@sun-asterisk/sungen 3.2.34 → 3.3.0-alpha.1

package/dist/contract/trace/trace-steps.d.ts

@@ -0,0 +1,19 @@
+import type { ParsedTrace } from './trace-file-reader';
+export type IntentKind = 'action' | 'assert' | 'opaque-action' | 'opaque-assert';
+export interface IntentStep {
+    kind: IntentKind;
+    method: string;
+    callId?: string;
+    params: Record<string, unknown>;
+    /** Enclosing `test.step` titles, outermost first (impl:code compares by the first). */
+    group: string[];
+    location?: {
+        file: string;
+        line: number;
+    };
+    /** The runner's own words for an opaque step (`Expect "toMatchObject"`, `GET /api/health`). */
+    verbatim?: string;
+    startTime: number;
+}
+export declare function traceIntentSteps(trace: ParsedTrace): IntentStep[];
+//# sourceMappingURL=trace-steps.d.ts.map

package/dist/contract/trace/trace-steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-steps.d.ts","sourceRoot":"","sources":["../../../src/contract/trace/trace-steps.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,WAAW,EAAc,MAAM,qBAAqB,CAAC;AAEnE,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,eAAe,GAAG,eAAe,CAAC;AACjF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAkBD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,EAAE,CAuCjE"}

package/dist/contract/trace/trace-steps.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.traceIntentSteps = traceIntentSteps;
+/**
+ * A trace → the test's INTENT, in order (phase 08 requirement 1). What is kept:
+ *
+ *   action         Frame goto / click / dblclick / fill / check / uncheck / selectOption / press /
+ *                  hover / setInputFiles / type / tap, and page keyboard presses
+ *   assert         Frame.expect — a check on an element or the page (url, title)
+ *   opaque-assert  a runner `expect` with no browser call behind it: `expect(await res.json())…`,
+ *                  a check on a JS value — cannot be compared, always review (DOS-14.6)
+ *   opaque-action  an API request, an `evaluate` (canvas…) — behaviour the contract cannot see into
+ *
+ * Dropped as implementation detail: waits (`waitForTimeout`, `waitFor*`), reads (`textContent`,
+ * `isVisible`…), context/page plumbing, and everything in fixtures, runner hooks and teardown —
+ * only the body and user `beforeEach` hooks are the test's behaviour. A focus click right before a
+ * fill on the same element is dropped later, once identities say "same element" (render step).
+ */
+const test_step_join_1 = require("./test-step-join");
+const FRAME_ACTIONS = new Set(['goto', 'click', 'dblclick', 'fill', 'check', 'uncheck', 'selectOption', 'press', 'hover', 'setInputFiles', 'type', 'tap']);
+const PAGE_KEYS = new Set(['keyboardPress', 'keyboardType', 'keyboardInsertText']);
+const EVALUATE = /^evaluate/;
+/** The first frame in the test's own code (not a library, not the runner's `project#` marker). */
+function firstFrame(frames) {
+    const f = frames?.find((x) => x.file && !x.file.includes('node_modules') && !x.file.endsWith('#'));
+    return f ? { file: f.file, line: f.line } : undefined;
+}
+function groupOf(steps, stepId) {
+    if (!stepId)
+        return [];
+    const w = (0, test_step_join_1.classifyStep)(steps, stepId);
+    return w.phase === 'body' ? w.stepPath : [];
+}
+function traceIntentSteps(trace) {
+    const { steps, calls } = (0, test_step_join_1.joinCalls)(trace);
+    const stacks = new Map(trace.library.map((l) => [l.name, l.stacks]));
+    const out = [];
+    const withCall = new Set(calls.map((c) => c.stepId).filter((s) => !!s));
+    for (const c of calls) {
+        if (!(0, test_step_join_1.isBehaviour)(c.where))
+            continue;
+        let kind = null;
+        let verbatim;
+        if (c.class === 'Frame' && FRAME_ACTIONS.has(c.method))
+            kind = 'action';
+        else if (c.class === 'Frame' && c.method === 'expect')
+            kind = 'assert';
+        else if (c.class === 'Page' && PAGE_KEYS.has(c.method))
+            kind = 'action';
+        else if (c.class === 'APIRequestContext' && c.method === 'fetch') {
+            kind = 'opaque-action';
+            verbatim = `${String(c.params.method ?? 'GET')} ${String(c.params.url ?? '')}`;
+        }
+        else if (EVALUATE.test(c.method) && /^(Frame|Page|JSHandle|ElementHandle|Worker)$/.test(c.class)) {
+            kind = 'opaque-action';
+            verbatim = `${c.class}.${c.method}`;
+        }
+        if (!kind)
+            continue;
+        const runner = c.stepId ? steps.get(c.stepId) : undefined;
+        out.push({
+            kind, method: c.method, callId: c.callId, params: c.params, group: groupOf(steps, c.stepId),
+            location: firstFrame(runner?.stack) ?? firstFrame(stacks.get(c.part)?.get(c.callNumber)),
+            ...(verbatim ? { verbatim } : {}), startTime: c.startTime,
+        });
+    }
+    // A runner `expect` that drove no browser call checked a plain JS value: opaque.
+    const runnerStart = new Map(trace.runner.filter((e) => e.type === 'before').map((e) => [String(e.callId), Number(e.startTime) || 0]));
+    for (const s of steps.values()) {
+        if (s.method !== 'expect' || withCall.has(s.id) || !(0, test_step_join_1.isBehaviour)((0, test_step_join_1.classifyStep)(steps, s.id)))
+            continue;
+        out.push({
+            kind: 'opaque-assert', method: 'expect', params: s.params, group: groupOf(steps, s.id),
+            location: firstFrame(s.stack), verbatim: s.title, startTime: runnerStart.get(s.id) ?? 0,
+        });
+    }
+    return out.sort((a, b) => a.startTime - b.startTime);
+}
+//# sourceMappingURL=trace-steps.js.map

