@principles/core 1.287.1 → 1.287.2

package/dist/runtime-v2/activation/__tests__/production-gate-deps.test.js

@@ -1,503 +0,0 @@
-/**
- * Production Gate Deps Factory Tests — Story A (PRI-408)
- *
- * Tests verify that createProductionGateDeps() returns a valid
- * RefinerRuleHostGateDeps that can compile and evaluate rule code
- * against golden traces using node:vm — the same compilation path
- * used by the production openclaw-plugin RuleHost.
- *
- * ERR checklist:
- * - ERR-001: Treat parsed JSON / LLM output as unknown — rule code is string-validated
- * - ERR-002: Every failure path carries reason
- * - ERR-025: Production-path test, not just helper
- */
-import { describe, it, expect } from 'vitest';
-import { compileHardenedRuleEvaluator, createProductionGateDeps } from '../production-gate-deps.js';
-import { createGoldenTraceFixture, createSyntheticRuleHostInput } from '../../golden-trace.js';
-describe('createProductionGateDeps', () => {
-    it('returns a valid RefinerRuleHostGateDeps with evaluateInSandbox function', () => {
-        const deps = createProductionGateDeps();
-        expect(deps).toBeDefined();
-        expect(typeof deps.evaluateInSandbox).toBe('function');
-    });
-    it('compiles and evaluates valid rule code that matches golden trace expectations', () => {
-        const deps = createProductionGateDeps();
-        // Rule: block edit on system paths, allow safe paths.
-        // Differentiates negative/positive by checking params.filePath.
-        const ruleCode = `
-function evaluate(input, helpers) {
-  var p = input.action.paramsSummary;
-  if (helpers.getToolName() === 'edit' && p && p.filePath === '/etc/passwd') {
-    return { decision: 'block', matched: true, reason: 'system path blocked' };
-  }
-  return { decision: 'allow', matched: false, reason: 'safe path' };
-}
-`;
-        const goldenTrace = createGoldenTraceFixture({
-            toolName: 'edit',
-            negativeParams: { filePath: '/etc/passwd' },
-            positiveParams: { filePath: '/src/index.ts' },
-            expectedDecision: 'block',
-        });
-        const result = deps.evaluateInSandbox(ruleCode, goldenTrace);
-        expect(result.success).toBe(true);
-        expect(result.failedCases).toHaveLength(0);
-        expect(result.forbiddenPatternViolations).toHaveLength(0);
-    });
-    it('detects validation failure when rule decision does not match golden trace', () => {
-        const deps = createProductionGateDeps();
-        // Rule: always allows — but golden trace expects block for negative case
-        const ruleCode = `
-function evaluate(input, helpers) {
-  return { decision: 'allow', matched: false, reason: 'always allow' };
-}
-`;
-        const goldenTrace = createGoldenTraceFixture({
-            toolName: 'edit',
-            negativeParams: { filePath: '/etc/passwd' },
-            positiveParams: { filePath: '/src/index.ts' },
-            expectedDecision: 'block',
-        });
-        const result = deps.evaluateInSandbox(ruleCode, goldenTrace);
-        expect(result.success).toBe(false);
-        expect(result.failedCases.length).toBeGreaterThan(0);
-        // The negative case should fail because expectedDecision is 'block' but rule returns 'allow'
-        const negativeFailure = result.failedCases.find((c) => c.caseId === 'negative-1');
-        expect(negativeFailure).toBeDefined();
-        expect(negativeFailure?.errorType).toBe('validation_failed');
-    });
-    it('rejects code with forbidden patterns (e.g., require)', () => {
-        const deps = createProductionGateDeps();
-        const maliciousCode = `
-function evaluate(input, helpers) {
-  const fs = require('fs');
-  return { decision: 'allow', matched: false, reason: 'ok' };
-}
-`;
-        const goldenTrace = createGoldenTraceFixture({
-            toolName: 'edit',
-            negativeParams: { filePath: '/etc/passwd' },
-            positiveParams: { filePath: '/src/index.ts' },
-            expectedDecision: 'block',
-        });
-        const result = deps.evaluateInSandbox(maliciousCode, goldenTrace);
-        expect(result.success).toBe(false);
-        expect(result.forbiddenPatternViolations.length).toBeGreaterThan(0);
-    });
-    it('rejects code that does not define an evaluate function', () => {
-        const deps = createProductionGateDeps();
-        const invalidCode = `
-function notEvaluate(input, helpers) {
-  return { decision: 'allow', matched: false, reason: 'ok' };
-}
-`;
-        const goldenTrace = createGoldenTraceFixture({
-            toolName: 'edit',
-            negativeParams: { filePath: '/etc/passwd' },
-            positiveParams: { filePath: '/src/index.ts' },
-            expectedDecision: 'block',
-        });
-        const result = deps.evaluateInSandbox(invalidCode, goldenTrace);
-        expect(result.success).toBe(false);
-        expect(result.failedCases.length).toBeGreaterThan(0);
-    });
-    it('rejects export function evaluate syntax (PRI-439 Phase 2: export is forbidden)', () => {
-        const deps = createProductionGateDeps();
-        const exportCode = `
-export function evaluate(input, helpers) {
-  var p = input.action.paramsSummary;
-  if (helpers.getToolName() === 'edit' && p && p.filePath === '/etc/passwd') {
-    return { decision: 'block', matched: true, reason: 'system path blocked' };
-  }
-  return { decision: 'allow', matched: false, reason: 'safe path' };
-}
-`;
-        const goldenTrace = createGoldenTraceFixture({
-            toolName: 'edit',
-            negativeParams: { filePath: '/etc/passwd' },
-            positiveParams: { filePath: '/src/index.ts' },
-            expectedDecision: 'block',
-        });
-        const result = deps.evaluateInSandbox(exportCode, goldenTrace);
-        // PRI-439 Phase 2: `export` is now a forbidden pattern. The validator
-        // rejects it before compilation — no stripping, no normalization.
