@skrr-ai/cli 0.1.115 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/commitmentExecutionContract.js

@@ -1,550 +1,434 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.COMMITMENT_EXECUTION_CONTRACT_CAPABILITY = exports.COMMITMENT_EXECUTION_CONTRACT_VERSION = void 0;
-exports.eventRepository = eventRepository;
-exports.normalizeCommitmentExecutionContract = normalizeCommitmentExecutionContract;
-const node_util_1 = require("node:util");
-/** Mode-free responsibility context. Tool permissions belong to the Agent runtime. */
-exports.COMMITMENT_EXECUTION_CONTRACT_VERSION = 3;
-exports.COMMITMENT_EXECUTION_CONTRACT_CAPABILITY = 'commitment_execution_contract_v3';
-const DELIVERY_MODES = new Set([
-    'report_only',
-    'local_patch',
-    'draft_pr',
-    'push_branch',
-    'direct_branch',
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var commitmentExecutionContract_exports = {};
+__export(commitmentExecutionContract_exports, {
+  COMMITMENT_EXECUTION_CONTRACT_CAPABILITY: () => COMMITMENT_EXECUTION_CONTRACT_CAPABILITY,
+  COMMITMENT_EXECUTION_CONTRACT_VERSION: () => COMMITMENT_EXECUTION_CONTRACT_VERSION,
+  eventRepository: () => eventRepository,
+  normalizeCommitmentExecutionContract: () => normalizeCommitmentExecutionContract
+});
+module.exports = __toCommonJS(commitmentExecutionContract_exports);
+var import_node_util = require("node:util");
+const COMMITMENT_EXECUTION_CONTRACT_VERSION = 3;
+const COMMITMENT_EXECUTION_CONTRACT_CAPABILITY = "commitment_execution_contract_v3";
+const DELIVERY_MODES = /* @__PURE__ */ new Set([
+  "report_only",
+  "local_patch",
+  "draft_pr",
+  "push_branch",
+  "direct_branch"
 ]);
-const FACT_KEYS = new Set([
-    'id',
-    'source',
-    'type',
-    'eventType',
-    'checkName',
-    'workflowName',
-    'workflowRunId',
-    'revision',
-    'appId',
-    'appSlug',
-    'slug',
-    'app',
-    'action',
-    'status',
-    'conclusion',
-    'sha',
-    'headSha',
-    'head_sha',
-    'branch',
-    'headBranch',
-    'head_branch',
-    'repo',
-    'repository',
-    'fullName',
-    'full_name',
-    'repoFullName',
-    'prNumber',
-    'owner',
-    'name',
-    'number',
-    'checkRunId',
-    'check_run_id',
-    'runId',
-    'run_id',
-    'url',
-    'runUrl',
-    'htmlUrl',
-    'html_url',
-    'createdAt',
-    'updatedAt',
-    'occurredAt',
-    'completed_at',
-    'started_at',
-    'check_run',
-    'check_suite',
-    'workflow_run',
-    'pull_request',
-    'base',
-    'head',
-    'ref',
-    'eventId',
-    'rerun',
-    'checkAnnotations',
-    'path',
-    'startLine',
-    'endLine',
-    'level',
-    'message',
-    'title',
+const FACT_KEYS = /* @__PURE__ */ new Set([
+  "id",
+  "source",
+  "type",
+  "eventType",
+  "checkName",
+  "workflowName",
+  "workflowRunId",
+  "revision",
+  "appId",
+  "appSlug",
+  "slug",
+  "app",
+  "action",
+  "status",
+  "conclusion",
+  "sha",
+  "headSha",
+  "head_sha",
+  "branch",
+  "headBranch",
+  "head_branch",
+  "repo",
+  "repository",
+  "fullName",
+  "full_name",
+  "repoFullName",
+  "prNumber",
+  "owner",
+  "name",
+  "number",
+  "checkRunId",
+  "check_run_id",
+  "runId",
+  "run_id",
+  "url",
+  "runUrl",
+  "htmlUrl",
+  "html_url",
+  "createdAt",
+  "updatedAt",
+  "occurredAt",
+  "completed_at",
+  "started_at",
+  "check_run",
+  "check_suite",
+  "workflow_run",
+  "pull_request",
+  "base",
+  "head",
+  "ref",
+  "eventId",
+  "rerun",
+  "checkAnnotations",
+  "path",
+  "startLine",
+  "endLine",
+  "level",
+  "message",
+  "title"
 ]);
-const CAPABILITY_SOURCE_KEYS = new Set([
-    'source',
-    'provider',
-    'capability',
-    'scope',
-    'status',
-    'attestation',
-    'accountFingerprint',
-    'testedAt',
-    'expiresAt',
-    'runtimeId',
-    'reason',
+const CAPABILITY_SOURCE_KEYS = /* @__PURE__ */ new Set([
+  "source",
+  "provider",
+  "capability",
+  "scope",
+  "status",
+  "attestation",
+  "accountFingerprint",
+  "testedAt",
+  "expiresAt",
+  "runtimeId",
+  "reason"
 ]);
-const WORKSPACE_CONSTRAINT_KEYS = new Set([
-    'allowedCommitmentDeliveryModes',
-    'requireAttestedAccessForDeliveryModes',
-    'maxInitiativesPerDay',
-    'maxAutoRunsPerDay',
-    'maxCommitmentActionRunsPerDay',
-    'maxCommitmentObservationRunsPerDay',
-    'maxCommitmentConcurrentRuns',
-    'maxCommitmentCostUsdPerDay',
-    'requireApprovalRiskLevels',
-    'requireApprovalActionClasses',
-    'blockedSourceKinds',
+const WORKSPACE_CONSTRAINT_KEYS = /* @__PURE__ */ new Set([
+  "allowedCommitmentDeliveryModes",
+  "requireAttestedAccessForDeliveryModes",
+  "maxInitiativesPerDay",
+  "maxAutoRunsPerDay",
+  "maxCommitmentActionRunsPerDay",
+  "maxCommitmentObservationRunsPerDay",
