@sourcey/catalog-verifier 1.0.0

package/dist/packages/catalog-verifier/src/application.js

@@ -0,0 +1,363 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+import { catalogVerifierCriterionSchema, catalogVerifierDiagnosticSchema, catalogVerifierResultSchema, } from "../../../contracts/catalog-verifier/src/index.js";
+import { catalogReleaseBundleSchema } from "../../../contracts/release/src/index.js";
+import { currentAgentReadinessPolicy } from "../../../modules/agent-readiness-policy/src/current-policy.js";
+import { inspectAgentReadinessCandidateSources, inspectAgentReadinessRepositoryChangePacket, } from "../../../modules/agent-readiness-repository/src/index.js";
+import { verifyCatalogReleaseDirectory } from "../../../modules/artifact/src/index.js";
+import { analyzeCatalogPrTree, catalogAdmissionCandidateSchema, createCatalogAdmissionConflictLookupRequest, evaluateCatalogAdmissionConflicts, verifyCatalogVerifierIdentityContextPacket, } from "../../../modules/catalog-admission/src/index.js";
+import { inspectCatalogCandidateSources } from "../../../modules/catalog-authoring-validation/src/index.js";
+import { assertDigest, canonicalJson, compareCanonicalStrings, digest, } from "../../../modules/primitives/src/index.js";
+import { verifyCatalogDeltaDirectory } from "../../../modules/release/src/verifier.js";
+const criteria = Object.freeze([
+    {
+        rule_id: "startup-credits.changed-closure",
+        repository_kind: "startup-credits",
+        title: "Changed Catalog closure",
+        requirement: "Only canonical Entity YAML may change with Catalog data; every changed Entity, Program, Offer, source, role, path, and identifier must close under the current authoring contract.",
+        exclusion: "This structural result does not establish factual truth, source availability, submitter authority, or publication.",
+    },
+    {
+        rule_id: "startup-credits.taxonomy",
+        repository_kind: "startup-credits",
+        title: "Canonical taxonomy",
+        requirement: "Every changed Entity category must exist in the exact supplied Catalog taxonomy.",
+        exclusion: null,
+    },
+    {
+        rule_id: "startup-credits.identity-context",
+        repository_kind: "startup-credits",
+        title: "Shared Entity identity",
+        requirement: "Every changed Entity identity must close against an unexpired signed live-Catalog context derived from the exact candidate keys.",
+        exclusion: "An identity-context pass does not establish submitter authority, factual truth, or publication.",
+    },
+    {
+        rule_id: "agent-readiness.changed-closure",
+        repository_kind: "agent-readiness",
+        title: "Changed declaration closure",
+        requirement: "Only canonical Agent Readiness Entity YAML may change with declaration data; every changed declaration and referenced node must close under the current declaration contract.",
+        exclusion: "Declarations are assessment inputs. They do not author observations, findings, stage states, grades, or publication authority.",
+    },
+    {
+        rule_id: "agent-readiness.policy-closure",
+        repository_kind: "agent-readiness",
+        title: "Current policy closure",
+        requirement: "Every declaration target, resource, endpoint, interface, relation, source binding, and exclusion must satisfy the exact current Agent Readiness policy closure.",
+        exclusion: null,
+    },
+    {
+        rule_id: "agent-readiness.identity-context",
+        repository_kind: "agent-readiness",
+        title: "Shared Entity identity",
+        requirement: "Every changed Entity identity must close against an unexpired signed live-Catalog context derived from the exact candidate keys.",
+        exclusion: "An identity-context pass does not establish submitter authority, observed readiness, a grade, or publication.",
+    },
+].map((criterion) => catalogVerifierCriterionSchema.parse(criterion)));
+export class CatalogVerifierApplication {
+    explain(repositoryKind) {
+        return criteria
+            .filter((criterion) => criterion.repository_kind === repositoryKind)
+            .map((criterion) => structuredClone(criterion));
+    }
+    async validateRepositoryChange(input) {
+        const operation = `validate.${input.repositoryKind}`;
+        try {
+            const inspection = await inspectRepositoryChange(input);
+            const context = verifyIdentityContext({
+                identities: inspection.identities,
+                candidate: input.candidate,
+                context: input.identityContext,
+            });
+            return valid(operation, {
+                ...inspection.summary,
+                identity_context_digest: context.context.context_digest,
+                live_parent_release_id: context.context.live_parent_release_id,
+            });
+        }
+        catch (error) {
+            return invalid(operation, diagnosticFor(error, ruleForError(error, input.repositoryKind)));
+        }
+    }
+    async createRepositoryIdentityContextRequest(input) {
+        assertDigest(input.liveParentReleaseId, "live parent release ID");
+        const inspection = await inspectRepositoryChange(input);
+        return createCatalogAdmissionConflictLookupRequest({
+            identities: inspection.identities,
+            liveParentReleaseId: input.liveParentReleaseId,
+            candidate: input.candidate,
+        });
+    }
+    validateCandidate(input) {
+        const operation = `validate.${input.repositoryKind}`;
+        try {
+            if (input.repositoryKind === "startup-credits") {
+                if (!input.taxonomy) {
+                    return invalid(operation, {