-        expect(result.success).toBe(false);
-        expect(result.forbiddenPatternViolations).toContain('export');
-    });
-    it('handles bare function evaluate(input, helpers) syntax (canonical dialect)', () => {
-        const deps = createProductionGateDeps();
-        const bareCode = `
-function evaluate(input, helpers) {
-  var p = input.action.paramsSummary;
-  if (helpers.getToolName() === 'edit' && p && p.filePath === '/etc/passwd') {
-    return { decision: 'block', matched: true, reason: 'system path blocked' };
-  }
-  return { decision: 'allow', matched: false, reason: 'safe path' };
-}
-`;
-        const goldenTrace = createGoldenTraceFixture({
-            toolName: 'edit',
-            negativeParams: { filePath: '/etc/passwd' },
-            positiveParams: { filePath: '/src/index.ts' },
-            expectedDecision: 'block',
-        });
-        const result = deps.evaluateInSandbox(bareCode, goldenTrace);
-        expect(result.success).toBe(true);
-        expect(result.failedCases).toHaveLength(0);
-    });
-    // P2 #6 fix: vm evaluator output validation tests
-    describe('P2 #6: vm evaluator output validation', () => {
-        it('rejects invalid decision enum value (not one of allow|block|requireApproval|auto_correct)', () => {
-            const deps = createProductionGateDeps();
-            const invalidDecisionCode = `
-function evaluate(input, helpers) {
-  return { decision: 'invalid_decision', matched: true, reason: 'bad decision' };
-}
-`;
-            const goldenTrace = createGoldenTraceFixture({
-                toolName: 'edit',
-                negativeParams: { filePath: '/etc/passwd' },
-                positiveParams: { filePath: '/src/index.ts' },
-                expectedDecision: 'block',
-            });
-            const result = deps.evaluateInSandbox(invalidDecisionCode, goldenTrace);
-            expect(result.success).toBe(false);
-            expect(result.failedCases.length).toBeGreaterThan(0);
-            // The invalid decision may surface as either a compile-time error or a
-            // per-case validation error, depending on whether the rule is evaluated
-            // during compilation. Either way, the result must be failure.
-            expect(result.success).toBe(false);
-        });
-        it('rejects result with missing matched field', () => {
-            const deps = createProductionGateDeps();
-            const missingMatchedCode = `
-function evaluate(input, helpers) {
-  return { decision: 'allow', reason: 'missing matched' };
-}
-`;
-            const goldenTrace = createGoldenTraceFixture({
-                toolName: 'edit',
-                negativeParams: { filePath: '/etc/passwd' },
-                positiveParams: { filePath: '/src/index.ts' },
-                expectedDecision: 'block',
-            });
-            const result = deps.evaluateInSandbox(missingMatchedCode, goldenTrace);
-            expect(result.success).toBe(false);
-        });
-        it('rejects result with missing reason field', () => {
-            const deps = createProductionGateDeps();
-            const missingReasonCode = `
-function evaluate(input, helpers) {
-  return { decision: 'allow', matched: false };
-}
-`;
-            const goldenTrace = createGoldenTraceFixture({
-                toolName: 'edit',
-                negativeParams: { filePath: '/etc/passwd' },
-                positiveParams: { filePath: '/src/index.ts' },
-                expectedDecision: 'block',
-            });
-            const result = deps.evaluateInSandbox(missingReasonCode, goldenTrace);
-            expect(result.success).toBe(false);
-        });
-        it('rejects auto_correct decision without correctionProposal', () => {
-            const deps = createProductionGateDeps();
-            const autoCorrectWithoutProposalCode = `
-function evaluate(input, helpers) {
-  return { decision: 'auto_correct', matched: true, reason: 'auto correct without proposal' };
-}
-`;
-            const goldenTrace = createGoldenTraceFixture({
-                toolName: 'edit',
-                negativeParams: { filePath: '/etc/passwd' },
-                positiveParams: { filePath: '/src/index.ts' },
-                expectedDecision: 'block',
-            });
-            const result = deps.evaluateInSandbox(autoCorrectWithoutProposalCode, goldenTrace);
-            expect(result.success).toBe(false);
-        });
-        it('accepts auto_correct decision with correctionProposal present', () => {
-            const deps = createProductionGateDeps();
-            const autoCorrectWithProposalCode = `
-function evaluate(input, helpers) {
-  return {
-    decision: 'auto_correct',
-    matched: true,
-    reason: 'auto correct with proposal',
-    correctionProposal: {
-      proposedParams: { filePath: '/safe/path.ts' },
-      correctedFields: [{ field: 'filePath', original: '/etc/passwd', proposed: '/safe/path.ts', reason: 'redirected' }],
-      applicationMode: 'shadow',
-      confidence: 0.9,
-      ruleId: 'rule-001',
-      notifyAgent: true
-    }
-  };
-}
-`;
-            const goldenTrace = createGoldenTraceFixture({
-                toolName: 'edit',
-                negativeParams: { filePath: '/etc/passwd' },
-                positiveParams: { filePath: '/src/index.ts' },
-                expectedDecision: 'block',
-            });
-            const result = deps.evaluateInSandbox(autoCorrectWithProposalCode, goldenTrace);
-            // The rule returns auto_correct which doesn't match expectedDecision 'block',
-            // so the golden trace validation will fail — but the RuleHostResult shape
-            // validation itself should pass (no compile error about invalid shape).