+  "maxCommitmentConcurrentRuns",
+  "maxCommitmentCostUsdPerDay",
+  "requireApprovalRiskLevels",
+  "requireApprovalActionClasses",
+  "blockedSourceKinds"
 ]);
-const CAPABILITY_SOURCES = new Set([
-    'event_payload',
-    'cloud_runtime',
-    'local_harness',
-    'platform_grant',
+const CAPABILITY_SOURCES = /* @__PURE__ */ new Set([
+  "event_payload",
+  "cloud_runtime",
+  "local_harness",
+  "platform_grant"
 ]);
-const CAPABILITY_STATUSES = new Set(['available', 'unavailable', 'unknown', 'stale']);
-const CAPABILITY_ATTESTATIONS = new Set(['platform', 'runtime', 'machine', 'none']);
+const CAPABILITY_STATUSES = /* @__PURE__ */ new Set(["available", "unavailable", "unknown", "stale"]);
+const CAPABILITY_ATTESTATIONS = /* @__PURE__ */ new Set(["platform", "runtime", "machine", "none"]);
 function plainObject(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
 }
 function hasOnlyKeys(value, allowed) {
-    return plainObject(value) && Object.keys(value).every((key) => allowed.has(key));
+  return plainObject(value) && Object.keys(value).every((key) => allowed.has(key));
 }
-function boundedString(value, max = 1000) {
-    return typeof value === 'string' && value.length > 0 && value.length <= max;
+function boundedString(value, max = 1e3) {
+  return typeof value === "string" && value.length > 0 && value.length <= max;
 }
-function optionalString(value, max = 1000) {
-    return typeof value === 'string' && value.length <= max;
+function optionalString(value, max = 1e3) {
+  return typeof value === "string" && value.length <= max;
 }
 function isoTimestamp(value) {
-    return (typeof value === 'string' &&
-        value.length <= 40 &&
-        Number.isFinite(Date.parse(value)) &&
-        new Date(value).toISOString() === value);
+  return typeof value === "string" && value.length <= 40 && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
 }
 function normalizedEventFactValue(item, depth) {
-    if (typeof item === 'string') {
-        if (containsCredentialSignature(item))
-            return undefined;
-        return item.slice(0, 1000);
-    }
-    if (typeof item === 'number' || typeof item === 'boolean')
-        return item;
-    if (Array.isArray(item)) {
-        return item
-            .slice(0, 20)
-            .map((entry) => normalizedEventFacts(entry, depth + 1))
-            .filter((entry) => entry !== undefined);
-    }
-    return normalizedEventFacts(item, depth + 1);
+  if (typeof item === "string") {
+    if (containsCredentialSignature(item))
+      return void 0;
+    return item.slice(0, 1e3);
+  }
+  if (typeof item === "number" || typeof item === "boolean")
+    return item;
+  if (Array.isArray(item)) {
+    return item.slice(0, 20).map((entry) => normalizedEventFacts(entry, depth + 1)).filter((entry) => entry !== void 0);
+  }
+  return normalizedEventFacts(item, depth + 1);
 }
 const CREDENTIAL_SIGNATURE_RE = /(?:bearer\s+(?!\[REDACTED\](?:\s|$))\S{8,}|github_pat_[A-Za-z0-9_]{8,}|gh[pousr]_[A-Za-z0-9_]{8,}|xox[baprs]-[A-Za-z0-9-]{8,}|sk_(?:live|test)_[A-Za-z0-9]{8,}|(?:AKIA|ASIA)[A-Z0-9]{16}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:(?!\[REDACTED\]@)[^\s/@]+@|-----BEGIN [A-Z ]*PRIVATE KEY-----)/i;
 function containsCredentialSignature(value) {
-    return typeof value === 'string' && CREDENTIAL_SIGNATURE_RE.test(value);
+  return typeof value === "string" && CREDENTIAL_SIGNATURE_RE.test(value);
 }
 function normalizedEventFacts(value, depth = 0) {
-    if (!plainObject(value) || depth > 3)
-        return undefined;
-    return Object.fromEntries(Object.entries(value)
-        .filter(([key]) => FACT_KEYS.has(key))
-        .slice(0, 30)
-        .map(([key, item]) => [key, normalizedEventFactValue(item, depth)])
-        .filter(([, item]) => item !== undefined));
+  if (!plainObject(value) || depth > 3)
+    return void 0;
+  return Object.fromEntries(Object.entries(value).filter(([key]) => FACT_KEYS.has(key)).slice(0, 30).map(([key, item]) => [key, normalizedEventFactValue(item, depth)]).filter(([, item]) => item !== void 0));
 }
-const CI_LOG_EVIDENCE_KEYS = new Set([
-    'version',
-    'provider',
-    'kind',
-    'repoFullName',
-    'checkRunId',
-    'workflowRunId',
-    'jobId',
-    'capability',
-    'attestation',
-    'fetchedAt',
-    'status',
-    'reason',
-    'byteLength',
-    'lineCount',
-    'excerptLines',
-    'excerpt',
-    'digest',
-    // Attribution facts, taken off the job row the server had to fetch to prove
-    // identity. Allowed on an UNREADABLE row: attribution happens before the
-    // download, so the failing step name survives a log the server could not
-    // read. Only text FROM the log is withheld when the read failed.