package/dist/contract/trace/trace-steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-steps.js","sourceRoot":"","sources":["../../../src/contract/trace/trace-steps.ts"],"names":[],"mappings":";;AAgDA,4CAuCC;AAvFD;;;;;;;;;;;;;;GAcG;AACH,qDAAoF;AAiBpF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3J,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC;AACnF,MAAM,QAAQ,GAAG,WAAW,CAAC;AAE7B,kGAAkG;AAClG,SAAS,UAAU,CAAC,MAAgC;IAClD,MAAM,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,OAAO,CAAC,KAA8B,EAAE,MAA0B;IACzE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,IAAA,6BAAY,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAkB;IACjD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAA,0BAAS,EAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,IAAA,4BAAW,EAAC,CAAC,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,IAAI,GAAsB,IAAI,CAAC;QACnC,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,IAAI,GAAG,QAAQ,CAAC;aACnE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,IAAI,GAAG,QAAQ,CAAC;aAClE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,IAAI,GAAG,QAAQ,CAAC;aACnE,IAAI,CAAC,CAAC,KAAK,KAAK,mBAAmB,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACjE,IAAI,GAAG,eAAe,CAAC;YACvB,QAAQ,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;QACjF,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnG,IAAI,GAAG,eAAe,CAAC;YACvB,QAAQ,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YAC3F,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACxF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtI,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAA,4BAAW,EAAC,IAAA,6BAAY,EAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,SAAS;QACrG,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YACtF,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;SACxF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;AACvD,CAAC"}

package/dist/contract/trace/trace-zip-limits.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Limits for reading an untrusted Playwright trace.zip (DOS-14.7), and the one error every trace
+ * refusal raises. A trace is attacker-shaped input: a report can point at any file, and a zip can
+ * claim small sizes and inflate to gigabytes, so every number below is checked BEFORE inflating and
+ * again WHILE inflating (the inflater is capped at the declared size).
+ *
+ *   file size           20 MB        a real trace is ~0.6 MB per attempt, max 1.3 MB measured (phase 07)
+ *   entries            10 000
+ *   one entry           16 MB uncompressed
+ *   all entries         64 MB uncompressed   (each raisable by env: traceZipLimits)
+ *   ratio              100 : 1 per entry (a bomb is ~1000 : 1)
+ *
+ * An entry NAME is a key and nothing else: names with `..`, a leading `/`, a drive letter, a
+ * backslash or a NUL are refused outright rather than "sanitized", because nothing legitimate in a
+ * trace looks like that.
+ */
+export interface TraceZipLimits {
+    maxZipBytes: number;
+    maxEntries: number;
+    maxEntryBytes: number;
+    maxTotalBytes: number;
+    maxRatio: number;
+}
+export declare const TRACE_ZIP_LIMITS: Readonly<TraceZipLimits>;
+/**
+ * The limits in force: the defaults, each raisable by env for unusually large traces —
+ * `SUNGEN_TRACE_MAX_ZIP_MB`, `SUNGEN_TRACE_MAX_ENTRY_MB`, `SUNGEN_TRACE_MAX_TOTAL_MB` (positive numbers;
+ * anything else is ignored, so a typo can never turn a cap into zero or infinity).
+ */
+export declare function traceZipLimits(env?: Record<string, string | undefined>): TraceZipLimits;
+/** Trace format versions this reader was verified against: 8 = Playwright 1.57, 9 = 1.63. */
+export declare const SUPPORTED_TRACE_VERSIONS: ReadonlySet<number>;
+export type TraceRejectCode = 'zip.too-large' | 'zip.too-many-entries' | 'zip.entry-too-large' | 'zip.total-too-large' | 'zip.ratio' | 'zip.entry-name' | 'zip.malformed' | 'zip.unsupported' | 'trace.version-unsupported' | 'trace.malformed';
+/** A trace that was refused before anything in it was trusted. `code` is stable; `message` names the cause. */
+export declare class TraceRejected extends Error {
+    readonly code: TraceRejectCode;
+    constructor(code: TraceRejectCode, message: string);
+}
+/** Refuse an entry name that could ever be mistaken for a path outside the archive. */
+export declare function assertSafeEntryName(name: string): void;
+//# sourceMappingURL=trace-zip-limits.d.ts.map