+                        rule_id: "startup-credits.taxonomy",
+                        classification: "invalid_input",
+                        path: null,
+                        message: "Startup Credits validation requires an exact Catalog taxonomy.",
+                        guidance: "Supply the taxonomy selected by the current hosted verifier context.",
+                    });
+                }
+                const inspection = inspectCatalogCandidateSources({
+                    sources: input.sources,
+                    taxonomy: input.taxonomy,
+                });
+                const context = verifyIdentityContext({
+                    identities: inspection.entries.map(({ value }) => value.entity),
+                    candidate: input.candidate,
+                    context: input.identityContext,
+                });
+                return valid(operation, {
+                    ...inspection.summary,
+                    identity_context_digest: context.context.context_digest,
+                    live_parent_release_id: context.context.live_parent_release_id,
+                });
+            }
+            const inspection = inspectAgentReadinessCandidateSources({
+                sources: input.sources,
+                policy: currentAgentReadinessPolicy,
+            });
+            const context = verifyIdentityContext({
+                identities: inspection.authoring.map(({ entity }) => entity),
+                candidate: input.candidate,
+                context: input.identityContext,
+            });
+            return valid(operation, {
+                ...inspection.summary,
+                identity_context_digest: context.context.context_digest,
+                live_parent_release_id: context.context.live_parent_release_id,
+            });
+        }
+        catch (error) {
+            return invalid(operation, diagnosticFor(error, ruleForError(error, input.repositoryKind)));
+        }
+    }
+    createCandidateIdentityContextRequest(input) {
+        assertDigest(input.liveParentReleaseId, "live parent release ID");
+        const candidate = input.candidate ?? detachedCandidate(input);
+        if (input.repositoryKind === "startup-credits") {
+            if (!input.taxonomy) {
+                throw new Error("Startup Credits validation requires an exact Catalog taxonomy.");
+            }
+            const inspection = inspectCatalogCandidateSources({
+                sources: input.sources,
+                taxonomy: input.taxonomy,
+            });
+            return createCatalogAdmissionConflictLookupRequest({
+                identities: inspection.entries.map(({ value }) => value.entity),
+                liveParentReleaseId: input.liveParentReleaseId,
+                candidate,
+            });
+        }
+        const inspection = inspectAgentReadinessCandidateSources({
+            sources: input.sources,
+            policy: currentAgentReadinessPolicy,
+        });
+        return createCatalogAdmissionConflictLookupRequest({
+            identities: inspection.authoring.map(({ entity }) => entity),
+            liveParentReleaseId: input.liveParentReleaseId,
+            candidate,
+        });
+    }
+    async verifyRelease(input) {
+        const operation = "verify-release";
+        try {
+            assertDigest(input.trustedRootDigest, "trusted root digest");
+            const bundle = catalogReleaseBundleSchema.parse(JSON.parse(await readFile(join(input.directory, "bundle.json"), "utf8")));
+            const genesis = bundle.release.release_core.release_sequence === 1 &&
+                bundle.release.release_core.parent_release_id === null;
+            const trust = { rootSetDigest: input.trustedRootDigest };
+            const result = genesis
+                ? await verifyCatalogReleaseDirectory(input.directory, trust)
+                : await verifyCatalogDeltaDirectory(input.directory, trust);
+            return valid(operation, {
+                entities: "artifact" in result ? result.artifact.entities.length : result.entities.size,
+                release_id: result.bundle.release.release_id,
+                snapshot_id: result.bundle.release.snapshot_id,
+                files: result.files.size,
+            });
+        }
+        catch (error) {
+            return invalid(operation, diagnosticFor(error, "release.immutable-closure"));
+        }
+    }
+}
+export function validateCatalogCandidate(input) {
+    return new CatalogVerifierApplication().validateCandidate(input);
+}
+async function inspectRepositoryChange(input) {
+    if (input.repositoryKind === "startup-credits") {
+        if (!input.taxonomy) {
+            throw new CatalogVerifierInputError("Startup Credits validation requires an exact Catalog taxonomy.");
+        }
+        const analysis = await analyzeCatalogPrTree({
+            repositoryRoot: input.repositoryRoot,
+            baseRevision: input.baseRevision,
+            headRevision: input.headRevision,
+            taxonomy: input.taxonomy,
+        });
+        return {
+            identities: analysis.changedEntities.map(({ currentAuthoring }) => currentAuthoring.entity),
+            summary: {
+                entities: analysis.entities,
+                programs: analysis.programs,
+                offers: analysis.offers,
+            },
+        };
+    }
+    const inspection = await inspectAgentReadinessRepositoryChangePacket({
+        repositoryRoot: input.repositoryRoot,
+        baseRevision: input.baseRevision,
+        headRevision: input.headRevision,
+        policy: currentAgentReadinessPolicy,
+    });
+    return {