-    'jobName',
-    'failedStepName',
-    'failedStepNumber',
+const CI_LOG_EVIDENCE_KEYS = /* @__PURE__ */ new Set([
+  "version",
+  "provider",
+  "kind",
+  "repoFullName",
+  "checkRunId",
+  "workflowRunId",
+  "jobId",
+  "capability",
+  "attestation",
+  "fetchedAt",
+  "status",
+  "reason",
+  "byteLength",
+  "lineCount",
+  "excerptLines",
+  "excerpt",
+  "digest",
+  // Attribution facts, taken off the job row the server had to fetch to prove
+  // identity. Allowed on an UNREADABLE row: attribution happens before the
+  // download, so the failing step name survives a log the server could not
+  // read. Only text FROM the log is withheld when the read failed.
+  "jobName",
+  "failedStepName",
+  "failedStepNumber"
 ]);
-const CI_LOG_EVIDENCE_STATUSES = new Set(['available', 'truncated', 'unavailable', 'unauthorized']);
-const CI_LOG_EVIDENCE_READABLE = new Set(['available', 'truncated']);
-const CI_LOG_EXCERPT_MAX_CHARS = 12_000;
+const CI_LOG_EVIDENCE_STATUSES = /* @__PURE__ */ new Set(["available", "truncated", "unavailable", "unauthorized"]);
+const CI_LOG_EVIDENCE_READABLE = /* @__PURE__ */ new Set(["available", "truncated"]);
+const CI_LOG_EXCERPT_MAX_CHARS = 12e3;
 function validCiLogEvidence(value) {
-    if (!hasOnlyKeys(value, CI_LOG_EVIDENCE_KEYS))
-        return false;
-    if (value.version !== 1 ||
-        value.provider !== 'github' ||
-        value.kind !== 'actions_job_log' ||
-        value.capability !== 'github:actions:read' ||
-        value.attestation !== 'platform' ||
-        !CI_LOG_EVIDENCE_STATUSES.has(String(value.status)) ||
-        !isoTimestamp(value.fetchedAt) ||
-        !/^[\w.-]+\/[\w.-]+$/.test(String(value.repoFullName || '')) ||
-        !/^\d{1,20}$/.test(String(value.checkRunId || '')))
-        return false;
-    for (const key of ['workflowRunId', 'jobId']) {
-        if (value[key] !== undefined && !/^\d{1,20}$/.test(String(value[key])))
-            return false;
-    }
-    for (const key of ['byteLength', 'lineCount', 'excerptLines', 'failedStepNumber']) {
-        const item = value[key];
-        if (item !== undefined && (!Number.isSafeInteger(item) || item < 0))
-            return false;
-    }
-    for (const key of ['jobName', 'failedStepName']) {
-        if (value[key] !== undefined && !boundedString(value[key], 200))
-            return false;
-    }
-    if (value.reason !== undefined && !/^[a-z0-9_]{1,80}$/.test(String(value.reason)))
-        return false;
-    if (value.digest !== undefined && !/^[a-f0-9]{16}$/.test(String(value.digest)))
-        return false;
-    // A read that failed carries no text: an unreadable log must not be able to
-    // arrive looking like a readable one.
-    if (!CI_LOG_EVIDENCE_READABLE.has(String(value.status))) {
-        return value.excerpt === undefined && value.digest === undefined && Boolean(value.reason);
-    }
-    return boundedString(value.excerpt, CI_LOG_EXCERPT_MAX_CHARS) && value.jobId !== undefined;
+  if (!hasOnlyKeys(value, CI_LOG_EVIDENCE_KEYS))
+    return false;
+  if (value.version !== 1 || value.provider !== "github" || value.kind !== "actions_job_log" || value.capability !== "github:actions:read" || value.attestation !== "platform" || !CI_LOG_EVIDENCE_STATUSES.has(String(value.status)) || !isoTimestamp(value.fetchedAt) || !/^[\w.-]+\/[\w.-]+$/.test(String(value.repoFullName || "")) || !/^\d{1,20}$/.test(String(value.checkRunId || "")))
+    return false;
+  for (const key of ["workflowRunId", "jobId"]) {
+    if (value[key] !== void 0 && !/^\d{1,20}$/.test(String(value[key])))
+      return false;
+  }
+  for (const key of ["byteLength", "lineCount", "excerptLines", "failedStepNumber"]) {
+    const item = value[key];
+    if (item !== void 0 && (!Number.isSafeInteger(item) || item < 0))
+      return false;
+  }
+  for (const key of ["jobName", "failedStepName"]) {
+    if (value[key] !== void 0 && !boundedString(value[key], 200))
+      return false;
+  }
+  if (value.reason !== void 0 && !/^[a-z0-9_]{1,80}$/.test(String(value.reason)))
+    return false;
+  if (value.digest !== void 0 && !/^[a-f0-9]{16}$/.test(String(value.digest)))
+    return false;
+  if (!CI_LOG_EVIDENCE_READABLE.has(String(value.status))) {
+    return value.excerpt === void 0 && value.digest === void 0 && Boolean(value.reason);
+  }
+  return boundedString(value.excerpt, CI_LOG_EXCERPT_MAX_CHARS) && value.jobId !== void 0;
 }
 function validEvidence(value) {
-    if (!hasOnlyKeys(value, new Set(['version', 'ci'])))
-        return false;
-    return (value.version === 1 &&
-        Array.isArray(value.ci) &&
-        value.ci.length >= 1 &&
-        value.ci.length <= 4 &&
-        value.ci.every(validCiLogEvidence));
+  if (!hasOnlyKeys(value, /* @__PURE__ */ new Set(["version", "ci"])))
+    return false;
+  return value.version === 1 && Array.isArray(value.ci) && value.ci.length >= 1 && value.ci.length <= 4 && value.ci.every(validCiLogEvidence);
 }
-// Mirror of `validObserve` in
-// api/server/services/Commitments/CommitmentExecutionContract.js. The daemon
-// has no projector, so canonical form is part of validity on both sides:
-// `egress` must be strictly ascending (sorted AND unique). The shared parity
-// fixture holds the two to one verdict.
