@osva-ai/cli 1.1.0-rc.1 → 1.1.0-rc.2

package/dist/validate/canonical-json.js

@@ -0,0 +1,17 @@
+export function canonicalJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (value === null || typeof value !== "object") {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map(sortKeys);
+    }
+    const sorted = {};
+    for (const key of Object.keys(value).sort()) {
+        sorted[key] = sortKeys(value[key]);
+    }
+    return sorted;
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/validate/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../src/validate/canonical-json.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/validate/exit-code.d.ts

@@ -0,0 +1,3 @@
+import type { ValidateReport } from "./types.js";
+export declare function validateExitCode(report: ValidateReport): number;
+//# sourceMappingURL=exit-code.d.ts.map

package/dist/validate/exit-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-code.d.ts","sourceRoot":"","sources":["../../src/validate/exit-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAE/D"}

package/dist/validate/exit-code.js

@@ -0,0 +1,4 @@
+export function validateExitCode(report) {
+    return report.result === "fail" ? 1 : 0;
+}
+//# sourceMappingURL=exit-code.js.map

package/dist/validate/exit-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-code.js","sourceRoot":"","sources":["../../src/validate/exit-code.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/validate/format.d.ts

@@ -0,0 +1,4 @@
+import type { ValidateReport } from "./types.js";
+export declare function formatValidateHuman(report: ValidateReport): string;
+export declare function formatValidateJson(report: ValidateReport): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/validate/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/validate/format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAkBlE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEjE"}

package/dist/validate/format.js

@@ -0,0 +1,23 @@
+export function formatValidateHuman(report) {
+    const lines = [
+        "OSVA Validate",
+        "",
+        `Project: ${report.projectDir}`,
+        "",
+    ];
+    for (const check of report.checks) {
+        const status = check.status.padEnd(4, " ");
+        const id = check.id.padEnd(28, " ");
+        lines.push(`${status} ${id} ${check.message}`);
+        if (check.remediation !== undefined) {
+            lines.push(`      → ${check.remediation}`);
+        }
+    }
+    lines.push("");
+    lines.push(`Result: ${report.result.toUpperCase()}`);
+    return `${lines.join("\n")}\n`;
+}
+export function formatValidateJson(report) {
+    return `${JSON.stringify(report, null, 2)}\n`;
+}
+//# sourceMappingURL=format.js.map

package/dist/validate/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/validate/format.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,MAAM,KAAK,GAAa;QACtB,eAAe;QACf,EAAE;QACF,YAAY,MAAM,CAAC,UAAU,EAAE;QAC/B,EAAE;KACH,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAsB;IACvD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC"}

package/dist/validate/index.d.ts

@@ -0,0 +1,6 @@
+export type { ValidateCheck, ValidateReport } from "./types.js";
+export { validateExitCode } from "./exit-code.js";
+export { runValidatePipeline } from "./run-validate.js";
+export { resolveValidateProjectDir } from "./resolve-project-dir.js";
+export declare function runValidateCommand(flags: Readonly<Record<string, string | boolean>>, cwd?: string): Promise<number>;
+//# sourceMappingURL=index.d.ts.map

package/dist/validate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAOA,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAErE,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EACjD,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/validate/index.js

@@ -0,0 +1,29 @@
+import { writeStdout } from "../stdout.js";
+import { validateExitCode } from "./exit-code.js";
+import { formatValidateHuman, formatValidateJson } from "./format.js";
+import { resolveValidateProjectDir } from "./resolve-project-dir.js";
+import { runValidatePipeline } from "./run-validate.js";
+export { validateExitCode } from "./exit-code.js";
+export { runValidatePipeline } from "./run-validate.js";
+export { resolveValidateProjectDir } from "./resolve-project-dir.js";
+export async function runValidateCommand(flags, cwd = process.cwd()) {
+    const json = flags.json === true;
+    const resolved = await resolveValidateProjectDir({ cwd, flags });
+    const report = resolved.ok
+        ? await runValidatePipeline(resolved.projectDir)
+        : {
+            result: "fail",
+            projectDir: resolved.projectDir,
+            checks: [
+                {
+                    id: "project_directory",
+                    status: "FAIL",
+                    message: resolved.error,
+                    remediation: "Use --project to point at an osva init scaffold directory.",
+                },
+            ],
+        };
+    await writeStdout(json ? formatValidateJson(report) : formatValidateHuman(report));
+    return validateExitCode(report);
+}
+//# sourceMappingURL=index.js.map