+        identities: inspection.paths.flatMap(({ head }) => (head ? [head.authoring.entity] : [])),
+        summary: {
+            entities: inspection.paths.length,
+            declarations: inspection.paths.reduce((count, path) => count + path.declarations.filter((item) => item.kind !== "declaration_unchanged").length, 0),
+        },
+    };
+}
+function verifyIdentityContext(input) {
+    let verified;
+    try {
+        assertDigest(input.context.trustedRootDigest, "trusted root digest");
+        verified = verifyCatalogVerifierIdentityContextPacket({
+            packet: input.context.packet,
+            rootSet: input.context.rootSet,
+            trustedRootDigest: input.context.trustedRootDigest,
+            verifiedAt: input.context.verifiedAt,
+        });
+    }
+    catch (error) {
+        throw new CatalogVerifierIdentityContextError(error instanceof Error
+            ? error.message
+            : "The signed Catalog identity context could not be verified.");
+    }
+    const expected = createCatalogAdmissionConflictLookupRequest({
+        identities: input.identities,
+        liveParentReleaseId: verified.query.liveParentReleaseId,
+        candidate: catalogAdmissionCandidateSchema.parse(input.candidate),
+    });
+    if (canonicalJson(verified.query) !== canonicalJson(expected)) {
+        throw new CatalogVerifierIdentityContextError("The signed identity context was not issued for these exact candidate identities.");
+    }
+    const conflicts = evaluateCatalogAdmissionConflicts({
+        keys: verified.query.keys,
+        matches: verified.response.matches,
+        liveParentReleaseId: verified.query.liveParentReleaseId,
+        candidate: verified.query.candidate,
+    });
+    if (conflicts.length > 0) {
+        const labels = conflicts
+            .map(({ kind, targetReferences }) => `${kind}: ${targetReferences.join(", ")}`)
+            .sort(compareCanonicalStrings);
+        throw new CatalogVerifierIdentityConflictError(`The candidate conflicts with retained Catalog identity: ${labels.join("; ")}.`);
+    }
+    return verified;
+}
+function detachedCandidate(input) {
+    return catalogAdmissionCandidateSchema.parse({
+        kind: "detached",
+        repositoryKind: input.repositoryKind,
+        candidateDigest: digest({
+            repository_kind: input.repositoryKind,
+            sources: [...input.sources].sort((left, right) => compareCanonicalStrings(left.source, right.source)),
+        }),
+    });
+}
+class CatalogVerifierInputError extends Error {
+}
+class CatalogVerifierIdentityContextError extends Error {
+}
+class CatalogVerifierIdentityConflictError extends Error {
+}
+function ruleForError(error, repositoryKind) {
+    return error instanceof CatalogVerifierIdentityContextError ||
+        error instanceof CatalogVerifierIdentityConflictError
+        ? `${repositoryKind}.identity-context`
+        : primaryRule(repositoryKind);
+}
+function primaryRule(repositoryKind) {
+    return `${repositoryKind}.changed-closure`;
+}
+function valid(operation, summary) {
+    return catalogVerifierResultSchema.parse({
+        result_contract: "sourcey.catalog-verifier-result/v1alpha1",
+        operation,
+        status: "valid",
+        summary,
+        diagnostics: [],
+    });
+}
+function invalid(operation, diagnostic) {
+    return catalogVerifierResultSchema.parse({
+        result_contract: "sourcey.catalog-verifier-result/v1alpha1",
+        operation,
+        status: "invalid",
+        summary: null,
+        diagnostics: [diagnostic],
+    });
+}
+function diagnosticFor(error, ruleId) {
+    if (error instanceof CatalogVerifierIdentityConflictError) {
+        return catalogVerifierDiagnosticSchema.parse({
+            rule_id: ruleId,
+            classification: "identity_conflict",
+            path: "/identity_context",
+            message: error.message,
+            guidance: "Reuse the canonical Entity identity or resolve the collision before admission.",
+        });
+    }
+    if (error instanceof CatalogVerifierIdentityContextError) {
+        return catalogVerifierDiagnosticSchema.parse({
+            rule_id: ruleId,
+            classification: "policy_failure",
+            path: "/identity_context",
+            message: error.message,
+            guidance: "Request a fresh identity context for the exact unchanged candidate and retry.",
+        });
+    }
+    if (error instanceof CatalogVerifierInputError) {
+        return catalogVerifierDiagnosticSchema.parse({
+            rule_id: ruleId,
+            classification: "invalid_input",
+            path: null,
+            message: error.message,
+            guidance: "Supply every exact input required by this verifier operation.",
+        });
+    }
+    if (error instanceof z.ZodError) {
+        const issue = error.issues[0];
+        return catalogVerifierDiagnosticSchema.parse({
+            rule_id: ruleId,
+            classification: "contract_failure",
+            path: issue ? jsonPointer(issue.path) : null,
+            message: issue?.message ?? "Candidate bytes do not satisfy the current contract.",
+            guidance: "Correct the exact candidate field and run the same verifier again.",
+        });
+    }
+    const candidate = error;
+    const environmental = typeof candidate?.code === "string";
+    return catalogVerifierDiagnosticSchema.parse({
+        rule_id: ruleId,
+        classification: environmental ? "environmental_failure" : "contract_failure",
+        path: null,
+        message: error instanceof Error ? error.message : String(error),
+        guidance: environmental
+            ? "Restore the exact local input or Git object and retry without changing candidate bytes."
