@semacode/cli 2.3.0 → 3.0.0

package/dist/sistemasInterativos/operationPrimitives.js

@@ -0,0 +1,194 @@
+// SEMA-GOVERNED: sema.produto.sistemas_interativos.operacao
+// Descricao: primitivas puras de JSON canonico, digest e redacao para operacoes interativas.
+import { createHash } from "node:crypto";
+import { OPERATION_RESULT_SCHEMA_V1, } from "./operationsTypes.js";
+const BASE_FLAGS = {
+    executed: false,
+    workspaceMutated: false,
+    engineProbed: false,
+    editorInspected: false,
+    processesInspected: false,
+    resourcesReserved: false,
+    authoritative: false,
+};
+const SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const OPAQUE_SHA256_PATTERN = /^opaque:sha256:[a-f0-9]{64}$/;
+const SEMANTIC_ID_PATTERN = /^[a-z][a-z0-9_-]{0,31}(?:[.:/][a-z0-9][a-z0-9_-]{0,63})+$/;
+const SAFE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9._+-]{0,127}$/;
+const VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?$/;
+export const MEDIA_TYPE_PATTERN = /^[a-z0-9][a-z0-9.+-]{0,63}\/[a-z0-9][a-z0-9.+-]{0,63}$/;
+const DANGEROUS_KEYS = new Set(["__proto__", "prototype", "constructor"]);
+const OPAQUE_SENSITIVE_KEYS = new Set(["recoverytoken", "sourceuriref"]);
+const SENSITIVE_KEY_PARTS = [
+    "password", "passwd", "secret", "token", "apikey", "privatekey",
+    "clientsecret", "accesstoken", "refreshtoken", "credential",
+    "authorization", "cookie", "connectionstring",
+];
+const SENSITIVE_VALUE_PATTERNS = [
+    /\bbearer\s+[a-z0-9._~+\/-]{8,}/i,
+    /^(?:sk[-_][a-z0-9_-]{8,}|ghp_[a-z0-9]{20,}|github_pat_[a-z0-9_]{20,})$/i,
+    /^eyJ[a-z0-9_-]{8,}\.eyJ[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}$/i,
+    /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+    /-----BEGIN [A-Z0-9 ]*(?:PRIVATE KEY|CERTIFICATE)-----/,
+    /(?:^|[?&])(?:access_?token|api_?key|aws_?secret_?access_?key|secret|password|passwd|signature|sig|token|credential|authorization)=[^&#\s]+/i,
+    /:\/\/[^/\s:@]+:[^/\s@]+@/,
+];
+export function issue(code, field) {
+    return { code, field };
+}
+function normalizedIssues(issues) {
+    const unique = new Map();
+    for (const item of issues)
+        unique.set(item.code + "\u0000" + item.field, item);
+    return [...unique.values()].sort((a, b) => (a.code.localeCompare(b.code) || a.field.localeCompare(b.field)));
+}
+export function failure(issues) {
+    return {
+        schemaVersion: OPERATION_RESULT_SCHEMA_V1,
+        valid: false,
+        issues: normalizedIssues(issues),
+        ...BASE_FLAGS,
+    };
+}
+export function success(value, digest) {
+    return {
+        schemaVersion: OPERATION_RESULT_SCHEMA_V1,
+        valid: true,
+        issues: [],
+        value,
+        ...(digest === undefined ? {} : { digest }),
+        ...BASE_FLAGS,
+    };
+}
+export function isRecord(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function normalizedKey(key) {
+    return key.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+export function isSha256(value) {
+    return typeof value === "string" && SHA256_PATTERN.test(value);
+}
+export function isOpaqueSha256(value) {
+    return typeof value === "string" && OPAQUE_SHA256_PATTERN.test(value);
+}
+export function isSemanticId(value) {
+    return typeof value === "string" && value.length <= 192 && SEMANTIC_ID_PATTERN.test(value);
+}
+export function isSafeName(value) {
+    return typeof value === "string" && SAFE_NAME_PATTERN.test(value);
+}
+export function isVersion(value) {
+    return typeof value === "string" && VERSION_PATTERN.test(value);
+}
+export function isIsoTimestamp(value) {
+    if (typeof value !== "string" || value.length > 40)
+        return false;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
+}
+export function isIntegerIn(value, minimum, maximum) {
+    return typeof value === "number"
+        && Number.isSafeInteger(value)
+        && value >= minimum
+        && value <= maximum;
+}
+export function hasOnlyKeys(value, allowed) {
+    const allowlist = new Set(allowed);
+    return Object.keys(value).every((key) => allowlist.has(key));
+}
+function isSensitiveValue(value) {
+    if (isSha256(value) || isOpaqueSha256(value))
+        return false;
+    return SENSITIVE_VALUE_PATTERNS.some((pattern) => pattern.test(value));
+}
+export function inspectPlainJson(input, rootField) {
+    const issues = [];
+    const active = new Set();
+    let nodes = 0;
+    const visit = (value, field, depth) => {
+        nodes += 1;
+        if (nodes > 20_000) {
+            issues.push(issue("json_node_limit_exceeded", rootField));
+            return;
+        }
+        if (depth > 48) {
+            issues.push(issue("json_depth_limit_exceeded", rootField));
+            return;
+        }
+        if (typeof value === "string") {
+            if (isSensitiveValue(value))
+                issues.push(issue("sensitive_material_forbidden", field));
+            return;
+        }
+        if (value === null || typeof value === "boolean")
+            return;
+        if (typeof value === "number") {
+            if (!Number.isFinite(value))
+                issues.push(issue("json_number_invalid", field));
+            return;
+        }
+        if (typeof value !== "object") {
+            issues.push(issue("json_type_unsupported", field));
+            return;
+        }
+        if (active.has(value)) {
+            issues.push(issue("json_cycle_detected", rootField));
+            return;
+        }
+        active.add(value);
+        if (Array.isArray(value)) {
+            if (value.length > 10_000)
+                issues.push(issue("json_array_limit_exceeded", field));
+            for (const item of value)
+                visit(item, field, depth + 1);
+            active.delete(value);
+            return;
+        }
+        if (!isRecord(value)) {
+            issues.push(issue("json_object_not_plain", field));
+            active.delete(value);
+            return;
+        }
+        for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+            if (DANGEROUS_KEYS.has(key))
+                issues.push(issue("json_dangerous_key", field));
+            if (descriptor.get !== undefined || descriptor.set !== undefined) {
+                issues.push(issue("json_accessor_forbidden", field));
+                continue;
+            }
+            const keyNormalized = normalizedKey(key);
+            const child = descriptor.value;
+            const sensitive = SENSITIVE_KEY_PARTS.some((part) => keyNormalized.includes(part));
+            const opaqueException = OPAQUE_SENSITIVE_KEYS.has(keyNormalized) && isOpaqueSha256(child);
+            if (sensitive && !opaqueException)
+                issues.push(issue("sensitive_material_forbidden", field));
+            visit(child, field, depth + 1);
+        }
+        active.delete(value);
+    };
+    visit(input, rootField, 0);
+    return normalizedIssues(issues);
+}
+export function canonicalJson(value) {
+    if (Array.isArray(value))
+        return "[" + value.map(canonicalJson).join(",") + "]";
+    if (isRecord(value)) {
+        return "{" + Object.keys(value).sort().map((key) => (JSON.stringify(key) + ":" + canonicalJson(value[key]))).join(",") + "}";
+    }
+    return JSON.stringify(value);
+}
+export function digestJsonOperacional(value) {
+    return ("sha256:" + createHash("sha256").update(canonicalJson(value)).digest("hex"));
+}
+export function criarReferenciaFonteOpaca(sourceUri) {
+    if (typeof sourceUri !== "string" || sourceUri.length === 0 || sourceUri.length > 4096 || sourceUri.includes("\u0000")) {
+        return failure([issue("source_uri_invalid", "sourceUri")]);
+    }
+    const sourceUriRef = ("opaque:sha256:" + createHash("sha256").update(sourceUri).digest("hex"));
+    return success({ sourceUriRef, sourceUriRedacted: true }, digestJsonOperacional(sourceUriRef));
+}
+//# sourceMappingURL=operationPrimitives.js.map

