@tokenoftrust/storefront-runner 2.0.2 → 2.0.3

package/apps/storefront/scripts/replay-v84-clean-clone.ts

@@ -1,214 +0,0 @@
-/** Validate and compose two exact passes produced by one attested immutable execution snapshot. */
-import { createHash } from "node:crypto";
-import {
-  V84_CLEAN_CLONE_GRAPH_COUNT,
-  V84_CLEAN_CLONE_GRAPH_SHA256,
-  V84_CLEAN_CLONE_LAUNCHER_ENTRY,
-  type V84CleanCloneGraphIdentity,
-} from "./v84CleanCloneGraphPin.js";
-
-const SOURCE = "tokenoftrust.com";
-const CLONE = "tokenoftrust.com~clone~gtm-migration-v84";
-const SESSION = "offline-v84-shared-clone-session";
-const FAILURE = "The fixed clean-clone replay failed safely.";
-const STAGE_ORDER = ["import", "native", "dogfood", "lifecycle"] as const;
-
-type Json = null | boolean | number | string | Json[] | { [key: string]: Json };
-function digest(value: string): string {
-  return createHash("sha256").update(value).digest("hex");
-}
-function assertSafe(condition: unknown): asserts condition {
-  if (!condition) throw new Error(FAILURE);
-}
-function validateJson(value: unknown): asserts value is Json {
-  if (value === null || typeof value === "string" || typeof value === "boolean") return;
-  if (typeof value === "number") return assertSafe(Number.isFinite(value));
-  assertSafe(typeof value === "object");
-  if (Array.isArray(value)) return value.forEach(validateJson);
-  assertSafe(Object.getPrototypeOf(value) === Object.prototype);
-  for (const [key, child] of Object.entries(value)) {
-    assertSafe(!["__proto__", "prototype", "constructor"].includes(key));
-    validateJson(child);
-  }
-}
-function object(value: unknown): Record<string, Json> {
-  validateJson(value);
-  assertSafe(value !== null && !Array.isArray(value) && typeof value === "object");
-  return value;
-}
-function at(root: unknown, ...keys: readonly (string | number)[]): Json {
-  let current = root as Json;
-  for (const key of keys) {
-    if (typeof key === "number") {
-      assertSafe(Array.isArray(current) && key in current);
-      current = current[key]!;
-    } else {
-      assertSafe(current !== null && !Array.isArray(current) && typeof current === "object" && key in current);
-      current = current[key]!;
-    }
-  }
-  return current;
-}
-function arrayAt(root: unknown, ...keys: readonly (string | number)[]): Json[] {
-  const value = at(root, ...keys);
-  assertSafe(Array.isArray(value));
-  return value;
-}
-function validateSanitized(canonical: string): void {
-  assertSafe(!/(?:\/Users\/|\\Users\\|\/home\/|storefront-issue-|[A-Z]:\\)/i.test(canonical));
-  assertSafe(!/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i.test(canonical));
-  assertSafe(!/(?:-----BEGIN [A-Z ]+ PRIVATE KEY-----|\bBearer\s+[A-Za-z0-9._~-]+)/i.test(canonical));
-}
-function validateScope(evidence: Json, sourceMode: string, destinationMode: string): void {
-  assertSafe(at(evidence, "scope", "sourceTenant") === SOURCE);
-  assertSafe(at(evidence, "scope", "sourceMode") === sourceMode);
-  assertSafe(at(evidence, "scope", "cloneTenant") === CLONE);
-  assertSafe(at(evidence, "scope", "destinationMode") === destinationMode);
-}
-
-/** Validate that all product evidence belongs to one active, ordered clone session. */
-export function validateComposedV84Pass(unsafe: unknown): asserts unsafe is Json {
-  const evidence = object(unsafe);
-  validateScope(evidence, "read-only-fixed-fixture", "offline-in-memory-fake-local-only");
-  assertSafe(at(evidence, "proof") === "ws3-composed-clean-clone-pass");
-  assertSafe(at(evidence, "stateHandoff", "startsAbsent") === true);
-  assertSafe(at(evidence, "stateHandoff", "provisioned", "state") === "active");
-  assertSafe(at(evidence, "stateHandoff", "provisioned", "cloneTenant") === CLONE);
-  assertSafe(at(evidence, "stateHandoff", "activeThroughFinalStage") === true);
-  const immutable = at(evidence, "stateHandoff", "immutableExecution");