-            // The failure should be a validation_failed, not a compile/shape error.
-            expect(result.success).toBe(false);
-            // Verify the failure is due to decision mismatch, not invalid shape
-            const shapeError = result.failedCases.find(c => c.caseId === '__compile__' && c.message?.includes('invalid RuleHostResult'));
-            expect(shapeError).toBeUndefined();
-        });
-        it('rejects result where matched is not a boolean', () => {
-            const deps = createProductionGateDeps();
-            const wrongTypeMatchedCode = `
-function evaluate(input, helpers) {
-  return { decision: 'allow', matched: 'yes', reason: 'matched is string not boolean' };
-}
-`;
-            const goldenTrace = createGoldenTraceFixture({
-                toolName: 'edit',
-                negativeParams: { filePath: '/etc/passwd' },
-                positiveParams: { filePath: '/src/index.ts' },
-                expectedDecision: 'block',
-            });
-            const result = deps.evaluateInSandbox(wrongTypeMatchedCode, goldenTrace);
-            expect(result.success).toBe(false);
-        });
-    });
-    // ── PRI-634 PR-A (Slice A): replay/live semantic authority convergence ──
-    // The replay path previously used a LOCAL isValidRuleHostResult that was a
-    // semantic SUBSET of the canonical validateRuleHostResult (live RuleHost
-    // authority). Most notably it ACCEPTED `matched=false` paired with a
-    // non-allow decision — a result the live RuleHost rejects. These tests pin
-    // the convergence: the replay gate now enforces the exact canonical verdict
-    // on the same unknown results (A-T01…A-T06 through the public boundary).
-    describe('PRI-634 Slice A: canonical validator convergence', () => {
-        const trace = () => createGoldenTraceFixture({
-            toolName: 'edit',
-            negativeParams: { filePath: '/etc/passwd' },
-            positiveParams: { filePath: '/src/index.ts' },
-            expectedDecision: 'block',
-        });
-        const evalWith = (returnExpr) => createProductionGateDeps().evaluateInSandbox(`function evaluate(input, helpers) { return ${returnExpr}; }`, trace());
-        it('A-T01: allow + matched=false is accepted by the replay path (both cases pass)', () => {
-            const result = evalWith(`{ decision: 'allow', matched: false, reason: 'no match' }`);
-            // positive-1 expects allow → passes; negative-1 expects block → fails.
-            // The shape itself must NOT be the failure: no runtime_error failures.
-            expect(result.failedCases.every((c) => c.errorType === 'validation_failed')).toBe(true);
-        });
-        it('A-T02: block + matched=false is REJECTED — static early-warning layer catches the literal form', () => {
-            const result = evalWith(`{ decision: 'block', matched: false, reason: 'contradictory' }`);
-            // The static pre-check (checkMatchedFalseDecisions) catches the literal
-            // before VM execution — preserved early-warning semantics (SPEC Slice A2).
-            expect(result.success).toBe(false);
-            expect(result.failedCases.some((c) => c.caseId === '__matched_false_decision__' && c.errorType === 'validation_failed')).toBe(true);
-        });
-        it('A-T02b: block + dynamically-computed matched=false is REJECTED by the canonical runtime validator (convergence)', () => {
-            // The static scan cannot see through a variable — pre-convergence the
-            // local replay guard ACCEPTED this shape while the live RuleHost
-            // rejected it. Post-convergence the canonical validator rejects it in
-            // replay too: every case fails as runtime_error with the canonical reason.