-const OBSERVE_KEYS = new Set(['egress', 'web', 'shell', 'browser']);
+const OBSERVE_KEYS = /* @__PURE__ */ new Set(["egress", "web", "shell", "browser"]);
 const OBSERVE_EGRESS_MAX = 32;
 const OBSERVE_HOST_PATTERN = /^(\*\.)?[a-z0-9.-]+$/;
 const OBSERVE_HOST_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 function evidenceMatchesEvent(row, event) {
-    if (!plainObject(row) || !plainObject(event))
-        return true;
-    const same = (a, b) => String(a).toLowerCase() === String(b).toLowerCase();
-    if (event.repoFullName !== undefined && !same(row.repoFullName, event.repoFullName))
-        return false;
-    if (event.checkRunId !== undefined && !same(row.checkRunId, event.checkRunId))
-        return false;
-    if (row.workflowRunId !== undefined &&
-        event.workflowRunId !== undefined &&
-        !same(row.workflowRunId, event.workflowRunId))
-        return false;
+  if (!plainObject(row) || !plainObject(event))
     return true;
+  const same = (a, b) => String(a).toLowerCase() === String(b).toLowerCase();
+  if (event.repoFullName !== void 0 && !same(row.repoFullName, event.repoFullName))
+    return false;
+  if (event.checkRunId !== void 0 && !same(row.checkRunId, event.checkRunId))
+    return false;
+  if (row.workflowRunId !== void 0 && event.workflowRunId !== void 0 && !same(row.workflowRunId, event.workflowRunId))
+    return false;
+  return true;
 }
 function validCapabilitySource(value) {
-    if (!hasOnlyKeys(value, CAPABILITY_SOURCE_KEYS))
-        return false;
-    if (!CAPABILITY_SOURCES.has(String(value.source)) ||
-        !boundedString(value.provider, 80) ||
-        !/^[a-z0-9_.-]{1,80}$/i.test(value.provider) ||
-        !boundedString(value.capability, 120) ||
-        !/^[a-z0-9_:.-]{1,120}$/i.test(value.capability) ||
-        !CAPABILITY_STATUSES.has(String(value.status)) ||
-        !CAPABILITY_ATTESTATIONS.has(String(value.attestation)))
-        return false;
-    if (value.scope !== undefined && !optionalString(value.scope, 500))
-        return false;
-    if (value.accountFingerprint !== undefined &&
-        !/^[a-f0-9]{64}$/i.test(String(value.accountFingerprint)))
-        return false;
-    if (value.testedAt !== undefined && !isoTimestamp(value.testedAt))
-        return false;
-    if (value.expiresAt !== undefined && !isoTimestamp(value.expiresAt))
-        return false;
-    if (value.testedAt &&
-        value.expiresAt &&
-        Date.parse(String(value.expiresAt)) <= Date.parse(String(value.testedAt)))
-        return false;
-    if (value.runtimeId !== undefined && !boundedString(value.runtimeId, 200))
-        return false;
-    if (value.reason !== undefined && !optionalString(value.reason, 1000))
-        return false;
-    if (value.source === 'event_payload' && value.attestation !== 'platform')
-        return false;
-    if (value.source === 'platform_grant' && value.attestation !== 'platform')
-        return false;
-    if (value.source === 'local_harness' &&
-        (!['machine', 'none'].includes(String(value.attestation)) ||
-            (value.status === 'available' &&
-                (value.attestation !== 'machine' ||
-                    !value.accountFingerprint ||
-                    !value.testedAt ||
-                    !value.expiresAt ||
-                    !value.runtimeId))))
-        return false;
-    if (value.source === 'cloud_runtime' &&
-        (!['runtime', 'none'].includes(String(value.attestation)) ||
-            (value.status === 'available' &&
-                (value.attestation !== 'runtime' ||
-                    !value.accountFingerprint ||
-                    !value.testedAt ||
-                    !value.expiresAt ||
-                    !value.runtimeId))))
-        return false;
-    return true;
+  if (!hasOnlyKeys(value, CAPABILITY_SOURCE_KEYS))
+    return false;
+  if (!CAPABILITY_SOURCES.has(String(value.source)) || !boundedString(value.provider, 80) || !/^[a-z0-9_.-]{1,80}$/i.test(value.provider) || !boundedString(value.capability, 120) || !/^[a-z0-9_:.-]{1,120}$/i.test(value.capability) || !CAPABILITY_STATUSES.has(String(value.status)) || !CAPABILITY_ATTESTATIONS.has(String(value.attestation)))
+    return false;
+  if (value.scope !== void 0 && !optionalString(value.scope, 500))
+    return false;
+  if (value.accountFingerprint !== void 0 && !/^[a-f0-9]{64}$/i.test(String(value.accountFingerprint)))
+    return false;
+  if (value.testedAt !== void 0 && !isoTimestamp(value.testedAt))
+    return false;
+  if (value.expiresAt !== void 0 && !isoTimestamp(value.expiresAt))
+    return false;
+  if (value.testedAt && value.expiresAt && Date.parse(String(value.expiresAt)) <= Date.parse(String(value.testedAt)))
+    return false;
+  if (value.runtimeId !== void 0 && !boundedString(value.runtimeId, 200))
+    return false;
+  if (value.reason !== void 0 && !optionalString(value.reason, 1e3))
+    return false;