-  assertSafe(at(immutable, "exactBytesReadOnceAndExecuted") === true);
-  assertSafe(at(immutable, "sourceGraphCount") === V84_CLEAN_CLONE_GRAPH_COUNT);
-  assertSafe(at(immutable, "sourceGraphSha256") === V84_CLEAN_CLONE_GRAPH_SHA256);
-  const snapshotSha256 = at(immutable, "executionSnapshotSha256");
-  assertSafe(typeof snapshotSha256 === "string" && /^[a-f0-9]{64}$/.test(snapshotSha256));
-  const executionLedger = arrayAt(immutable, "ledger");
-  assertSafe(executionLedger.length === STAGE_ORDER.length);
-  const ledger = arrayAt(evidence, "stateHandoff", "stageLedger");
-  assertSafe(ledger.length === STAGE_ORDER.length);
-  for (let index = 0; index < STAGE_ORDER.length; index += 1) {
-    const row = ledger[index]!;
-    const stage = STAGE_ORDER[index]!;
-    const executionRow = executionLedger[index]!;
-    assertSafe(at(executionRow, "stage") === stage);
-    assertSafe(at(executionRow, "sourceGraphCount") === V84_CLEAN_CLONE_GRAPH_COUNT);
-    assertSafe(at(executionRow, "sourceGraphSha256") === V84_CLEAN_CLONE_GRAPH_SHA256);
-    assertSafe(at(executionRow, "executionSnapshotSha256") === snapshotSha256);
-    assertSafe(at(row, "stage") === stage);
-    assertSafe(at(row, "cloneTenant") === CLONE);
-    assertSafe(at(row, "cloneState") === "active");
-    assertSafe(at(row, "sessionId") === SESSION);
-    assertSafe(at(row, "sharedStateKeyCount") === [1, 5, 9, 4][index]);
-    assertSafe(at(row, "evidenceSha256") === at(evidence, "stages", stage, "evidenceSha256"));
-    const stageEvidence = at(evidence, "stages", stage, "evidence");
-    assertSafe(at(row, "evidenceSha256") === `sha256:${digest(JSON.stringify(stageEvidence))}`);
-  }
-  assertSafe(arrayAt(evidence, "stateHandoff", "cleanup", "cloneResidual", "kvKeys").length === 0);
-  assertSafe(arrayAt(evidence, "stateHandoff", "cleanup", "cloneResidual", "r2Keys").length === 0);
-  assertSafe(at(evidence, "stateHandoff", "cleanup", "sourcePreserved") === true);
-  const deletedKvKeys = arrayAt(evidence, "stateHandoff", "cleanup", "kvKeysDeleted");
-  for (const required of [
-    "shared-state:stage/import/handoff",
-    "shared-state:stage/native/drafts/",
-    "shared-state:stage/native/installs/",
-    "shared-state:stage/native/handoff",
-    "shared-state:stage/dogfood/artifacts/",
-    "shared-state:stage/dogfood/handoff",
-    "shared-state:stage/lifecycle/materialization/",
-    "shared-state:stage/lifecycle/cache/",
-    "shared-state:stage/lifecycle/handoff",
-  ]) {
-    assertSafe(deletedKvKeys.some((key) => typeof key === "string" && key.includes(required)));
-  }
-  assertSafe(at(evidence, "sourceInvariant", "fixtureSha256Before") === at(evidence, "sourceInvariant", "fixtureSha256After"));
-  assertSafe(at(evidence, "sourceInvariant", "sourceStateBefore") === at(evidence, "sourceInvariant", "sourceStateAtFinalStage"));
-  assertSafe(at(evidence, "sourceInvariant", "sourceStateBefore") === at(evidence, "sourceInvariant", "sourceStateAfterCleanup"));
-  assertSafe(at(evidence, "sourceInvariant", "sourceWrites") === 0);
-  assertSafe(at(evidence, "sourceInvariant", "unchanged") === true);
-  const imported = at(evidence, "stages", "import", "evidence");
-  validateScope(imported, "read-only-fixture", "offline-in-memory-only");
-  assertSafe(at(imported, "accounting", "accountedTotal") === 89);
-  assertSafe(arrayAt(imported, "codeExecutionUnsupported").length === 8);
-  assertSafe(at(imported, "safety", "sourceMutationCount") === 0);
-  assertSafe(at(imported, "safety", "networkRequestCount") === 0);
-  assertSafe(at(imported, "safety", "importedCodeExecuted") === false);
-  const native = at(evidence, "stages", "native", "evidence");
-  validateScope(native, "read-only", "offline-in-memory-fake-only");
-  assertSafe(arrayAt(native, "installations").length === 2);
-  assertSafe(at(native, "safety", "liveDestinationCount") === 0);
-  assertSafe(at(native, "safety", "externalNetworkRequestCount") === 0);
