@yiaany/ghostapi 0.1.9 → 0.2.0

package/dist/evidence/report.js

@@ -1,13 +1,13 @@
 import { createHash } from "node:crypto";
 import { createRequire } from "node:module";
 import { lstat, mkdir, readFile, readdir, rm } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep, } from "node:path";
 import { getDataPaths } from "../config/dataPaths.js";
 import { detectEgressCapabilities } from "../egress/capabilities.js";
-import { evaluatePolicy, loadPolicyFile } from "../policy/index.js";
-import { sanitizeSecrets, sanitizeSecretString, isSecretFieldName } from "../security/secrets.js";
-import { atomicWriteJson, ensurePrivateDirectory } from "../storage/fileStore.js";
-import { diffContracts, loadContract } from "../contracts/index.js";
+import { evaluatePolicy, loadPolicyFile, } from "../policy/index.js";
+import { sanitizeSecrets, sanitizeSecretString, isSecretFieldName, } from "../security/secrets.js";
+import { atomicWriteJson, ensurePrivateDirectory, } from "../storage/fileStore.js";
+import { diffContracts, loadContract, } from "../contracts/index.js";
 const require = createRequire(import.meta.url);
 const packageJson = require("../../package.json");
 const MAX_EVENTS_FOR_REPORT = 1_000;
@@ -16,7 +16,19 @@ const MAX_REPORT_BYTES = 512 * 1024;
 const MAX_RUN_EVIDENCE_BYTES = 128 * 1024;
 const MAX_REPORTS_RETAINED = 20;
 const MAX_ATTEMPTS = 500;
-const SENSITIVE_QUERY_KEYS = new Set(["api_key", "apikey", "access_token", "refresh_token", "token", "secret", "key", "client_secret", "password", "authorization", "cookie"]);
+const SENSITIVE_QUERY_KEYS = new Set([
+    "api_key",
+    "apikey",
+    "access_token",
+    "refresh_token",
+    "token",
+    "secret",
+    "key",
+    "client_secret",
+    "password",
+    "authorization",
+    "cookie",
+]);
 export class EvidenceReportError extends Error {
     constructor(message) {
         super(message);
@@ -33,21 +45,27 @@ export async function generateEvidenceReport(options = {}) {
         events,
         policy: loadedPolicy?.policy,
         policyHash: loadedPolicy?.hash ?? readString(run?.evidence.policy?.policyHash),
-        requiredScenarios: loadedPolicy?.policy.requiredScenarios ?? readStringArray(run?.evidence.policy?.requiredScenarios),
+        requiredScenarios: loadedPolicy?.policy.requiredScenarios ??
+            readStringArray(run?.evidence.policy?.requiredScenarios),
         runEvidence: run?.evidence ?? null,
         contractDiff,
         generatedAt: options.generatedAt ?? new Date().toISOString(),
-        ghostApiVersion: options.ghostApiVersion ?? readPackageVersion()
+        ghostApiVersion: options.ghostApiVersion ?? readPackageVersion(),
     });
     const path = await writeEvidenceReport(report, projectRoot, options.outPath);
     return { report, path };
 }
 export function buildEvidenceReport(input) {
-    const sanitizedEvents = input.events.slice(0, MAX_EVENTS_FOR_REPORT).map((event) => sanitizeEvent(event));
+    const sanitizedEvents = input.events
+        .slice(0, MAX_EVENTS_FOR_REPORT)
+        .map((event) => sanitizeEvent(event));
     const capability = detectEgressCapabilities();
-    const runEvents = Array.isArray(input.runEvidence?.events) ? input.runEvidence.events : [];
+    const runEvents = Array.isArray(input.runEvidence?.events)
+        ? input.runEvidence.events
+        : [];
     const runStatus = readRunStatus(input.runEvidence?.status);
-    const runUsedNamespace = input.runEvidence?.backend === "linux-network-namespace" && runStatus === "finished";
+    const runUsedNamespace = input.runEvidence?.backend === "linux-network-namespace" &&
+        runStatus === "finished";
     const completedScenarios = detectScenarios(sanitizedEvents);
     const requiredScenarios = uniqueSorted(input.requiredScenarios ?? []);
     const providers = uniqueSorted(sanitizedEvents.map((event) => event.provider).filter(Boolean));
@@ -61,87 +79,183 @@ export function buildEvidenceReport(input) {
