@tomflow/proflow-platform-cli 0.1.14 → 0.1.16

package/dist/src/verification/verify.d.ts

@@ -1,33 +0,0 @@
-import type { ModuleOperationResult } from "@tomflow/proflow-module-contract";
-import type { ResolvedModule, VerificationRecord } from "../contracts.ts";
-import type { ModuleCatalog } from "../modules.ts";
-import type { WorkspacePaths } from "../paths.ts";
-export interface VerifyResult {
-    moduleRef: string;
-    record: VerificationRecord;
-    result: ModuleOperationResult;
-    observedEffects: string[];
-}
-/**
- * Derives a stable verificationRef from the record's own identity fields. It is
- * deterministic (no randomness) yet unique per verification event, because the
- * recorded `verifiedAt` timestamp is part of the canonical input.
- */
-export declare function verificationRefOf(record: Omit<VerificationRecord, "verificationRef">): string;
-/**
- * Fingerprints the identity-defining config of an external resource. Key order
- * is normalized so the fingerprint is stable regardless of insertion order.
- */
-export declare function configFingerprint(values: Record<string, string>, secretRefs?: readonly string[]): string;
-/**
- * Verifies a single module by dispatching its public `verify` primitive through
- * the lifecycle boundary, then appending a Version Verification Record. The
- * verdict always comes from the live adapter result, never from persisted
- * history. Records are appended, never overwritten.
- */
-export declare function verifyModule(catalog: ModuleCatalog, module: ResolvedModule, paths: WorkspacePaths): Promise<VerifyResult>;
-/**
- * Verifies every module that declares the `verify` primitive; modules without
- * it are skipped (the descriptor is the truth for what is verifiable).
- */
-export declare function verifyModules(catalog: ModuleCatalog, modules: readonly ResolvedModule[], paths: WorkspacePaths): Promise<VerifyResult[]>;

package/dist/src/verification/verify.js

@@ -1,114 +0,0 @@
-import { createHash } from "node:crypto";
-import { dispatchLifecycle } from "../lifecycle/index.js";
-import { appendVerification, loadConfig } from "../persistence/index.js";
-/**
- * Derives a stable verificationRef from the record's own identity fields. It is
- * deterministic (no randomness) yet unique per verification event, because the
- * recorded `verifiedAt` timestamp is part of the canonical input.
- */
-export function verificationRefOf(record) {
-    const canonical = JSON.stringify([
-        record.moduleRef,
-        record.moduleVersion,
-        record.resourceIdentity ?? null,
-        record.resourceVersion ?? null,
-        record.result,
-        record.verifiedAt,
-    ]);
-    const digest = createHash("sha256").update(canonical).digest("hex");
-    return `verify-${record.moduleRef}-${digest.slice(0, 16)}`;
-}
-/**
- * Fingerprints the identity-defining config of an external resource. Key order
- * is normalized so the fingerprint is stable regardless of insertion order.
- */
-export function configFingerprint(values, secretRefs = []) {
-    const entries = [
-        ...Object.entries(values)
-            .sort(([left], [right]) => left.localeCompare(right))
-            .map(([key, value]) => `${key}=${value}`),
-        ...[...secretRefs].sort().map((key) => `secretRef=${key}`),
-    ];
-    const digest = createHash("sha256").update(entries.join("\n")).digest("hex");
-    return `fp-${digest.slice(0, 16)}`;
-}
-// A verification record is a binary verdict: only an explicit SUCCEEDED maps to
-// PASS. BLOCKED / ACTION_REQUIRED / FAILED are all recorded as FAIL so a pending
-// human action or blocked dependency can never masquerade as a passing verify.
-function verdictOf(status) {
-    return status === "SUCCEEDED" ? "PASS" : "FAIL";
-}
-function summaryOf(result) {
-    if (result.status === "SUCCEEDED") {
-        const checks = result.checks ?? [];
-        if (checks.length === 0)
-            return "verify succeeded";
-        const passed = checks.filter((check) => check.status === "PASS").length;
-        return `verify succeeded (${passed}/${checks.length} checks passed)`;
-    }
-    if (result.status === "ACTION_REQUIRED" &&
-        result.actionRequired !== undefined) {
-        return `action required: ${result.actionRequired.action} — ${result.actionRequired.description}`;
-    }
-    if (result.error !== undefined) {
-        return `${result.error.code}: ${result.error.message}`;
-    }
-    return `verify ${result.status.toLowerCase()}`;
-}
-function evidenceRefsOf(result) {
-    return (result.checks ?? []).map((check) => `check:${check.id}:${check.status}`);
-}
-/**
- * Verifies a single module by dispatching its public `verify` primitive through
- * the lifecycle boundary, then appending a Version Verification Record. The
- * verdict always comes from the live adapter result, never from persisted
- * history. Records are appended, never overwritten.
- */
-export async function verifyModule(catalog, module, paths) {
-    const dispatched = await dispatchLifecycle(catalog, module, "verify");
-    const result = dispatched.result;
-    let resourceIdentity;
-    let resourceVersion;
-    if (module.kind === "external-resource") {
-        const config = await loadConfig(paths, module.moduleRef);
-        const secretRefs = module.configSlots
-            .filter((slot) => slot.type === "secretRef")
-            .map((slot) => slot.key);
-        resourceIdentity = configFingerprint(config?.publicValues ?? {}, secretRefs);
-        resourceVersion = result.resourceVersion;
-    }
-    const base = {
-        moduleRef: module.moduleRef,
-        moduleVersion: module.moduleVersion,
-        result: verdictOf(result.status),
-        summary: summaryOf(result),
-        evidenceRefs: evidenceRefsOf(result),
-        verifiedAt: new Date().toISOString(),
-        ...(resourceIdentity !== undefined ? { resourceIdentity } : {}),
-        ...(resourceVersion !== undefined ? { resourceVersion } : {}),
-    };
-    const record = {
-        ...base,
-        verificationRef: verificationRefOf(base),
-    };
-    await appendVerification(paths, record);
-    return {
-        moduleRef: module.moduleRef,
-        record,
-        result,
-        observedEffects: dispatched.observedEffects,
-    };
-}
-/**
- * Verifies every module that declares the `verify` primitive; modules without
- * it are skipped (the descriptor is the truth for what is verifiable).
- */
-export async function verifyModules(catalog, modules, paths) {
-    const results = [];
-    for (const module of modules) {
-        if (!module.lifecycle.includes("verify"))
-            continue;
-        results.push(await verifyModule(catalog, module, paths));
-    }
-    return results;
-}