-  assertSafe(at(native, "operationCounts", "publish") === 0);
-  const dogfood = at(evidence, "stages", "dogfood", "evidence");
-  validateScope(dogfood, "read-only-fixture", "fake-local-only");
-  assertSafe(arrayAt(dogfood, "ledger").length === 8);
-  assertSafe(at(dogfood, "summary", "retired") === 3);
-  assertSafe(at(dogfood, "summary", "evidenceRejected") === 5);
-  assertSafe(at(dogfood, "summary", "unexplainedNotInstalled") === 0);
-  assertSafe(at(dogfood, "safety", "externalNetworkRequests") === 0);
-  assertSafe(at(dogfood, "safety", "dataLayerTouched") === false);
-  const lifecycle = at(evidence, "stages", "lifecycle", "evidence");
-  validateScope(lifecycle, "read-only", "offline-in-memory-callback-only");
-  assertSafe(at(lifecycle, "disabledDrafts", "materializedCount") === 0);
-  assertSafe(at(lifecycle, "operationCounts", "sourceWrites") === 0);
-  assertSafe(at(lifecycle, "operationCounts", "externalNetworkRequests") === 0);
-  assertSafe(at(lifecycle, "operationCounts", "lifecycleMutations") === 0);
-  assertSafe(at(lifecycle, "operationCounts", "publishes") === 0);
-  assertSafe(at(evidence, "result") === "pass");
-}
-
-export function composeV84CleanCloneReplayEvidence(
-  firstUnsafe: unknown,
-  secondUnsafe: unknown,
-  graph: V84CleanCloneGraphIdentity,
-  executionSnapshotSha256: string,
-) {
-  const firstCanonical = JSON.stringify(firstUnsafe);
-  const secondCanonical = JSON.stringify(secondUnsafe);
-  const first = object(JSON.parse(firstCanonical) as unknown);
-  const second = object(JSON.parse(secondCanonical) as unknown);
-  validateSanitized(firstCanonical);
-  validateSanitized(secondCanonical);
-  validateComposedV84Pass(first);
-  validateComposedV84Pass(second);
-  assertSafe(firstCanonical === secondCanonical);
-  assertSafe(graph.count === V84_CLEAN_CLONE_GRAPH_COUNT && graph.sha256 === V84_CLEAN_CLONE_GRAPH_SHA256);
-  assertSafe(/^[a-f0-9]{64}$/.test(executionSnapshotSha256));
-  assertSafe(at(first, "stateHandoff", "immutableExecution", "executionSnapshotSha256") === executionSnapshotSha256);
-  const passEvidenceSha256 = digest(firstCanonical);
-  const pass = first;
-  return {
-    schemaVersion: 2 as const,
-    proof: "ws3-composed-clean-clone-complete-replay" as const,
-    scope: at(pass, "scope"),
-    commandPin: {
-      entry: V84_CLEAN_CLONE_LAUNCHER_ENTRY,
-      resolvedSourceCount: graph.count,
-      resolvedSourceGraphSha256: graph.sha256,
-      executionSnapshotSha256,
-      composedPassEvidenceSha256: passEvidenceSha256,
-      exactBytesReadOnceAndExecuted: true as const,
-      runtimeTooling: "none" as const,
-    },
-    replay: { passes: 2 as const, exact: true as const },
-    stateHandoff: at(pass, "stateHandoff"),
-    sourceInvariant: at(pass, "sourceInvariant"),
-    accounting: at(pass, "stages", "import", "evidence", "accounting"),
-    nativeInstallSummary: {
-      count: arrayAt(pass, "stages", "native", "evidence", "installations").length,
-      lifecycle: at(pass, "stages", "native", "evidence", "safety", "lifecycle"),
-      liveDestinationCount: at(pass, "stages", "native", "evidence", "safety", "liveDestinationCount"),
-    },
-    eightRouteLedger: at(pass, "stages", "dogfood", "evidence", "ledger"),
-    eightRouteSummary: at(pass, "stages", "dogfood", "evidence", "summary"),
-    lifecycleSummary: {
-      disabledDrafts: at(pass, "stages", "lifecycle", "evidence", "disabledDrafts"),
-      operationCounts: at(pass, "stages", "lifecycle", "evidence", "operationCounts"),
-    },
-    safety: {
-      externalNetworkRequests: 0 as const, liveSecretsUsed: 0 as const,
-      productionActions: 0 as const, sourceMutations: 0 as const,
-      importedCodeExecuted: false as const, originalMarkupRendered: false as const,
-      runtimeLoaderInitialized: false as const, dataLayerTouched: false as const,
-    },
-    result: "pass" as const,
-  };
-}