+            : "Correct the candidate closure described by this rule and run the same verifier again.",
+    });
+}
+function jsonPointer(path) {
+    if (path.length === 0)
+        return "/";
+    return `/${path
+        .map((segment) => String(segment).replaceAll("~", "~0").replaceAll("/", "~1"))
+        .join("/")}`;
+}
+//# sourceMappingURL=application.js.map

package/dist/packages/catalog-verifier/src/application.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application.js","sourceRoot":"","sources":["../../../../packages/catalog-verifier/src/application.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,8BAA8B,EAC9B,+BAA+B,EAC/B,2BAA2B,GAE5B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAErF,OAAO,EAAE,2BAA2B,EAAE,MAAM,+DAA+D,CAAC;AAC5G,OAAO,EACL,qCAAqC,EACrC,2CAA2C,GAC5C,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EACL,oBAAoB,EAEpB,+BAA+B,EAC/B,2CAA2C,EAC3C,iCAAiC,EACjC,0CAA0C,GAC3C,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,4DAA4D,CAAC;AAC5G,OAAO,EACL,YAAY,EACZ,aAAa,EACb,uBAAuB,EAEvB,MAAM,GACP,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAiBvF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC5B;IACE;QACE,OAAO,EAAE,iCAAiC;QAC1C,eAAe,EAAE,iBAAiB;QAClC,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,oLAAoL;QACtL,SAAS,EACP,oHAAoH;KACvH;IACD;QACE,OAAO,EAAE,0BAA0B;QACnC,eAAe,EAAE,iBAAiB;QAClC,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,kFAAkF;QACpF,SAAS,EAAE,IAAI;KAChB;IACD;QACE,OAAO,EAAE,kCAAkC;QAC3C,eAAe,EAAE,iBAAiB;QAClC,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,kIAAkI;QACpI,SAAS,EACP,iGAAiG;KACpG;IACD;QACE,OAAO,EAAE,iCAAiC;QAC1C,eAAe,EAAE,iBAAiB;QAClC,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,+KAA+K;QACjL,SAAS,EACP,gIAAgI;KACnI;IACD;QACE,OAAO,EAAE,gCAAgC;QACzC,eAAe,EAAE,iBAAiB;QAClC,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,iKAAiK;QACnK,SAAS,EAAE,IAAI;KAChB;IACD;QACE,OAAO,EAAE,kCAAkC;QAC3C,eAAe,EAAE,iBAAiB;QAClC,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,kIAAkI;QACpI,SAAS,EACP,+GAA+G;KAClH;CACF,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACtE,CAAC;AAEF,MAAM,OAAO,0BAA0B;IACrC,OAAO,CAAC,cAAsC;QAC5C,OAAO,QAAQ;aACZ,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,eAAe,KAAK,cAAc,CAAC;aACnE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAQ9B;QACC,MAAM,SAAS,GAAG,YAAY,KAAK,CAAC,cAAc,EAAW,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,qBAAqB,CAAC;gBACpC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,eAAe;aAC/B,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,SAAS,EAAE;gBACtB,GAAG,UAAU,CAAC,OAAO;gBACrB,uBAAuB,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;gBACvD,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,sBAAsB;aAC/D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sCAAsC,CAC1C,KAGC;QAED,YAAY,CAAC,KAAK,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;QAClE,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,2CAA2C,CAAC;YACjD,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,mBAAmB,EAAE,KAAK,CAAC,mBAA6B;YACxD,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB,CACf,KAGC;QAED,MAAM,SAAS,GAAG,YAAY,KAAK,CAAC,cAAc,EAAW,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,cAAc,KAAK,iBAAiB,EAAE,CAAC;gBAC/C,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACpB,OAAO,OAAO,CAAC,SAAS,EAAE;wBACxB,OAAO,EAAE,0BAA0B;wBACnC,cAAc,EAAE,eAAe;wBAC/B,IAAI,EAAE,IAAI;wBACV,OAAO,EAAE,gEAAgE;wBACzE,QAAQ,EAAE,sEAAsE;qBACjF,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,UAAU,GAAG,8BAA8B,CAAC;oBAChD,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,qBAAqB,CAAC;oBACpC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;oBAC/D,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,OAAO,EAAE,KAAK,CAAC,eAAe;iBAC/B,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,SAAS,EAAE;oBACtB,GAAG,UAAU,CAAC,OAAO;oBACrB,uBAAuB,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;oBACvD,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,sBAAsB;iBAC/D,CAAC,CAAC;YACL,CAAC;YACD,MAAM,UAAU,GAAG,qCAAqC,CAAC;gBACvD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,2BAA2B;aACpC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,qBAAqB,CAAC;gBACpC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;gBAC5D,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,eAAe;aAC/B,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,SAAS,EAAE;gBACtB,GAAG,UAAU,CAAC,OAAO;gBACrB,uBAAuB,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;gBACvD,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,sBAAsB;aAC/D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,qCAAqC,CACnC,KAGC;QAED,YAAY,CAAC,KAAK,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,cAAc,KAAK,iBAAiB,EAAE,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,UAAU,GAAG,8BAA8B,CAAC;gBAChD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,OAAO,2CAA2C,CAAC;gBACjD,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC/D,mBAAmB,EAAE,KAAK,CAAC,mBAA6B;gBACxD,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,qCAAqC,CAAC;YACvD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;QACH,OAAO,2CAA2C,CAAC;YACjD,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;YAC5D,mBAAmB,EAAE,KAAK,CAAC,mBAA6B;YACxD,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,MAAM,SAAS,GAAG,gBAAyB,CAAC;QAC5C,IAAI,CAAC;YACH,YAAY,CAAC,KAAK,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,CACzE,CAAC;YACF,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,gBAAgB,KAAK,CAAC;gBAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,iBAAiB,KAAK,IAAI,CAAC;YACzD,MAAM,KAAK,GAAG,EAAE,aAAa,EAAE,KAAK,CAAC,iBAA2B,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,OAAO;gBACpB,CAAC,CAAC,MAAM,6BAA6B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC;gBAC7D,CAAC,CAAC,MAAM,2BAA2B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC,SAAS,EAAE;gBACtB,QAAQ,EAAE,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;gBACvF,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU;gBAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW;gBAC9C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CACtC,KAGC;IAED,OAAO,IAAI,0BAA0B,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAAqC;IAS1E,IAAI,KAAK,CAAC,cAAc,KAAK,iBAAiB,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAyB,CACjC,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,OAAO;YACL,UAAU,EAAE,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC3F,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB;SACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,2CAA2C,CAAC;QACnE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,2BAA2B;KACpC,CAAC,CAAC;IACH,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE;YACP,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;YACjC,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACd,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC,MAAM,EAC1F,CAAC,CACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAI9B;IACC,IAAI,QAAuE,CAAC;IAC5E,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;QACrE,QAAQ,GAAG,0CAA0C,CAAC;YACpD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAA2B;YAC5D,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;SACrC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mCAAmC,CAC3C,KAAK,YAAY,KAAK;YACpB,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,4DAA4D,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,2CAA2C,CAAC;QAC3D,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;QACvD,SAAS,EAAE,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;KAClE,CAAC,CAAC;IACH,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,mCAAmC,CAC3C,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,iCAAiC,CAAC;QAClD,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI;QACzB,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO;QAClC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;QACvD,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS;KACpC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,SAAS;aACrB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;aAC9E,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACjC,MAAM,IAAI,oCAAoC,CAC5C,2DAA2D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoC;IAC7D,OAAO,+BAA+B,CAAC,KAAK,CAAC;QAC3C,IAAI,EAAE,UAAU;QAChB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe,EAAE,MAAM,CAAC;YACtB,eAAe,EAAE,KAAK,CAAC,cAAc;YACrC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/C,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACnD;SACF,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,MAAM,yBAA0B,SAAQ,KAAK;CAAG;AAChD,MAAM,mCAAoC,SAAQ,KAAK;CAAG;AAC1D,MAAM,oCAAqC,SAAQ,KAAK;CAAG;AAE3D,SAAS,YAAY,CAAC,KAAc,EAAE,cAAsC;IAC1E,OAAO,KAAK,YAAY,mCAAmC;QACzD,KAAK,YAAY,oCAAoC;QACrD,CAAC,CAAC,GAAG,cAAc,mBAAmB;QACtC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,WAAW,CAAC,cAAsC;IACzD,OAAO,GAAG,cAAc,kBAAkB,CAAC;AAC7C,CAAC;AAED,SAAS,KAAK,CACZ,SAA6C,EAC7C,OAAsD;IAEtD,OAAO,2BAA2B,CAAC,KAAK,CAAC;QACvC,eAAe,EAAE,0CAA0C;QAC3D,SAAS;QACT,MAAM,EAAE,OAAO;QACf,OAAO;QACP,WAAW,EAAE,EAAE;KAChB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CACd,SAA6C,EAC7C,UAA2D;IAE3D,OAAO,2BAA2B,CAAC,KAAK,CAAC;QACvC,eAAe,EAAE,0CAA0C;QAC3D,SAAS;QACT,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,CAAC,UAAU,CAAC;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,MAAc;IAEd,IAAI,KAAK,YAAY,oCAAoC,EAAE,CAAC;QAC1D,OAAO,+BAA+B,CAAC,KAAK,CAAC;YAC3C,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,mBAAmB;YACnC,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,gFAAgF;SAC3F,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,YAAY,mCAAmC,EAAE,CAAC;QACzD,OAAO,+BAA+B,CAAC,KAAK,CAAC;YAC3C,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,gBAAgB;YAChC,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,+EAA+E;SAC1F,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;QAC/C,OAAO,+BAA+B,CAAC,KAAK,CAAC;YAC3C,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,eAAe;YAC/B,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,+DAA+D;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,+BAA+B,CAAC,KAAK,CAAC;YAC3C,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,kBAAkB;YAClC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,sDAAsD;YACjF,QAAQ,EAAE,oEAAoE;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,KAA8B,CAAC;IACjD,MAAM,aAAa,GAAG,OAAO,SAAS,EAAE,IAAI,KAAK,QAAQ,CAAC;IAC1D,OAAO,+BAA+B,CAAC,KAAK,CAAC;QAC3C,OAAO,EAAE,MAAM;QACf,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,kBAAkB;QAC5E,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,QAAQ,EAAE,aAAa;YACrB,CAAC,CAAC,yFAAyF;YAC3F,CAAC,CAAC,uFAAuF;KAC5F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,IAA4B;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,OAAO,IAAI,IAAI;SACZ,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;SAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACjB,CAAC"}