package/dist/contract/trace/trace-zip-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-zip-limits.d.ts","sourceRoot":"","sources":["../../../src/contract/trace/trace-zip-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,cAAc,CAMpD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,cAAc,CAWpG;AAED,6FAA6F;AAC7F,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAAmB,CAAC;AAE7E,MAAM,MAAM,eAAe,GACvB,eAAe,GAAG,sBAAsB,GAAG,qBAAqB,GAAG,qBAAqB,GAAG,WAAW,GACtG,gBAAgB,GAAG,eAAe,GAAG,iBAAiB,GAAG,2BAA2B,GAAG,iBAAiB,CAAC;AAE7G,+GAA+G;AAC/G,qBAAa,aAAc,SAAQ,KAAK;aACV,IAAI,EAAE,eAAe;gBAArB,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAInE;AAID,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtD"}

package/dist/contract/trace/trace-zip-limits.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TraceRejected = exports.SUPPORTED_TRACE_VERSIONS = exports.TRACE_ZIP_LIMITS = void 0;
+exports.traceZipLimits = traceZipLimits;
+exports.assertSafeEntryName = assertSafeEntryName;
+const MB = 1024 * 1024;
+exports.TRACE_ZIP_LIMITS = Object.freeze({
+    maxZipBytes: 20 * MB,
+    maxEntries: 10000,
+    maxEntryBytes: 16 * MB,
+    maxTotalBytes: 64 * MB,
+    maxRatio: 100,
+});
+/**
+ * The limits in force: the defaults, each raisable by env for unusually large traces —
+ * `SUNGEN_TRACE_MAX_ZIP_MB`, `SUNGEN_TRACE_MAX_ENTRY_MB`, `SUNGEN_TRACE_MAX_TOTAL_MB` (positive numbers;
+ * anything else is ignored, so a typo can never turn a cap into zero or infinity).
+ */
+function traceZipLimits(env = process.env) {
+    const mb = (name, fallback) => {
+        const v = Number(env[name]);
+        return Number.isFinite(v) && v > 0 && v <= 4096 ? Math.floor(v * MB) : fallback;
+    };
+    return {
+        ...exports.TRACE_ZIP_LIMITS,
+        maxZipBytes: mb('SUNGEN_TRACE_MAX_ZIP_MB', exports.TRACE_ZIP_LIMITS.maxZipBytes),
+        maxEntryBytes: mb('SUNGEN_TRACE_MAX_ENTRY_MB', exports.TRACE_ZIP_LIMITS.maxEntryBytes),
+        maxTotalBytes: mb('SUNGEN_TRACE_MAX_TOTAL_MB', exports.TRACE_ZIP_LIMITS.maxTotalBytes),
+    };
+}
+/** Trace format versions this reader was verified against: 8 = Playwright 1.57, 9 = 1.63. */
+exports.SUPPORTED_TRACE_VERSIONS = new Set([8, 9]);
+/** A trace that was refused before anything in it was trusted. `code` is stable; `message` names the cause. */
+class TraceRejected extends Error {
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.code = code;
+        this.name = 'TraceRejected';
+    }
+}
+exports.TraceRejected = TraceRejected;
+const BAD_NAME = /(^|[\\/])\.\.([\\/]|$)|^[\\/]|^[A-Za-z]:|\\|\0/;
+/** Refuse an entry name that could ever be mistaken for a path outside the archive. */
+function assertSafeEntryName(name) {
+    if (!name || BAD_NAME.test(name))
+        throw new TraceRejected('zip.entry-name', `refused entry name ${JSON.stringify(name.slice(0, 80))}`);
+}
+//# sourceMappingURL=trace-zip-limits.js.map