package/apps/storefront/scripts/run-fixed-v84-native-install-producer.mjs

@@ -1,18 +0,0 @@
-/** Trusted plain-JavaScript bootstrap for the frozen v84 native-install producer. */
-if (process.argv.length !== 2) {
-  process.stderr.write("refused: fixed-input native-install evidence accepts no arguments\n");
-  process.exitCode = 64;
-} else try {
-  const { sanitizeV84ProofEnvironment } = await import("./sanitize-v84-proof-environment.mjs");
-  sanitizeV84ProofEnvironment();
-  await import("tsx");
-  const { tsImport } = await import("tsx/esm/api");
-  const tooling = await tsImport("./initialize-v84-lifecycle-tooling.ts", import.meta.url);
-  if (tooling.V84_LIFECYCLE_TOOLING_READY !== true) throw new Error("tooling unavailable");
-  await import("./deny-v84-lifecycle-capabilities.mjs");
-  const producer = await tsImport("./install-v84-native-through-ws1.ts", import.meta.url);
-  process.stdout.write(`${JSON.stringify(await producer.buildFixedV84NativeInstallEvidence(), null, 2)}\n`);
-} catch {
-  process.stderr.write("refused: fixed native-install evidence unavailable\n");
-  process.exitCode = 70;
-}

package/apps/storefront/scripts/run-v84-clone-isolation-proof.mjs

@@ -1,18 +0,0 @@
-/** Capability-denied bootstrap for the fixed offline clone isolation proof. */
-if (process.argv.length !== 2) {
-  process.stderr.write("refused: fixed-input clone-isolation command accepts no arguments\n");
-  process.exitCode = 64;
-} else try {
-  const { sanitizeV84ProofEnvironment } = await import("./sanitize-v84-proof-environment.mjs");
-  sanitizeV84ProofEnvironment();
-  await import("tsx");
-  const { tsImport } = await import("tsx/esm/api");
-  const tooling = await tsImport("./initialize-v84-lifecycle-tooling.ts", import.meta.url);
-  if (tooling.V84_LIFECYCLE_TOOLING_READY !== true) throw new Error("tooling unavailable");
-  await import("./deny-v84-lifecycle-capabilities.mjs");
-  const proof = await tsImport("./prove-clone-isolation.ts", import.meta.url);
-  process.stdout.write(`${JSON.stringify(await proof.runOfflineCloneIsolationProof(), null, 2)}\n`);
-} catch {
-  process.stderr.write("refused: fixed clone-isolation evidence unavailable\n");
-  process.exitCode = 70;
-}