+  if (value.source === "event_payload" && value.attestation !== "platform")
+    return false;
+  if (value.source === "platform_grant" && value.attestation !== "platform")
+    return false;
+  if (value.source === "local_harness" && (!["machine", "none"].includes(String(value.attestation)) || value.status === "available" && (value.attestation !== "machine" || !value.accountFingerprint || !value.testedAt || !value.expiresAt || !value.runtimeId)))
+    return false;
+  if (value.source === "cloud_runtime" && (!["runtime", "none"].includes(String(value.attestation)) || value.status === "available" && (value.attestation !== "runtime" || !value.accountFingerprint || !value.testedAt || !value.expiresAt || !value.runtimeId)))
+    return false;
+  return true;
 }
 function validStringArray(value, max, values) {
-    return (Array.isArray(value) &&
-        value.length <= max &&
-        value.every((item) => boundedString(item, 120) && (!values || values.has(item))));
+  return Array.isArray(value) && value.length <= max && value.every((item) => boundedString(item, 120) && (!values || values.has(item)));
 }
 function validWorkspacePolicy(value) {
-    if (!hasOnlyKeys(value, new Set(['hardStop', 'hardConstraints'])))
+  if (!hasOnlyKeys(value, /* @__PURE__ */ new Set(["hardStop", "hardConstraints"])))
+    return false;
+  if (value.hardStop !== void 0 && value.hardStop !== null) {
+    if (!hasOnlyKeys(value.hardStop, /* @__PURE__ */ new Set(["enabled", "reason", "scope"])))
+      return false;
+    if (typeof value.hardStop.enabled !== "boolean")
+      return false;
+    if (value.hardStop.reason !== void 0 && !optionalString(value.hardStop.reason, 1e3))
+      return false;
+    if (value.hardStop.scope !== void 0 && !optionalString(value.hardStop.scope, 100))
+      return false;
+  }
+  if (value.hardConstraints === void 0)
+    return true;
+  if (!hasOnlyKeys(value.hardConstraints, WORKSPACE_CONSTRAINT_KEYS))
+    return false;
+  for (const [key, item] of Object.entries(value.hardConstraints)) {
+    if (item === null)
+      continue;
+    if (key === "allowedCommitmentDeliveryModes" || key === "requireAttestedAccessForDeliveryModes") {
+      if (!validStringArray(item, 5, DELIVERY_MODES))
         return false;
-    if (value.hardStop !== undefined && value.hardStop !== null) {
-        if (!hasOnlyKeys(value.hardStop, new Set(['enabled', 'reason', 'scope'])))
-            return false;
-        if (typeof value.hardStop.enabled !== 'boolean')
-            return false;
-        if (value.hardStop.reason !== undefined && !optionalString(value.hardStop.reason, 1000))
-            return false;
-        if (value.hardStop.scope !== undefined && !optionalString(value.hardStop.scope, 100))
-            return false;
-    }
-    if (value.hardConstraints === undefined)
-        return true;
-    if (!hasOnlyKeys(value.hardConstraints, WORKSPACE_CONSTRAINT_KEYS))
+    } else if (key === "maxCommitmentCostUsdPerDay") {
+      if (typeof item !== "number" || !Number.isFinite(item) || item < 0)
         return false;
-    for (const [key, item] of Object.entries(value.hardConstraints)) {
-        if (item === null)
-            continue;
-        if (key === 'allowedCommitmentDeliveryModes' ||
-            key === 'requireAttestedAccessForDeliveryModes') {
-            if (!validStringArray(item, 5, DELIVERY_MODES))
-                return false;
-        }
-        else if (key === 'maxCommitmentCostUsdPerDay') {
-            if (typeof item !== 'number' || !Number.isFinite(item) || item < 0)
-                return false;
-        }
-        else if (key.startsWith('max')) {
-            if (!Number.isSafeInteger(item) || Number(item) < 0)
-                return false;
-        }
-        else if (key === 'requireApprovalRiskLevels') {
-            if (!validStringArray(item, 3, new Set(['low', 'medium', 'high'])))
-                return false;
-        }
-        else if (!validStringArray(item, key === 'blockedSourceKinds' ? 50 : 20))
-            return false;
-    }
-    return true;
+    } else if (key.startsWith("max")) {
+      if (!Number.isSafeInteger(item) || Number(item) < 0)
+        return false;
+    } else if (key === "requireApprovalRiskLevels") {
+      if (!validStringArray(item, 3, /* @__PURE__ */ new Set(["low", "medium", "high"])))
+        return false;
+    } else if (!validStringArray(item, key === "blockedSourceKinds" ? 50 : 20))
+      return false;
+  }
+  return true;
 }
 function validBranch(value) {
-    return (boundedString(value, 255) &&
-        value !== 'HEAD' &&
-        !value.startsWith('refs/') &&
-        !value.startsWith('origin/') &&
-        !value.startsWith('-') &&
-        !value.startsWith('/') &&
-        !value.endsWith('/') &&
-        !value.endsWith('.') &&
-        // Control characters are exactly what this rejects: a Git ref name may not
-        // contain them, so the class is deliberate rather than an oversight.
