
-        }
-        passedTests = assertions.length;
-        for (const [path, names] of mutation) {
-            const stub = [...names].map((name) => name === 'default'
-                ? `export default function(){throw new Error('${CANARY}')}`
-                : `export const ${name}=function(){throw new Error('${CANARY}')}`).join('\n');
-            writeFileSync(join(scratch, path), `${stub}\n`, { mode: 0o600 });
-        }
-        const negative = runSandbox(scratch, 'mutation.json');
-        if (negative === 0 || !existsSync(join(scratch, 'mutation.json')))
-            fail('mutation-not-causal');
-        const mutated = reportAssertions(scratch, 'mutation.json', consumerPaths);
-        if (mutated.length !== assertions.length || mutated.some((row) => row.status !== 'failed'
-            || !Array.isArray(row.failureMessages)
-            || !row.failureMessages.some((message) => typeof message === 'string' && message.includes(CANARY)))) {
-            fail('mutation-not-causal');
-        }
-        mutationFailedTests = mutated.length;
-        if (git(root, ['rev-parse', 'HEAD']).toString('utf8').trim() !== revision
-            || [...files].some(([path, bytes]) => !regularBytes(root, path, 8 * 1024 * 1024).equals(bytes))) {
-            fail('source-unsupported');
-        }
-        return result('consumer-proven', revision, filesSha256, expectedInteractions, passedTests, mutationFailedTests);
-    }
-    catch (error) {
-        const reason = error instanceof RuntimeFailure ? error.reason : 'source-unsupported';
-        return result(reason, revision, filesSha256, expectedInteractions, passedTests, mutationFailedTests);
-    }
-    finally {
-        if (scratch)
-            rmSync(scratch, { recursive: true, force: true });
-    }
-}
+import{spawnSync as O}from"node:child_process";import{createHash as Z}from"node:crypto";import{constants as z}from"node:fs";import{closeSync as J,existsSync as w,fstatSync as W,lstatSync as R,mkdirSync as G,mkdtempSync as K,openSync as Q,readFileSync as ee,readdirSync as te,realpathSync as se,rmSync as ne,writeFileSync as P}from"node:fs";import{tmpdir as oe}from"node:os";import{dirname as re,join as m,posix as T,resolve as ie}from"node:path";import{isDeepStrictEqual as ae}from"node:util";import{parse as F}from"@babel/parser";import{derivePactWriteSet as ce}from"./pact-write-set.js";import{validatePactTestSource as ue}from"./pact-test-source.js";import{inspectPactToolchain as pe,planPactToolchainManifest as le}from"./pact-toolchain.js";const fe=1024,de=16*1024*1024,me=2*1024*1024,I="P222_APP_CONSUMER_CAUSAL_CANARY",B=/^(?:src|app|lib|packages|clients)\//,ye=/\.