package/dist/contract/trace/trace-zip-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-zip-limits.js","sourceRoot":"","sources":["../../../src/contract/trace/trace-zip-limits.ts"],"names":[],"mappings":";;;AAuCA,wCAWC;AAoBD,kDAEC;AAhDD,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEV,QAAA,gBAAgB,GAA6B,MAAM,CAAC,MAAM,CAAC;IACtE,WAAW,EAAE,EAAE,GAAG,EAAE;IACpB,UAAU,EAAE,KAAM;IAClB,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,QAAQ,EAAE,GAAG;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAgB,cAAc,CAAC,MAA0C,OAAO,CAAC,GAAG;IAClF,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAU,EAAE;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClF,CAAC,CAAC;IACF,OAAO;QACL,GAAG,wBAAgB;QACnB,WAAW,EAAE,EAAE,CAAC,yBAAyB,EAAE,wBAAgB,CAAC,WAAW,CAAC;QACxE,aAAa,EAAE,EAAE,CAAC,2BAA2B,EAAE,wBAAgB,CAAC,aAAa,CAAC;QAC9E,aAAa,EAAE,EAAE,CAAC,2BAA2B,EAAE,wBAAgB,CAAC,aAAa,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,6FAA6F;AAChF,QAAA,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAM7E,+GAA+G;AAC/G,MAAa,aAAc,SAAQ,KAAK;IACtC,YAA4B,IAAqB,EAAE,OAAe;QAChE,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QADH,SAAI,GAAJ,IAAI,CAAiB;QAE/C,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AALD,sCAKC;AAED,MAAM,QAAQ,GAAG,gDAAgD,CAAC;AAElE,uFAAuF;AACvF,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AACzI,CAAC"}

package/dist/contract/trace/trace-zip-reader.d.ts

@@ -0,0 +1,10 @@
+import { TraceZipLimits } from './trace-zip-limits';
+export interface ZipArchive {
+    names(): string[];
+    has(name: string): boolean;
+    readBuffer(name: string): Buffer;
+    readText(name: string): string;
+}
+/** Open a zip held in memory. Throws TraceRejected for anything outside the limits or the format. */
+export declare function openZip(buf: Buffer, limits?: TraceZipLimits): ZipArchive;
+//# sourceMappingURL=trace-zip-reader.d.ts.map

package/dist/contract/trace/trace-zip-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-zip-reader.d.ts","sourceRoot":"","sources":["../../../src/contract/trace/trace-zip-reader.ts"],"names":[],"mappings":"AAYA,OAAO,EAAwD,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAI1G,MAAM,WAAW,UAAU;IACzB,KAAK,IAAI,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAkFD,qGAAqG;AACrG,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,cAAiC,GAAG,UAAU,CAsB1F"}