package/dist/packages/catalog-verifier/src/index.d.ts

@@ -0,0 +1,7 @@
+export * from "../../../contracts/catalog-verifier/src/index.js";
+export * from "../../../modules/artifact/src/index.js";
+export * from "../../../modules/authority/src/index.js";
+export * from "../../../modules/catalog-admission/src/index.js";
+export * from "../../../modules/release/src/verifier.js";
+export * from "./application.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/packages/catalog-verifier/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../packages/catalog-verifier/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kDAAkD,CAAC;AACjE,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,iDAAiD,CAAC;AAChE,cAAc,0CAA0C,CAAC;AACzD,cAAc,kBAAkB,CAAC"}

package/dist/packages/catalog-verifier/src/index.js

@@ -0,0 +1,7 @@
+export * from "../../../contracts/catalog-verifier/src/index.js";
+export * from "../../../modules/artifact/src/index.js";
+export * from "../../../modules/authority/src/index.js";
+export * from "../../../modules/catalog-admission/src/index.js";
+export * from "../../../modules/release/src/verifier.js";
+export * from "./application.js";
+//# sourceMappingURL=index.js.map

package/dist/packages/catalog-verifier/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/catalog-verifier/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kDAAkD,CAAC;AACjE,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,iDAAiD,CAAC;AAChE,cAAc,0CAA0C,CAAC;AACzD,cAAc,kBAAkB,CAAC"}

package/dist/packages/catalog-verifier/src/program.d.ts

@@ -0,0 +1,4 @@
+export declare function main(arguments_: readonly string[]): Promise<void>;
+export declare function resolveCatalogVerifierCommit(repositoryRoot: string, revision: string): Promise<string>;
+export declare function catalogVerifierError(error: unknown): Error;
+//# sourceMappingURL=program.d.ts.map

package/dist/packages/catalog-verifier/src/program.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../../../packages/catalog-verifier/src/program.ts"],"names":[],"mappings":"AAgBA,wBAAsB,IAAI,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvE;AAyHD,wBAAsB,4BAA4B,CAChD,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAe1D"}

package/dist/packages/catalog-verifier/src/program.js

@@ -0,0 +1,203 @@
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { verifierRepositoryKindSchema, } from "../../../contracts/catalog-verifier/src/index.js";
+import { readCatalogTaxonomy } from "../../../modules/catalog-admission/src/index.js";
+import { requiredFlag, requiredPath } from "../../../modules/cli/src/index.js";
+import { digest } from "../../../modules/primitives/src/index.js";
+import { CatalogVerifierApplication } from "./application.js";
+const execFileAsync = promisify(execFile);
+export async function main(arguments_) {
+    try {
+        await run(arguments_);
+    }
+    catch (error) {
+        throw catalogVerifierError(error);
+    }
+}
+async function run(arguments_) {
+    const [command, subject, ...args] = arguments_;
+    const application = new CatalogVerifierApplication();
+    if (command === "validate") {
+        const repositoryKind = verifierRepositoryKindSchema.parse(subject);
+        const repositoryRoot = requiredPath(args, "--repository");
+        const [baseRevision, headRevision, taxonomy] = await Promise.all([
+            resolveCatalogVerifierCommit(repositoryRoot, requiredFlag(args, "--base")),
+            resolveCatalogVerifierCommit(repositoryRoot, requiredFlag(args, "--head")),
+            repositoryKind === "startup-credits"
+                ? readCatalogTaxonomy(requiredPath(args, "--taxonomy"))
+                : undefined,
+        ]);
+        const result = await application.validateRepositoryChange({
+            repositoryKind,
+            repositoryRoot,
+            baseRevision,
+            headRevision,
+            ...(taxonomy ? { taxonomy } : {}),
+            candidate: candidateIdentity(repositoryKind, baseRevision, headRevision, args),
+            identityContext: {
+                packet: await readJson(requiredPath(args, "--identity-context")),
+                rootSet: await readJson(requiredPath(args, "--root-set")),
+                trustedRootDigest: requiredFlag(args, "--trusted-root-digest"),
+                verifiedAt: requiredFlag(args, "--verified-at"),
+            },
+        });
+        renderResult(result, outputFormat(args));
+        if (result.status === "invalid")
+            process.exitCode = 2;
+        return;
+    }
+    if (command === "identity-context-request") {
+        const repositoryKind = verifierRepositoryKindSchema.parse(subject);
+        const repositoryRoot = requiredPath(args, "--repository");
+        const [baseRevision, headRevision, taxonomy] = await Promise.all([
+            resolveCatalogVerifierCommit(repositoryRoot, requiredFlag(args, "--base")),
+            resolveCatalogVerifierCommit(repositoryRoot, requiredFlag(args, "--head")),
+            repositoryKind === "startup-credits"
+                ? readCatalogTaxonomy(requiredPath(args, "--taxonomy"))
+                : undefined,