(?:ts|tsx|js|jsx|mjs|cjs|json)$/;class U extends Error{reason;constructor(c){super(c),this.reason=c}}function n(p){throw new U(p)}function L(p,c,i,o,l=0,u=0){const s=p==="consumer-proven";return Object.freeze({schemaVersion:1,outcome:s?"consumer-proven":"unverified",reasonCode:p,sourceRevision:c,filesSha256:i,expectedInteractions:o,passedTests:l,mutationFailedTests:u,appConsumerProven:s,providerVerified:!1,qaAccepted:!1,publicSafe:!0})}function A(p,c,i){let o=p;for(const s of c.split("/").slice(0,-1)){o=m(o,s);const e=R(o);(!e.isDirectory()||e.isSymbolicLink())&&n("source-unsupported")}const l=m(p,c),u=Q(l,z.O_RDONLY|z.O_NOFOLLOW);try{const s=W(u);return(!s.isFile()||s.size<1||s.size>i)&&n("source-unsupported"),ee(u)}finally{J(u)}}function _(p,c){const i={PATH:process.env.PATH,HOME:process.env.HOME},o=O("git",c,{cwd:p,env:i,timeout:3e4,maxBuffer:2*1024*1024,stdio:["ignore","pipe","ignore"]});return(o.error||o.status!==0||!Buffer.isBuffer(o.stdout))&&n("source-unsupported"),o.stdout}function ge(p,c,i){const o=new Map,l=F(c,{sourceType:"module",plugins:["typescript"]});for(const u of l.program.body){if(u.type!=="ImportDeclaration"||u.source.value==="@pact-foundation/pact"||u.source.value==="vitest")continue;const s=u.source.value;/^\.\.?\/[A-Za-z0-9_./-]{1,240}$/.test(s)||n("source-unsupported");const e=T.normalize(T.join(T.dirname(p),s));(!B.test(e)||e.split("/").includes(".."))&&n("source-unsupported");const a=(/\.(?:ts|tsx|js|mjs)$/.test(e)?[e,...e.endsWith(".js")?[`${e.slice(0,-3)}.ts`,`${e.slice(0,-3)}.tsx`]:[]]:[`${e}.ts`,`${e}.tsx`,`${e}.js`,`${e}.mjs`,`${e}/index.ts`,`${e}/index.tsx`,`${e}/index.js`]).filter(f=>i.has(f));a.length!==1&&n("source-unsupported");const y=o.get(a[0])??new Set;for(const f of u.specifiers){f.type==="ImportNamespaceSpecifier"&&n("source-unsupported");const g=f.type==="ImportDefaultSpecifier"?"default":f.imported.type==="Identifier"?f.imported.name:f.imported.value;/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(g)||n("source-unsupported"),y.add(g)}y.size===0&&n("source-unsupported"),o.set(a[0],y)}return o}function he(p){const i=[F(p,{sourceType:"module",plugins:["typescript"]}).program];let o=null,l=0;for(;i.length>0;){const u=i.pop();if(!u||typeof u!="object"||Array.isArray(u))continue;++l>1e5&&n("source-unsupported");const s=u;if(s.type==="NewExpression"&&s.callee&&typeof s.callee=="object"&&s.callee.type==="Identifier"&&s.callee.name==="PactV3"){(o!==null||!Array.isArray(s.arguments)||s.arguments.length!==1)&&n("source-unsupported");const e=s.arguments[0];(!e||e.type!=="ObjectExpression"||!Array.isArray(e.properties))&&n("source-unsupported");let t="pacts",a=!1;for(const y of e.properties){const f=y;(f.type!=="ObjectProperty"||f.computed===!0)&&n("source-unsupported");const g=f.key;if((g.type==="Identifier"?g.name:g.type==="StringLiteral"?g.value:void 0)!=="dir")continue;a&&n("source-unsupported"),a=!0;const b=f.value;(b.type!=="StringLiteral"||typeof b.value!="string")&&n("source-unsupported"),b.value==="./pact-files"||b.value==="pact-files"?t="pact-files":b.value!=="./pacts"&&b.value!