package/dist/contract/trace/trace-zip-reader.js

@@ -0,0 +1,186 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openZip = openZip;
+/**
+ * A synchronous, limit-enforcing zip reader for trace.zip files (DOS-14.7) on Node's own zlib —
+ * no dependency, and synchronous so the contract verdict (and the Claude Code guard that rebuilds
+ * it) stays a plain function.
+ *
+ * Only what a Playwright trace needs is accepted: STORE or DEFLATE entries, no encryption, no
+ * ZIP64, no duplicate names. Sizes come from the central directory and are checked against
+ * TRACE_ZIP_LIMITS before anything is inflated; inflation itself is capped at the declared size and
+ * the CRC is verified, so a header that lies is caught while reading, not after. Entry names are
+ * map keys — nothing here ever touches the filesystem.
+ */
+const zlib = __importStar(require("zlib"));
+const trace_zip_limits_1 = require("./trace-zip-limits");
+const EOCD = 0x06054b50;
+const CENTRAL = 0x02014b50;
+const LOCAL = 0x04034b50;
+/** Below this, a high ratio is just a small repetitive file; the per-entry and total caps still apply. */
+const RATIO_FLOOR_BYTES = 64 * 1024;
+const malformed = (why) => new trace_zip_limits_1.TraceRejected('zip.malformed', why);
+const CRC_TABLE = (() => {
+    const t = new Int32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        t[n] = c;
+    }
+    return t;
+})();
+function crc32(buf) {
+    let c = -1;
+    for (let i = 0; i < buf.length; i++)
+        c = CRC_TABLE[(c ^ buf[i]) & 0xff] ^ (c >>> 8);
+    return (c ^ -1) >>> 0;
+}
+function findEocd(buf) {
+    const stop = Math.max(0, buf.length - 22 - 0xffff);
+    for (let i = buf.length - 22; i >= stop; i--)
+        if (buf.readUInt32LE(i) === EOCD)
+            return i;
+    throw malformed('no end-of-central-directory record (not a zip)');
+}
+function readEntries(buf, limits) {
+    const eocd = findEocd(buf);
+    const count = buf.readUInt16LE(eocd + 10);
+    const cdOffset = buf.readUInt32LE(eocd + 16);
+    if (count === 0xffff || cdOffset === 0xffffffff)
+        throw new trace_zip_limits_1.TraceRejected('zip.unsupported', 'ZIP64 archives are not read');
+    if (count > limits.maxEntries)
+        throw new trace_zip_limits_1.TraceRejected('zip.too-many-entries', `${count} entries > ${limits.maxEntries}`);
+    const entries = new Map();
+    let at = cdOffset;
+    let total = 0;
+    for (let i = 0; i < count; i++) {
+        if (buf.readUInt32LE(at) !== CENTRAL)
+            throw malformed(`central directory entry ${i} has a bad signature`);
+        const flags = buf.readUInt16LE(at + 8);
+        const method = buf.readUInt16LE(at + 10);
+        const crc = buf.readUInt32LE(at + 16);
+        const compressed = buf.readUInt32LE(at + 20);
+        const size = buf.readUInt32LE(at + 24);
+        const nameLen = buf.readUInt16LE(at + 28);
+        const name = buf.toString('utf8', at + 46, at + 46 + nameLen);
+        const localOffset = buf.readUInt32LE(at + 42);
+        at += 46 + nameLen + buf.readUInt16LE(at + 30) + buf.readUInt16LE(at + 32);
+        (0, trace_zip_limits_1.assertSafeEntryName)(name.replace(/\/$/, '') || name);
+        if (flags & 1)
+            throw new trace_zip_limits_1.TraceRejected('zip.unsupported', `${name} is encrypted`);
+        if (method !== 0 && method !== 8)
+            throw new trace_zip_limits_1.TraceRejected('zip.unsupported', `${name} uses compression method ${method}`);
+        if (compressed === 0xffffffff || size === 0xffffffff)
+            throw new trace_zip_limits_1.TraceRejected('zip.unsupported', `${name} needs ZIP64`);
+        if (name.endsWith('/'))
+            continue;
+        if (entries.has(name))
+            throw malformed(`duplicate entry ${name}`);
+        if (size > limits.maxEntryBytes)
+            throw new trace_zip_limits_1.TraceRejected('zip.entry-too-large', `${name}: ${size} B > ${limits.maxEntryBytes}`);
+        if (size >= RATIO_FLOOR_BYTES && compressed > 0 && size / compressed > limits.maxRatio) {
+            throw new trace_zip_limits_1.TraceRejected('zip.ratio', `${name}: ratio ${(size / compressed).toFixed(0)}:1 > ${limits.maxRatio}:1`);
+        }
+        if (size >= RATIO_FLOOR_BYTES && compressed === 0)
+            throw new trace_zip_limits_1.TraceRejected('zip.ratio', `${name}: ${size} B from 0 compressed bytes`);
+        total += size;
+        if (total > limits.maxTotalBytes)
+            throw new trace_zip_limits_1.TraceRejected('zip.total-too-large', `more than ${limits.maxTotalBytes} B uncompressed`);
+        entries.set(name, { name, method, compressed, size, crc, localOffset });
+    }
+    return entries;
+}
+function inflate(buf, e) {
+    if (buf.readUInt32LE(e.localOffset) !== LOCAL)
+        throw malformed(`${e.name}: bad local header`);
+    const start = e.localOffset + 30 + buf.readUInt16LE(e.localOffset + 26) + buf.readUInt16LE(e.localOffset + 28);
+    const data = buf.subarray(start, start + e.compressed);
+    if (data.length !== e.compressed)
+        throw malformed(`${e.name}: truncated data`);
+    let out;
+    if (e.method === 0)
+        out = data;
+    else {
+        try {
+            out = zlib.inflateRawSync(data, { maxOutputLength: Math.max(1, e.size) });
+        }
+        catch (err) {
+            throw malformed(`${e.name}: inflates past its declared ${e.size} B or is corrupt (${err.message.split('\n')[0]})`);
+        }
+    }
+    if (out.length !== e.size)
+        throw malformed(`${e.name}: ${out.length} B, header says ${e.size} B`);
+    if (crc32(out) !== e.crc)
+        throw malformed(`${e.name}: CRC mismatch`);
+    return out;
+}
+/** Open a zip held in memory. Throws TraceRejected for anything outside the limits or the format. */
+function openZip(buf, limits = trace_zip_limits_1.TRACE_ZIP_LIMITS) {
+    if (buf.length > limits.maxZipBytes)
+        throw new trace_zip_limits_1.TraceRejected('zip.too-large', `${buf.length} B > ${limits.maxZipBytes}`);
+    if (buf.length < 22)
+        throw malformed('too short to be a zip');
+    let entries;
+    try {
+        entries = readEntries(buf, limits);
+    }
+    catch (e) {
+        if (e instanceof trace_zip_limits_1.TraceRejected)
+            throw e;
+        throw malformed(`unreadable zip structure (${e.message.split('\n')[0]})`);
+    }
+    const readBuffer = (name) => {
+        const e = entries.get(name);
+        if (!e)
+            throw malformed(`no entry ${name}`);
+        try {
+            return inflate(buf, e);
+        }
+        catch (err) {
+            if (err instanceof trace_zip_limits_1.TraceRejected)
+                throw err;
+            throw malformed(`${name}: ${err.message.split('\n')[0]}`);
+        }
+    };
+    return {
+        names: () => [...entries.keys()],
+        has: (name) => entries.has(name),
+        readBuffer,
+        readText: (name) => readBuffer(name).toString('utf8'),
+    };
+}
+//# sourceMappingURL=trace-zip-reader.js.map