     }
     const runOutputSecretMatches = readNonNegativeInteger(input.runEvidence?.output?.secretMatches) ?? 0;
     secretMatches += runOutputSecretMatches;
-    const allowedAttempts = sanitizedEvents.map((event) => ({
+    const allowedAttempts = sanitizedEvents
+        .map((event) => ({
         provider: limitText(event.provider),
         method: limitText(event.method),
         path: sanitizePath(event.path),
         statusCode: event.statusCode,
-        source: limitText(event.source)
-    })).slice(0, MAX_ATTEMPTS);
-    const failures = allowedAttempts.filter((attempt) => attempt.statusCode >= 400).map((attempt) => ({ provider: attempt.provider, method: attempt.method, path: attempt.path, statusCode: attempt.statusCode }));
+        source: limitText(event.source),
+    }))
+        .slice(0, MAX_ATTEMPTS);
+    const failures = allowedAttempts
+        .filter((attempt) => attempt.statusCode >= 400)
+        .map((attempt) => ({
+        provider: attempt.provider,
+        method: attempt.method,
+        path: attempt.path,
+        statusCode: attempt.statusCode,
+    }));
     const retryCount = sanitizedEvents.filter((event) => event.statusCode === 429 || hasRetryAfter(event)).length;
-    const productionAttempts = 0;
+    const productionAttempts = null;
     const contractDrift = input.contractDiff === undefined
         ? { breaking: 0, nonBreaking: 0, uncertain: 0 }
-        : { baselineHash: input.contractDiff.baselineHash, candidateHash: input.contractDiff.candidateHash, ...input.contractDiff.summary };
+        : {
+            baselineHash: input.contractDiff.baselineHash,
+            candidateHash: input.contractDiff.candidateHash,
+            ...input.contractDiff.summary,
+        };
     const findings = [];
     const warnings = [];
     if (sanitizedEvents.length < input.events.length)
         warnings.push(`Event evidence was truncated to ${MAX_EVENTS_FOR_REPORT} events.`);
     if (input.runEvidence === null)
         warnings.push("Run evidence is missing; report cannot prove launcher lifecycle or blocked kernel egress attempts.");
+    warnings.push("Production egress attempts are not measured; the current backend records namespace lifecycle and GhostAPI-local traffic only.");
     if (readBoolean(input.runEvidence?.output?.timedOut))
         warnings.push("Target exceeded the configured run timeout.");
     if (readBoolean(input.runEvidence?.output?.limitExceeded))
         warnings.push("Target exceeded the configured output limit.");
     if (runUsedNamespace)
-        findings.push({ id: "enforcement.isolated", severity: "pass", message: "Run evidence reports a completed Linux namespace boundary." });
+        findings.push({
+            id: "enforcement.isolated",
+            severity: "pass",
+            message: "Run evidence reports a completed Linux namespace boundary.",
+        });
     else
-        findings.push({ id: "enforcement.degraded", severity: "warning", message: "Egress enforcement is degraded or unavailable on this host." });
+        findings.push({
+            id: "enforcement.degraded",
+            severity: "warning",
+            message: "Egress enforcement is degraded or unavailable on this host.",
+        });
     if (input.runEvidence?.status === "finished")
-        findings.push({ id: "run.finished", severity: "pass", message: "Run evidence reached finished status." });
+        findings.push({
+            id: "run.finished",
+            severity: "pass",
+            message: "Run evidence reached finished status.",
+        });
     else
-        findings.push({ id: "run.incomplete", severity: "warning", message: "Run evidence is absent or incomplete." });
+        findings.push({
+            id: "run.incomplete",
+            severity: "warning",
+            message: "Run evidence is absent or incomplete.",
+        });
     for (const scenarioId of requiredScenarios) {