=="pacts"&&n("source-unsupported")}o=t}for(const[e,t]of Object.entries(s))["loc","extra","comments","leadingComments","trailingComments","innerComments"].includes(e)||(Array.isArray(t)?i.push(...t):t&&typeof t=="object"&&i.push(t))}return o===null&&n("source-unsupported"),o}function be(p,c){const i=["--die-with-parent","--new-session","--unshare-all","--clearenv","--setenv","HOME","/work","--setenv","TMPDIR","/tmp","--setenv","PATH","/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin","--setenv","CI","true","--setenv","NODE_ENV","test","--ro-bind","/usr","/usr","--ro-bind","/lib","/lib","--ro-bind","/lib64","/lib64","--ro-bind","/bin","/bin","--ro-bind","/etc","/etc"];return w("/home/linuxbrew/.linuxbrew")&&i.push("--ro-bind","/home/linuxbrew/.linuxbrew","/home/linuxbrew/.linuxbrew"),[...i,"--dev","/dev","--proc","/proc","--tmpfs","/tmp","--bind",p,"/work","--chdir","/work","--",process.execPath,"node_modules/vitest/vitest.mjs","run","--maxWorkers=1","tests/pact/consumer/","--reporter=json",`--outputFile=/work/${c}`]}function q(p,c){const i=O("/usr/bin/bwrap",be(p,c),{env:{PATH:"/usr/bin:/bin"},timeout:18e4,stdio:"ignore"});return(i.error||i.signal||i.status===null)&&n("sandbox-unavailable"),i.status}function X(p,c,i){w(m(p,c))||n("sandbox-unavailable");let o;try{o=JSON.parse(A(p,c,me).toString("utf8"))}catch{n("consumer-failed")}(!o||typeof o!="object"||Array.isArray(o))&&n("consumer-failed");const l=o.testResults;(!Array.isArray(l)||l.length!==i.length)&&n("consumer-failed");const u=new Map;for(const s of l){(!s||typeof s!="object"||Array.isArray(s))&&n("consumer-failed");const e=s;(typeof e.name!="string"||!i.some(t=>e.name===`/work/${t}`)||u.has(e.name)||!Array.isArray(e.assertionResults)||e.assertionResults.length<1)&&n("consumer-failed"),u.set(e.name,e)}return i.flatMap(s=>u.get(`/work/${s}`).assertionResults)}function ve(p,c){const i=p.split("/"),o=c.split("/");return i.length===o.length&&i.every((l,u)=>{const s=o[u];if(!l.includes("{"))return l===s;const e=/^([^{}]*)\{[^{}]+\}([^{}]*)$/.exec(l);return!!e&&s.startsWith(e[1])&&s.endsWith(e[2])&&s.length>e[1].length+e[2].length})}function Ae(p,c,i){const o=m(p,c);if(!w(o)||!R(o).isDirectory())return!1;const l=te(o).filter(e=>/^[A-Za-z0-9_.-]+\.json$/.test(e));if(l.length<1||l.length>16)return!1;const u=[];for(const e of l){let t;try{t=JSON.parse(A(o,e,1024*1024).toString("utf8"))}catch{return!1}if(!t||typeof t!="object"||Array.isArray(t))return!1;const a=t.interactions;if(!Array.isArray(a))return!1;for(const y of a){if(!y||typeof y!="object"||Array.isArray(y))return!1;const f=y.request;if(!f||typeof f!="object"||Array.isArray(f))return!1;const{method:g,path:h}=f;if(typeof g!="string"||typeof h!="string")return!1;u.push({method:g,path:h})}}const s=[...u];for(const e of i){const t=s.findIndex(a=>a.method.toUpperCase()===e.method&&ve(e.endpointPath,a.path));if(t===-1)return!1;s.splice(t,1)}return s.length===0}function Me(p,c,i){let o=null,l=null,u=0,s=0;const e=c.interactions.length;let t;try{(process.platform!=="linux"||!w("/usr/bin/bwrap"))&&n("sandbox-unavailable");const a=ie(p);(se(a)!==a||!R(a).isDirectory())&&n("source-unsupported"),o=_(a,["rev-parse","HEAD"]).toString("utf8").trim(),(!/^[a-f0-9]{40,64}$/.test(o)||_(a,["rev-parse","--show-toplevel"]).toString("utf8").trim()!==a)&&n("source-unsupported");const y=ce(a,i);(y.outcome!=="ready"||!ae(y.writeSet,c))&&n("source-unsupported"),pe(a,i).outcome!