package/dist/contract/trace/trace-zip-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-zip-reader.js","sourceRoot":"","sources":["../../../src/contract/trace/trace-zip-reader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwGA,0BAsBC;AA9HD;;;;;;;;;;GAUG;AACH,2CAA6B;AAC7B,yDAA0G;AAW1G,MAAM,IAAI,GAAG,UAAU,CAAC;AACxB,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,0GAA0G;AAC1G,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAiB,EAAE,CAAC,IAAI,gCAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;AAE1F,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;IACtB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAChI,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AACL,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;IACzF,MAAM,SAAS,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAAsB;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,MAAM,IAAI,QAAQ,KAAK,UAAU;QAAE,MAAM,IAAI,gCAAa,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;IAC3H,IAAI,KAAK,GAAG,MAAM,CAAC,UAAU;QAAE,MAAM,IAAI,gCAAa,CAAC,sBAAsB,EAAE,GAAG,KAAK,cAAc,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1H,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACzC,IAAI,EAAE,GAAG,QAAQ,CAAC;IAClB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,OAAO;YAAE,MAAM,SAAS,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,CAAC;QAC1G,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,EAAE,IAAI,EAAE,GAAG,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,IAAA,sCAAmB,EAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,gCAAa,CAAC,iBAAiB,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;QAClF,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,gCAAa,CAAC,iBAAiB,EAAE,GAAG,IAAI,4BAA4B,MAAM,EAAE,CAAC,CAAC;QAC1H,IAAI,UAAU,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU;YAAE,MAAM,IAAI,gCAAa,CAAC,iBAAiB,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;QACxH,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,SAAS,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,IAAI,GAAG,MAAM,CAAC,aAAa;YAAE,MAAM,IAAI,gCAAa,CAAC,qBAAqB,EAAE,GAAG,IAAI,KAAK,IAAI,QAAQ,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAChI,IAAI,IAAI,IAAI,iBAAiB,IAAI,UAAU,GAAG,CAAC,IAAI,IAAI,GAAG,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvF,MAAM,IAAI,gCAAa,CAAC,WAAW,EAAE,GAAG,IAAI,WAAW,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,IAAI,IAAI,iBAAiB,IAAI,UAAU,KAAK,CAAC;YAAE,MAAM,IAAI,gCAAa,CAAC,WAAW,EAAE,GAAG,IAAI,KAAK,IAAI,4BAA4B,CAAC,CAAC;QACtI,KAAK,IAAI,IAAI,CAAC;QACd,IAAI,KAAK,GAAG,MAAM,CAAC,aAAa;YAAE,MAAM,IAAI,gCAAa,CAAC,qBAAqB,EAAE,aAAa,MAAM,CAAC,aAAa,iBAAiB,CAAC,CAAC;QACrI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,CAAQ;IACpC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,UAAU;QAAE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC;IAC/E,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,GAAG,IAAI,CAAC;SAC1B,CAAC;QACJ,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAC9F,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC,IAAI,qBAAsB,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI;QAAE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,mBAAmB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAClG,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG;QAAE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,SAAgB,OAAO,CAAC,GAAW,EAAE,SAAyB,mCAAgB;IAC5E,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,gCAAa,CAAC,eAAe,EAAE,GAAG,GAAG,CAAC,MAAM,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACzH,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC9D,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,YAAY,gCAAa;YAAE,MAAM,CAAC,CAAC;QACxC,MAAM,SAAS,CAAC,6BAA8B,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE;QAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC;YAAE,MAAM,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC;YAAC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAC3C,IAAI,GAAG,YAAY,gCAAa;gBAAE,MAAM,GAAG,CAAC;YAC5C,MAAM,SAAS,CAAC,GAAG,IAAI,KAAM,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAChC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAChC,UAAU;QACV,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/contract/verify-approval-decisions.d.ts