package/dist/validate/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAiD,EACjD,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAmB,QAAQ,CAAC,EAAE;QACxC,CAAC,CAAC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChD,CAAC,CAAC;YACE,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,MAAM,EAAE;gBACN;oBACE,EAAE,EAAE,mBAAmB;oBACvB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,QAAQ,CAAC,KAAK;oBACvB,WAAW,EACT,4DAA4D;iBAC/D;aACF;SACF,CAAC;IAEN,MAAM,WAAW,CACf,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAChE,CAAC;IACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC"}

package/dist/validate/integrity.d.ts

@@ -0,0 +1,4 @@
+export declare function sha256IntegrityOf(content: Buffer | string): string;
+export declare function sha256IntegrityOfFile(filePath: string): Promise<string>;
+export declare function normalizeIntegrityDigest(value: string): string | undefined;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/validate/integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/validate/integrity.ts"],"names":[],"mappings":"AAKA,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAKlE;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7E;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS1E"}

package/dist/validate/integrity.js

@@ -0,0 +1,24 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { SHA256_INTEGRITY_PREFIX } from "@osva-ai/contracts";
+export function sha256IntegrityOf(content) {
+    return `${SHA256_INTEGRITY_PREFIX}${createHash("sha256")
+        .update(content)
+        .digest("hex")
+        .toLowerCase()}`;
+}
+export async function sha256IntegrityOfFile(filePath) {
+    const bytes = await readFile(filePath);
+    return sha256IntegrityOf(bytes);
+}
+export function normalizeIntegrityDigest(value) {
+    if (!value.startsWith(SHA256_INTEGRITY_PREFIX)) {
+        return undefined;
+    }
+    const hex = value.slice(SHA256_INTEGRITY_PREFIX.length);
+    if (!/^[0-9a-fA-F]{64}$/.test(hex)) {
+        return undefined;
+    }
+    return `${SHA256_INTEGRITY_PREFIX}${hex.toLowerCase()}`;
+}
+//# sourceMappingURL=integrity.js.map

package/dist/validate/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/validate/integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,UAAU,iBAAiB,CAAC,OAAwB;IACxD,OAAO,GAAG,uBAAuB,GAAG,UAAU,CAAC,QAAQ,CAAC;SACrD,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,KAAK,CAAC;SACb,WAAW,EAAE,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IAC1D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,uBAAuB,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;AAC1D,CAAC"}

package/dist/validate/json-schema-draft.d.ts

@@ -0,0 +1,8 @@
+export declare const SUPPORTED_JSON_SCHEMA_DRAFT: "https://json-schema.org/draft/2020-12/schema";
+export interface JsonSchemaDraftValidation {
+    readonly ok: boolean;
+    readonly warnMissingSchema?: boolean;
+    readonly error?: string;
+}
+export declare function validateJsonSchemaDocument(schema: unknown, label: string): JsonSchemaDraftValidation;
+//# sourceMappingURL=json-schema-draft.d.ts.map

package/dist/validate/json-schema-draft.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-schema-draft.d.ts","sourceRoot":"","sources":["../../src/validate/json-schema-draft.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,2BAA2B,EACtC,8CAAuD,CAAC;AAc1D,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,GACZ,yBAAyB,CA4B3B"}