-        // eslint-disable-next-line no-control-regex
-        !/[\s~^:?*[\\\x00-\x1f\x7f]/.test(value) &&
-        !value.includes('..') &&
-        !value.includes('@{') &&
-        !value.includes('//') &&
-        value !== '@' &&
-        !value.split('/').some((part) => part.startsWith('.') || part.endsWith('.lock')));
+  return boundedString(value, 255) && value !== "HEAD" && !value.startsWith("refs/") && !value.startsWith("origin/") && !value.startsWith("-") && !value.startsWith("/") && !value.endsWith("/") && !value.endsWith(".") && // Control characters are exactly what this rejects: a Git ref name may not
+  // contain them, so the class is deliberate rather than an oversight.
+  // eslint-disable-next-line no-control-regex
+  !/[\s~^:?*[\\\x00-\x1f\x7f]/.test(value) && !value.includes("..") && !value.includes("@{") && !value.includes("//") && value !== "@" && !value.split("/").some((part) => part.startsWith(".") || part.endsWith(".lock"));
 }
 function validDelivery(value) {
-    if (!hasOnlyKeys(value, new Set(['version', 'mode', 'repo', 'baseBranch', 'expectations'])))
+  if (!hasOnlyKeys(value, /* @__PURE__ */ new Set(["version", "mode", "repo", "baseBranch", "expectations"])))
+    return false;
+  if (value.version !== 1 || !DELIVERY_MODES.has(String(value.mode)))
+    return false;
+  if (value.repo !== void 0 && (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(String(value.repo)) || String(value.repo) !== String(value.repo).toLowerCase()))
+    return false;
+  if (value.baseBranch !== void 0 && !validBranch(value.baseBranch))
+    return false;
+  if (["draft_pr", "push_branch", "direct_branch"].includes(String(value.mode)) && (!value.repo || !value.baseBranch))
+    return false;
+  if (value.expectations !== void 0) {
+    if (!Array.isArray(value.expectations) || value.expectations.length > 20)
+      return false;
+    const ids = /* @__PURE__ */ new Set();
+    const allowed = /* @__PURE__ */ new Set([
+      "id",
+      "shape",
+      "kind",
+      "format",
+      "target",
+      "minimumAuthority",
+      "description",
+      "presetKey"
+    ]);
+    for (const expectation of value.expectations) {
+      if (!hasOnlyKeys(expectation, allowed) || !["code", "page", "url", "file", "message", "dataset"].includes(String(expectation.kind)))
         return false;
-    if (value.version !== 1 || !DELIVERY_MODES.has(String(value.mode)))
+      if (expectation.id !== void 0) {
+        if (!boundedString(expectation.id, 64) || expectation.id === "commitment-delivery" || ids.has(expectation.id))
+          return false;
+        ids.add(expectation.id);
+      }
+      if (expectation.shape !== void 0 && !["checkable", "judged"].includes(String(expectation.shape)))
         return false;
-    if (value.repo !== undefined &&
-        (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(String(value.repo)) ||
-            String(value.repo) !== String(value.repo).toLowerCase()))
+      if (expectation.minimumAuthority !== void 0 && !["self_reported", "human_confirmed", "observation_backed"].includes(String(expectation.minimumAuthority)))
         return false;
-    if (value.baseBranch !== undefined && !validBranch(value.baseBranch))
-        return false;
-    if (['draft_pr', 'push_branch', 'direct_branch'].includes(String(value.mode)) &&
-        (!value.repo || !value.baseBranch))
-        return false;
-    if (value.expectations !== undefined) {
-        if (!Array.isArray(value.expectations) || value.expectations.length > 20)
-            return false;
-        const ids = new Set();
-        const allowed = new Set([
-            'id',
-            'shape',
-            'kind',
-            'format',
-            'target',
-            'minimumAuthority',
-            'description',
-            'presetKey',
-        ]);
-        for (const expectation of value.expectations) {
-            if (!hasOnlyKeys(expectation, allowed) ||
-                !['code', 'page', 'url', 'file', 'message', 'dataset'].includes(String(expectation.kind)))
-                return false;
-            if (expectation.id !== undefined) {
-                if (!boundedString(expectation.id, 64) ||
-                    expectation.id === 'commitment-delivery' ||
-                    ids.has(expectation.id))
-                    return false;
-                ids.add(expectation.id);
-            }
-            if (expectation.shape !== undefined &&
-                !['checkable', 'judged'].includes(String(expectation.shape)))
-                return false;
-            if (expectation.minimumAuthority !== undefined &&
-                !['self_reported', 'human_confirmed', 'observation_backed'].includes(String(expectation.minimumAuthority)))
-                return false;
-            for (const [key, max] of [
-                ['format', 40],
-                ['target', 500],
-                ['description', 500],
-                ['presetKey', 64],
-            ]) {
-                if (expectation[key] !== undefined && !optionalString(expectation[key], max))
-                    return false;
-            }
-        }
+      for (const [key, max] of [
+        ["format", 40],
+        ["target", 500],
+        ["description", 500],