+        ]);
+        const request = await application.createRepositoryIdentityContextRequest({
+            repositoryKind,
+            repositoryRoot,
+            baseRevision,
+            headRevision,
+            ...(taxonomy ? { taxonomy } : {}),
+            liveParentReleaseId: requiredFlag(args, "--live-parent-release-id"),
+            candidate: candidateIdentity(repositoryKind, baseRevision, headRevision, args),
+        });
+        process.stdout.write(`${JSON.stringify(request)}\n`);
+        return;
+    }
+    if (command === "explain") {
+        const repositoryKind = verifierRepositoryKindSchema.parse(subject);
+        renderCriteria(application.explain(repositoryKind), outputFormat(args));
+        return;
+    }
+    if (command === "verify-release") {
+        if (subject !== undefined) {
+            throw new Error("verify-release accepts flags only.");
+        }
+        const result = await application.verifyRelease({
+            directory: requiredPath(args, "--release"),
+            trustedRootDigest: requiredFlag(args, "--trusted-root-digest"),
+        });
+        renderResult(result, outputFormat(args));
+        if (result.status === "invalid")
+            process.exitCode = 2;
+        return;
+    }
+    throw new Error(usage());
+}
+function candidateIdentity(repositoryKind, baseRevision, headRevision, args) {
+    const repository = optionalFlag(args, "--candidate-repository");
+    const pullRequest = optionalFlag(args, "--pull-request");
+    if ((repository === undefined) !== (pullRequest === undefined)) {
+        throw new Error("--candidate-repository and --pull-request must be supplied together.");
+    }
+    if (repository && pullRequest) {
+        const pullRequestNumber = Number.parseInt(pullRequest, 10);
+        if (!Number.isInteger(pullRequestNumber) || pullRequestNumber < 1) {
+            throw new Error("--pull-request must be a positive integer.");
+        }
+        return {
+            kind: "git_pull_request",
+            repository,
+            pullRequestNumber,
+            headSha: headRevision,
+        };
+    }
+    return {
+        kind: "detached",
+        repositoryKind,
+        candidateDigest: digest({
+            repository_kind: repositoryKind,
+            base_revision: baseRevision,
+            head_revision: headRevision,
+        }),
+    };
+}
+function optionalFlag(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--"))
+        throw new Error(`${name} requires a value.`);
+    return value;
+}
+async function readJson(path) {
+    return JSON.parse(await readFile(path, "utf8"));
+}
+export async function resolveCatalogVerifierCommit(repositoryRoot, revision) {
+    const { stdout } = await execFileAsync("git", ["rev-parse", "--verify", "--end-of-options", `${revision}^{commit}`], {
+        cwd: repositoryRoot,
+        encoding: "utf8",
+        maxBuffer: 4 * 1024 * 1024,
+    });
+    const commit = stdout.trim();
+    if (!/^[a-f0-9]{40,64}$/u.test(commit)) {
+        throw new Error(`Git did not resolve '${revision}' to an exact commit.`);
+    }
+    return commit;
+}
+export function catalogVerifierError(error) {
+    if (!(error instanceof z.ZodError)) {
+        return error instanceof Error ? error : new Error(String(error));
+    }
+    const issues = error.issues.map((issue) => {
+        const path = issue.path.reduce((result, segment) => typeof segment === "number"
+            ? `${result}[${segment}]`
+            : `${result}${result ? "." : ""}${String(segment)}`, "");
+        return `- ${path || "document"}: ${issue.message}`;
+    });
+    return new Error(`Catalog data is invalid:\n${issues.join("\n")}`);
+}
+function outputFormat(args) {
+    const formatIndex = args.indexOf("--format");
+    if (formatIndex < 0)
+        return "human";
+    const format = args[formatIndex + 1];
+    if (format !== "human" && format !== "json") {
+        throw new Error("--format must be human or json.");
+    }
+    return format;
+}
+function renderResult(result, format) {
+    if (format === "json") {
+        process.stdout.write(`${JSON.stringify(result)}\n`);
+        return;
+    }
+    if (result.status === "valid") {
+        const counts = Object.entries(result.summary ?? {})
+            .map(([key, value]) => `${key.replaceAll("_", " ")}: ${value}`)
+            .join(", ");
+        process.stdout.write(`Sourcey verification passed (${counts}).\n`);
+        return;
+    }
+    for (const diagnostic of result.diagnostics) {
+        process.stderr.write(`${diagnostic.rule_id} [${diagnostic.classification}]${diagnostic.path ? ` ${diagnostic.path}` : ""}\n${diagnostic.message}\n${diagnostic.guidance}\n`);
+    }
+}
+function renderCriteria(criteria, format) {
+    if (format === "json") {
+        process.stdout.write(`${JSON.stringify({ criteria_contract: "sourcey.catalog-verifier-criteria/v1alpha1", criteria })}\n`);
+        return;
+    }
+    for (const criterion of criteria) {
+        process.stdout.write(`${criterion.rule_id}\n${criterion.title}: ${criterion.requirement}${criterion.exclusion ? `\nDoes not establish: ${criterion.exclusion}` : ""}\n\n`);
+    }
+}
+function usage() {
+    return [
+        "Usage:",