-        const decision = input.policy === undefined ? { allowed: completedScenarios.includes(scenarioId) } : evaluatePolicy(input.policy, { type: "scenario", scenarioId, completedScenarioIds: completedScenarios });
+        const decision = input.policy === undefined
+            ? { allowed: completedScenarios.includes(scenarioId) }
+            : evaluatePolicy(input.policy, {
+                type: "scenario",
+                scenarioId,
+                completedScenarioIds: completedScenarios,
+            });
         findings.push(decision.allowed
-            ? { id: `scenario.${scenarioId}`, severity: "pass", message: `Required scenario completed: ${scenarioId}` }
-            : { id: `scenario.${scenarioId}`, severity: "fail", message: `Required scenario missing: ${scenarioId}` });
+            ? {
+                id: `scenario.${scenarioId}`,
+                severity: "pass",
+                message: `Required scenario completed: ${scenarioId}`,
+            }
+            : {
+                id: `scenario.${scenarioId}`,
+                severity: "fail",
+                message: `Required scenario missing: ${scenarioId}`,
+            });
     }
-    const reportDecision = input.policy === undefined ? { allowed: productionAttempts === 0 && secretMatches === 0 && contractDrift.breaking === 0 } : evaluatePolicy(input.policy, { type: "report", productionEgressAttempts: productionAttempts, forbiddenCredentialMatches: secretMatches, breakingContractChanges: contractDrift.breaking });
+    const reportDecision = input.policy === undefined
+        ? { allowed: secretMatches === 0 && contractDrift.breaking === 0 }
+        : {
+            allowed: secretMatches <=
+                input.policy.reports.maxForbiddenCredentialMatches &&
+                contractDrift.breaking <=
+                    input.policy.reports.maxBreakingContractChanges,
+        };
     findings.push(reportDecision.allowed
-        ? { id: "policy.report-thresholds", severity: "pass", message: "Policy report thresholds are satisfied." }
-        : { id: "policy.report-thresholds", severity: "fail", message: "Policy report thresholds are exceeded." });
+        ? {
+            id: "policy.report-thresholds",
+            severity: "pass",
+            message: "Policy report thresholds are satisfied.",
+        }
+        : {
+            id: "policy.report-thresholds",
+            severity: "fail",
+            message: "Policy report thresholds are exceeded.",
+        });
     if (secretMatches > 0)
-        findings.push({ id: "secrets.detected", severity: "fail", message: "Secret-shaped values were detected and summarized without raw values.", count: secretMatches });
+        findings.push({
+            id: "secrets.detected",
+            severity: "fail",
+            message: "Secret-shaped values were detected and summarized without raw values.",
+            count: secretMatches,
+        });
     if (input.contractDiff !== undefined) {
         if (contractDrift.breaking > 0)
-            findings.push({ id: "contract-drift.breaking", severity: "fail", message: "Breaking contract drift was detected.", count: contractDrift.breaking });
+            findings.push({
+                id: "contract-drift.breaking",
+                severity: "fail",
+                message: "Breaking contract drift was detected.",
+                count: contractDrift.breaking,
+            });
         if (contractDrift.uncertain > 0)
-            findings.push({ id: "contract-drift.uncertain", severity: "warning", message: "Contract changes need compatibility review because client tolerance is unknown.", count: contractDrift.uncertain });
+            findings.push({
+                id: "contract-drift.uncertain",
+                severity: "warning",
+                message: "Contract changes need compatibility review because client tolerance is unknown.",
+                count: contractDrift.uncertain,
+            });