package/apps/storefront/scripts/run-v84-clone-lifecycle-proof.mjs

@@ -1,18 +0,0 @@
-/** Trusted plain-JavaScript bootstrap for the fixed v84 lifecycle proof. */
-try {
-  const { sanitizeV84ProofEnvironment } = await import("./sanitize-v84-proof-environment.mjs");
-  sanitizeV84ProofEnvironment();
-  await import("tsx");
-  const { tsImport } = await import("tsx/esm/api");
-  const tooling = await tsImport("./initialize-v84-lifecycle-tooling.ts", import.meta.url);
-  if (tooling.V84_LIFECYCLE_TOOLING_READY !== true) throw new Error("tooling unavailable");
-  Object.defineProperty(globalThis, Symbol.for("tot.v84.lifecycle-producer-capability"), {
-    configurable: true,
-    value: "allow-exact-native-install-producer",
-  });
-  await import("./deny-v84-lifecycle-capabilities.mjs");
-  await tsImport("./validate-v84-clone-lifecycle.ts", import.meta.url);
-} catch {
-  process.stderr.write("refused: fixed lifecycle evidence unavailable\n");
-  process.exitCode = 70;
-}

package/apps/storefront/scripts/run-v84-import-through-ws2-proof.mjs

@@ -1,17 +0,0 @@
-/** Capability-denied bootstrap for the fixed offline WS2 import proof. */
-if (process.argv.length !== 2) {
-  process.stderr.write("refused: fixed-input WS2 import command accepts no arguments\n");
-  process.exitCode = 64;
-} else try {
-  const { sanitizeV84ProofEnvironment } = await import("./sanitize-v84-proof-environment.mjs");
-  sanitizeV84ProofEnvironment();
-  await import("tsx");
-  const { tsImport } = await import("tsx/esm/api");
-  const tooling = await tsImport("./initialize-v84-lifecycle-tooling.ts", import.meta.url);
-  if (tooling.V84_LIFECYCLE_TOOLING_READY !== true) throw new Error("tooling unavailable");
-  await import("./deny-v84-lifecycle-capabilities.mjs");
-  await tsImport("./import-v84-through-ws2.ts", import.meta.url);
-} catch {
-  process.stderr.write("refused: fixed WS2 import evidence unavailable\n");
-  process.exitCode = 70;
-}

package/apps/storefront/scripts/run-v84-nonportable-route-dogfood.mjs

@@ -1,15 +0,0 @@
-/** Capability-denied bootstrap for the fixed v84 eight-route dogfood proof. */
-try {
-  // No caller environment survives into the proof; live secrets cannot be read.
-  const { sanitizeV84ProofEnvironment } = await import("./sanitize-v84-proof-environment.mjs");
-  sanitizeV84ProofEnvironment();
-  await import("tsx");
-  const { tsImport } = await import("tsx/esm/api");
-  const tooling = await tsImport("./initialize-v84-lifecycle-tooling.ts", import.meta.url);
-  if (tooling.V84_LIFECYCLE_TOOLING_READY !== true) throw new Error("tooling unavailable");
-  await import("./deny-v84-dogfood-capabilities.mjs");
-  await tsImport("./dogfood-v84-nonportable-routes.ts", import.meta.url);
-} catch {
-  process.stderr.write("refused: fixed nonportable-route dogfood unavailable\n");
-  process.exitCode = 70;
-}