@@ -0,0 +1,5 @@
+import { HeadSnapshot } from './contract-git';
+import { ContractLock } from './contract-schema';
+import type { UncommittedEntry } from './lock-vs-git-head';
+export declare function unverifiedApprovals(projectRoot: string, unitDir: string, lock: ContractLock | null, skip: ReadonlySet<string>, snap: HeadSnapshot): UncommittedEntry[];
+//# sourceMappingURL=verify-approval-decisions.d.ts.map

package/dist/contract/verify-approval-decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-approval-decisions.d.ts","sourceRoot":"","sources":["../../src/contract/verify-approval-decisions.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAA0C,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,YAAY,EAA8B,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AA6B3D,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,GAC7G,gBAAgB,EAAE,CAWpB"}

package/dist/contract/verify-approval-decisions.js

@@ -0,0 +1,104 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unverifiedApprovals = unverifiedApprovals;
+/**
+ * Every approved lock entry must be vouched for by its decision (DOS-13.2, DOS-14.4, review M1):
+ * `qa/<kind>/<unit>/decisions/<decisionId>.yaml`, COMMITTED in git HEAD (outside git: on disk),
+ * intact (schema, id = content, entry_hash = entry), of kind `contract-approval`, whose payload lists
+ * this scenario at this hash, and whose `valid_from` is the entry's `approvedAt`. A lock line copied
+ * from elsewhere, re-pointed at another decision, or backdated fails here — `unverified`, reported
+ * under contract.lock-uncommitted (hard).
+ *
+ * Only entries that are otherwise identical to HEAD are checked: an entry already added, changed or
+ * tampered is a hard finding on its own.
+ */
+const path = __importStar(require("path"));
+const decision_identity_1 = require("../decisions/decision-identity");
+const decision_schema_1 = require("../decisions/decision-schema");
+const safe_yaml_parse_1 = require("../utils/safe-yaml-parse");
+const contract_git_1 = require("./contract-git");
+const contract_schema_1 = require("./contract-schema");
+function loadDecision(projectRoot, unitDir, id, snap) {
+    const file = path.join(unitDir, 'decisions', `${id}.yaml`);
+    const rel = (0, contract_git_1.posixRel)(projectRoot, file);
+    const working = (0, contract_git_1.readTextOrNull)(file);
+    const text = snap.blobs === null ? working : (0, contract_git_1.headFileText)(snap, rel, working);
+    if (text === null)
+        return { problem: snap.blobs === null ? `decision ${id} does not exist` : `decision ${id} is not in git HEAD (not committed through review)` };
+    let raw;
+    try {
+        raw = (0, safe_yaml_parse_1.safeYamlParse)(text, rel);
+    }
+    catch (e) {
+        return { problem: `decision ${id} is unreadable: ${e instanceof Error ? e.message : e}` };
+    }
+    const errors = (0, decision_schema_1.storedEntryErrors)(raw);
+    if (errors.length)
+        return { problem: `decision ${id} is invalid: ${errors[0]}` };
+    const entry = raw;
+    const scope = (0, contract_git_1.posixRel)(path.join(projectRoot, 'qa'), unitDir);
+    if (entry.id !== id || (0, decision_identity_1.computeDecisionId)(entry, scope) !== id)
+        return { problem: `decision ${id} does not hash to its id in ${scope}` };
+    if ((0, decision_identity_1.computeEntryHash)(entry) !== entry.entry_hash)
+        return { problem: `decision ${id} was altered (entry_hash)` };
+    return { entry };
+}
+function mismatch(scenario, lockEntry, d) {
+    if (d.kind !== 'contract-approval')
+        return `decision ${d.id} is a ${d.kind}, not a contract-approval`;
+    const listed = Array.isArray(d.payload?.scenarios) ? d.payload.scenarios : [];
+    if (!listed.some((s) => s && s.id === scenario && s.hash === lockEntry.hash))
+        return `decision ${d.id} does not approve ${scenario} at hash ${lockEntry.hash}`;
+    if (Date.parse(lockEntry.approvedAt) !== Date.parse(d.valid_from))
+        return `approvedAt ${lockEntry.approvedAt} is not decision ${d.id}'s valid_from ${d.valid_from}`;
+    return null;
+}
+function unverifiedApprovals(projectRoot, unitDir, lock, skip, snap) {
+    const cache = new Map();
+    const out = [];
+    for (const [id, entry] of Object.entries(lock?.scenarios ?? {})) {
+        if (!(0, contract_schema_1.isHumanApproved)(entry) || skip.has(id))
+            continue;
+        if (!cache.has(entry.decisionId))
+            cache.set(entry.decisionId, loadDecision(projectRoot, unitDir, entry.decisionId, snap));
+        const loaded = cache.get(entry.decisionId);
+        const problem = 'problem' in loaded ? loaded.problem : mismatch(id, entry, loaded.entry);
+        if (problem)
+            out.push({ id, change: 'unverified', detail: problem });
+    }
+    return out;
+}
+//# sourceMappingURL=verify-approval-decisions.js.map