-            const deps = createProductionGateDeps();
-            const result = deps.evaluateInSandbox(`function evaluate(input, helpers) {
-  var m = (input.action.toolName === 'edit');
-  m = false;
-  return { decision: 'block', matched: m, reason: 'contradictory' };
-}`, trace());
-            expect(result.success).toBe(false);
-            expect(result.failedCases.length).toBeGreaterThan(0);
-            expect(result.failedCases.every((c) => c.errorType === 'runtime_error')).toBe(true);
-            expect(result.failedCases.some((c) => c.message.includes("matched=false requires decision 'allow'"))).toBe(true);
-        });
-        it('A-T03: invalid decision enum (deny) is rejected', () => {
-            const result = evalWith(`{ decision: 'deny', matched: true, reason: 'bad enum' }`);
-            expect(result.success).toBe(false);
-            expect(result.failedCases.some((c) => c.errorType === 'runtime_error' && c.message.includes('decision must be one of'))).toBe(true);
-        });
-        it('A-T04: auto_correct + malformed correctionProposal is rejected with canonical errors', () => {
-            const result = evalWith(`{ decision: 'auto_correct', matched: true, reason: 'broken proposal', correctionProposal: { proposedParams: {} } }`);
-            expect(result.success).toBe(false);
-            expect(result.failedCases.some((c) => c.errorType === 'runtime_error' && c.message.includes('correctionProposal invalid'))).toBe(true);
-        });
-        it('A-T05: well-formed auto_correct result passes shape validation (failure, if any, is decision mismatch only)', () => {
-            const result = evalWith(`{ decision: 'auto_correct', matched: true, reason: 'ok', correctionProposal: { proposedParams: { filePath: '/safe.ts' }, correctedFields: [{ field: 'filePath', original: '/etc/passwd', proposed: '/safe.ts', reason: 'redirect' }], applicationMode: 'shadow', confidence: 0.9, ruleId: 'rule-001', notifyAgent: true } }`);
-            expect(result.failedCases.every((c) => c.errorType === 'validation_failed')).toBe(true);
-        });
-        it('A-T06: prototype-pollution keys in the result are rejected by the replay path (canonical-only check)', () => {
-            const result = evalWith(`{ decision: 'allow', matched: false, reason: 'pp', __proto__: undefined }`);
-            // A literal __proto__ own-property is hard to construct via object
-            // literal in strict vm code; if the shape still validates, the case
-            // outcome must at least never be runtime_error-free contradiction.
-            // The authoritative prototype-pollution rejection is pinned directly in
-            // rule-host-validator tests; here we pin the delegation is total (no
-            // crash, structured failure).
-            expect(result.success).toBe(false);
-        });
-    });
-});
-// ── PRI-809: pre-activation sandbox trust boundary ──────────────────────────
-// Unapproved RuleCode must never reach host capabilities during replay.
-// These probes call the hardened primitive DIRECTLY (no forbidden-pattern
-// scanner in front) to prove runtime isolation is the trust boundary — the
-// static scanner is only defense-in-depth (PRI-679 stays an upgrade option).
-describe('PRI-809 sandbox trust boundary (hardened replay evaluator)', () => {
-    const HOST_PROCESS_PREFIX = 'ESCAPED_PROCESS_';
-    function evaluateRaw(ruleBody, input) {
-        const evaluate = compileHardenedRuleEvaluator(`function evaluate(input, helpers) {\n${ruleBody}\n}`, 'pri-809-probe');
-        return evaluate(input, {});
-    }
-    function probeInput() {
-        return createSyntheticRuleHostInput({ toolName: 'edit', params: { filePath: '/src/index.ts' } }, {}, {});
-    }
-    it('blocks the top-level input.constructor.constructor escape (Case 1)', () => {
-        const result = evaluateRaw(`
-      try {
-        var hostFunction = input.constructor.constructor;
-        var proc = hostFunction('return process')();
-        return { decision: 'allow', matched: false, reason: '${HOST_PROCESS_PREFIX}' + String(proc && proc.version) };
-      } catch (error) {
-        return { decision: 'allow', matched: false, reason: 'escape_blocked:' + String(error && error.message).slice(0, 80) };
-      }
-    `, probeInput());
-        expect(result.decision).toBe('allow');
-        expect(result.reason).not.toContain(HOST_PROCESS_PREFIX);
-        expect(result.reason).toContain('escape_blocked');
-    });
-    it('blocks nested-object constructor chains (input.action.paramsSummary.constructor.constructor) (Case 2)', () => {
-        const result = evaluateRaw(`
-      try {
-        var hostFunction = input.action.paramsSummary.constructor.constructor;
-        var proc = hostFunction('return process')();
-        return { decision: 'allow', matched: false, reason: '${HOST_PROCESS_PREFIX}' + String(proc && proc.version) };
-      } catch (error) {
-        return { decision: 'allow', matched: false, reason: 'escape_blocked_nested:' + String(error && error.message).slice(0, 80) };
-      }
-    `, probeInput());
-        expect(result.reason).not.toContain(HOST_PROCESS_PREFIX);
-    });
-    it('blocks helper escapes (helpers.constructor.constructor and helpers.getToolName.constructor.constructor) (Case 3)', () => {
-        const result = evaluateRaw(`
-      var vectors = [helpers, helpers.getToolName];
-      for (var i = 0; i < vectors.length; i++) {
-        try {
-          var hostFunction = vectors[i].constructor.constructor;
-          var proc = hostFunction('return process')();
-          return { decision: 'allow', matched: false, reason: '${HOST_PROCESS_PREFIX}' + String(proc && proc.version) };
-        } catch (error) { /* try next vector */ }
-      }
-      return { decision: 'allow', matched: false, reason: 'helper_escape_blocked_all_vectors' };
-    `, probeInput());
-        expect(result.reason).toBe('helper_escape_blocked_all_vectors');
-    });
-    it('string-concatenation bypasses the scanner but still cannot escape (Case 4)', () => {
-        // The forbidden-pattern scanner matches literal patterns; dynamic
-        // property access built from concatenated strings evades it. Runtime
-        // isolation must hold anyway — the scanner is NOT the trust boundary.