     }
     if (failures.length > 0)
-        findings.push({ id: "provider.failures", severity: "warning", message: "Provider failures were observed.", count: failures.length });
+        findings.push({
+            id: "provider.failures",
+            severity: "warning",
+            message: "Provider failures were observed.",
+            count: failures.length,
+        });
     const reportWithoutHash = {
         schemaVersion: 1,
-        artifact: { generatedAt: input.generatedAt, logicalHash: "", canonicalization: "json-stable-sorted-keys-v1" },
+        artifact: {
+            generatedAt: input.generatedAt,
+            logicalHash: "",
+            canonicalization: "json-stable-sorted-keys-v1",
+        },
         run: {
             id: readString(input.runEvidence?.runId) ?? "unknown",
             status: runStatus,
             startedAt: firstTimestamp(runEvents),
             finishedAt: lastTimestamp(runEvents),
-            exitCode: lastExitCode(runEvents)
+            exitCode: lastExitCode(runEvents),
         },
         ghostapi: { version: input.ghostApiVersion ?? "unknown" },
         enforcement: {
             capability: capability.summary,
-            mode: input.runEvidence?.backend === "linux-network-namespace" ? "linux-network-namespace" : "proxy-guidance",
+            mode: input.runEvidence?.backend === "linux-network-namespace"
+                ? "linux-network-namespace"
+                : "proxy-guidance",
             isolated: runUsedNamespace,
-            degraded: !runUsedNamespace
+            degraded: !runUsedNamespace,
         },
         policy: { hash: input.policyHash, requiredScenarios },
         coverage: { providers, scenarios: completedScenarios },
         contractDrift,
         egress: { allowedAttempts, blockedAttempts: [], productionAttempts },
-        secrets: { categories: [...secretCategories].sort(), matches: secretMatches },
-        retriesAndFailures: { retryCount, failureCount: failures.length, failures: failures.slice(0, MAX_ATTEMPTS) },
+        secrets: {
+            categories: [...secretCategories].sort(),
+            matches: secretMatches,
+        },
+        retriesAndFailures: {
+            retryCount,
+            failureCount: failures.length,
+            failures: failures.slice(0, MAX_ATTEMPTS),
+        },
         findings: findings.sort((left, right) => left.id.localeCompare(right.id)),
         warnings: warnings.map(limitText).sort(),
-        summary: { passed: false, failCount: 0, warningCount: 0 }
+        summary: { passed: false, failCount: 0, warningCount: 0 },
     };
     const failCount = reportWithoutHash.findings.filter((finding) => finding.severity === "fail").length;
     const warningCount = reportWithoutHash.findings.filter((finding) => finding.severity === "warning").length + reportWithoutHash.warnings.length;
-    reportWithoutHash.summary = { passed: failCount === 0, failCount, warningCount };
+    reportWithoutHash.summary = {
+        passed: failCount === 0,
+        failCount,
+        warningCount,
+    };
     reportWithoutHash.artifact.logicalHash = hashLogicalReport(reportWithoutHash);
     return reportWithoutHash;
 }
@@ -179,13 +293,13 @@ export function formatEvidenceReport(report) {
         `Contract drift: ${(report.contractDrift ?? emptyContractDrift()).breaking} breaking, ${(report.contractDrift ?? emptyContractDrift()).nonBreaking} non-breaking, ${(report.contractDrift ?? emptyContractDrift()).uncertain} uncertain`,
         `Allowed egress attempts: ${report.egress.allowedAttempts.length}`,
         `Blocked egress attempts: ${report.egress.blockedAttempts.length}`,
-        `Production egress attempts: ${report.egress.productionAttempts}`,
+        `Production egress attempts: ${report.egress.productionAttempts ?? "not measured"}`,
         `Secret categories: ${report.secrets.categories.length > 0 ? report.secrets.categories.map(escapeTerminal).join(", ") : "none"}`,