=="manifest-aligned"&&n("toolchain-unavailable"),le(a,i);const f=new Set(_(a,["ls-files","-z","--","src","app","lib","packages","clients"]).toString("utf8").split("\0").filter(Boolean)),g=[...f].filter(r=>B.test(r)&&ye.test(r));(g.length>fe||[...f].some(r=>r.includes("\\")||r.split("/").some(d=>!d||d==="."||d==="..")))&&n("source-unsupported");const h=c.interactions.map(r=>r.filePath);(new Set(h).size!==h.length||h.length<1)&&n("source-unsupported");const b=new Map,k=new Map;let x=null;for(const r of c.interactions){const d=A(a,r.filePath,262144),v=new TextDecoder("utf-8",{fatal:!0}).decode(d);ue(r.filePath,v,null,r,a).consumerBinding!=="app-import-candidate"&&n("app-binding-missing");const C=he(v);x!==null&&x!==C&&n("source-unsupported"),x=C;for(const[H,Y]of ge(r.filePath,v,f)){const N=k.get(H)??new Set;for(const V of Y)N.add(V);k.set(H,N)}b.set(r.filePath,d)}(k.size<1||x===null)&&n("app-binding-missing");const j=new Map([["package.json",A(a,"package.json",1024*1024)],["package-lock.json",A(a,"package-lock.json",8*1024*1024)],...b.entries()]);for(const r of g)j.set(r,A(a,r,1024*1024));[...j.values()].reduce((r,d)=>r+d.length,0)>de&&n("source-unsupported");const M=Z("sha256");for(const[r,d]of[...j.entries()].sort(([v],[S])=>v<S?-1:v>S?1:0))M.update(r).update("\0").update(d).update("\0");l=M.digest("hex"),t=K(m(oe(),"p222-pact-runtime-"));for(const r of["package.json","package-lock.json"])P(m(t,r),j.get(r),{mode:384});P(m(t,"user.npmrc"),"",{mode:384}),P(m(t,"global.npmrc"),"",{mode:384});const D=O("npm",["ci","--ignore-scripts","--no-audit","--no-fund","--registry=https://registry.npmjs.org/",`--userconfig=${m(t,"user.npmrc")}`,`--globalconfig=${m(t,"global.npmrc")}`],{cwd:t,env:{PATH:process.env.PATH,HOME:t,TMPDIR:t,npm_config_cache:m(t,".npm-cache"),CI:"true",NO_UPDATE_NOTIFIER:"1"},timeout:18e4,stdio:"ignore"});(D.error||D.status!==0)&&n("install-failed");for(const[r,d]of j)r==="package.json"||r==="package-lock.json"||(G(m(t,re(r)),{recursive:!0,mode:448}),P(m(t,r),d,{mode:384}));q(t,"positive.json")!==0&&n(w(m(t,"positive.json"))?"consumer-failed":"sandbox-unavailable");const $=X(t,"positive.json",h);($.some(r=>r.status!=="passed")||!Ae(t,x,c.interactions))&&n("pact-artifact-missing"),u=$.length;for(const[r,d]of k){const v=[...d].map(S=>S==="default"?`export default function(){throw new Error('${I}')}`:`export const ${S}=function(){throw new Error('${I}')}`).join(`
+`);P(m(t,r),`${v}
+`,{mode:384})}(q(t,"mutation.json")===0||!w(m(t,"mutation.json")))&&n("mutation-not-causal");const E=X(t,"mutation.json",h);return(E.length!==$.length||E.some(r=>r.status!=="failed"||!Array.isArray(r.failureMessages)||!r.failureMessages.some(d=>typeof d=="string"&&d.includes(I))))&&n("mutation-not-causal"),s=E.length,(_(a,["rev-parse","HEAD"]).toString("utf8").trim()!==o||[...j].some(([r,d])=>!A(a,r,8*1024*1024).equals(d)))&&n("source-unsupported"),L("consumer-proven",o,l,e,u,s)}catch(a){const y=a instanceof U?a.reason:"source-unsupported";return L(y,o,l,e,u,s)}finally{t&&ne(t,{recursive:!0,force:!0})}}export{Me as verifyPactConsumerRuntime};