-        const result = evaluateRaw(`
-      try {
-        var ctor = input['con' + 'structor'];
-        var hostFunction = ctor['con' + 'structor'];
-        var proc = hostFunction('return process')();
-        return { decision: 'allow', matched: false, reason: '${HOST_PROCESS_PREFIX}' + String(proc && proc.version) };
-      } catch (error) {
-        return { decision: 'allow', matched: false, reason: 'concat_bypass_still_sandboxed:' + String(error && error.message).slice(0, 80) };
-      }
-    `, probeInput());
-        expect(result.reason).not.toContain(HOST_PROCESS_PREFIX);
-    });
-    it('the concat-bypass rule sails through the forbidden-pattern scanner (proving isolation, not the scanner, is the boundary)', () => {
-        const deps = createProductionGateDeps();
-        const concatRule = `
-function evaluate(input, helpers) {
-  try {
-    var hostFunction = input['con' + 'structor']['con' + 'structor'];
-    hostFunction('return process')();
-  } catch (error) { /* unreachable either way */ }
-  return { decision: 'allow', matched: false, reason: 'safe path' };
-}
-`;
-        const goldenTrace = createGoldenTraceFixture({
-            toolName: 'edit',
-            negativeParams: { filePath: '/etc/passwd' },
-            positiveParams: { filePath: '/src/index.ts' },
-            expectedDecision: 'allow',
-        });
-        const result = deps.evaluateInSandbox(concatRule, goldenTrace);
-        // The scanner misses the dynamic access entirely, and the replay is
-        // judged on behavior — no host escape happened (it could not).
-        expect(result.forbiddenPatternViolations).toHaveLength(0);
-        expect(result.success).toBe(true);
-    });
-    it('legal allow rule with helpers still works (Case 5a)', () => {
-        const result = evaluateRaw(`
-      if (helpers.getToolName() === 'edit' && helpers.isRiskPath() === false) {
-        return { decision: 'allow', matched: false, reason: 'helpers:' + helpers.getToolName() + ':' + String(helpers.getEstimatedLineChanges()) + ':' + helpers.getBashRisk() + ':' + String(helpers.getEpTier()) };
-      }
-      return { decision: 'allow', matched: false, reason: 'helpers unexpected' };
-    `, probeInput());
-        expect(result.reason).toBe('helpers:edit:0:unknown:0');
-    });
-    it('legal block rule reading input context still works (Case 5b)', () => {
-        const result = evaluateRaw(`
-      var p = input.action.paramsSummary;
-      if (p && p.filePath === '/src/index.ts') {
-        return { decision: 'block', matched: true, reason: 'index guarded' };
-      }
-      return { decision: 'allow', matched: false, reason: 'safe path' };
-    `, probeInput());
-        expect(result.decision).toBe('block');
-        expect(result.matched).toBe(true);
-        expect(result.reason).toBe('index guarded');
-    });
-    it('replay is deterministic: same rule + same input produce identical verdicts', () => {
-        const rule = `
-function evaluate(input, helpers) {
-  return { decision: 'allow', matched: false, reason: 'det:' + input.action.toolName + ':' + String(input.workspace.isRiskPath) };
-}
-`;
-        const evaluate = compileHardenedRuleEvaluator(rule, 'pri-809-determinism');
-        const a = evaluate(probeInput(), {});
-        const b = evaluate(probeInput(), {});
-        expect(JSON.stringify(a)).toBe(JSON.stringify(b));
-    });
-    it('blocks Function.caller / arguments.callee walks toward host frames (Case 6)', () => {
-        // The constructor chain is not the only classic vm-escape family: walking
-        // .caller across realm frames is the other. The rule CAN reach the
-        // realm-side bridge function via arguments.callee.caller (the bridge is
-        // realm code — that is fine), but walking past it must hit the strict
-        // host frame (throw/null), and NO reachable frame may yield host process
-        // through its constructor chain.