         `Retries: ${report.retriesAndFailures.retryCount}`,
         `Failures: ${report.retriesAndFailures.failureCount}`,
         `Findings: ${report.summary.failCount} fail, ${report.summary.warningCount} warning`,
         ...report.findings.map((finding) => `  ${finding.severity.toUpperCase()} ${escapeTerminal(finding.id)}: ${escapeTerminal(finding.message)}`),
-        ...report.warnings.map((warning) => `  WARNING evidence: ${escapeTerminal(warning)}`)
+        ...report.warnings.map((warning) => `  WARNING evidence: ${escapeTerminal(warning)}`),
     ].join("\n");
 }
 export function compareEvidenceReports(left, right) {
@@ -200,21 +314,34 @@ export function compareEvidenceReports(left, right) {
         differences.push("egress.productionAttempts differs");
     if (left.secrets.matches !== right.secrets.matches)
         differences.push("secrets.matches differs");
-    if (stableStringify(left.contractDrift ?? emptyContractDrift()) !== stableStringify(right.contractDrift ?? emptyContractDrift()))
+    if (stableStringify(left.contractDrift ?? emptyContractDrift()) !==
+        stableStringify(right.contractDrift ?? emptyContractDrift()))
         differences.push("contractDrift differs");
     if (stableStringify(left.coverage) !== stableStringify(right.coverage))
         differences.push("coverage differs");
     if (stableStringify(left.findings) !== stableStringify(right.findings))
         differences.push("findings differ");
-    return { equal: differences.length === 0, leftHash: left.artifact.logicalHash, rightHash: right.artifact.logicalHash, differences };
+    return {
+        equal: differences.length === 0,
+        leftHash: left.artifact.logicalHash,
+        rightHash: right.artifact.logicalHash,
+        differences,
+    };
 }
 export function formatEvidenceCompare(result) {
     if (result.equal)
         return `Evidence reports match: ${result.leftHash}`;
-    return [`Evidence reports differ:`, `Left: ${result.leftHash}`, `Right: ${result.rightHash}`, ...result.differences.map((difference) => `  - ${escapeTerminal(difference)}`)].join("\n");
+    return [
+        `Evidence reports differ:`,
+        `Left: ${result.leftHash}`,
+        `Right: ${result.rightHash}`,
+        ...result.differences.map((difference) => `  - ${escapeTerminal(difference)}`),
+    ].join("\n");
 }
 async function writeEvidenceReport(report, projectRoot, outPath) {
-    const target = outPath === undefined ? join(getDataPaths().reports, `${report.run.id === "unknown" ? "latest" : report.run.id}.json`) : await resolveOutputPath(outPath, projectRoot);
+    const target = outPath === undefined
+        ? join(getDataPaths().reports, `${report.run.id === "unknown" ? "latest" : report.run.id}.json`)
+        : await resolveOutputPath(outPath, projectRoot);
     await ensurePrivateDirectory(dirname(target));
     await atomicWriteJson(target, report);
     const source = await readFile(target, "utf8");
@@ -260,10 +387,12 @@ async function readPersistedEvents(runEvidencePath) {
     return events;
 }
 async function readRunEvidence(runPath, projectRoot) {
-    const path = runPath ?? await findLatestRunEvidence();
+    const path = runPath ?? (await findLatestRunEvidence());
     if (path === undefined)
         return null;
-    const resolved = runPath === undefined ? path : await resolveExistingReportPath(runPath, projectRoot);
+    const resolved = runPath === undefined
+        ? path
+        : await resolveExistingReportPath(runPath, projectRoot);
     const source = await readFile(resolved, "utf8");
     if (Buffer.byteLength(source, "utf8") > MAX_RUN_EVIDENCE_BYTES)
         throw new EvidenceReportError(`Run evidence exceeds ${MAX_RUN_EVIDENCE_BYTES} bytes.`);
@@ -280,11 +409,16 @@ async function loadContractDiff(baselinePath, candidatePath, projectRoot) {
     if (baselinePath === undefined || candidatePath === undefined)