+        ["presetKey", 64]
+      ]) {
+        if (expectation[key] !== void 0 && !optionalString(expectation[key], max))
+          return false;
+      }
     }
-    return true;
+  }
+  return true;
 }
 function validDeliverySource(value) {
-    if (!hasOnlyKeys(value, new Set(['parentTaskId', 'branch', 'headSha', 'baseCommit', 'runtime'])))
-        return false;
-    return (typeof value.parentTaskId === 'string' &&
-        value.parentTaskId.length > 0 &&
-        value.parentTaskId.length <= 200 &&
-        typeof value.branch === 'string' &&
-        /^[A-Za-z0-9][A-Za-z0-9_./-]{0,239}$/.test(value.branch) &&
-        !value.branch.includes('..') &&
-        !value.branch.includes('@{') &&
-        /^[a-f0-9]{40,64}$/i.test(value.headSha) &&
-        typeof value.baseCommit === 'string' &&
-        /^[a-f0-9]{40,64}$/i.test(value.baseCommit) &&
-        hasOnlyKeys(value.runtime, new Set(['kind', 'id'])) &&
-        ['local_daemon', 'hosted_machine'].includes(String(value.runtime.kind)) &&
-        boundedString(value.runtime.id, 200) &&
-        (value.runtime.kind !== 'hosted_machine' || value.runtime.id.startsWith('sbs_')));
+  if (!hasOnlyKeys(value, /* @__PURE__ */ new Set(["parentTaskId", "branch", "headSha", "baseCommit", "runtime"])))
+    return false;
+  return typeof value.parentTaskId === "string" && value.parentTaskId.length > 0 && value.parentTaskId.length <= 200 && typeof value.branch === "string" && /^[A-Za-z0-9][A-Za-z0-9_./-]{0,239}$/.test(value.branch) && !value.branch.includes("..") && !value.branch.includes("@{") && /^[a-f0-9]{40,64}$/i.test(value.headSha) && typeof value.baseCommit === "string" && /^[a-f0-9]{40,64}$/i.test(value.baseCommit) && hasOnlyKeys(value.runtime, /* @__PURE__ */ new Set(["kind", "id"])) && ["local_daemon", "hosted_machine"].includes(String(value.runtime.kind)) && boundedString(value.runtime.id, 200) && (value.runtime.kind !== "hosted_machine" || value.runtime.id.startsWith("sbs_"));
 }
 function eventSourceRevision(event) {
-    if (!event)
-        return '';
-    const nestedCheck = event.check_run;
-    const nestedWorkflow = event.workflow_run;
-    const value = event.headSha ||
-        event.head_sha ||
-        event.sha ||
-        nestedCheck?.head_sha ||
-        nestedWorkflow?.head_sha;
-    return /^[a-f0-9]{40,64}$/i.test(String(value || '')) ? String(value).toLowerCase() : '';
+  if (!event)
+    return "";
+  const nestedCheck = event.check_run;
+  const nestedWorkflow = event.workflow_run;
+  const value = event.headSha || event.head_sha || event.sha || nestedCheck?.head_sha || nestedWorkflow?.head_sha;
+  return /^[a-f0-9]{40,64}$/i.test(String(value || "")) ? String(value).toLowerCase() : "";
 }
 function eventRepository(event) {
-    if (!event)
-        return '';
-    const repository = event.repository;
-    const value = event.repoFullName || repository?.full_name || repository?.fullName;
-    return /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(String(value || ''))
-        ? String(value).toLowerCase()
-        : '';
+  if (!event)
+    return "";
+  const repository = event.repository;
+  const value = event.repoFullName || repository?.full_name || repository?.fullName;
+  return /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(String(value || "")) ? String(value).toLowerCase() : "";
 }
 function failedGitHubCheck(event) {
-    const eventType = String(event?.eventType || event?.type || '').toLowerCase();
-    return eventType === 'github.check_run_failed' || eventType === 'check_run_failed';
+  const eventType = String(event?.eventType || event?.type || "").toLowerCase();
+  return eventType === "github.check_run_failed" || eventType === "check_run_failed";
 }
-/** One strict parser used at storage admission and at runtime admission. */
 function normalizeCommitmentExecutionContract(value) {
-    if (!hasOnlyKeys(value, new Set([
-        'version',
-        'kind',
-        'responsibilityRef',
-        'responsibility',
-        'event',
-        'workspace',
-        'delivery',
-        'capabilitySources',
-        'evidence',
-        'workspacePolicy',
-        'deliverySource',
-        'mustNot',
-        'return',
-    ])))
-        return null;
-    const contract = value;
-    const event = contract.event === undefined ? null : contract.event;
-    const eventSha = eventSourceRevision(event);
-    const eventRepo = eventRepository(event);
-    const taskDelivery = contract.kind === 'task_delivery';
-    if (contract.version !== exports.COMMITMENT_EXECUTION_CONTRACT_VERSION ||
-        !['commitment', 'task_delivery'].includes(contract.kind) ||
-        !hasOnlyKeys(contract.responsibilityRef, new Set(['kind', 'id', 'version'])) ||
-        contract.responsibilityRef.kind !== (taskDelivery ? 'task' : 'commitment') ||
-        !boundedString(contract.responsibilityRef.id, 240) ||
-        !Number.isSafeInteger(contract.responsibilityRef.version) ||
-        contract.responsibilityRef.version < 1 ||
-        !boundedString(contract.responsibility, 2000) ||
-        !hasOnlyKeys(contract.workspace, new Set(['kind', 'base', 'fetchBase'])) ||
-        contract.workspace.kind !== 'ephemeral' ||
-        !boundedString(contract.workspace.base, 255) ||