-        const result = evaluateRaw(`
-      var seen = [];
-      var fn = arguments.callee;
-      for (var depth = 0; depth < 5; depth++) {
-        try {
-          fn = fn.caller;
-          if (!fn) { seen.push('null@' + depth); break; }
-          seen.push(typeof fn + '@' + depth);
-          try {
-            var proc = fn.constructor.constructor('return process')();
-            if (proc && proc.version) {
-              return { decision: 'allow', matched: false, reason: 'ESCAPED_VIA_CALLER_' + String(proc.version) };
-            }
-            seen.push('proc-unreachable@' + depth);
-          } catch (ctorError) { seen.push('ctor-throw@' + depth); }
-        } catch (walkError) { seen.push('walk-throw@' + depth); break; }
-      }
-      return { decision: 'allow', matched: false, reason: 'caller-walk:' + seen.join(',') };
-    `, probeInput());
-        expect(result.reason).not.toContain('ESCAPED_VIA_CALLER');
-        expect(result.reason.startsWith('caller-walk:')).toBe(true);
-    });
-    it('non-JSON-serializable input fails loud instead of crossing the boundary (rc-3)', () => {
-        const evaluate = compileHardenedRuleEvaluator('function evaluate(input, helpers) { return { decision: "allow", matched: false, reason: "ok" }; }', 'pri-809-rc3');
-        const circular = { toolName: 'edit' };
-        circular.self = circular;
-        const poison = { derived: circular };
-        expect(() => evaluate(poison, {})).toThrow(/not JSON-serializable/);
-    });
-});
-//# sourceMappingURL=production-gate-deps.test.js.map

package/dist/runtime-v2/activation/__tests__/production-gate-deps.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"production-gate-deps.test.js","sourceRoot":"","sources":["../../../../src/runtime-v2/activation/__tests__/production-gate-deps.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAI/F,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;QAExC,sDAAsD;QACtD,gEAAgE;QAChE,MAAM,QAAQ,GAAG;;;;;;;;CAQpB,CAAC;QAEE,MAAM,WAAW,GAAG,wBAAwB,CAAC;YAC3C,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC7C,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;QAExC,yEAAyE;QACzE,MAAM,QAAQ,GAAG;;;;CAIpB,CAAC;QAEE,MAAM,WAAW,GAAG,wBAAwB,CAAC;YAC3C,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC7C,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACrD,6FAA6F;QAC7F,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;QAClF,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;QAExC,MAAM,aAAa,GAAG;;;;;CAKzB,CAAC;QAEE,MAAM,WAAW,GAAG,wBAAwB,CAAC;YAC3C,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC7C,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAElE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;QAExC,MAAM,WAAW,GAAG;;;;CAIvB,CAAC;QAEE,MAAM,WAAW,GAAG,wBAAwB,CAAC;YAC3C,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC7C,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAEhE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;QAExC,MAAM,UAAU,GAAG;;;;;;;;CAQtB,CAAC;QAEE,MAAM,WAAW,GAAG,wBAAwB,CAAC;YAC3C,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC7C,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAE/D,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;QAExC,MAAM,QAAQ,GAAG;;;;;;;;CAQpB,CAAC;QAEE,MAAM,WAAW,GAAG,wBAAwB,CAAC;YAC3C,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC7C,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;QACrD,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;YACnG,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YAExC,MAAM,mBAAmB,GAAG;;;;CAIjC,CAAC;YAEI,MAAM,WAAW,GAAG,wBAAwB,CAAC;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;gBAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;gBAC7C,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;YAExE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACrD,uEAAuE;YACvE,wEAAwE;YACxE,8DAA8D;YAC9D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YAExC,MAAM,kBAAkB,GAAG;;;;CAIhC,CAAC;YAEI,MAAM,WAAW,GAAG,wBAAwB,CAAC;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;gBAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;gBAC7C,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;YAEvE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YAExC,MAAM,iBAAiB,GAAG;;;;CAI/B,CAAC;YAEI,MAAM,WAAW,GAAG,wBAAwB,CAAC;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;gBAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;gBAC7C,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YAEtE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YAExC,MAAM,8BAA8B,GAAG;;;;CAI5C,CAAC;YAEI,MAAM,WAAW,GAAG,wBAAwB,CAAC;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;gBAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;gBAC7C,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,EAAE,WAAW,CAAC,CAAC;YAEnF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACvE,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YAExC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;CAgBzC,CAAC;YAEI,MAAM,WAAW,GAAG,wBAAwB,CAAC;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;gBAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;gBAC7C,