         throw new EvidenceReportError("Contract drift evidence requires both --contract-baseline and --contract-candidate.");
     try {
-        const [baseline, candidate] = await Promise.all([loadContract(baselinePath, projectRoot), loadContract(candidatePath, projectRoot)]);
+        const [baseline, candidate] = await Promise.all([
+            loadContract(baselinePath, projectRoot),
+            loadContract(candidatePath, projectRoot),
+        ]);
         return diffContracts(baseline, candidate);
     }
     catch (error) {
-        throw new EvidenceReportError(error instanceof Error ? `Contract drift input is invalid: ${error.message}` : "Contract drift input is invalid.");
+        throw new EvidenceReportError(error instanceof Error
+            ? `Contract drift input is invalid: ${error.message}`
+            : "Contract drift input is invalid.");
     }
 }
 async function findLatestRunEvidence() {
@@ -300,7 +434,8 @@ async function findLatestRunEvidence() {
             if (info?.isFile())
                 candidates.push({ path: evidencePath, mtimeMs: info.mtimeMs });
         }
-        return candidates.sort((left, right) => right.mtimeMs - left.mtimeMs)[0]?.path;
+        return candidates.sort((left, right) => right.mtimeMs - left.mtimeMs)[0]
+            ?.path;
     }
     catch (error) {
         if (isErrorCode(error, "ENOENT"))
@@ -310,7 +445,9 @@ async function findLatestRunEvidence() {
 }
 async function pruneReports() {
     try {
-        const entries = await readdir(getDataPaths().reports, { withFileTypes: true });
+        const entries = await readdir(getDataPaths().reports, {
+            withFileTypes: true,
+        });
         const reports = [];
         for (const entry of entries) {
             if (!entry.isFile() || !entry.name.endsWith(".json"))
@@ -320,7 +457,9 @@ async function pruneReports() {
             if (!info.isSymbolicLink())
                 reports.push({ path, mtimeMs: info.mtimeMs });
         }
-        for (const report of reports.sort((left, right) => right.mtimeMs - left.mtimeMs).slice(MAX_REPORTS_RETAINED))
+        for (const report of reports
+            .sort((left, right) => right.mtimeMs - left.mtimeMs)
+            .slice(MAX_REPORTS_RETAINED))
             await rm(report.path, { force: true });
     }
     catch (error) {
@@ -329,7 +468,9 @@ async function pruneReports() {
     }
 }
 async function resolveOutputPath(outPath, projectRoot) {
-    const target = isAbsolute(outPath) ? resolve(outPath) : resolve(projectRoot, outPath);
+    const target = isAbsolute(outPath)
+        ? resolve(outPath)
+        : resolve(projectRoot, outPath);
     assertPathInsideAllowedRoots(projectRoot, target);
     await mkdir(dirname(target), { recursive: true, mode: 0o700 });
     const parent = await lstat(dirname(target));
@@ -354,17 +495,27 @@ function normalizeEvidenceReport(value) {
     const report = value;
     if (report.schemaVersion !== 1)
         throw new EvidenceReportError("Unsupported evidence report schema version.");
-    if (typeof report.artifact?.logicalHash !== "string" || !/^[a-f0-9]{64}$/.test(report.artifact.logicalHash))
+    if (typeof report.artifact?.logicalHash !== "string" ||
+        !/^[a-f0-9]{64}$/.test(report.artifact.logicalHash))
         throw new EvidenceReportError("Evidence report is missing a valid logical hash.");
     if (report.artifact.canonicalization !== "json-stable-sorted-keys-v1")
         throw new EvidenceReportError("Unsupported evidence report canonicalization.");
-    if (typeof report.run?.id !== "string" || typeof report.summary?.passed !== "boolean" || !Array.isArray(report.findings))
+    if (typeof report.run?.id !== "string" ||
+        typeof report.summary?.passed !== "boolean" ||
+        !Array.isArray(report.findings))
         throw new EvidenceReportError("Evidence report has an invalid schema.");
     return report;
 }
 function sanitizeEvent(event) {
     const sanitized = sanitizeSecrets(event);