package/dist/validate/json-schema-draft.js

@@ -0,0 +1,32 @@
+import Ajv2020Import from "ajv/dist/2020.js";
+export const SUPPORTED_JSON_SCHEMA_DRAFT = "https://json-schema.org/draft/2020-12/schema";
+const Ajv2020 = Ajv2020Import;
+const ajv = new Ajv2020({ allErrors: true, strict: true });
+export function validateJsonSchemaDocument(schema, label) {
+    if (typeof schema !== "object" || schema === null) {
+        return { ok: false, error: `${label} must be a JSON object.` };
+    }
+    const record = schema;
+    const declared = record.$schema;
+    let warnMissingSchema = false;
+    if (declared === undefined) {
+        warnMissingSchema = true;
+    }
+    else if (declared !== SUPPORTED_JSON_SCHEMA_DRAFT) {
+        return {
+            ok: false,
+            error: `${label} $schema must be ${SUPPORTED_JSON_SCHEMA_DRAFT}.`,
+        };
+    }
+    try {
+        ajv.compile(schema);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Invalid JSON Schema document.";
+        return { ok: false, error: `${label}: ${message}` };
+    }
+    return warnMissingSchema
+        ? { ok: true, warnMissingSchema: true }
+        : { ok: true };
+}
+//# sourceMappingURL=json-schema-draft.js.map

package/dist/validate/json-schema-draft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-schema-draft.js","sourceRoot":"","sources":["../../src/validate/json-schema-draft.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAG7C,MAAM,CAAC,MAAM,2BAA2B,GACtC,8CAAuD,CAAC;AAU1D,MAAM,OAAO,GAAG,aAA0C,CAAC;AAE3D,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAQ3D,MAAM,UAAU,0BAA0B,CACxC,MAAe,EACf,KAAa;IAEb,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,yBAAyB,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC;IAChC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;SAAM,IAAI,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,KAAK,oBAAoB,2BAA2B,GAAG;SAClE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,MAAgB,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,KAAK,OAAO,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,iBAAiB;QACtB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;QACvC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACnB,CAAC"}

package/dist/validate/project-config.d.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+export declare const osvaAgentProjectSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"1">;
+    key: z.ZodString;
+    name: z.ZodString;
+    runtime: z.ZodObject<{
+        type: z.ZodLiteral<"TRUSTED_TYPESCRIPT">;
+        entrypoint: z.ZodString;
+    }, z.core.$strict>;
+    execution: z.ZodObject<{
+        timeoutMs: z.ZodInt;
+        maxAttempts: z.ZodInt;
+    }, z.core.$strict>;
+    capabilities: z.ZodObject<{
+        model: z.ZodBoolean;
+        tools: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    contracts: z.ZodObject<{
+        input: z.ZodString;
+        output: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type OsvaAgentProject = z.infer<typeof osvaAgentProjectSchema>;
+//# sourceMappingURL=project-config.d.ts.map

package/dist/validate/project-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config.d.ts","sourceRoot":"","sources":["../../src/validate/project-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;kBAuBjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/validate/project-config.js

@@ -0,0 +1,27 @@
+import { z } from "zod";
+import { AGENT_EXECUTION_MAX_TIMEOUT_MS, AGENT_EXECUTION_MIN_TIMEOUT_MS, } from "@osva-ai/contracts";
+export const osvaAgentProjectSchema = z.strictObject({
+    schemaVersion: z.literal("1"),
+    key: z.string().min(1),
+    name: z.string().min(1),
+    runtime: z.strictObject({
+        type: z.literal("TRUSTED_TYPESCRIPT"),
+        entrypoint: z.string().min(1),
+    }),
+    execution: z.strictObject({
+        timeoutMs: z
+            .int()
+            .min(AGENT_EXECUTION_MIN_TIMEOUT_MS)
+            .max(AGENT_EXECUTION_MAX_TIMEOUT_MS),
+        maxAttempts: z.int().min(1),
+    }),
+    capabilities: z.strictObject({
+        model: z.boolean(),
+        tools: z.array(z.string().min(1)),
+    }),
+    contracts: z.strictObject({
+        input: z.string().min(1),
+        output: z.string().min(1),
+    }),
+});
+//# sourceMappingURL=project-config.js.map

package/dist/validate/project-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config.js","sourceRoot":"","sources":["../../src/validate/project-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IACnD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC9B,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC;QACxB,SAAS,EAAE,CAAC;aACT,GAAG,EAAE;aACL,GAAG,CAAC,8BAA8B,CAAC;aACnC,GAAG,CAAC,8BAA8B,CAAC;QACtC,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5B,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;QAC3B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KAClC,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1B,CAAC;CACH,CAAC,CAAC"}