+        "  sourcey-catalog-verify identity-context-request startup-credits --repository DIR --base COMMIT --head COMMIT --taxonomy FILE --live-parent-release-id DIGEST [--candidate-repository OWNER/REPO --pull-request NUMBER]",
+        "  sourcey-catalog-verify identity-context-request agent-readiness --repository DIR --base COMMIT --head COMMIT --live-parent-release-id DIGEST [--candidate-repository OWNER/REPO --pull-request NUMBER]",
+        "  sourcey-catalog-verify validate startup-credits --repository DIR --base COMMIT --head COMMIT --taxonomy FILE --identity-context FILE --root-set FILE --trusted-root-digest DIGEST --verified-at INSTANT [--candidate-repository OWNER/REPO --pull-request NUMBER] [--format human|json]",
+        "  sourcey-catalog-verify validate agent-readiness --repository DIR --base COMMIT --head COMMIT --identity-context FILE --root-set FILE --trusted-root-digest DIGEST --verified-at INSTANT [--candidate-repository OWNER/REPO --pull-request NUMBER] [--format human|json]",
+        "  sourcey-catalog-verify explain startup-credits|agent-readiness [--format human|json]",
+        "  sourcey-catalog-verify verify-release --release DIR --trusted-root-digest DIGEST [--format human|json]",
+    ].join("\n");
+}
+//# sourceMappingURL=program.js.map

package/dist/packages/catalog-verifier/src/program.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"program.js","sourceRoot":"","sources":["../../../../packages/catalog-verifier/src/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,4BAA4B,GAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,0CAA0C,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,UAA6B;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,UAA6B;IAC9C,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,0BAA0B,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/D,4BAA4B,CAAC,cAAc,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC1E,4BAA4B,CAAC,cAAc,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC1E,cAAc,KAAK,iBAAiB;gBAClC,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBACvD,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,wBAAwB,CAAC;YACxD,cAAc;YACd,cAAc;YACd,YAAY;YACZ,YAAY;YACZ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,SAAS,EAAE,iBAAiB,CAAC,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC;YAC9E,eAAe,EAAE;gBACf,MAAM,EAAE,MAAM,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;gBAChE,OAAO,EAAE,MAAM,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBACzD,iBAAiB,EAAE,YAAY,CAAC,IAAI,EAAE,uBAAuB,CAAC;gBAC9D,UAAU,EAAE,YAAY,CAAC,IAAI,EAAE,eAAe,CAAC;aAChD;SACF,CAAC,CAAC;QACH,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,0BAA0B,EAAE,CAAC;QAC3C,MAAM,cAAc,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/D,4BAA4B,CAAC,cAAc,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC1E,4BAA4B,CAAC,cAAc,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC1E,cAAc,KAAK,iBAAiB;gBAClC,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBACvD,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,sCAAsC,CAAC;YACvE,cAAc;YACd,cAAc;YACd,YAAY;YACZ,YAAY;YACZ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,mBAAmB,EAAE,YAAY,CAAC,IAAI,EAAE,0BAA0B,CAAC;YACnE,SAAS,EAAE,iBAAiB,CAAC,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC;SAC/E,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnE,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC;YAC7C,SAAS,EAAE,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC;YAC1C,iBAAiB,EAAE,YAAY,CAAC,IAAI,EAAE,uBAAuB,CAAC;SAC/D,CAAC,CAAC;QACH,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CACxB,cAAqD,EACrD,YAAoB,EACpB,YAAoB,EACpB,IAAuB;IAEvB,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,kBAA2B;YACjC,UAAU;YACV,iBAAiB;YACjB,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAmB;QACzB,cAAc;QACd,eAAe,EAAE,MAAM,CAAC;YACtB,eAAe,EAAE,cAAc;YAC/B,aAAa,EAAE,YAAY;YAC3B,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAuB,EAAE,IAAY;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,cAAsB,EACtB,QAAgB;IAEhB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,KAAK,EACL,CAAC,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,QAAQ,WAAW,CAAC,EACrE;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;KAC3B,CACF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,uBAAuB,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAC5B,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAClB,OAAO,OAAO,KAAK,QAAQ;YACzB,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,GAAG;YACzB,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EACvD,EAAE,CACH,CAAC;QACF,OAAO,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,IAAuB;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,WAAW,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAA6B,EAAE,MAAwB;IAC3E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;aAC9D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,MAAM,MAAM,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,QAAQ,IAAI,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,QAA6C,EAC7C,MAAwB;IAExB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,4CAA4C,EAAE,QAAQ,EAAE,CAAC,IAAI,CACrG,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CACrJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,KAAK;IACZ,OAAO;QACL,QAAQ;QACR,0NAA0N;QAC1N,0MAA0M;QAC1M,2RAA2R;QAC3R,2QAA2Q;QAC3Q,wFAAwF;QACxF,0GAA0G;KAC3G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}