package/dist/contract/verify-approval-decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-approval-decisions.js","sourceRoot":"","sources":["../../src/contract/verify-approval-decisions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,kDAaC;AA3DD;;;;;;;;;;GAUG;AACH,2CAA6B;AAC7B,sEAAqF;AACrF,kEAAgF;AAChF,8DAAyD;AACzD,iDAAsF;AACtF,uDAA6E;AAK7E,SAAS,YAAY,CAAC,WAAmB,EAAE,OAAe,EAAE,EAAU,EAAE,IAAkB;IACxF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAA,uBAAQ,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAA,6BAAc,EAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,2BAAY,EAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9E,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,YAAY,EAAE,oDAAoD,EAAE,CAAC;IAClK,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAA,+BAAa,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,mBAAmB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAAC,CAAC;IAChJ,MAAM,MAAM,GAAG,IAAA,mCAAiB,EAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,GAAoB,CAAC;IACnC,MAAM,KAAK,GAAG,IAAA,uBAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,IAAA,qCAAiB,EAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,+BAA+B,KAAK,EAAE,EAAE,CAAC;IACxI,IAAI,IAAA,oCAAgB,EAAC,KAAK,CAAC,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,CAAC;IAChH,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,SAAoB,EAAE,CAAgB;IACxE,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,2BAA2B,CAAC;IACtG,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAQ,CAAC,SAAoD,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1H,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,CAAC,EAAE,qBAAqB,QAAQ,YAAY,SAAS,CAAC,IAAI,EAAE,CAAC;IAC/J,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,OAAO,cAAc,SAAS,CAAC,UAAU,oBAAoB,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,UAAU,EAAE,CAAC;IACpK,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,mBAAmB,CACjC,WAAmB,EAAE,OAAe,EAAE,IAAyB,EAAE,IAAyB,EAAE,IAAkB;IAE9G,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,IAAA,iCAAe,EAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACtD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1H,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACzF,IAAI,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/decisions/append-decision.d.ts

@@ -0,0 +1,12 @@
+import { DecisionDraft, DecisionEntry } from './decision-schema';
+export interface AppendResult {
+    status: 'created' | 'already-recorded';
+    entry: DecisionEntry;
+    path: string;
+}
+export declare class DecisionConflictError extends Error {
+    readonly path: string;
+    constructor(path: string, detail: string);
+}
+export declare function appendDecision(projectRoot: string, scope: string, draft: DecisionDraft): AppendResult;
+//# sourceMappingURL=append-decision.d.ts.map

package/dist/decisions/append-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"append-decision.d.ts","sourceRoot":"","sources":["../../src/decisions/append-decision.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAe,MAAM,mBAAmB,CAAC;AAI9E,MAAM,WAAW,YAAY;IAAG,MAAM,EAAE,SAAS,GAAG,kBAAkB,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAE5G,qBAAa,qBAAsB,SAAQ,KAAK;aAClB,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAIzD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,YAAY,CAYrG"}