package/apps/storefront/scripts/sanitize-v84-proof-environment.mjs

@@ -1,21 +0,0 @@
-/** Reduce the native process environment to the one fixed proof setting. */
-export function sanitizeV84ProofEnvironment() {
-  const environment = process.env;
-  const inheritedKeys = Reflect.ownKeys(environment);
-  for (const key of inheritedKeys) {
-    if (typeof key !== "string" || !Reflect.deleteProperty(environment, key)) {
-      throw new Error("proof environment unavailable");
-    }
-  }
-  if (Reflect.ownKeys(environment).length !== 0) {
-    throw new Error("proof environment unavailable");
-  }
-  environment.TSX_DISABLE_CACHE = "1";
-  const descriptors = Object.getOwnPropertyDescriptors(environment);
-  const keys = Reflect.ownKeys(descriptors);
-  const descriptor = descriptors.TSX_DISABLE_CACHE;
-  if (keys.length !== 1 || keys[0] !== "TSX_DISABLE_CACHE" || descriptor === undefined ||
-      !("value" in descriptor) || descriptor.value !== "1") {
-    throw new Error("proof environment unavailable");
-  }
-}

package/apps/storefront/scripts/v84CleanCloneGraphPin.ts

@@ -1,42 +0,0 @@
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { resolveV84CleanCloneSourceGraph } from "./v84CleanCloneSourceGraph.js";
-
-export const V84_CLEAN_CLONE_LAUNCHER_ENTRY =
-  "scripts/diag/rerun-v84-clean-clone.sh" as const;
-export const V84_CLEAN_CLONE_BOOTSTRAP_ENTRY =
-  "scripts/diag/run-v84-clean-clone-attested.cjs" as const;
-export const V84_CLEAN_CLONE_STANDALONE_SOURCE_ENTRY =
-  "apps/storefront/scripts/replay-v84-clean-clone-standalone.ts" as const;
-export const V84_CLEAN_CLONE_BUILD_ENTRY =
-  "apps/storefront/scripts/build-v84-clean-clone-standalone.mjs" as const;
-export const V84_CLEAN_CLONE_GRAPH_COUNT = 191;
-export const V84_CLEAN_CLONE_GRAPH_SHA256 =
-  "dc9fb2e28b7d8041ca901ae2df204ab34da1eb957cd88f75437361e42491e566" as const;
-
-export interface V84CleanCloneGraphIdentity {
-  readonly paths: readonly string[];
-  readonly count: number;
-  readonly sha256: string;
-}
-
-export function resolvePinnedV84CleanCloneGraph(): V84CleanCloneGraphIdentity {
-  const storefrontDir = dirname(dirname(fileURLToPath(import.meta.url)));
-  const repositoryRoot = resolve(storefrontDir, "../..");
-  return resolveV84CleanCloneSourceGraph(repositoryRoot, [
-    V84_CLEAN_CLONE_LAUNCHER_ENTRY,
-    V84_CLEAN_CLONE_BOOTSTRAP_ENTRY,
-    V84_CLEAN_CLONE_STANDALONE_SOURCE_ENTRY,
-    V84_CLEAN_CLONE_BUILD_ENTRY,
-  ]);
-}
-
-export function assertPinnedV84CleanCloneGraph(
-  resolveGraph: () => V84CleanCloneGraphIdentity = resolvePinnedV84CleanCloneGraph,
-): V84CleanCloneGraphIdentity {
-  const graph = resolveGraph();
-  if (graph.count !== V84_CLEAN_CLONE_GRAPH_COUNT || graph.sha256 !== V84_CLEAN_CLONE_GRAPH_SHA256) {
-    throw new Error("The fixed clean-clone graph changed.");
-  }
-  return graph;
-}