package/dist/sistemasInterativos/operations.d.ts

@@ -1,40 +1,5 @@
-import { type AcceptanceLockV1, type AcceptanceOperationValue, type AcceptanceTimeRange, type AssetProvenanceV1, type EditorStateV1, type EngineSnapshotDiffV1, type JobOrchestrationPlanV1, type MultimodalChannelType, type MultimodalEvidenceDescriptorV1, type OpaqueSha256, type OperationResult, type Sha256, type ValidatedEngineSnapshot } from "./operationsTypes.js";
+export { criarReferenciaFonteOpaca, digestJsonOperacional, } from "./operationPrimitives.js";
+export { derivarDiffSnapshotsEngine, validarEstadoEditor, validarProvenienciaAsset, validarSnapshotEngine, } from "./engineObservation.js";
+export { planejarOrquestracaoJobs } from "./jobOrchestration.js";
+export { digestVinculoClaimMultimodal, operarAcceptanceLock, validarAcceptanceLock, validarEvidenciaMultimodal, } from "./acceptanceEvidence.js";
 export * from "./operationsTypes.js";
-export declare function digestJsonOperacional(value: unknown): Sha256;
-export declare function criarReferenciaFonteOpaca(sourceUri: unknown): OperationResult<{
-    readonly sourceUriRef: OpaqueSha256;
-    readonly sourceUriRedacted: true;
-}>;
-export declare function validarSnapshotEngine(input: unknown): OperationResult<ValidatedEngineSnapshot>;
-export declare function derivarDiffSnapshotsEngine(beforeInput: unknown, afterInput: unknown): OperationResult<EngineSnapshotDiffV1>;
-export declare function validarProvenienciaAsset(input: unknown): OperationResult<{
-    readonly provenance: AssetProvenanceV1;
-    readonly provenanceDigest: Sha256;
-}>;
-export declare function validarEstadoEditor(input: unknown): OperationResult<{
-    readonly state: EditorStateV1;
-    readonly editorStateDigest: Sha256;
-    readonly externallyObserved: false;
-}>;
-export declare function planejarOrquestracaoJobs(input: unknown): OperationResult<JobOrchestrationPlanV1>;
-export declare function validarAcceptanceLock(input: unknown): OperationResult<{
-    readonly lock: AcceptanceLockV1;
-    readonly lockDigest: Sha256;
-}>;
-export declare function operarAcceptanceLock(operation: unknown, lockInput: unknown, contextInput: unknown): OperationResult<AcceptanceOperationValue>;
-export declare function digestVinculoClaimMultimodal(input: {
-    readonly claimId: string;
-    readonly runId: string;
-    readonly definitionDigest: Sha256;
-    readonly planDigest: Sha256;
-    readonly contractDigest: Sha256;
-    readonly artifactDigest: Sha256;
-    readonly sceneId: string;
-    readonly timeRange: AcceptanceTimeRange;
-    readonly requiredModalities: readonly MultimodalChannelType[];
-}): Sha256;
-export declare function validarEvidenciaMultimodal(input: unknown): OperationResult<{
-    readonly descriptor: MultimodalEvidenceDescriptorV1;
-    readonly descriptorDigest: Sha256;
-    readonly localDescriptorOnly: true;
-}>;