package/dist/validate/resolve-project-dir.d.ts

@@ -0,0 +1,12 @@
+export declare function resolveValidateProjectDir(input: {
+    readonly cwd: string;
+    readonly flags: Readonly<Record<string, string | boolean>>;
+}): Promise<{
+    ok: true;
+    projectDir: string;
+} | {
+    ok: false;
+    error: string;
+    projectDir: string;
+}>;
+//# sourceMappingURL=resolve-project-dir.d.ts.map

package/dist/validate/resolve-project-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-project-dir.d.ts","sourceRoot":"","sources":["../../src/validate/resolve-project-dir.ts"],"names":[],"mappings":"AAGA,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAC5D,GAAG,OAAO,CACP;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CACnD,CAyBA"}

package/dist/validate/resolve-project-dir.js

@@ -0,0 +1,27 @@
+import { stat } from "node:fs/promises";
+import path from "node:path";
+export async function resolveValidateProjectDir(input) {
+    const projectFlag = input.flags.project;
+    const projectDir = typeof projectFlag === "string" && projectFlag.length > 0
+        ? path.resolve(input.cwd, projectFlag)
+        : path.resolve(input.cwd);
+    try {
+        const info = await stat(projectDir);
+        if (!info.isDirectory()) {
+            return {
+                ok: false,
+                projectDir,
+                error: `Project path is not a directory: ${projectDir}`,
+            };
+        }
+    }
+    catch {
+        return {
+            ok: false,
+            projectDir,
+            error: `Project directory does not exist: ${projectDir}`,
+        };
+    }
+    return { ok: true, projectDir };
+}
+//# sourceMappingURL=resolve-project-dir.js.map

package/dist/validate/resolve-project-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-project-dir.js","sourceRoot":"","sources":["../../src/validate/resolve-project-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAG/C;IAIC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;IACxC,MAAM,UAAU,GACd,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU;gBACV,KAAK,EAAE,oCAAoC,UAAU,EAAE;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU;YACV,KAAK,EAAE,qCAAqC,UAAU,EAAE;SACzD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC"}

package/dist/validate/run-validate.d.ts

@@ -0,0 +1,3 @@
+import type { ValidateReport } from "./types.js";
+export declare function runValidatePipeline(projectDir: string): Promise<ValidateReport>;
+//# sourceMappingURL=run-validate.d.ts.map

package/dist/validate/run-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-validate.d.ts","sourceRoot":"","sources":["../../src/validate/run-validate.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,YAAY,CAAC;AAKhE,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,CAAC,CAuKzB"}