-        (contract.workspace.fetchBase !== undefined &&
-            (contract.workspace.fetchBase !== true || contract.workspace.kind !== 'ephemeral')) ||
-        !validDelivery(contract.delivery) ||
-        !Array.isArray(contract.capabilitySources) ||
-        contract.capabilitySources.length > 32 ||
-        !contract.capabilitySources.every(validCapabilitySource) ||
-        !validWorkspacePolicy(contract.workspacePolicy ?? {}) ||
-        !(0, node_util_1.isDeepStrictEqual)(contract.mustNot, [
-            'change_workspace_administration',
-            'broaden_credentials',
-            ...(taskDelivery ? ['reimplement_source_work'] : []),
-        ]) ||
-        (taskDelivery
-            ? contract.return !== 'task_output'
-            : contract.return !== 'commitment_result_v1') ||
-        (event !== null &&
-            (!plainObject(event) || !(0, node_util_1.isDeepStrictEqual)(event, normalizedEventFacts(event)))) ||
-        (eventSha && contract.workspace.base.toLowerCase() !== eventSha) ||
-        (eventRepo &&
-            contract.delivery.repo &&
-            String(contract.delivery.repo).toLowerCase() !== eventRepo) ||
-        (failedGitHubCheck(event) && (!eventSha || !eventRepo)) ||
-        (contract.evidence !== undefined &&
-            (taskDelivery ||
-                !validEvidence(contract.evidence) ||
-                !contract.evidence.ci.every((row) => evidenceMatchesEvent(row, event)))) ||
-        (taskDelivery &&
-            (event !== null ||
-                !['draft_pr', 'push_branch', 'direct_branch'].includes(contract.delivery.mode) ||
-                contract.workspace.kind !== 'ephemeral' ||
-                !validDeliverySource(contract.deliverySource) ||
-                contract.responsibilityRef.id !== contract.deliverySource?.parentTaskId ||
-                contract.workspace.base.toLowerCase() !==
-                    String(contract.deliverySource?.baseCommit).toLowerCase())) ||
-        (!taskDelivery && contract.deliverySource !== undefined))
-        return null;
-    return JSON.parse(JSON.stringify(contract));
+  if (!hasOnlyKeys(value, /* @__PURE__ */ new Set([
+    "version",
+    "kind",
+    "responsibilityRef",
+    "responsibility",
+    "event",
+    "workspace",
+    "delivery",
+    "capabilitySources",
+    "evidence",
+    "workspacePolicy",
+    "deliverySource",
+    "mustNot",
+    "return"
+  ])))
+    return null;
+  const contract = value;
+  const event = contract.event === void 0 ? null : contract.event;
+  const eventSha = eventSourceRevision(event);
+  const eventRepo = eventRepository(event);
+  const taskDelivery = contract.kind === "task_delivery";
+  if (contract.version !== COMMITMENT_EXECUTION_CONTRACT_VERSION || !["commitment", "task_delivery"].includes(contract.kind) || !hasOnlyKeys(contract.responsibilityRef, /* @__PURE__ */ new Set(["kind", "id", "version"])) || contract.responsibilityRef.kind !== (taskDelivery ? "task" : "commitment") || !boundedString(contract.responsibilityRef.id, 240) || !Number.isSafeInteger(contract.responsibilityRef.version) || contract.responsibilityRef.version < 1 || !boundedString(contract.responsibility, 2e3) || !hasOnlyKeys(contract.workspace, /* @__PURE__ */ new Set(["kind", "base", "fetchBase"])) || contract.workspace.kind !== "ephemeral" || !boundedString(contract.workspace.base, 255) || contract.workspace.fetchBase !== void 0 && (contract.workspace.fetchBase !== true || contract.workspace.kind !== "ephemeral") || !validDelivery(contract.delivery) || !Array.isArray(contract.capabilitySources) || contract.capabilitySources.length > 32 || !contract.capabilitySources.every(validCapabilitySource) || !validWorkspacePolicy(contract.workspacePolicy ?? {}) || !(0, import_node_util.isDeepStrictEqual)(contract.mustNot, [
+    "change_workspace_administration",
+    "broaden_credentials",
+    ...taskDelivery ? ["reimplement_source_work"] : []
+  ]) || (taskDelivery ? contract.return !== "task_output" : contract.return !== "commitment_result_v1") || event !== null && (!plainObject(event) || !(0, import_node_util.isDeepStrictEqual)(event, normalizedEventFacts(event))) || eventSha && contract.workspace.base.toLowerCase() !== eventSha || eventRepo && contract.delivery.repo && String(contract.delivery.repo).toLowerCase() !== eventRepo || failedGitHubCheck(event) && (!eventSha || !eventRepo) || contract.evidence !== void 0 && (taskDelivery || !validEvidence(contract.evidence) || !contract.evidence.ci.every((row) => evidenceMatchesEvent(row, event))) || taskDelivery && (event !== null || !["draft_pr", "push_branch", "direct_branch"].includes(contract.delivery.mode) || contract.workspace.kind !== "ephemeral" || !validDeliverySource(contract.deliverySource) || contract.responsibilityRef.id !== contract.deliverySource?.parentTaskId || contract.workspace.base.toLowerCase() !== String(contract.deliverySource?.baseCommit).toLowerCase()) || !taskDelivery && contract.deliverySource !== void 0)
+    return null;
+  return JSON.parse(JSON.stringify(contract));
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  COMMITMENT_EXECUTION_CONTRACT_CAPABILITY,
+  COMMITMENT_EXECUTION_CONTRACT_VERSION,
+  eventRepository,
+  normalizeCommitmentExecutionContract
+});