-    return { ...sanitized, provider: limitText(sanitized.provider), method: limitText(sanitized.method), path: sanitizePath(sanitized.path), request: sanitizeSecrets(sanitized.request), response: sanitizeSecrets(sanitized.response) };
+    return {
+        ...sanitized,
+        provider: limitText(sanitized.provider),
+        method: limitText(sanitized.method),
+        path: sanitizePath(sanitized.path),
+        request: sanitizeSecrets(sanitized.request),
+        response: sanitizeSecrets(sanitized.response),
+    };
 }
 function sanitizePath(path) {
     const sanitized = sanitizeSecretString(path);
@@ -373,7 +524,9 @@ function sanitizePath(path) {
         return limitText(pathname ?? "");
     const params = query.split("&").map((part) => {
         const [key = "", value = ""] = part.split("=", 2);
-        return SENSITIVE_QUERY_KEYS.has(decodeURIComponentSafe(key).toLowerCase()) ? `${key}=***` : `${key}=${sanitizeSecretString(value)}`;
+        return SENSITIVE_QUERY_KEYS.has(decodeURIComponentSafe(key).toLowerCase())
+            ? `${key}=***`
+            : `${key}=${sanitizeSecretString(value)}`;
     });
     return limitText(`${pathname}?${params.join("&")}`);
 }
@@ -393,7 +546,9 @@ function collectScenarioStrings(value, scenarios) {
     }
     if (value !== null && typeof value === "object") {
         for (const [key, entry] of Object.entries(value)) {
-            if (key.toLowerCase() === "scenario" && typeof entry === "string" && /^[a-z0-9][a-z0-9._-]{0,127}$/.test(entry))
+            if (key.toLowerCase() === "scenario" &&
+                typeof entry === "string" &&
+                /^[a-z0-9][a-z0-9._-]{0,127}$/.test(entry))
                 scenarios.add(entry);
             collectScenarioStrings(entry, scenarios);
         }
@@ -449,7 +604,9 @@ function hashLogicalReport(report) {
     const logical = structuredClone(report);
     logical.artifact.logicalHash = "";
     logical.artifact.generatedAt = "";
-    return createHash("sha256").update(stableStringify(logical), "utf8").digest("hex");
+    return createHash("sha256")
+        .update(stableStringify(logical), "utf8")
+        .digest("hex");
 }
 function stableStringify(value) {
     if (value === undefined)
@@ -458,32 +615,58 @@ function stableStringify(value) {
         return JSON.stringify(value);
     if (Array.isArray(value))
         return `[${value.map(stableStringify).join(",")}]`;
-    const entries = Object.entries(value).filter(([, entry]) => entry !== undefined).sort(([left], [right]) => left.localeCompare(right));
+    const entries = Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .sort(([left], [right]) => left.localeCompare(right));
     return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableStringify(entry)}`).join(",")}}`;
 }
 function firstTimestamp(events) {
-    return events.map((event) => readString(event.timestamp)).filter((value) => value !== undefined).sort()[0];
+    return events
+        .map((event) => readString(event.timestamp))
+        .filter((value) => value !== undefined)
+        .sort()[0];
 }
 function lastTimestamp(events) {
-    return events.map((event) => readString(event.timestamp)).filter((value) => value !== undefined).sort().at(-1);
+    return events
+        .map((event) => readString(event.timestamp))
+        .filter((value) => value !== undefined)
+        .sort()
+        .at(-1);
 }
 function lastExitCode(events) {
-    return events.map((event) => event.exitCode).filter((value) => Number.isInteger(value)).at(-1);
+    return events
+        .map((event) => event.exitCode)
+        .filter((value) => Number.isInteger(value))
+        .at(-1);
 }
 function hasRetryAfter(event) {
-    return JSON.stringify(event.response).toLowerCase().includes("retry-after") || JSON.stringify(event.request).toLowerCase().includes("retry-after");
+    return (JSON.stringify(event.response).toLowerCase().includes("retry-after") ||