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAC;YAEhF,8EAA8E;YAC9E,0EAA0E;YAC1E,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,oEAAoE;YACpE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAC7H,MAAM,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YAExC,MAAM,oBAAoB,GAAG;;;;CAIlC,CAAC;YAEI,MAAM,WAAW,GAAG,wBAAwB,CAAC;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;gBAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;gBAC7C,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YAEzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,wBAAwB,CAAC;YAC3C,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC7C,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,CAAC,UAAkB,EAAE,EAAE,CACtC,wBAAwB,EAAE,CAAC,iBAAiB,CAC1C,8CAA8C,UAAU,KAAK,EAC7D,KAAK,EAAE,CACR,CAAC;QAEJ,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;YACvF,MAAM,MAAM,GAAG,QAAQ,CAAC,2DAA2D,CAAC,CAAC;YACrF,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gGAAgG,EAAE,GAAG,EAAE;YACxG,MAAM,MAAM,GAAG,QAAQ,CAAC,gEAAgE,CAAC,CAAC;YAC1F,wEAAwE;YACxE,2EAA2E;YAC3E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,4BAA4B,IAAI,CAAC,CAAC,SAAS,KAAK,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtI,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iHAAiH,EAAE,GAAG,EAAE;YACzH,sEAAsE;YACtE,iEAAiE;YACjE,sEAAsE;YACtE,2EAA2E;YAC3E,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CACnC;;;;EAIN,EACM,KAAK,EAAE,CACR,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,yDAAyD,CAAC,CAAC;YACnF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtI,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;YAC9F,MAAM,MAAM,GAAG,QAAQ,CAAC,oHAAoH,CAAC,CAAC;YAC9I,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzI,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6GAA6G,EAAE,GAAG,EAAE;YACrH,MAAM,MAAM,GAAG,QAAQ,CAAC,6TAA6T,CAAC,CAAC;YACvV,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sGAAsG,EAAE,GAAG,EAAE;YAE9G,MAAM,MAAM,GAAG,QAAQ,CAAC,2EAA2E,CAAC,CAAC;YACrG,mEAAmE;YACnE,oEAAoE;YACpE,mEAAmE;YACnE,wEAAwE;YACxE,qEAAqE;YACrE,8BAA8B;YAC9B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAE7E,QAAQ,CAAC,4DAA4D,EAAE,GAAG,EAAE;IAC1E,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;IAE/C,SAAS,WAAW,CAAC,QAAgB,EAAE,KAAoB;QACzD,MAAM,QAAQ,GAAG,4BAA4B,CAC3C,wCAAwC,QAAQ,KAAK,EACrD,eAAe,CAChB,CAAC;QACF,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAqB,CAAC,CAAC;IAChD,CAAC;IAED,SAAS,UAAU;QACjB,OAAO,4BAA4B,CACjC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,EAC3D,EAAE,EACF,EAAE,CACH,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,MAAM,GAAG,WAAW,CAAC;;;;+DAIgC,mBAAmB;;;;KAI7E,EAAE,UAAU,EAAE,CAAC,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uGAAuG,EAAE,GAAG,EAAE;QAC/G,MAAM,MAAM,GAAG,WAAW,CAAC;;;;+DAIgC,mBAAmB;;;;KAI7E,EAAE,UAAU,EAAE,CAAC,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kHAAkH,EAAE,GAAG,EAAE;QAC1H,MAAM,MAAM,GAAG,WAAW,CAAC;;;;;;iEAMkC,mBAAmB;;;;KAI/E,EAAE,UAAU,EAAE,CAAC,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,MAAM,GAAG,WAAW,CAAC;;;;;+DAKgC,mBAAmB;;;;KAI7E,EAAE,UAAU,EAAE,CAAC,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0HAA0H,EAAE,GAAG,EAAE;QAClI,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG;;;;;;;;CAQtB,CAAC;QACE,MAAM,WAAW,GAAG,wBAAwB,CAAC;YAC3C,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC3C,cAAc,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC7C,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC/D,oEAAoE;QACpE,+DAA+D;QAC/D,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,WAAW,CAAC;;;;;KAK1B,EAAE,UAAU,EAAE,CAAC,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,MAAM,GAAG,WAAW,CAAC;;;;;;KAM1B,EAAE,UAAU,EAAE,CAAC,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,IAAI,GAAG;;;;CAIhB,CAAC;QACE,MAAM,QAAQ,GAAG,4BAA4B,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAqB,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAqB,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,iCAAiC;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC;;;;;;;;;;;;;;;;;;KAkB1B,EAAE,UAAU,EAAE,CAAC,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,QAAQ,GAAG,4BAA4B,CAC3C,mGAAmG,EACnG,aAAa,CACd,CAAC;QACF,MAAM,QAAQ,GAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC;QACzB,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,EAA8B,CAAC;QACjE,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/runtime-v2/activation/__tests__/promotion-evidence-snapshot.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=promotion-evidence-snapshot.test.d.ts.map

package/dist/runtime-v2/activation/__tests__/promotion-evidence-snapshot.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"promotion-evidence-snapshot.test.d.ts","sourceRoot":"","sources":["../../../../src/runtime-v2/activation/__tests__/promotion-evidence-snapshot.test.ts"],"names":[],"mappings":""}

package/dist/runtime-v2/activation/__tests__/promotion-evidence-snapshot.test.js

@@ -1,104 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { buildPromotionEvidenceSnapshot, computeArtifactDigest, normalizeOwnerIdentity, } from '../promotion-evidence-snapshot.js';
-const sampleArtifact = {
-    artifactId: 'artifact-1',