package/apps/storefront/scripts/v84CleanCloneSourceGraph.ts

@@ -1,145 +0,0 @@
-import { createHash } from "node:crypto";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { dirname, extname, relative, resolve, sep } from "node:path";
-
-const TOOLCHAIN_FILES = [
-  "package.json",
-  "pnpm-lock.yaml",
-  "pnpm-workspace.yaml",
-  "apps/storefront/package.json",
-  "apps/storefront/tsconfig.json",
-] as const;
-const IMPORT_PATTERN = /(?:from\s+|import\s*(?:\(\s*)?|tsImport\s*\(\s*|require(?:\.resolve)?\s*\(\s*)["'`]([^"'`]+)["'`]/g;
-const URL_PATTERN = /new\s+URL\s*\(\s*["'`]([^"'`]+)["'`]\s*,\s*import\.meta\.url\s*\)/g;
-
-function sha256(value: string): string {
-  return createHash("sha256").update(value).digest("hex");
-}
-
-function canonicalSource(path: string, repositoryRoot: string): string {
-  const source = readFileSync(path, "utf8");
-  const relativePath = relative(repositoryRoot, path).split(sep).join("/");
-  if (relativePath === "apps/storefront/scripts/v84CleanCloneGraphPin.ts") {
-    const canonical = source.replace(
-      /(V84_CLEAN_CLONE_GRAPH_SHA256\s*=\s*")[a-f0-9]{64}("\s+as const)/,
-      "$1<self-pinned-graph-sha256>$2",
-    );
-    if (canonical === source) throw new Error("The clean-clone graph self-pin could not be canonicalized.");
-    return canonical;
-  }
-  if (relativePath === "scripts/diag/rerun-v84-clean-clone.sh") {
-    const canonical = source.replace(
-      /(expected_artifact_sha256=)[a-f0-9]{64}/,
-      "$1<self-pinned-replay-artifact-sha256>",
-    );
-    if (canonical === source) throw new Error("The clean-clone replay artifact pin could not be canonicalized.");
-    return canonical;
-  }
-  if (relativePath === "scripts/diag/run-v84-clean-clone-attested.cjs") {
-    const canonical = source.replace(
-      /(const expected = ")[a-f0-9]{64}(";)/,
-      "$1<self-pinned-execution-snapshot-sha256>$2",
-    );
-    if (canonical === source) throw new Error("The clean-clone bootstrap snapshot pin could not be canonicalized.");
-    return canonical;
-  }
-  return source;
-}
-
-function workspacePackages(repositoryRoot: string) {
-  const packages = new Map<string, { root: string; packageJson: string; manifest: Record<string, unknown> }>();
-  for (const parent of ["apps", "packages"]) {
-    const parentPath = resolve(repositoryRoot, parent);
-    for (const child of readdirSync(parentPath, { withFileTypes: true })) {
-      if (!child.isDirectory()) continue;
-      const root = resolve(parentPath, child.name);
-      const packageJson = resolve(root, "package.json");
-      if (!existsSync(packageJson)) continue;
-      const manifest = JSON.parse(readFileSync(packageJson, "utf8")) as Record<string, unknown>;
-      if (typeof manifest.name === "string") packages.set(manifest.name, { root, packageJson, manifest });
-    }
-  }
-  return packages;
-}
-
-function candidatePaths(target: string): string[] {
-  const extension = extname(target);
-  if (extension === ".js") return [target, `${target.slice(0, -3)}.ts`, `${target.slice(0, -3)}.mjs`];
-  if (extension) return [target];
-  return [target, `${target}.ts`, `${target}.mjs`, `${target}.js`, `${target}.json`, resolve(target, "index.ts")];
-}
-
-function exactFile(target: string): string {
-  const found = candidatePaths(target).find((path) => existsSync(path) && statSync(path).isFile());
-  if (!found) throw new Error("The clean-clone executable import graph could not be resolved.");
-  return found;
-}
-
-function exportTarget(exportsValue: unknown, key: string): string | null {
-  if (typeof exportsValue === "string" && key === ".") return exportsValue;
-  if (!exportsValue || typeof exportsValue !== "object" || Array.isArray(exportsValue)) return null;
-  const selected = (exportsValue as Record<string, unknown>)[key];
-  if (typeof selected === "string") return selected;
