@tradejs/cli 3.1.21 → 3.1.22

package/dist/lib/runtimeEvidenceProducer.js

@@ -0,0 +1,98 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/lib/runtimeEvidenceProducer.ts
+var runtimeEvidenceProducer_exports = {};
+__export(runtimeEvidenceProducer_exports, {
+  parseRuntimeEvidenceProducer: () => parseRuntimeEvidenceProducer,
+  resolveRuntimeEvidenceProducer: () => resolveRuntimeEvidenceProducer
+});
+module.exports = __toCommonJS(runtimeEvidenceProducer_exports);
+var import_node_crypto = require("crypto");
+var import_promises = __toESM(require("fs/promises"));
+var import_node_path = __toESM(require("path"));
+var isRecord = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var sha256 = (value) => (0, import_node_crypto.createHash)("sha256").update(value).digest("hex");
+var parseRuntimeEvidenceProducer = (value) => {
+  const producer = isRecord(value) ? value : null;
+  const runtimePackageManifest = isRecord(producer?.runtimePackageManifest) ? producer.runtimePackageManifest : null;
+  if (producer?.schemaVersion !== 1 || typeof producer.projectSha !== "string" || !/^[a-f0-9]{40}$/.test(producer.projectSha) || typeof producer.imageDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(producer.imageDigest) || runtimePackageManifest?.file !== "runtime-package-manifest.json" || typeof runtimePackageManifest.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(runtimePackageManifest.sha256)) {
+    throw new Error("Runtime evidence producer image identity is invalid");
+  }
+  return producer;
+};
+var resolveRuntimeEvidenceProducer = async ({
+  projectRoot,
+  required
+}) => {
+  const projectSha = String(process.env.TRADEJS_PROJECT_SHA ?? "").trim();
+  const imageDigest = String(
+    process.env.TRADEJS_PROJECT_IMAGE_DIGEST ?? ""
+  ).trim();
+  if (!projectSha && !imageDigest && !required) {
+    return null;
+  }
+  if (!/^[a-f0-9]{40}$/.test(projectSha)) {
+    throw new Error(
+      "TRADEJS_PROJECT_SHA must be a full lowercase Git SHA before publishing runtime evidence"
+    );
+  }
+  if (!/^sha256:[a-f0-9]{64}$/.test(imageDigest)) {
+    throw new Error(
+      "TRADEJS_PROJECT_IMAGE_DIGEST must be an immutable sha256 digest before publishing runtime evidence"
+    );
+  }
+  const manifestPath = import_node_path.default.join(projectRoot, "runtime-package-manifest.json");
+  let manifest;
+  try {
+    manifest = await import_promises.default.readFile(manifestPath);
+  } catch (error) {
+    if (!required && error.code === "ENOENT") {
+      return null;
+    }
+    throw new Error(
+      `Runtime package manifest is required for runtime evidence: ${manifestPath}`,
+      { cause: error }
+    );
+  }
+  return {
+    schemaVersion: 1,
+    projectSha,
+    imageDigest,
+    runtimePackageManifest: {
+      file: "runtime-package-manifest.json",
+      sha256: sha256(manifest)
+    }
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseRuntimeEvidenceProducer,
+  resolveRuntimeEvidenceProducer
+});

package/dist/lib/runtimeEvidenceSync.js

@@ -377,7 +377,8 @@ var markRuntimeEvidenceBundleProcessed = async ({
   evidenceRoot,
   deploymentId,
   bundleDir,
-  scorecardPath
+  scorecardPath,
+  runtimeFeedback
 }) => {
   const safeDeploymentId = safeSegment(deploymentId, "production");
   const verified = await verifyRuntimeEvidenceBundle(bundleDir);
@@ -390,11 +391,15 @@ var markRuntimeEvidenceBundleProcessed = async ({
   const finalPath = receiptPath(receiptsRoot, verified.manifest.artifactId);
   const temporaryPath = `${finalPath}.tmp-${process.pid}`;
   const receipt = {
-    schemaVersion: 1,
+    schemaVersion: runtimeFeedback ? 2 : 1,
     artifactId: verified.manifest.artifactId,
     payloadSha256: verified.manifest.payload.sha256,
     processedAt: Date.now(),
-    scorecardPath: scorecardPath ?? null
+    scorecardPath: scorecardPath ?? null,
+    ...runtimeFeedback ? {
+      runtimeFeedbackArtifactId: runtimeFeedback.artifactId,
+      replayEvidenceSha256: runtimeFeedback.replayEvidenceSha256
+    } : {}
   };
   await import_promises2.default.mkdir(receiptsRoot, { recursive: true });
   await import_promises2.default.writeFile(