+        JSON.stringify(event.request).toLowerCase().includes("retry-after"));
 }
 function readRunStatus(value) {
-    return value === "preparing" || value === "running" || value === "failed-to-start" || value === "finished" ? value : "unknown";
+    return value === "preparing" ||
+        value === "running" ||
+        value === "failed-to-start" ||
+        value === "finished"
+        ? value
+        : "unknown";
 }
 function readString(value) {
-    return typeof value === "string" && value.trim() !== "" ? limitText(sanitizeSecretString(value)) : undefined;
+    return typeof value === "string" && value.trim() !== ""
+        ? limitText(sanitizeSecretString(value))
+        : undefined;
 }
 function readStringArray(value) {
-    return Array.isArray(value) ? uniqueSorted(value.filter((entry) => typeof entry === "string").map(limitText)) : [];
+    return Array.isArray(value)
+        ? uniqueSorted(value
+            .filter((entry) => typeof entry === "string")
+            .map(limitText))
+        : [];
 }
 function readNonNegativeInteger(value) {
-    return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : undefined;
+    return typeof value === "number" && Number.isInteger(value) && value >= 0
+        ? value
+        : undefined;
 }
 function readBoolean(value) {
     return value === true;
@@ -496,10 +679,14 @@ function emptyContractDrift() {
 }
 function limitText(value) {
     const sanitized = sanitizeSecretString(value).replace(/[\r\n\t]/g, " ");
-    return sanitized.length > 2_000 ? `${sanitized.slice(0, 2_000)}[truncated]` : sanitized;
+    return sanitized.length > 2_000
+        ? `${sanitized.slice(0, 2_000)}[truncated]`
+        : sanitized;
 }
 function escapeTerminal(value) {
-    return value.replace(/[\u001B\u009B][[\]()#;?]*(?:(?:(?:[a-zA-Z\d]*(?:;[a-zA-Z\d]*)*)?\u0007)|(?:(?:\d{1,4}(?:;\d{0,4})*)?[\dA-PR-TZcf-nq-uy=><~]))/g, "").replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");
+    return value
+        .replace(/[\u001B\u009B][[\]()#;?]*(?:(?:(?:[a-zA-Z\d]*(?:;[a-zA-Z\d]*)*)?\u0007)|(?:(?:\d{1,4}(?:;\d{0,4})*)?[\dA-PR-TZcf-nq-uy=><~]))/g, "")
+        .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");
 }
 function secretCategory(key) {
     const normalized = key.toLowerCase();
@@ -516,7 +703,9 @@ function secretCategory(key) {
     return "secret-field";
 }
 function readPackageVersion() {
-    return typeof packageJson.version === "string" ? packageJson.version : "unknown";
+    return typeof packageJson.version === "string"
+        ? packageJson.version
+        : "unknown";
 }
 async function realProjectRoot(projectRoot) {
     const root = resolve(projectRoot);
@@ -525,13 +714,6 @@ async function realProjectRoot(projectRoot) {
         throw new EvidenceReportError("Project root must be a real directory, not a symlink.");
     return root;
 }
-function assertPathInside(root, target) {
-    const relativePath = relative(root, target);
-    if (relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath))
-        throw new EvidenceReportError("Evidence path traversal outside the project root is not allowed.");
-    if (basename(target).trim() === "")
-        throw new EvidenceReportError("Evidence path must include a file name.");
-}
 function assertPathInsideAllowedRoots(projectRoot, target) {
     if (!isInside(projectRoot, target) && !isInside(getDataPaths().root, target))
         throw new EvidenceReportError("Evidence path traversal outside the project root or GHOSTAPI_DATA_DIR is not allowed.");
@@ -540,7 +722,9 @@ function assertPathInsideAllowedRoots(projectRoot, target) {
 }
 function isInside(root, target) {
     const relativePath = relative(resolve(root), target);
-    return relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
+    return (relativePath !== ".." &&
+        !relativePath.startsWith(`..${sep}`) &&
+        !isAbsolute(relativePath));
 }
 function decodeURIComponentSafe(value) {
     try {