-  if (!selected || typeof selected !== "object" || Array.isArray(selected)) return null;
-  const conditions = selected as Record<string, unknown>;
-  for (const condition of ["import", "default", "types"]) {
-    if (typeof conditions[condition] === "string") return conditions[condition];
-  }
-  return null;
-}
-
-function resolveSpecifier(
-  specifier: string,
-  importer: string,
-  repositoryRoot: string,
-  packages: ReturnType<typeof workspacePackages>,
-): string[] {
-  const clean = specifier.split(/[?#]/, 1)[0]!;
-  if (clean.startsWith("node:") || /^[a-z]+:/i.test(clean)) return [];
-  if (clean.startsWith(".")) return [exactFile(resolve(dirname(importer), clean))];
-  if (clean.startsWith("@/")) return [exactFile(resolve(repositoryRoot, "apps/storefront/src", clean.slice(2)))];
-  const matched = [...packages.entries()]
-    .sort(([left], [right]) => right.length - left.length)
-    .find(([name]) => clean === name || clean.startsWith(`${name}/`));
-  if (!matched) return [];
-  const [name, workspace] = matched;
-  const subpath = clean === name ? "." : `.${clean.slice(name.length)}`;
-  const target = exportTarget(workspace.manifest.exports, subpath) ??
-    (subpath === "." && typeof workspace.manifest.main === "string" ? workspace.manifest.main : null);
-  if (!target) throw new Error("The clean-clone workspace barrel could not be resolved.");
-  return [workspace.packageJson, exactFile(resolve(workspace.root, target))];
-}
-
-function insideRepository(path: string, repositoryRoot: string): boolean {
-  const tail = relative(repositoryRoot, path);
-  return tail !== "" && tail !== ".." && !tail.startsWith(`..${sep}`) && !resolve(path).includes(`${sep}node_modules${sep}`);
-}
-
-export function resolveV84CleanCloneSourceGraph(repositoryRoot: string, entries: readonly string[]) {
-  const packages = workspacePackages(repositoryRoot);
-  const seen = new Set<string>();
-  const pending = [
-    ...TOOLCHAIN_FILES.map((path) => resolve(repositoryRoot, path)),
-    ...entries.map((path) => resolve(repositoryRoot, path)),
-  ];
-  while (pending.length > 0) {
-    const path = exactFile(pending.pop()!);
-    if (seen.has(path)) continue;
-    if (!insideRepository(path, repositoryRoot)) throw new Error("The clean-clone source graph escaped the repository.");
-    seen.add(path);
-    const source = readFileSync(path, "utf8");
-    const specifiers = [
-      ...[...source.matchAll(IMPORT_PATTERN)].map((match) => match[1]!),
-      ...[...source.matchAll(URL_PATTERN)].map((match) => match[1]!),
-    ];
-    for (const specifier of specifiers) {
-      for (const resolved of resolveSpecifier(specifier, path, repositoryRoot, packages)) pending.push(resolved);
-    }
-  }
-  const paths = [...seen].sort();
-  const canonical = JSON.stringify(paths.map((path) => [
-    relative(repositoryRoot, path).split(sep).join("/"),
-    canonicalSource(path, repositoryRoot),
-  ]));
-  return { paths, count: paths.length, sha256: sha256(canonical) };
-}

package/apps/storefront/scripts/validate-v84-clone-lifecycle.ts

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-/** Fixed-input lifecycle proof composed from the frozen offline native-install producer. */
-import { readFixedV84NativeInstallEvidence } from "./fixed-v84-native-install-producer.js";
-import { buildV84CloneLifecycleEvidence } from "../src/lib/apps/v84CloneLifecycleEvidence.js";
-
-if (process.argv.length !== 2) {
-  process.stderr.write("refused: fixed-input lifecycle command accepts no arguments\n");
-  process.exit(64);
-}
-
-try {
-  const nativeEvidence = readFixedV84NativeInstallEvidence();
-  const evidence = await buildV84CloneLifecycleEvidence(nativeEvidence);
-  process.stdout.write(`${JSON.stringify(evidence, null, 2)}\n`);
-} catch {
-  process.stderr.write("refused: fixed lifecycle evidence unavailable\n");
-  process.exit(70);
-}