-    artifactKind: 'rule',
-    sourceTaskId: 'task-100',
-    lineageArtifactIds: ['parent-1', 'parent-2'],
-    validationStatus: 'validated',
-    contentJson: '{"code":"console.log()"}',
-    createdAt: '2026-08-21T00:00:00.000Z',
-    updatedAt: '2026-08-21T00:00:00.000Z',
-};
-describe('promotion-evidence-snapshot factory', () => {
-    it('computes deterministic digest given identical inputs and fixed clock', () => {
-        const input = {
-            activationId: 'act-123',
-            evaluationId: 'eval-456',
-            checks: [{ checkId: 'bounded_scope', status: 'passed' }],
-            artifact: sampleArtifact,
-            ownerIdentity: {
-                principal: { kind: 'configured_owner', ownerId: 'wesley' },
-                authentication: { method: 'cli_owner_credential', credentialId: 'cred-1' },
-            },
-            hostRuntimeVersion: 'openclaw-legacy@1',
-            now: () => '2026-08-21T12:00:00.000Z',
-            newSnapshotId: () => 'snapshot-fixed',
-        };
-        const snap1 = buildPromotionEvidenceSnapshot(input);
-        const snap2 = buildPromotionEvidenceSnapshot(input);
-        expect(snap1.snapshotId).toBe('snapshot-fixed');
-        expect(snap1.snapshotDigest).toBe(snap2.snapshotDigest);
-        expect(snap1.artifactDigest).toBe(computeArtifactDigest(sampleArtifact));
-        expect(snap1.lineageRefs).toEqual(['task-100', 'parent-1', 'parent-2']);
-        expect(snap1.redaction).toEqual({ version: 'v1', rawParametersStored: false });
-    });
-    it('changes digest when activationId or evaluationId changes', () => {
-        const base = {
-            activationId: 'act-1',
-            evaluationId: 'eval-1',
-            checks: [{ checkId: 'bounded_scope', status: 'passed' }],
-            now: () => '2026-08-21T12:00:00.000Z',
-        };
-        const snapBase = buildPromotionEvidenceSnapshot(base);
-        const snapDiffAct = buildPromotionEvidenceSnapshot({ ...base, activationId: 'act-2' });
-        const snapDiffEval = buildPromotionEvidenceSnapshot({ ...base, evaluationId: 'eval-2' });
-        expect(snapBase.snapshotDigest).not.toBe(snapDiffAct.snapshotDigest);
-        expect(snapBase.snapshotDigest).not.toBe(snapDiffEval.snapshotDigest);
-    });
-    it('changes digest when lineageRefs change (lineage is digest-bound)', () => {
-        const base = {
-            activationId: 'act-1',
-            evaluationId: 'eval-1',
-            checks: [{ checkId: 'bounded_scope', status: 'passed' }],
-            artifact: sampleArtifact,
-            now: () => '2026-08-21T12:00:00.000Z',
-        };
-        const snapBase = buildPromotionEvidenceSnapshot(base);
-        const snapDiffLineage = buildPromotionEvidenceSnapshot({
-            ...base,
-            artifact: { ...sampleArtifact, lineageArtifactIds: ['parent-1'] },
-            // explicit override must win over the derived list, so both differ
-            lineageRefs: ['task-100', 'parent-9'],
-        });
-        const snapExplicit = buildPromotionEvidenceSnapshot({ ...base, lineageRefs: ['task-100', 'parent-1', 'parent-2'] });
-        expect(snapBase.lineageRefs).toEqual(['task-100', 'parent-1', 'parent-2']);
-        expect(snapBase.snapshotDigest).not.toBe(snapDiffLineage.snapshotDigest);
-        expect(snapBase.snapshotDigest).toBe(snapExplicit.snapshotDigest);
-    });
-    it('changes digest when owner identity or runtime version changes', () => {
-        const base = {
-            activationId: 'act-1',
-            evaluationId: 'eval-1',
-            checks: [{ checkId: 'bounded_scope', status: 'passed' }],
-            ownerIdentity: { principalKind: 'configured_owner', actorId: 'wesley', authenticationMethod: 'cli_owner_credential' },
-            hostRuntimeVersion: 'openclaw-legacy@1',
-            now: () => '2026-08-21T12:00:00.000Z',
-        };
-        const snapBase = buildPromotionEvidenceSnapshot(base);
-        const snapDiffOwner = buildPromotionEvidenceSnapshot({
-            ...base,
-            ownerIdentity: { principalKind: 'configured_owner', actorId: 'other_user', authenticationMethod: 'cli_owner_credential' },
-        });
-        const snapDiffRuntime = buildPromotionEvidenceSnapshot({
-            ...base,
-            hostRuntimeVersion: 'openclaw-v2',
-        });
-        expect(snapBase.snapshotDigest).not.toBe(snapDiffOwner.snapshotDigest);
-        expect(snapBase.snapshotDigest).not.toBe(snapDiffRuntime.snapshotDigest);
-    });
-    it('normalizes owner identity from OwnerPromotionActor', () => {
-        const actor = {
-            principal: { kind: 'configured_owner', ownerId: 'wesley' },
-            authentication: { method: 'console_token', credentialId: 'tok-abc' },
-        };
-        const normalized = normalizeOwnerIdentity(actor);
-        expect(normalized).toEqual({
-            principalKind: 'configured_owner',
-            actorId: 'wesley',
-            authenticationMethod: 'console_token',
-            credentialId: 'tok-abc',
-        });
-    });
-});
-//# sourceMappingURL=promotion-evidence-snapshot.test.js.map