package/dist/validate/run-validate.js

@@ -0,0 +1,278 @@
+import { readFile, realpath, stat } from "node:fs/promises";
+import path from "node:path";
+import { isRelativeTrustedEntrypoint } from "@osva-ai/contracts";
+import { agentManifestSchema } from "@osva-ai/contracts/schemas";
+import { canonicalJson } from "./canonical-json.js";
+import { sha256IntegrityOfFile, normalizeIntegrityDigest, } from "./integrity.js";
+import { validateJsonSchemaDocument } from "./json-schema-draft.js";
+import { osvaAgentProjectSchema, } from "./project-config.js";
+import { redactSecrets } from "../doctor/redact.js";
+import { isInsideRoot, isSafeProjectRelativePath, resolvePathInsideRoot, } from "./safe-path.js";
+const BUILD_REMEDIATION = "Run npm run build, then npm run manifest.";
+const MANIFEST_REMEDIATION = "Run npm run manifest after npm run build.";
+export async function runValidatePipeline(projectDir) {
+    const checks = [];
+    checks.push(passCheck("project_directory", `Using project directory ${projectDir}.`));
+    let projectConfig;
+    const projectConfigPath = path.join(projectDir, "osva-agent.project.json");
+    try {
+        const raw = await readFile(projectConfigPath, "utf8");
+        const parsed = osvaAgentProjectSchema.safeParse(JSON.parse(raw));
+        if (!parsed.success) {
+            checks.push(failCheck("project_config", "osva-agent.project.json is invalid.", "Fix the project configuration file or re-run osva init."));
+            return finalizeReport(projectDir, checks);
+        }
+        projectConfig = parsed.data;
+        checks.push(passCheck("project_config", "osva-agent.project.json parsed successfully."));
+    }
+    catch (error) {
+        const message = error instanceof Error &&
+            "code" in error &&
+            error.code === "ENOENT"
+            ? "osva-agent.project.json was not found."
+            : "osva-agent.project.json could not be read.";
+        checks.push(failCheck("project_config", message, "Run osva init in this directory or use --project to point at a scaffold."));
+        return finalizeReport(projectDir, checks);
+    }
+    const contractChecks = await validateContractPaths(projectDir, projectConfig);
+    checks.push(...contractChecks);
+    if (contractChecks.some((check) => check.status === "FAIL")) {
+        return finalizeReport(projectDir, checks);
+    }
+    const manifestPath = path.join(projectDir, "osva.manifest.json");
+    let manifestRaw;
+    try {
+        manifestRaw = await readFile(manifestPath, "utf8");
+        checks.push(passCheck("manifest_file", "osva.manifest.json is present."));
+    }
+    catch (error) {
+        void error;
+        checks.push(failCheck("manifest_file", "osva.manifest.json was not found.", MANIFEST_REMEDIATION));
+        return finalizeReport(projectDir, checks);
+    }
+    let manifestParsed;
+    try {
+        manifestParsed = JSON.parse(manifestRaw);
+    }
+    catch {
+        checks.push(failCheck("manifest_file", "osva.manifest.json is not valid JSON.", MANIFEST_REMEDIATION));
+        return finalizeReport(projectDir, checks);
+    }
+    const manifestSchemaResult = agentManifestSchema.safeParse(manifestParsed);
+    if (!manifestSchemaResult.success) {
+        checks.push(failCheck("manifest_schema", "osva.manifest.json does not satisfy AgentManifestV1.", MANIFEST_REMEDIATION));
+        return finalizeReport(projectDir, checks);
+    }
+    const manifest = manifestSchemaResult.data;
+    checks.push(passCheck("manifest_schema", "osva.manifest.json satisfies AgentManifestV1."));
+    if (manifest.runtime.type !== "TRUSTED_TYPESCRIPT") {
+        checks.push(failCheck("runtime_type", `Manifest runtime type must be TRUSTED_TYPESCRIPT (found ${manifest.runtime.type}).`, MANIFEST_REMEDIATION));
+        return finalizeReport(projectDir, checks);
+    }
+    checks.push(passCheck("runtime_type", "Manifest runtime type is TRUSTED_TYPESCRIPT."));
+    const entrypoint = manifest.runtime.entrypoint;
+    if (!isRelativeTrustedEntrypoint(entrypoint)) {
+        checks.push(failCheck("runtime_entrypoint", "Manifest runtime.entrypoint must be a safe relative POSIX path.", MANIFEST_REMEDIATION));
+        return finalizeReport(projectDir, checks);
+    }
+    checks.push(passCheck("runtime_entrypoint", `Manifest entrypoint "${entrypoint}" is a valid trusted runtime path.`));
+    const artifactCheck = await validateBuildArtifact(projectDir, entrypoint);
+    checks.push(artifactCheck);
+    if (artifactCheck.status === "FAIL") {
+        return finalizeReport(projectDir, checks);
+    }
+    const artifactPath = resolvePathInsideRoot(projectDir, "dist", "agent", entrypoint);
+    const integrityCheck = await validateArtifactIntegrity(artifactPath, manifest.runtime.integrity);
+    checks.push(integrityCheck);
+    const pathSafetyCheck = await validateArtifactPathSafety(projectDir, entrypoint);
+    checks.push(pathSafetyCheck);
+    checks.push(validateProjectManifestAgreement(projectConfig, manifest));
+    const schemaAgreement = await validateContractSchemaAgreement(projectDir, projectConfig, manifest);
+    checks.push(schemaAgreement);
+    return finalizeReport(projectDir, checks);
+}
+async function validateContractPaths(projectDir, project) {
+    const checks = [];
+    const pairs = [
+        {
+            id: "input_schema",
+            label: "Input schema",
+            relative: project.contracts.input,
+        },
+        {
+            id: "output_schema",
+            label: "Output schema",
+            relative: project.contracts.output,
+        },
+    ];
+    for (const pair of pairs) {
+        if (!isSafeProjectRelativePath(pair.relative)) {
+            checks.push(failCheck(pair.id, `${pair.label} path must be a safe relative path.`, "Use paths relative to the project root without .. traversal."));
+            continue;
+        }
+        let schemaPath;
+        try {
+            schemaPath = resolvePathInsideRoot(projectDir, ...pair.relative.split("/"));
+        }
+        catch {
+            checks.push(failCheck(pair.id, `${pair.label} path escapes the project directory.`, "Fix contracts.input or contracts.output in osva-agent.project.json."));
+            continue;
+        }
+        let schemaRaw;
+        try {
+            schemaRaw = await readFile(schemaPath, "utf8");
+        }
+        catch {
+            checks.push(failCheck(pair.id, `${pair.label} file is missing at ${pair.relative}.`, "Restore the contract schema file or update osva-agent.project.json."));
+            continue;
+        }
+        let schemaDocument;
+        try {
+            schemaDocument = JSON.parse(schemaRaw);
+        }
+        catch {
+            checks.push(failCheck(pair.id, `${pair.label} file is not valid JSON.`, `Fix ${pair.relative}.`));
+            continue;
+        }
+        const draftResult = validateJsonSchemaDocument(schemaDocument, pair.label);
+        if (!draftResult.ok) {
+            checks.push(failCheck(pair.id, redactSecrets(draftResult.error ?? `${pair.label} is invalid.`), `Fix ${pair.relative}.`));
+            continue;
+        }
+        if (draftResult.warnMissingSchema) {
+            checks.push(warnCheck(pair.id, `${pair.label} compiled but $schema is missing (expected draft 2020-12).`, `Add "$schema": "https://json-schema.org/draft/2020-12/schema" to ${pair.relative}.`));
+            continue;
+        }
+        checks.push(passCheck(pair.id, `${pair.label} is valid JSON Schema draft 2020-12.`));
+    }
+    return checks;
+}
+async function validateBuildArtifact(projectDir, entrypoint) {
+    let artifactPath;
+    try {
+        artifactPath = resolvePathInsideRoot(projectDir, "dist", "agent", entrypoint);
+    }
+    catch {
+        return failCheck("build_artifact", "Build artifact path escapes the project directory.", BUILD_REMEDIATION);
+    }
+    try {
+        const info = await stat(artifactPath);
+        if (!info.isFile()) {
+            return failCheck("build_artifact", `Build artifact at dist/agent/${entrypoint} is not a regular file.`, BUILD_REMEDIATION);
+        }
+    }
+    catch {
+        return failCheck("build_artifact", `Build artifact is missing at dist/agent/${entrypoint}.`, BUILD_REMEDIATION);
+    }
+    return passCheck("build_artifact", `Build artifact dist/agent/${entrypoint} exists.`);
+}
+async function validateArtifactIntegrity(artifactPath, manifestIntegrity) {
+    const expected = normalizeIntegrityDigest(manifestIntegrity);
+    if (expected === undefined) {
+        return failCheck("artifact_integrity", "Manifest runtime.integrity is not a valid sha256 digest.", MANIFEST_REMEDIATION);
+    }
+    const actual = await sha256IntegrityOfFile(artifactPath);
+    if (actual !== expected) {
+        return failCheck("artifact_integrity", "Build artifact SHA-256 does not match manifest runtime.integrity.", BUILD_REMEDIATION);
+    }
+    return passCheck("artifact_integrity", "Build artifact SHA-256 matches manifest runtime.integrity.");
+}
+async function validateArtifactPathSafety(projectDir, entrypoint) {
+    let artifactPath;
+    let agentDir;
+    try {
+        agentDir = resolvePathInsideRoot(projectDir, "dist", "agent");
+        artifactPath = resolvePathInsideRoot(projectDir, "dist", "agent", entrypoint);
+    }
+    catch {
+        return failCheck("artifact_path_safety", "Artifact path resolution failed.", BUILD_REMEDIATION);
+    }
+    try {
+        const projectReal = await realpath(projectDir);
+        const agentDirReal = await realpath(agentDir);
+        const artifactReal = await realpath(artifactPath);
+        if (!isInsideRoot(projectReal, agentDirReal)) {
+            return failCheck("artifact_path_safety", "dist/agent resolves outside the project directory.", BUILD_REMEDIATION);
+        }
+        if (!isInsideRoot(agentDirReal, artifactReal)) {
+            return failCheck("artifact_path_safety", "Build artifact resolves outside dist/agent.", BUILD_REMEDIATION);
+        }
+    }
+    catch {
+        return failCheck("artifact_path_safety", "Could not resolve build artifact path safely.", BUILD_REMEDIATION);
+    }
+    return passCheck("artifact_path_safety", "Build artifact path stays within dist/agent.");
+}
+async function validateContractSchemaAgreement(projectDir, project, manifest) {
+    try {
+        const inputPath = resolvePathInsideRoot(projectDir, ...project.contracts.input.split("/"));
+        const outputPath = resolvePathInsideRoot(projectDir, ...project.contracts.output.split("/"));
+        const inputSchema = JSON.parse(await readFile(inputPath, "utf8"));
+        const outputSchema = JSON.parse(await readFile(outputPath, "utf8"));
+        const mismatches = [];
+        if (canonicalJson(inputSchema) !== canonicalJson(manifest.input.schema)) {
+            mismatches.push("input schema");
+        }
+        if (canonicalJson(outputSchema) !== canonicalJson(manifest.output.schema)) {
+            mismatches.push("output schema");
+        }
+        if (mismatches.length > 0) {
+            return failCheck("contract_schema_agreement", `Contract files disagree with manifest (${mismatches.join(", ")}).`, MANIFEST_REMEDIATION);
+        }
+    }
+    catch {
+        return failCheck("contract_schema_agreement", "Could not compare contract schemas with the manifest.", MANIFEST_REMEDIATION);
+    }
+    return passCheck("contract_schema_agreement", "Contract schema files match manifest input and output.");
+}
+function validateProjectManifestAgreement(project, manifest) {
+    if (manifest.runtime.type !== "TRUSTED_TYPESCRIPT") {
+        return failCheck("project_manifest_agreement", "Manifest runtime is not TRUSTED_TYPESCRIPT.", MANIFEST_REMEDIATION);
+    }
+    const mismatches = [];
+    if (project.key !== manifest.key) {
+        mismatches.push("key");
+    }
+    if (project.name !== manifest.name) {
+        mismatches.push("name");
+    }
+    if (project.runtime.entrypoint !== manifest.runtime.entrypoint) {
+        mismatches.push("runtime.entrypoint");
+    }
+    if (canonicalJson(project.execution) !== canonicalJson(manifest.execution)) {
+        mismatches.push("execution");
+    }
+    if (canonicalJson(project.capabilities) !== canonicalJson(manifest.capabilities)) {
+        mismatches.push("capabilities");
+    }
+    if (mismatches.length > 0) {
+        return failCheck("project_manifest_agreement", `Project configuration disagrees with manifest (${mismatches.join(", ")}).`, MANIFEST_REMEDIATION);
+    }
+    return passCheck("project_manifest_agreement", "Project configuration matches manifest identity and runtime settings.");
+}
+function passCheck(id, message) {
+    return { id, status: "PASS", message: redactSecrets(message) };
+}
+function warnCheck(id, message, remediation) {
+    return {
+        id,
+        status: "WARN",
+        message: redactSecrets(message),
+        remediation: redactSecrets(remediation),
+    };
+}
+function failCheck(id, message, remediation) {
+    return {
+        id,
+        status: "FAIL",
+        message: redactSecrets(message),
+        remediation: redactSecrets(remediation),
+    };
+}
+function finalizeReport(projectDir, checks) {
+    const hasFail = checks.some((check) => check.status === "FAIL");
+    const hasWarn = checks.some((check) => check.status === "WARN");
+    const result = hasFail ? "fail" : hasWarn ? "warn" : "pass";
+    return { result, projectDir, checks };
+}
+//# sourceMappingURL=run-validate.js.map